Analysis
- max time kernel
91s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 22:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-11_4a0ab3c4b251c71d605e7ea1c4c4bb8b_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-11_4a0ab3c4b251c71d605e7ea1c4c4bb8b_elex_emotet_stop.exe
- Size 208KB
- Sample261012-2d6lfaf141
- SHA256 1a50002b0953f9ea2825103f442fc7274f106c85b5c9b65645a4b138d44afa6d
- MD5 4a0ab3c4b251c71d605e7ea1c4c4bb8b
- SHA1 47e55040cb088994efbdcb779a5aaecf165fc6ac
- SHA512 a5dc655f4c27898bc192bf78f2dd51047b5a0c467c470eee7f0e55326f57b537d50206b40c9a0c8f0329874f00c0aae8e7c4131324ba6008b4cb2ceadc0886b0
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfe4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOWkEj1
- TLSH T1C7247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2480 JVJOQ.exe 6092 DBK.exe 4624 JBSNO.exe 4084 VUNGXWE.exe 5724 GMQ.exe 972 MMX.exe 2468 GACVY.exe 5744 ZDGZ.exe 1840 AGKVJL.exe 1960 FGR.exe 2412 PGTW.exe 5928 VHBJNFZ.exe 4572 PUG.exe 5500 BNJMF.exe 2120 EDPMJFR.exe 1460 WDR.exe 4892 QYWAX.exe 3436 LMTKHKX.exe 1968 RMBX.exe 4628 AMDKC.exe 4292 ECJ.exe 2752 MIJZPH.exe 2404 BNPWX.exe 4904 XLVTEAV.exe 1044 FDWMREK.exe 2992 FJW.exe 1784 LJDPC.exe 3476 WCGHKB.exe 4512 RPD.exe 4064 EAUPJE.exe 2804 EGUEKRI.exe 2824 BLS.exe 4920 GLZPAV.exe 5824 QUBUMAO.exe 4952 HUD.exe 5444 WPNDAK.exe 3336 YNOFHHG.exe 3160 CDVF.exe 2780 IDCTCU.exe 1076 TWX.exe 1388 OJCV.exe 3924 ZCFO.exe 4676 DKM.exe 2952 OCPHPQT.exe 1544 UDWVY.exe 2728 FVRNGZ.exe 3580 CBXLNBD.exe 4504 XOCU.exe 3932 COKI.exe 4616 OHNBPL.exe 4228 ZZITPSY.exe 1184 KSL.exe 592 FFPVI.exe 1556 ABUFSHR.exe 4060 WYA.exe 2664 CYIQ.exe 1664 NRDIQ.exe 2996 CXIYYC.exe 976 YCOVFM.exe 3264 KVJNNTV.exe 3364 PVRBW.exe 3920 PBRQX.exe 1336 MGXNMKT.exe 5640 XZSYNR.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\IDCTCU.exe CDVF.exe File opened for modification C:\windows\SysWOW64\NRDIQ.exe CYIQ.exe File created C:\windows\SysWOW64\JLLU.exe.bat ELDGJC.exe File created C:\windows\SysWOW64\JRDI.exe.bat JLLU.exe File created C:\windows\SysWOW64\KFP.exe VJGTCQ.exe File opened for modification C:\windows\SysWOW64\RMBX.exe LMTKHKX.exe File created C:\windows\SysWOW64\OCPHPQT.exe.bat DKM.exe File created C:\windows\SysWOW64\FFPVI.exe.bat KSL.exe File created C:\windows\SysWOW64\YARA.exe SAJMQTN.exe File created C:\windows\SysWOW64\AAHNYVW.exe JNWVJR.exe File created C:\windows\SysWOW64\JALYHI.exe.bat GSEQ.exe File opened for modification C:\windows\SysWOW64\LJDPC.exe FJW.exe File created C:\windows\SysWOW64\FVRNGZ.exe.bat UDWVY.exe File created C:\windows\SysWOW64\QZG.exe VMBXLRM.exe File created C:\windows\SysWOW64\YBO.exe.bat NILRVZU.exe File opened for modification C:\windows\SysWOW64\JALYHI.exe GSEQ.exe File opened for modification C:\windows\SysWOW64\MMX.exe GMQ.exe File opened for modification C:\windows\SysWOW64\VHBJNFZ.exe PGTW.exe File opened for modification C:\windows\SysWOW64\PUG.exe VHBJNFZ.exe File created C:\windows\SysWOW64\COKI.exe XOCU.exe File created C:\windows\SysWOW64\KFP.exe.bat VJGTCQ.exe File created C:\windows\SysWOW64\MMX.exe.bat GMQ.exe File created C:\windows\SysWOW64\VHBJNFZ.exe.bat PGTW.exe File opened for modification C:\windows\SysWOW64\ECJ.exe AMDKC.exe File created C:\windows\SysWOW64\BNPWX.exe MIJZPH.exe File opened for modification C:\windows\SysWOW64\XLVTEAV.exe BNPWX.exe File created C:\windows\SysWOW64\FVRNGZ.exe UDWVY.exe File created C:\windows\SysWOW64\JZHHNO.exe DZAT.exe File opened for modification C:\windows\SysWOW64\JLLU.exe ELDGJC.exe File created C:\windows\SysWOW64\FGR.exe.bat AGKVJL.exe File created C:\windows\SysWOW64\HUD.exe QUBUMAO.exe File created C:\windows\SysWOW64\OCPHPQT.exe DKM.exe File created C:\windows\SysWOW64\NRDIQ.exe.bat CYIQ.exe File opened for modification C:\windows\SysWOW64\KVJNNTV.exe YCOVFM.exe File created C:\windows\SysWOW64\XZSYNR.exe MGXNMKT.exe File created C:\windows\SysWOW64\VUQEZV.exe.bat MGF.exe File opened for modification C:\windows\SysWOW64\YBO.exe NILRVZU.exe File opened for modification C:\windows\SysWOW64\FGR.exe AGKVJL.exe File created C:\windows\SysWOW64\MIJZPH.exe ECJ.exe File created C:\windows\SysWOW64\HUD.exe.bat QUBUMAO.exe File created C:\windows\SysWOW64\IDCTCU.exe.bat CDVF.exe File opened for modification C:\windows\SysWOW64\FVRNGZ.exe UDWVY.exe File created C:\windows\SysWOW64\YARA.exe.bat SAJMQTN.exe File opened for modification C:\windows\SysWOW64\VUQEZV.exe MGF.exe File created C:\windows\SysWOW64\JLLU.exe ELDGJC.exe File created C:\windows\SysWOW64\ECJ.exe AMDKC.exe File created C:\windows\SysWOW64\FFPVI.exe KSL.exe File created C:\windows\SysWOW64\VJGTCQ.exe.bat JRDI.exe File created C:\windows\SysWOW64\YBO.exe NILRVZU.exe File opened for modification C:\windows\SysWOW64\AAHNYVW.exe JNWVJR.exe File created C:\windows\SysWOW64\JALYHI.exe GSEQ.exe File created C:\windows\SysWOW64\ZDGZ.exe.bat GACVY.exe File created C:\windows\SysWOW64\VHBJNFZ.exe PGTW.exe File opened for modification C:\windows\SysWOW64\HUD.exe QUBUMAO.exe File opened for modification C:\windows\SysWOW64\COKI.exe XOCU.exe File created C:\windows\SysWOW64\KSL.exe.bat ZZITPSY.exe File opened for modification C:\windows\SysWOW64\CYIQ.exe WYA.exe File opened for modification C:\windows\SysWOW64\XZSYNR.exe MGXNMKT.exe File created C:\windows\SysWOW64\VJGTCQ.exe JRDI.exe File opened for modification C:\windows\SysWOW64\ZDGZ.exe GACVY.exe File created C:\windows\SysWOW64\RMBX.exe.bat LMTKHKX.exe File opened for modification C:\windows\SysWOW64\IDCTCU.exe CDVF.exe File created C:\windows\SysWOW64\ZZITPSY.exe OHNBPL.exe File created C:\windows\SysWOW64\ZZITPSY.exe.bat OHNBPL.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\SFOQIS.exe.bat HMTXHDU.exe File created C:\windows\YFV.exe SFOQIS.exe File created C:\windows\system\RTXB.exe MTPGBUO.exe File created C:\windows\BTZGN.exe RTXB.exe File opened for modification C:\windows\JVJOQ.exe 2026-10-11_4a0ab3c4b251c71d605e7ea1c4c4bb8b_elex_emotet_stop.exe File created C:\windows\system\NILRVZU.exe DLXF.exe File created C:\windows\system\NDKSUTG.exe.bat LFRY.exe File created C:\windows\system\AZQSMR.exe OHNAE.exe File created C:\windows\GMQ.exe VUNGXWE.exe File created C:\windows\system\GACVY.exe MMX.exe File created C:\windows\system\EGUEKRI.exe EAUPJE.exe File opened for modification C:\windows\system\EGUEKRI.exe EAUPJE.exe File created C:\windows\system\ZCFO.exe.bat OJCV.exe File opened for modification C:\windows\PBRQX.exe PVRBW.exe File opened for modification C:\windows\system\MEWIKJ.exe YBO.exe File opened for modification C:\windows\system\RTXB.exe MTPGBUO.exe File opened for modification C:\windows\WDR.exe EDPMJFR.exe File created C:\windows\SAJMQTN.exe.bat JZHHNO.exe File created C:\windows\system\RTXB.exe.bat MTPGBUO.exe File created C:\windows\JNWVJR.exe PASLG.exe File created C:\windows\UDBTG.exe.bat YFV.exe File created C:\windows\system\LFRY.exe ZXKQKM.exe File opened for modification C:\windows\system\OHNAE.exe KRG.exe File created C:\windows\JSUTID.exe.bat YARA.exe File opened for modification C:\windows\IVVJ.exe NAQZHRE.exe File created C:\windows\KWV.exe BJLFNQB.exe File created C:\windows\WDR.exe.bat EDPMJFR.exe File opened for modification C:\windows\system\MGXNMKT.exe PBRQX.exe File created C:\windows\system\MTPGBUO.exe MNPZRP.exe File opened for modification C:\windows\NAQZHRE.exe FUQL.exe File opened for modification C:\windows\system\QOI.exe BTZGN.exe File created C:\windows\KWV.exe.bat BJLFNQB.exe File opened for modification C:\windows\SAJMQTN.exe JZHHNO.exe File created C:\windows\LITBA.exe.bat KFP.exe File created C:\windows\BJLFNQB.exe TDTQML.exe File created C:\windows\EDPMJFR.exe BNJMF.exe File created C:\windows\system\LMTKHKX.exe QYWAX.exe File created C:\windows\QUBUMAO.exe GLZPAV.exe File created C:\windows\BTZGN.exe.bat RTXB.exe File created C:\windows\system\TQEM.exe GGWWIJ.exe File created C:\windows\system\LMTKHKX.exe.bat QYWAX.exe File opened for modification C:\windows\system\DKM.exe ZCFO.exe File opened for modification C:\windows\JSUTID.exe YARA.exe File opened for modification C:\windows\VLPDQKT.exe JSUTID.exe File created C:\windows\LITBA.exe KFP.exe File created C:\windows\VLPDQKT.exe.bat JSUTID.exe File created C:\windows\BNJMF.exe.bat PUG.exe File opened for modification C:\windows\system\LMTKHKX.exe QYWAX.exe File created C:\windows\system\JBSNO.exe DBK.exe File opened for modification C:\windows\system\FDWMREK.exe XLVTEAV.exe File created C:\windows\system\YNOFHHG.exe WPNDAK.exe File created C:\windows\UUMT.exe URJPUQ.exe File opened for modification C:\windows\BTZGN.exe RTXB.exe File created C:\windows\ZXKQKM.exe.bat QOI.exe File created C:\windows\GSEQ.exe LFZHKQT.exe File opened for modification C:\windows\BJN.exe JALYHI.exe File created C:\windows\system\UDWVY.exe OCPHPQT.exe File created C:\windows\YCOVFM.exe CXIYYC.exe File created C:\windows\XQENDDU.exe.bat IVVJ.exe File opened for modification C:\windows\system\MGF.exe XQENDDU.exe File created C:\windows\system\MEWIKJ.exe.bat YBO.exe File created C:\windows\system\PGTW.exe FGR.exe File created C:\windows\system\FDWMREK.exe XLVTEAV.exe File opened for modification C:\windows\system\KRG.exe TQEM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5656 cmd.exe 3004 cmd.exe 4272 cmd.exe 6040 cmd.exe 4924 cmd.exe 5380 cmd.exe 5636 cmd.exe 1396 cmd.exe 1660 cmd.exe 3036 cmd.exe 4152 cmd.exe 5080 cmd.exe 3204 cmd.exe 4144 cmd.exe 4056 cmd.exe 1964 cmd.exe 3332 cmd.exe 5424 cmd.exe 4560 cmd.exe 4592 cmd.exe 3664 cmd.exe 4176 cmd.exe 3376 cmd.exe 2292 cmd.exe 5784 cmd.exe 6044 cmd.exe 4192 cmd.exe 4472 cmd.exe 2008 cmd.exe 1580 cmd.exe 5104 cmd.exe 3600 cmd.exe 6120 cmd.exe 3292 cmd.exe 3120 cmd.exe 2492 cmd.exe 5944 cmd.exe 3628 cmd.exe 5768 cmd.exe 2860 cmd.exe 5672 cmd.exe 2352 cmd.exe 4256 cmd.exe 3340 cmd.exe 5164 cmd.exe 2476 cmd.exe 2688 cmd.exe 3148 cmd.exe 4832 cmd.exe 4104 cmd.exe 3064 cmd.exe 5736 cmd.exe 2660 cmd.exe 1292 cmd.exe 1052 cmd.exe 1928 cmd.exe 1740 cmd.exe 1152 cmd.exe 4928 cmd.exe 952 cmd.exe 6048 cmd.exe 2484 cmd.exe 4744 cmd.exe 4660 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2808 3212 WerFault.exe 87 4220 2480 WerFault.exe 93 5784 6092 WerFault.exe 99 2592 4624 WerFault.exe 104 2120 4084 WerFault.exe 109 5076 5724 WerFault.exe 114 5380 972 WerFault.exe 119 2500 2468 WerFault.exe 124 2244 5744 WerFault.exe 129 1748 1840 WerFault.exe 134 2804 1960 WerFault.exe 139 1312 2412 WerFault.exe 144 5080 5928 WerFault.exe 149 5836 4572 WerFault.exe 154 1072 5500 WerFault.exe 159 3824 2120 WerFault.exe 164 2672 1460 WerFault.exe 169 4540 4892 WerFault.exe 174 5888 3436 WerFault.exe 179 2132 1968 WerFault.exe 184 2588 4628 WerFault.exe 189 5764 4292 WerFault.exe 194 3804 2752 WerFault.exe 199 4940 2404 WerFault.exe 204 984 4904 WerFault.exe 209 5280 1044 WerFault.exe 214 2656 2992 WerFault.exe 219 3160 1784 WerFault.exe 224 3344 3476 WerFault.exe 229 4108 4512 WerFault.exe 234 2680 4064 WerFault.exe 239 2472 2804 WerFault.exe 244 1032 2824 WerFault.exe 249 4404 4920 WerFault.exe 254 3332 5824 WerFault.exe 259 5076 4952 WerFault.exe 264 1824 5444 WerFault.exe 269 3384 3336 WerFault.exe 274 3696 3160 WerFault.exe 279 2524 2780 WerFault.exe 284 5424 1076 WerFault.exe 290 4696 1388 WerFault.exe 295 4396 3924 WerFault.exe 300 480 4676 WerFault.exe 305 5836 2952 WerFault.exe 310 5640 1544 WerFault.exe 315 5596 2728 WerFault.exe 320 1664 3580 WerFault.exe 325 5840 4504 WerFault.exe 330 5676 3932 WerFault.exe 335 5900 4616 WerFault.exe 340 3804 4228 WerFault.exe 345 5668 1184 WerFault.exe 350 1336 592 WerFault.exe 355 1072 1556 WerFault.exe 360 4732 4060 WerFault.exe 365 1912 2664 WerFault.exe 370 2356 1664 WerFault.exe 375 540 2996 WerFault.exe 380 380 976 WerFault.exe 385 5768 3264 WerFault.exe 390 204 3364 WerFault.exe 395 1736 3920 WerFault.exe 400 5924 1336 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZAT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMTXHDU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JBSNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDWVY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDBTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMDKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPNDAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZQSMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VMBXLRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LITBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XZSYNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XQENDDU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QOI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYWAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLVTEAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGTW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNJMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJDPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YARA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFOQIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QZG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMWOCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMTKHKX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYIQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3212 2026-10-11_4a0ab3c4b251c71d605e7ea1c4c4bb8b_elex_emotet_stop.exe 3212 2026-10-11_4a0ab3c4b251c71d605e7ea1c4c4bb8b_elex_emotet_stop.exe 2480 JVJOQ.exe 2480 JVJOQ.exe 6092 DBK.exe 6092 DBK.exe 4624 JBSNO.exe 4624 JBSNO.exe 4084 VUNGXWE.exe 4084 VUNGXWE.exe 5724 GMQ.exe 5724 GMQ.exe 972 MMX.exe 972 MMX.exe 2468 GACVY.exe 2468 GACVY.exe 5744 ZDGZ.exe 5744 ZDGZ.exe 1840 AGKVJL.exe 1840 AGKVJL.exe 1960 FGR.exe 1960 FGR.exe 2412 PGTW.exe 2412 PGTW.exe 5928 VHBJNFZ.exe 5928 VHBJNFZ.exe 4572 PUG.exe 4572 PUG.exe 5500 BNJMF.exe 5500 BNJMF.exe 2120 EDPMJFR.exe 2120 EDPMJFR.exe 1460 WDR.exe 1460 WDR.exe 4892 QYWAX.exe 4892 QYWAX.exe 3436 LMTKHKX.exe 3436 LMTKHKX.exe 1968 RMBX.exe 1968 RMBX.exe 4628 AMDKC.exe 4628 AMDKC.exe 4292 ECJ.exe 4292 ECJ.exe 2752 MIJZPH.exe 2752 MIJZPH.exe 2404 BNPWX.exe 2404 BNPWX.exe 4904 XLVTEAV.exe 4904 XLVTEAV.exe 1044 FDWMREK.exe 1044 FDWMREK.exe 2992 FJW.exe 2992 FJW.exe 1784 LJDPC.exe 1784 LJDPC.exe 3476 WCGHKB.exe 3476 WCGHKB.exe 4512 RPD.exe 4512 RPD.exe 4064 EAUPJE.exe 4064 EAUPJE.exe 2804 EGUEKRI.exe 2804 EGUEKRI.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3212 2026-10-11_4a0ab3c4b251c71d605e7ea1c4c4bb8b_elex_emotet_stop.exe 3212 2026-10-11_4a0ab3c4b251c71d605e7ea1c4c4bb8b_elex_emotet_stop.exe 2480 JVJOQ.exe 2480 JVJOQ.exe 6092 DBK.exe 6092 DBK.exe 4624 JBSNO.exe 4624 JBSNO.exe 4084 VUNGXWE.exe 4084 VUNGXWE.exe 5724 GMQ.exe 5724 GMQ.exe 972 MMX.exe 972 MMX.exe 2468 GACVY.exe 2468 GACVY.exe 5744 ZDGZ.exe 5744 ZDGZ.exe 1840 AGKVJL.exe 1840 AGKVJL.exe 1960 FGR.exe 1960 FGR.exe 2412 PGTW.exe 2412 PGTW.exe 5928 VHBJNFZ.exe 5928 VHBJNFZ.exe 4572 PUG.exe 4572 PUG.exe 5500 BNJMF.exe 5500 BNJMF.exe 2120 EDPMJFR.exe 2120 EDPMJFR.exe 1460 WDR.exe 1460 WDR.exe 4892 QYWAX.exe 4892 QYWAX.exe 3436 LMTKHKX.exe 3436 LMTKHKX.exe 1968 RMBX.exe 1968 RMBX.exe 4628 AMDKC.exe 4628 AMDKC.exe 4292 ECJ.exe 4292 ECJ.exe 2752 MIJZPH.exe 2752 MIJZPH.exe 2404 BNPWX.exe 2404 BNPWX.exe 4904 XLVTEAV.exe 4904 XLVTEAV.exe 1044 FDWMREK.exe 1044 FDWMREK.exe 2992 FJW.exe 2992 FJW.exe 1784 LJDPC.exe 1784 LJDPC.exe 3476 WCGHKB.exe 3476 WCGHKB.exe 4512 RPD.exe 4512 RPD.exe 4064 EAUPJE.exe 4064 EAUPJE.exe 2804 EGUEKRI.exe 2804 EGUEKRI.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3212 wrote to memory of 2444 3212 2026-10-11_4a0ab3c4b251c71d605e7ea1c4c4bb8b_elex_emotet_stop.exe 89 PID 2444 wrote to memory of 2480 2444 cmd.exe 93 PID 2480 wrote to memory of 4592 2480 JVJOQ.exe 95 PID 4592 wrote to memory of 6092 4592 cmd.exe 99 PID 6092 wrote to memory of 1660 6092 DBK.exe 100 PID 1660 wrote to memory of 4624 1660 cmd.exe 104 PID 4624 wrote to memory of 4344 4624 JBSNO.exe 105 PID 4344 wrote to memory of 4084 4344 cmd.exe 109 PID 4084 wrote to memory of 5916 4084 VUNGXWE.exe 110 PID 5916 wrote to memory of 5724 5916 cmd.exe 114 PID 5724 wrote to memory of 4200 5724 GMQ.exe 115 PID 4200 wrote to memory of 972 4200 cmd.exe 119 PID 972 wrote to memory of 5860 972 MMX.exe 120 PID 5860 wrote to memory of 2468 5860 cmd.exe 124 PID 2468 wrote to memory of 1964 2468 GACVY.exe 125 PID 1964 wrote to memory of 5744 1964 cmd.exe 129 PID 5744 wrote to memory of 1292 5744 ZDGZ.exe 130 PID 1292 wrote to memory of 1840 1292 cmd.exe 134 PID 1840 wrote to memory of 3120 1840 AGKVJL.exe 135 PID 3120 wrote to memory of 1960 3120 cmd.exe 139 PID 1960 wrote to memory of 5552 1960 FGR.exe 140 PID 5552 wrote to memory of 2412 5552 cmd.exe 144 PID 2412 wrote to memory of 1696 2412 PGTW.exe 145 PID 1696 wrote to memory of 5928 1696 cmd.exe 149 PID 5928 wrote to memory of 5452 5928 VHBJNFZ.exe 150 PID 5452 wrote to memory of 4572 5452 cmd.exe 154 PID 4572 wrote to memory of 3036 4572 PUG.exe 155 PID 3036 wrote to memory of 5500 3036 cmd.exe 159 PID 5500 wrote to memory of 4488 5500 BNJMF.exe 160 PID 4488 wrote to memory of 2120 4488 cmd.exe 164 PID 2120 wrote to memory of 1828 2120 EDPMJFR.exe 165 PID 1828 wrote to memory of 1460 1828 cmd.exe 169 PID 1460 wrote to memory of 892 1460 WDR.exe 170 PID 892 wrote to memory of 4892 892 cmd.exe 174 PID 4892 wrote to memory of 2916 4892 QYWAX.exe 175 PID 2916 wrote to memory of 3436 2916 cmd.exe 179 PID 3436 wrote to memory of 4816 3436 LMTKHKX.exe 180 PID 4816 wrote to memory of 1968 4816 cmd.exe 184 PID 1968 wrote to memory of 3004 1968 RMBX.exe 185 PID 3004 wrote to memory of 4628 3004 cmd.exe 189 PID 4628 wrote to memory of 4192 4628 AMDKC.exe 190 PID 4192 wrote to memory of 4292 4192 cmd.exe 194 PID 4292 wrote to memory of 2808 4292 ECJ.exe 195 PID 2808 wrote to memory of 2752 2808 cmd.exe 199 PID 2752 wrote to memory of 4184 2752 MIJZPH.exe 200 PID 4184 wrote to memory of 2404 4184 cmd.exe 204 PID 2404 wrote to memory of 2104 2404 BNPWX.exe 205 PID 2104 wrote to memory of 4904 2104 cmd.exe 209 PID 4904 wrote to memory of 1052 4904 XLVTEAV.exe 210 PID 1052 wrote to memory of 1044 1052 cmd.exe 214 PID 1044 wrote to memory of 5496 1044 FDWMREK.exe 215 PID 5496 wrote to memory of 2992 5496 cmd.exe 219 PID 2992 wrote to memory of 5272 2992 FJW.exe 220 PID 5272 wrote to memory of 1784 5272 cmd.exe 224 PID 1784 wrote to memory of 5664 1784 LJDPC.exe 225 PID 5664 wrote to memory of 3476 5664 cmd.exe 229 PID 3476 wrote to memory of 4472 3476 WCGHKB.exe 230 PID 4472 wrote to memory of 4512 4472 cmd.exe 234 PID 4512 wrote to memory of 4152 4512 RPD.exe 235 PID 4152 wrote to memory of 4064 4152 cmd.exe 239 PID 4064 wrote to memory of 3268 4064 EAUPJE.exe 240 PID 3268 wrote to memory of 2804 3268 cmd.exe 244 PID 2804 wrote to memory of 1196 2804 EGUEKRI.exe 245 PID 1196 wrote to memory of 2824 1196 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-11_4a0ab3c4b251c71d605e7ea1c4c4bb8b_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-11_4a0ab3c4b251c71d605e7ea1c4c4bb8b_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVJOQ.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\windows\JVJOQ.exeC:\windows\JVJOQ.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DBK.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\windows\DBK.exeC:\windows\DBK.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBSNO.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\windows\system\JBSNO.exeC:\windows\system\JBSNO.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VUNGXWE.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\system\VUNGXWE.exeC:\windows\system\VUNGXWE.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMQ.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\windows\GMQ.exeC:\windows\GMQ.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMX.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\windows\SysWOW64\MMX.exeC:\windows\system32\MMX.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GACVY.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\windows\system\GACVY.exeC:\windows\system\GACVY.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDGZ.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\windows\SysWOW64\ZDGZ.exeC:\windows\system32\ZDGZ.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGKVJL.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\windows\AGKVJL.exeC:\windows\AGKVJL.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGR.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\windows\SysWOW64\FGR.exeC:\windows\system32\FGR.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGTW.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\windows\system\PGTW.exeC:\windows\system\PGTW.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VHBJNFZ.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\windows\SysWOW64\VHBJNFZ.exeC:\windows\system32\VHBJNFZ.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PUG.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\windows\SysWOW64\PUG.exeC:\windows\system32\PUG.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNJMF.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\windows\BNJMF.exeC:\windows\BNJMF.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDPMJFR.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\windows\EDPMJFR.exeC:\windows\EDPMJFR.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDR.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\windows\WDR.exeC:\windows\WDR.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYWAX.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:892 -
C:\windows\QYWAX.exeC:\windows\QYWAX.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMTKHKX.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\windows\system\LMTKHKX.exeC:\windows\system\LMTKHKX.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RMBX.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\windows\SysWOW64\RMBX.exeC:\windows\system32\RMBX.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMDKC.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\windows\system\AMDKC.exeC:\windows\system\AMDKC.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ECJ.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\windows\SysWOW64\ECJ.exeC:\windows\system32\ECJ.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIJZPH.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\windows\SysWOW64\MIJZPH.exeC:\windows\system32\MIJZPH.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNPWX.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\windows\SysWOW64\BNPWX.exeC:\windows\system32\BNPWX.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XLVTEAV.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\windows\SysWOW64\XLVTEAV.exeC:\windows\system32\XLVTEAV.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FDWMREK.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\windows\system\FDWMREK.exeC:\windows\system\FDWMREK.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJW.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\windows\FJW.exeC:\windows\FJW.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJDPC.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\windows\SysWOW64\LJDPC.exeC:\windows\system32\LJDPC.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WCGHKB.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\windows\system\WCGHKB.exeC:\windows\system\WCGHKB.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPD.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\windows\system\RPD.exeC:\windows\system\RPD.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EAUPJE.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\windows\system\EAUPJE.exeC:\windows\system\EAUPJE.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EGUEKRI.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\windows\system\EGUEKRI.exeC:\windows\system\EGUEKRI.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BLS.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\windows\system\BLS.exeC:\windows\system\BLS.exe65⤵
- Executes dropped EXE
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GLZPAV.exe.bat" "66⤵PID:4948
-
C:\windows\system\GLZPAV.exeC:\windows\system\GLZPAV.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUBUMAO.exe.bat" "68⤵PID:2864
-
C:\windows\QUBUMAO.exeC:\windows\QUBUMAO.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUD.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4272 -
C:\windows\SysWOW64\HUD.exeC:\windows\system32\HUD.exe71⤵
- Executes dropped EXE
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPNDAK.exe.bat" "72⤵PID:4364
-
C:\windows\WPNDAK.exeC:\windows\WPNDAK.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNOFHHG.exe.bat" "74⤵PID:4348
-
C:\windows\system\YNOFHHG.exeC:\windows\system\YNOFHHG.exe75⤵
- Executes dropped EXE
PID:3336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDVF.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2492 -
C:\windows\system\CDVF.exeC:\windows\system\CDVF.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IDCTCU.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:2344 -
C:\windows\SysWOW64\IDCTCU.exeC:\windows\system32\IDCTCU.exe79⤵
- Executes dropped EXE
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWX.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:6032 -
C:\windows\system\TWX.exeC:\windows\system\TWX.exe81⤵
- Executes dropped EXE
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJCV.exe.bat" "82⤵
- Executes a command shell one-liner
PID:2484 -
C:\windows\OJCV.exeC:\windows\OJCV.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZCFO.exe.bat" "84⤵PID:2416
-
C:\windows\system\ZCFO.exeC:\windows\system\ZCFO.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKM.exe.bat" "86⤵PID:4220
-
C:\windows\system\DKM.exeC:\windows\system\DKM.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OCPHPQT.exe.bat" "88⤵PID:4788
-
C:\windows\SysWOW64\OCPHPQT.exeC:\windows\system32\OCPHPQT.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDWVY.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3332 -
C:\windows\system\UDWVY.exeC:\windows\system\UDWVY.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FVRNGZ.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:984 -
C:\windows\SysWOW64\FVRNGZ.exeC:\windows\system32\FVRNGZ.exe93⤵
- Executes dropped EXE
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CBXLNBD.exe.bat" "94⤵PID:4544
-
C:\windows\CBXLNBD.exeC:\windows\CBXLNBD.exe95⤵
- Executes dropped EXE
PID:3580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XOCU.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:3624 -
C:\windows\XOCU.exeC:\windows\XOCU.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COKI.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:5808 -
C:\windows\SysWOW64\COKI.exeC:\windows\system32\COKI.exe99⤵
- Executes dropped EXE
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHNBPL.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6040 -
C:\windows\OHNBPL.exeC:\windows\OHNBPL.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZZITPSY.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:1884 -
C:\windows\SysWOW64\ZZITPSY.exeC:\windows\system32\ZZITPSY.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KSL.exe.bat" "104⤵PID:2736
-
C:\windows\SysWOW64\KSL.exeC:\windows\system32\KSL.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FFPVI.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4832 -
C:\windows\SysWOW64\FFPVI.exeC:\windows\system32\FFPVI.exe107⤵
- Executes dropped EXE
PID:592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABUFSHR.exe.bat" "108⤵
- Executes a command shell one-liner
PID:2008 -
C:\windows\system\ABUFSHR.exeC:\windows\system\ABUFSHR.exe109⤵
- Executes dropped EXE
PID:1556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WYA.exe.bat" "110⤵PID:4648
-
C:\windows\WYA.exeC:\windows\WYA.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYIQ.exe.bat" "112⤵PID:1376
-
C:\windows\SysWOW64\CYIQ.exeC:\windows\system32\CYIQ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NRDIQ.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:1148 -
C:\windows\SysWOW64\NRDIQ.exeC:\windows\system32\NRDIQ.exe115⤵
- Executes dropped EXE
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CXIYYC.exe.bat" "116⤵PID:6024
-
C:\windows\CXIYYC.exeC:\windows\CXIYYC.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCOVFM.exe.bat" "118⤵PID:5996
-
C:\windows\YCOVFM.exeC:\windows\YCOVFM.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVJNNTV.exe.bat" "120⤵PID:3440
-
C:\windows\SysWOW64\KVJNNTV.exeC:\windows\system32\KVJNNTV.exe121⤵
- Executes dropped EXE
PID:3264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-