Analysis
- max time kernel
91s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 16:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-14_8ea20597547350e821d5abd0dfdcd60f_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-14_8ea20597547350e821d5abd0dfdcd60f_elex_emotet_stop.exe
- Size 208KB
- Sample261014-vfb2aaf121
- SHA256 74400dab30ded2ccb8565d9a524f2f1827dab84811581ba386f4bef737d8e42e
- MD5 8ea20597547350e821d5abd0dfdcd60f
- SHA1 7c8b9fe582291c1ec948673333ed16baeec425e9
- SHA512 0cb0248f1a2c69807ca56402333841a16ab74dd24ff1d163f75024973d8407d3b8809003dc5c608fb62f7714b55a7b365220613e5dc54986c57b24a75137b9af
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfX4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOvkEj1
- TLSH T178247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3260 LTEMSIE.exe 1988 EMA.exe 2864 IMO.exe 4484 KKBAA.exe 2280 AACA.exe 5440 EQJATI.exe 4428 VQL.exe 5632 XORZMVS.exe 4860 SZHYS.exe 4452 WHOYERB.exe 716 FPQDQO.exe 2748 ACN.exe 5944 PSWM.exe 1812 FNFQKWQ.exe 236 DYIGSK.exe 1112 EBMKG.exe 2168 XEPGLQX.exe 3660 HCDATY.exe 988 JAJU.exe 2296 EDRL.exe 6088 NLTYA.exe 5808 RTIYEHS.exe 2608 XOZZJ.exe 4268 BEOHVVE.exe 3484 HFN.exe 1616 RUBPTFO.exe 1172 LQGY.exe 5092 MVYNF.exe 2232 RWFAOMG.exe 3460 KZJW.exe 1764 WHY.exe 6036 FPAJJ.exe 2968 LPZXAUH.exe 1320 LVA.exe 1628 PDGLO.exe 4296 AVJEOH.exe 2580 VRO.exe 1076 MWZG.exe 5784 VEBLS.exe 504 WZEP.exe 3548 LCOTQLC.exe 3160 LIOHSYX.exe 4160 GVTR.exe 4856 BGBPIBH.exe 5392 WTGZ.exe 1312 FCIEWGY.exe 4800 LCQ.exe 2876 LII.exe 4740 FVNPZ.exe 4084 RLTX.exe 5964 VTIYPQB.exe 5884 OWMB.exe 1560 FWOGG.exe 1908 YZRC.exe 4532 PNCUB.exe 4768 AFXNKN.exe 2080 MYAGKUH.exe 4276 RYIT.exe 52 BYKYFU.exe 3964 JRSASY.exe 1092 DEX.exe 2992 DKPYE.exe 3832 JKXLNF.exe 2460 PKE.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\FVNPZ.exe LII.exe File created C:\windows\SysWOW64\FVNPZ.exe.bat LII.exe File created C:\windows\SysWOW64\GJHUPWE.exe.bat AJAGG.exe File created C:\windows\SysWOW64\HEURIY.exe BEME.exe File opened for modification C:\windows\SysWOW64\HEURIY.exe BEME.exe File created C:\windows\SysWOW64\FPQDQO.exe WHOYERB.exe File created C:\windows\SysWOW64\VQL.exe.bat EQJATI.exe File created C:\windows\SysWOW64\RUBPTFO.exe HFN.exe File created C:\windows\SysWOW64\HAY.exe.bat UPIZI.exe File created C:\windows\SysWOW64\ENQSM.exe.bat SUUZ.exe File opened for modification C:\windows\SysWOW64\MOPW.exe MLLAL.exe File created C:\windows\SysWOW64\LUQRKZR.exe.bat FUIDT.exe File created C:\windows\SysWOW64\VQL.exe EQJATI.exe File created C:\windows\SysWOW64\PSWM.exe.bat ACN.exe File created C:\windows\SysWOW64\EBMKG.exe.bat DYIGSK.exe File opened for modification C:\windows\SysWOW64\WTGZ.exe BGBPIBH.exe File created C:\windows\SysWOW64\WTGZ.exe.bat BGBPIBH.exe File created C:\windows\SysWOW64\BEME.exe GJHUPWE.exe File opened for modification C:\windows\SysWOW64\HAY.exe UPIZI.exe File opened for modification C:\windows\SysWOW64\AACA.exe KKBAA.exe File created C:\windows\SysWOW64\SZHYS.exe XORZMVS.exe File created C:\windows\SysWOW64\RUBPTFO.exe.bat HFN.exe File created C:\windows\SysWOW64\FPAJJ.exe WHY.exe File created C:\windows\SysWOW64\VEBLS.exe MWZG.exe File opened for modification C:\windows\SysWOW64\UPIZI.exe TMEDDD.exe File created C:\windows\SysWOW64\ENQSM.exe SUUZ.exe File created C:\windows\SysWOW64\MOPW.exe MLLAL.exe File created C:\windows\SysWOW64\PSWM.exe ACN.exe File created C:\windows\SysWOW64\VRO.exe AVJEOH.exe File opened for modification C:\windows\SysWOW64\JRSASY.exe BYKYFU.exe File opened for modification C:\windows\SysWOW64\GJHUPWE.exe AJAGG.exe File created C:\windows\SysWOW64\MTHK.exe MOPW.exe File opened for modification C:\windows\SysWOW64\MTHK.exe MOPW.exe File created C:\windows\SysWOW64\QBVSEWP.exe.bat MTHK.exe File opened for modification C:\windows\SysWOW64\SAWUXSR.exe CKVV.exe File opened for modification C:\windows\SysWOW64\FPQDQO.exe WHOYERB.exe File created C:\windows\SysWOW64\AACA.exe KKBAA.exe File opened for modification C:\windows\SysWOW64\PSWM.exe ACN.exe File opened for modification C:\windows\SysWOW64\KMCQ.exe EMVCIDM.exe File created C:\windows\SysWOW64\HAY.exe UPIZI.exe File created C:\windows\SysWOW64\TQRFSXP.exe.bat XKZQCTV.exe File opened for modification C:\windows\SysWOW64\LUQRKZR.exe FUIDT.exe File created C:\windows\SysWOW64\SZHYS.exe.bat XORZMVS.exe File created C:\windows\SysWOW64\FPQDQO.exe.bat WHOYERB.exe File created C:\windows\SysWOW64\EBMKG.exe DYIGSK.exe File opened for modification C:\windows\SysWOW64\XEPGLQX.exe EBMKG.exe File opened for modification C:\windows\SysWOW64\RUBPTFO.exe HFN.exe File opened for modification C:\windows\SysWOW64\FPAJJ.exe WHY.exe File created C:\windows\SysWOW64\PKE.exe JKXLNF.exe File created C:\windows\SysWOW64\WBZ.exe TLKZQ.exe File created C:\windows\SysWOW64\AACA.exe.bat KKBAA.exe File created C:\windows\SysWOW64\RTIYEHS.exe NLTYA.exe File opened for modification C:\windows\SysWOW64\VRO.exe AVJEOH.exe File created C:\windows\SysWOW64\VEBLS.exe.bat MWZG.exe File created C:\windows\SysWOW64\WTGZ.exe BGBPIBH.exe File created C:\windows\SysWOW64\BEME.exe.bat GJHUPWE.exe File created C:\windows\SysWOW64\MOPW.exe.bat MLLAL.exe File opened for modification C:\windows\SysWOW64\QBVSEWP.exe MTHK.exe File created C:\windows\SysWOW64\XEPGLQX.exe.bat EBMKG.exe File created C:\windows\SysWOW64\LCOTQLC.exe.bat WZEP.exe File opened for modification C:\windows\SysWOW64\PKE.exe JKXLNF.exe File created C:\windows\SysWOW64\PKE.exe.bat JKXLNF.exe File created C:\windows\SysWOW64\KMCQ.exe.bat EMVCIDM.exe File created C:\windows\SysWOW64\TMEDDD.exe.bat KMCQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\LTEMSIE.exe 2026-10-14_8ea20597547350e821d5abd0dfdcd60f_elex_emotet_stop.exe File created C:\windows\BEOHVVE.exe XOZZJ.exe File created C:\windows\PDGLO.exe.bat LVA.exe File opened for modification C:\windows\system\ADHS.exe PKE.exe File created C:\windows\system\WOHCKBC.exe.bat WIHOIOH.exe File opened for modification C:\windows\system\MJRHD.exe WOHCKBC.exe File created C:\windows\system\MLLAL.exe NNSXYW.exe File created C:\windows\BGBPIBH.exe.bat GVTR.exe File created C:\windows\OWMB.exe.bat VTIYPQB.exe File opened for modification C:\windows\JAJU.exe HCDATY.exe File created C:\windows\system\LVA.exe.bat LPZXAUH.exe File created C:\windows\system\VTIYPQB.exe.bat RLTX.exe File created C:\windows\JKXLNF.exe DKPYE.exe File created C:\windows\system\UQTYTQM.exe JIEYH.exe File created C:\windows\XKZQCTV.exe RXAPXQ.exe File opened for modification C:\windows\WTG.exe VQDU.exe File opened for modification C:\windows\HCDATY.exe XEPGLQX.exe File created C:\windows\MVYNF.exe.bat LQGY.exe File created C:\windows\GVTR.exe.bat LIOHSYX.exe File created C:\windows\system\RYIT.exe.bat MYAGKUH.exe File created C:\windows\system\HKUGSLX.exe.bat HEURIY.exe File created C:\windows\WIHOIOH.exe BXZP.exe File created C:\windows\system\NUNLVP.exe.bat SHICT.exe File created C:\windows\system\ADHS.exe.bat PKE.exe File opened for modification C:\windows\XLD.exe XQZPDZ.exe File created C:\windows\WTG.exe.bat VQDU.exe File created C:\windows\system\NNSXYW.exe ENQSM.exe File created C:\windows\FSY.exe.bat BKR.exe File created C:\windows\HCDATY.exe.bat XEPGLQX.exe File created C:\windows\system\NLTYA.exe EDRL.exe File opened for modification C:\windows\system\HFN.exe BEOHVVE.exe File created C:\windows\system\LPZXAUH.exe.bat FPAJJ.exe File created C:\windows\system\RLTX.exe FVNPZ.exe File created C:\windows\CKVV.exe TFK.exe File created C:\windows\EQJATI.exe AACA.exe File created C:\windows\system\XOZZJ.exe.bat RTIYEHS.exe File opened for modification C:\windows\system\TFK.exe SCHHWK.exe File opened for modification C:\windows\GYU.exe WPSBIWJ.exe File opened for modification C:\windows\BGBPIBH.exe GVTR.exe File opened for modification C:\windows\LII.exe LCQ.exe File created C:\windows\system\BYKYFU.exe RYIT.exe File opened for modification C:\windows\system\KKBAA.exe IMO.exe File created C:\windows\XORZMVS.exe VQL.exe File created C:\windows\system\BYKYFU.exe.bat RYIT.exe File created C:\windows\system\NUNLVP.exe SHICT.exe File created C:\windows\ODWP.exe.bat TQRFSXP.exe File created C:\windows\system\TFK.exe SCHHWK.exe File opened for modification C:\windows\GVTR.exe LIOHSYX.exe File created C:\windows\LCQ.exe.bat FCIEWGY.exe File opened for modification C:\windows\system\DEX.exe JRSASY.exe File opened for modification C:\windows\system\BYKYFU.exe RYIT.exe File opened for modification C:\windows\SUUZ.exe NUNLVP.exe File created C:\windows\system\MLLAL.exe.bat NNSXYW.exe File opened for modification C:\windows\system\FUIDT.exe WTG.exe File created C:\windows\TLKZQ.exe.bat UQTYTQM.exe File created C:\windows\XORZMVS.exe.bat VQL.exe File created C:\windows\system\XOZZJ.exe RTIYEHS.exe File opened for modification C:\windows\system\LPZXAUH.exe FPAJJ.exe File created C:\windows\system\UQTYTQM.exe.bat JIEYH.exe File created C:\windows\ACN.exe.bat FPQDQO.exe File created C:\windows\LCQ.exe FCIEWGY.exe File created C:\windows\AFXNKN.exe PNCUB.exe File opened for modification C:\windows\EMVCIDM.exe MJRHD.exe File created C:\windows\system\SHICT.exe XLD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5676 cmd.exe 3232 cmd.exe 4332 cmd.exe 5752 cmd.exe 3416 cmd.exe 1108 cmd.exe 1140 cmd.exe 6040 cmd.exe 5912 cmd.exe 5276 cmd.exe 5988 cmd.exe 1748 cmd.exe 3768 cmd.exe 1848 cmd.exe 5748 cmd.exe 3408 cmd.exe 5488 cmd.exe 3728 cmd.exe 4232 cmd.exe 2076 cmd.exe 3040 cmd.exe 4636 cmd.exe 960 cmd.exe 4300 cmd.exe 4612 cmd.exe 1348 cmd.exe 2068 cmd.exe 3528 cmd.exe 4840 cmd.exe 2532 cmd.exe 2620 cmd.exe 5636 cmd.exe 1104 cmd.exe 3276 cmd.exe 996 cmd.exe 5780 cmd.exe 2816 cmd.exe 1984 cmd.exe 4108 cmd.exe 872 cmd.exe 1416 cmd.exe 1956 cmd.exe 5144 cmd.exe 5088 cmd.exe 1224 cmd.exe 1340 cmd.exe 776 cmd.exe 1972 cmd.exe 2552 cmd.exe 548 cmd.exe 1124 cmd.exe 5820 cmd.exe 4144 cmd.exe 2208 cmd.exe 2920 cmd.exe 3536 cmd.exe 1060 cmd.exe 2956 cmd.exe 3156 cmd.exe 3720 cmd.exe 6076 cmd.exe 1440 cmd.exe 2212 cmd.exe 2680 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3892 3280 WerFault.exe 87 4296 3260 WerFault.exe 93 5960 1988 WerFault.exe 99 3656 2864 WerFault.exe 104 2088 4484 WerFault.exe 109 432 2280 WerFault.exe 114 3296 5440 WerFault.exe 119 3184 4428 WerFault.exe 124 4160 5632 WerFault.exe 129 1360 4860 WerFault.exe 134 824 4452 WerFault.exe 139 4748 716 WerFault.exe 144 3808 2748 WerFault.exe 149 2120 5944 WerFault.exe 154 364 1812 WerFault.exe 159 2596 236 WerFault.exe 164 3940 1112 WerFault.exe 169 1560 2168 WerFault.exe 174 5716 3660 WerFault.exe 179 4884 988 WerFault.exe 184 1364 2296 WerFault.exe 189 4316 6088 WerFault.exe 194 2920 5808 WerFault.exe 199 4492 2608 WerFault.exe 204 6096 4268 WerFault.exe 208 5152 3484 WerFault.exe 214 5096 1616 WerFault.exe 219 3772 1172 WerFault.exe 224 1148 5092 WerFault.exe 229 1740 2232 WerFault.exe 234 2400 3460 WerFault.exe 239 3864 1764 WerFault.exe 244 2180 6036 WerFault.exe 249 2852 2968 WerFault.exe 254 2432 1320 WerFault.exe 259 4300 1628 WerFault.exe 264 4284 4296 WerFault.exe 269 3076 2580 WerFault.exe 274 1376 1076 WerFault.exe 279 5964 5784 WerFault.exe 284 4500 504 WerFault.exe 289 4256 3548 WerFault.exe 294 3900 3160 WerFault.exe 299 5668 4160 WerFault.exe 304 5088 4856 WerFault.exe 309 4356 5392 WerFault.exe 314 1968 1312 WerFault.exe 319 124 4800 WerFault.exe 324 3328 2876 WerFault.exe 329 3728 4740 WerFault.exe 334 3176 4084 WerFault.exe 339 2176 5964 WerFault.exe 344 4256 5884 WerFault.exe 349 828 1560 WerFault.exe 354 1524 1908 WerFault.exe 359 4164 4532 WerFault.exe 364 2068 4768 WerFault.exe 369 1760 2080 WerFault.exe 374 960 4276 WerFault.exe 379 5152 52 WerFault.exe 384 4776 3964 WerFault.exe 389 1088 1092 WerFault.exe 394 1776 2992 WerFault.exe 399 4612 3832 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNFQKWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBMKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPIZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LII.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUUZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XORZMVS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMVCIDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUQRKZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKUGSLX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJRHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MZMPAOA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENQSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKZQCTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVYNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NNSXYW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQTYTQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJAGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MLLAL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-14_8ea20597547350e821d5abd0dfdcd60f_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEOHVVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LTEMSIE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WHOYERB.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3280 2026-10-14_8ea20597547350e821d5abd0dfdcd60f_elex_emotet_stop.exe 3280 2026-10-14_8ea20597547350e821d5abd0dfdcd60f_elex_emotet_stop.exe 3260 LTEMSIE.exe 3260 LTEMSIE.exe 1988 EMA.exe 1988 EMA.exe 2864 IMO.exe 2864 IMO.exe 4484 KKBAA.exe 4484 KKBAA.exe 2280 AACA.exe 2280 AACA.exe 5440 EQJATI.exe 5440 EQJATI.exe 4428 VQL.exe 4428 VQL.exe 5632 XORZMVS.exe 5632 XORZMVS.exe 4860 SZHYS.exe 4860 SZHYS.exe 4452 WHOYERB.exe 4452 WHOYERB.exe 716 FPQDQO.exe 716 FPQDQO.exe 2748 ACN.exe 2748 ACN.exe 5944 PSWM.exe 5944 PSWM.exe 1812 FNFQKWQ.exe 1812 FNFQKWQ.exe 236 DYIGSK.exe 236 DYIGSK.exe 1112 EBMKG.exe 1112 EBMKG.exe 2168 XEPGLQX.exe 2168 XEPGLQX.exe 3660 HCDATY.exe 3660 HCDATY.exe 988 JAJU.exe 988 JAJU.exe 2296 EDRL.exe 2296 EDRL.exe 6088 NLTYA.exe 6088 NLTYA.exe 5808 RTIYEHS.exe 5808 RTIYEHS.exe 2608 XOZZJ.exe 2608 XOZZJ.exe 4268 BEOHVVE.exe 4268 BEOHVVE.exe 3484 HFN.exe 3484 HFN.exe 1616 RUBPTFO.exe 1616 RUBPTFO.exe 1172 LQGY.exe 1172 LQGY.exe 5092 MVYNF.exe 5092 MVYNF.exe 2232 RWFAOMG.exe 2232 RWFAOMG.exe 3460 KZJW.exe 3460 KZJW.exe 1764 WHY.exe 1764 WHY.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3280 2026-10-14_8ea20597547350e821d5abd0dfdcd60f_elex_emotet_stop.exe 3280 2026-10-14_8ea20597547350e821d5abd0dfdcd60f_elex_emotet_stop.exe 3260 LTEMSIE.exe 3260 LTEMSIE.exe 1988 EMA.exe 1988 EMA.exe 2864 IMO.exe 2864 IMO.exe 4484 KKBAA.exe 4484 KKBAA.exe 2280 AACA.exe 2280 AACA.exe 5440 EQJATI.exe 5440 EQJATI.exe 4428 VQL.exe 4428 VQL.exe 5632 XORZMVS.exe 5632 XORZMVS.exe 4860 SZHYS.exe 4860 SZHYS.exe 4452 WHOYERB.exe 4452 WHOYERB.exe 716 FPQDQO.exe 716 FPQDQO.exe 2748 ACN.exe 2748 ACN.exe 5944 PSWM.exe 5944 PSWM.exe 1812 FNFQKWQ.exe 1812 FNFQKWQ.exe 236 DYIGSK.exe 236 DYIGSK.exe 1112 EBMKG.exe 1112 EBMKG.exe 2168 XEPGLQX.exe 2168 XEPGLQX.exe 3660 HCDATY.exe 3660 HCDATY.exe 988 JAJU.exe 988 JAJU.exe 2296 EDRL.exe 2296 EDRL.exe 6088 NLTYA.exe 6088 NLTYA.exe 5808 RTIYEHS.exe 5808 RTIYEHS.exe 2608 XOZZJ.exe 2608 XOZZJ.exe 4268 BEOHVVE.exe 4268 BEOHVVE.exe 3484 HFN.exe 3484 HFN.exe 1616 RUBPTFO.exe 1616 RUBPTFO.exe 1172 LQGY.exe 1172 LQGY.exe 5092 MVYNF.exe 5092 MVYNF.exe 2232 RWFAOMG.exe 2232 RWFAOMG.exe 3460 KZJW.exe 3460 KZJW.exe 1764 WHY.exe 1764 WHY.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3280 wrote to memory of 3340 3280 2026-10-14_8ea20597547350e821d5abd0dfdcd60f_elex_emotet_stop.exe 89 PID 3340 wrote to memory of 3260 3340 cmd.exe 93 PID 3260 wrote to memory of 3692 3260 LTEMSIE.exe 95 PID 3692 wrote to memory of 1988 3692 cmd.exe 99 PID 1988 wrote to memory of 4376 1988 EMA.exe 100 PID 4376 wrote to memory of 2864 4376 cmd.exe 104 PID 2864 wrote to memory of 204 2864 IMO.exe 105 PID 204 wrote to memory of 4484 204 cmd.exe 109 PID 4484 wrote to memory of 1972 4484 KKBAA.exe 110 PID 1972 wrote to memory of 2280 1972 cmd.exe 114 PID 2280 wrote to memory of 6112 2280 AACA.exe 115 PID 6112 wrote to memory of 5440 6112 cmd.exe 119 PID 5440 wrote to memory of 6040 5440 EQJATI.exe 120 PID 6040 wrote to memory of 4428 6040 cmd.exe 124 PID 4428 wrote to memory of 872 4428 VQL.exe 125 PID 872 wrote to memory of 5632 872 cmd.exe 129 PID 5632 wrote to memory of 2332 5632 XORZMVS.exe 130 PID 2332 wrote to memory of 4860 2332 cmd.exe 134 PID 4860 wrote to memory of 5540 4860 SZHYS.exe 135 PID 5540 wrote to memory of 4452 5540 cmd.exe 139 PID 4452 wrote to memory of 5748 4452 WHOYERB.exe 140 PID 5748 wrote to memory of 716 5748 cmd.exe 144 PID 716 wrote to memory of 5356 716 FPQDQO.exe 145 PID 5356 wrote to memory of 2748 5356 cmd.exe 149 PID 2748 wrote to memory of 1496 2748 ACN.exe 150 PID 1496 wrote to memory of 5944 1496 cmd.exe 154 PID 5944 wrote to memory of 3476 5944 PSWM.exe 155 PID 3476 wrote to memory of 1812 3476 cmd.exe 159 PID 1812 wrote to memory of 4580 1812 FNFQKWQ.exe 160 PID 4580 wrote to memory of 236 4580 cmd.exe 164 PID 236 wrote to memory of 1416 236 DYIGSK.exe 165 PID 1416 wrote to memory of 1112 1416 cmd.exe 169 PID 1112 wrote to memory of 5688 1112 EBMKG.exe 170 PID 5688 wrote to memory of 2168 5688 cmd.exe 174 PID 2168 wrote to memory of 2556 2168 XEPGLQX.exe 175 PID 2556 wrote to memory of 3660 2556 cmd.exe 179 PID 3660 wrote to memory of 3488 3660 HCDATY.exe 180 PID 3488 wrote to memory of 988 3488 cmd.exe 184 PID 988 wrote to memory of 3500 988 JAJU.exe 185 PID 3500 wrote to memory of 2296 3500 cmd.exe 189 PID 2296 wrote to memory of 1348 2296 EDRL.exe 190 PID 1348 wrote to memory of 6088 1348 cmd.exe 194 PID 6088 wrote to memory of 4672 6088 NLTYA.exe 195 PID 4672 wrote to memory of 5808 4672 cmd.exe 199 PID 5808 wrote to memory of 5644 5808 RTIYEHS.exe 200 PID 5644 wrote to memory of 2608 5644 cmd.exe 204 PID 2608 wrote to memory of 2212 2608 XOZZJ.exe 205 PID 2212 wrote to memory of 4268 2212 cmd.exe 208 PID 4268 wrote to memory of 6104 4268 BEOHVVE.exe 210 PID 6104 wrote to memory of 3484 6104 cmd.exe 214 PID 3484 wrote to memory of 1692 3484 HFN.exe 215 PID 1692 wrote to memory of 1616 1692 cmd.exe 219 PID 1616 wrote to memory of 5676 1616 RUBPTFO.exe 220 PID 5676 wrote to memory of 1172 5676 cmd.exe 224 PID 1172 wrote to memory of 2552 1172 LQGY.exe 225 PID 2552 wrote to memory of 5092 2552 cmd.exe 229 PID 5092 wrote to memory of 5856 5092 MVYNF.exe 230 PID 5856 wrote to memory of 2232 5856 cmd.exe 234 PID 2232 wrote to memory of 3368 2232 RWFAOMG.exe 235 PID 3368 wrote to memory of 3460 3368 cmd.exe 239 PID 3460 wrote to memory of 3408 3460 KZJW.exe 240 PID 3408 wrote to memory of 1764 3408 cmd.exe 244 PID 1764 wrote to memory of 1956 1764 WHY.exe 245 PID 1956 wrote to memory of 6036 1956 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-14_8ea20597547350e821d5abd0dfdcd60f_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-14_8ea20597547350e821d5abd0dfdcd60f_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LTEMSIE.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\windows\system\LTEMSIE.exeC:\windows\system\LTEMSIE.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMA.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\windows\system\EMA.exeC:\windows\system\EMA.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMO.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\windows\IMO.exeC:\windows\IMO.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KKBAA.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:204 -
C:\windows\system\KKBAA.exeC:\windows\system\KKBAA.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AACA.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\windows\SysWOW64\AACA.exeC:\windows\system32\AACA.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQJATI.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\windows\EQJATI.exeC:\windows\EQJATI.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VQL.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\windows\SysWOW64\VQL.exeC:\windows\system32\VQL.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XORZMVS.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:872 -
C:\windows\XORZMVS.exeC:\windows\XORZMVS.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SZHYS.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\windows\SysWOW64\SZHYS.exeC:\windows\system32\SZHYS.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WHOYERB.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\windows\SysWOW64\WHOYERB.exeC:\windows\system32\WHOYERB.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPQDQO.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\windows\SysWOW64\FPQDQO.exeC:\windows\system32\FPQDQO.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ACN.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\windows\ACN.exeC:\windows\ACN.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PSWM.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\windows\SysWOW64\PSWM.exeC:\windows\system32\PSWM.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FNFQKWQ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\windows\SysWOW64\FNFQKWQ.exeC:\windows\system32\FNFQKWQ.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYIGSK.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\system\DYIGSK.exeC:\windows\system\DYIGSK.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EBMKG.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\windows\SysWOW64\EBMKG.exeC:\windows\system32\EBMKG.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XEPGLQX.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\windows\SysWOW64\XEPGLQX.exeC:\windows\system32\XEPGLQX.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HCDATY.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\windows\HCDATY.exeC:\windows\HCDATY.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JAJU.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\windows\JAJU.exeC:\windows\JAJU.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EDRL.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\windows\system\EDRL.exeC:\windows\system\EDRL.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLTYA.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\windows\system\NLTYA.exeC:\windows\system\NLTYA.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RTIYEHS.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\windows\SysWOW64\RTIYEHS.exeC:\windows\system32\RTIYEHS.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOZZJ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\windows\system\XOZZJ.exeC:\windows\system\XOZZJ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BEOHVVE.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\windows\BEOHVVE.exeC:\windows\BEOHVVE.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HFN.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\windows\system\HFN.exeC:\windows\system\HFN.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUBPTFO.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\windows\SysWOW64\RUBPTFO.exeC:\windows\system32\RUBPTFO.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LQGY.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\windows\LQGY.exeC:\windows\LQGY.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MVYNF.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\windows\MVYNF.exeC:\windows\MVYNF.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RWFAOMG.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\windows\RWFAOMG.exeC:\windows\RWFAOMG.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KZJW.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\windows\system\KZJW.exeC:\windows\system\KZJW.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WHY.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\windows\system\WHY.exeC:\windows\system\WHY.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPAJJ.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\windows\SysWOW64\FPAJJ.exeC:\windows\system32\FPAJJ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LPZXAUH.exe.bat" "66⤵PID:2964
-
C:\windows\system\LPZXAUH.exeC:\windows\system\LPZXAUH.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVA.exe.bat" "68⤵PID:2928
-
C:\windows\system\LVA.exeC:\windows\system\LVA.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PDGLO.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:4320 -
C:\windows\PDGLO.exeC:\windows\PDGLO.exe71⤵
- Executes dropped EXE
PID:1628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AVJEOH.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2816 -
C:\windows\system\AVJEOH.exeC:\windows\system\AVJEOH.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRO.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:788 -
C:\windows\SysWOW64\VRO.exeC:\windows\system32\VRO.exe75⤵
- Executes dropped EXE
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MWZG.exe.bat" "76⤵PID:5708
-
C:\windows\MWZG.exeC:\windows\MWZG.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEBLS.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:3452 -
C:\windows\SysWOW64\VEBLS.exeC:\windows\system32\VEBLS.exe79⤵
- Executes dropped EXE
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZEP.exe.bat" "80⤵
- Executes a command shell one-liner
PID:3232 -
C:\windows\system\WZEP.exeC:\windows\system\WZEP.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LCOTQLC.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:3780 -
C:\windows\SysWOW64\LCOTQLC.exeC:\windows\system32\LCOTQLC.exe83⤵
- Executes dropped EXE
PID:3548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIOHSYX.exe.bat" "84⤵PID:4960
-
C:\windows\system\LIOHSYX.exeC:\windows\system\LIOHSYX.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GVTR.exe.bat" "86⤵PID:5652
-
C:\windows\GVTR.exeC:\windows\GVTR.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BGBPIBH.exe.bat" "88⤵
- Executes a command shell one-liner
PID:548 -
C:\windows\BGBPIBH.exeC:\windows\BGBPIBH.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WTGZ.exe.bat" "90⤵PID:5064
-
C:\windows\SysWOW64\WTGZ.exeC:\windows\system32\WTGZ.exe91⤵
- Executes dropped EXE
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FCIEWGY.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:3120 -
C:\windows\system\FCIEWGY.exeC:\windows\system\FCIEWGY.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCQ.exe.bat" "94⤵PID:5792
-
C:\windows\LCQ.exeC:\windows\LCQ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LII.exe.bat" "96⤵PID:3308
-
C:\windows\LII.exeC:\windows\LII.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FVNPZ.exe.bat" "98⤵PID:3656
-
C:\windows\SysWOW64\FVNPZ.exeC:\windows\system32\FVNPZ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLTX.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4312 -
C:\windows\system\RLTX.exeC:\windows\system\RLTX.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VTIYPQB.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1984 -
C:\windows\system\VTIYPQB.exeC:\windows\system\VTIYPQB.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OWMB.exe.bat" "104⤵PID:4564
-
C:\windows\OWMB.exeC:\windows\OWMB.exe105⤵
- Executes dropped EXE
PID:5884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWOGG.exe.bat" "106⤵
- Executes a command shell one-liner
PID:5488 -
C:\windows\system\FWOGG.exeC:\windows\system\FWOGG.exe107⤵
- Executes dropped EXE
PID:1560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZRC.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:3140 -
C:\windows\system\YZRC.exeC:\windows\system\YZRC.exe109⤵
- Executes dropped EXE
PID:1908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PNCUB.exe.bat" "110⤵PID:4904
-
C:\windows\PNCUB.exeC:\windows\PNCUB.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFXNKN.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:4676 -
C:\windows\AFXNKN.exeC:\windows\AFXNKN.exe113⤵
- Executes dropped EXE
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYAGKUH.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1748 -
C:\windows\MYAGKUH.exeC:\windows\MYAGKUH.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RYIT.exe.bat" "116⤵PID:1528
-
C:\windows\system\RYIT.exeC:\windows\system\RYIT.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BYKYFU.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:3552 -
C:\windows\system\BYKYFU.exeC:\windows\system\BYKYFU.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:52 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JRSASY.exe.bat" "120⤵PID:2128
-
C:\windows\SysWOW64\JRSASY.exeC:\windows\system32\JRSASY.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-