Analysis
- max time kernel
98s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/10/2026, 23:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-15_f129a8341f0c5bc7912e99f34add065c_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-15_f129a8341f0c5bc7912e99f34add065c_elex_emotet_stop.exe
- Size 208KB
- Sample261015-3fjecsys7j
- SHA256 12250cb90096a4f3fdc167a2b79cf0cc38bdcc7bdc6e041a6537116f79b45ff4
- MD5 f129a8341f0c5bc7912e99f34add065c
- SHA1 cb348db1243d573fe4d5a6d41b84ed2635e381bc
- SHA512 99b221d4e7441ee76fa8fb6272e3234704c521c00bccf1ee10c408fbfd810aef282cfe3e906d83ae5592322221fa80008a86d80b42d87ec126af980c28533b26
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfe4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOGkEj1
- TLSH T1A5247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4768 USTYTRY.exe 3604 SLLUFSV.exe 5316 RWNKOG.exe 3480 GRXP.exe 2940 YUB.exe 696 ISONU.exe 4532 PFN.exe 5548 CQWMFF.exe 2364 LYY.exe 4352 MTCNWS.exe 6124 QJIV.exe 2188 QMMRNB.exe 4740 WFU.exe 5148 EVVEDQ.exe 240 JVCS.exe 2128 KYGNRJ.exe 3844 DBKRFZY.exe 4152 JBSFO.exe 4120 TZFZ.exe 1576 LCJVJZ.exe 5660 LIJJKMN.exe 3764 GTSIYPI.exe 1580 BGWR.exe 5440 KGYWM.exe 1520 ABI.exe 4616 GXHK.exe 4652 LXPXLM.exe 3232 VFRCOKA.exe 3500 PSWM.exe 2772 OIHPMPP.exe 912 ZBKA.exe 3788 LRQ.exe 4296 URSN.exe 2600 YHZNWER.exe 1868 QHB.exe 2308 KVGJK.exe 3608 WNBCSR.exe 1284 QJG.exe 1484 WJNZL.exe 3684 RWSIVSC.exe 5264 LKXS.exe 1240 RKFGPN.exe 1416 RPFUQAV.exe 5560 OVDRXJ.exe 5936 GYGND.exe 5748 CJX.exe 952 COXA.exe 5892 WCUJDP.exe 3144 LXLO.exe 1388 BNMNUXI.exe 5432 FDTN.exe 4264 JLZVTAS.exe 4560 PGZW.exe 2608 UGGKH.exe 4960 WEME.exe 5964 OFOJRL.exe 2656 CKUGGUO.exe 3676 YVCXV.exe 4928 SIHOXFY.exe 1000 CQJ.exe 4540 WEODLCP.exe 4636 ZRTM.exe 5232 BPYHCL.exe 5800 LNMBST.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\DCAOXI.exe XMOLCDO.exe File created C:\windows\SysWOW64\DCAOXI.exe.bat XMOLCDO.exe File created C:\windows\SysWOW64\FFPVI.exe IIK.exe File created C:\windows\SysWOW64\QYIIPLP.exe JQHR.exe File opened for modification C:\windows\SysWOW64\LRQ.exe ZBKA.exe File created C:\windows\SysWOW64\LXLO.exe.bat WCUJDP.exe File created C:\windows\SysWOW64\RNJ.exe.bat TRKWZUL.exe File created C:\windows\SysWOW64\DBKRFZY.exe.bat KYGNRJ.exe File opened for modification C:\windows\SysWOW64\QHB.exe YHZNWER.exe File created C:\windows\SysWOW64\RWSIVSC.exe WJNZL.exe File opened for modification C:\windows\SysWOW64\BNMNUXI.exe LXLO.exe File created C:\windows\SysWOW64\JIQAEIV.exe.bat DNRZZ.exe File created C:\windows\SysWOW64\MXM.exe.bat GWEZB.exe File opened for modification C:\windows\SysWOW64\XNRLN.exe RNJ.exe File opened for modification C:\windows\SysWOW64\JBSFO.exe DBKRFZY.exe File created C:\windows\SysWOW64\MWHPDWL.exe KZT.exe File opened for modification C:\windows\SysWOW64\NDQDXY.exe FYYPW.exe File created C:\windows\SysWOW64\FVBU.exe.bat OVH.exe File created C:\windows\SysWOW64\CQJ.exe SIHOXFY.exe File opened for modification C:\windows\SysWOW64\MXM.exe GWEZB.exe File opened for modification C:\windows\SysWOW64\FFPVI.exe IIK.exe File created C:\windows\SysWOW64\OIHPMPP.exe.bat PSWM.exe File created C:\windows\SysWOW64\LRQ.exe.bat ZBKA.exe File created C:\windows\SysWOW64\URSN.exe LRQ.exe File created C:\windows\SysWOW64\BNMNUXI.exe.bat LXLO.exe File opened for modification C:\windows\SysWOW64\CQJ.exe SIHOXFY.exe File opened for modification C:\windows\SysWOW64\WEODLCP.exe CQJ.exe File opened for modification C:\windows\SysWOW64\JQVBS.exe JLVNQ.exe File created C:\windows\SysWOW64\NDQDXY.exe.bat FYYPW.exe File created C:\windows\SysWOW64\TRKWZUL.exe LHCVMIW.exe File opened for modification C:\windows\SysWOW64\RWNKOG.exe SLLUFSV.exe File created C:\windows\SysWOW64\PFN.exe ISONU.exe File created C:\windows\SysWOW64\DBKRFZY.exe KYGNRJ.exe File created C:\windows\SysWOW64\BPYHCL.exe ZRTM.exe File opened for modification C:\windows\SysWOW64\LXLO.exe WCUJDP.exe File created C:\windows\SysWOW64\CKUGGUO.exe OFOJRL.exe File created C:\windows\SysWOW64\MWHPDWL.exe.bat KZT.exe File created C:\windows\SysWOW64\CKUGGUO.exe.bat OFOJRL.exe File opened for modification C:\windows\SysWOW64\TRKWZUL.exe LHCVMIW.exe File opened for modification C:\windows\SysWOW64\RWSIVSC.exe WJNZL.exe File opened for modification C:\windows\SysWOW64\COXA.exe CJX.exe File opened for modification C:\windows\SysWOW64\YVCXV.exe CKUGGUO.exe File created C:\windows\SysWOW64\YVCXV.exe.bat CKUGGUO.exe File created C:\windows\SysWOW64\JQVBS.exe.bat JLVNQ.exe File created C:\windows\SysWOW64\QYIIPLP.exe.bat JQHR.exe File created C:\windows\SysWOW64\YVCXV.exe CKUGGUO.exe File created C:\windows\SysWOW64\PFN.exe.bat ISONU.exe File opened for modification C:\windows\SysWOW64\DCAOXI.exe XMOLCDO.exe File created C:\windows\SysWOW64\TRKWZUL.exe.bat LHCVMIW.exe File created C:\windows\SysWOW64\JBSFO.exe.bat DBKRFZY.exe File opened for modification C:\windows\SysWOW64\TZFZ.exe JBSFO.exe File created C:\windows\SysWOW64\WEODLCP.exe CQJ.exe File created C:\windows\SysWOW64\XMOLCDO.exe.bat GBQODIT.exe File opened for modification C:\windows\SysWOW64\JIQAEIV.exe DNRZZ.exe File opened for modification C:\windows\SysWOW64\BPYHCL.exe ZRTM.exe File opened for modification C:\windows\SysWOW64\LNMBST.exe BPYHCL.exe File created C:\windows\SysWOW64\PQD.exe JQVBS.exe File opened for modification C:\windows\SysWOW64\DBKRFZY.exe KYGNRJ.exe File created C:\windows\SysWOW64\OIHPMPP.exe PSWM.exe File created C:\windows\SysWOW64\LRQ.exe ZBKA.exe File created C:\windows\SysWOW64\OFOJRL.exe WEME.exe File created C:\windows\SysWOW64\OFOJRL.exe.bat WEME.exe File created C:\windows\SysWOW64\MXM.exe GWEZB.exe File created C:\windows\SysWOW64\COXA.exe CJX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\MRLS.exe.bat MWHPDWL.exe File opened for modification C:\windows\system\KYGNRJ.exe JVCS.exe File opened for modification C:\windows\system\VFRCOKA.exe LXPXLM.exe File opened for modification C:\windows\RKFGPN.exe LKXS.exe File opened for modification C:\windows\SIHOXFY.exe YVCXV.exe File created C:\windows\UQMAXDE.exe.bat JXRQXW.exe File created C:\windows\JQHR.exe.bat DQADZNZ.exe File opened for modification C:\windows\system\AOMK.exe JDOM.exe File created C:\windows\system\POODSAU.exe JTWUNXF.exe File created C:\windows\system\UGGKH.exe PGZW.exe File created C:\windows\system\ZRTM.exe.bat WEODLCP.exe File created C:\windows\system\MRLS.exe MWHPDWL.exe File opened for modification C:\windows\system\DDGZPE.exe XCYLGK.exe File opened for modification C:\windows\ROD.exe LBLFHSZ.exe File opened for modification C:\windows\system\OVH.exe KFTHKN.exe File created C:\windows\GTSIYPI.exe LIJJKMN.exe File opened for modification C:\windows\system\JLVNQ.exe UQMAXDE.exe File opened for modification C:\windows\JQHR.exe DQADZNZ.exe File created C:\windows\system\AOMK.exe.bat JDOM.exe File opened for modification C:\windows\system\DQADZNZ.exe DCAOXI.exe File opened for modification C:\windows\YUB.exe GRXP.exe File opened for modification C:\windows\system\LIJJKMN.exe LCJVJZ.exe File created C:\windows\WJNZL.exe.bat QJG.exe File opened for modification C:\windows\JLZVTAS.exe FDTN.exe File created C:\windows\system\KZT.exe NTV.exe File created C:\windows\system\RIGT.exe OVBKSXM.exe File created C:\windows\GRXP.exe.bat RWNKOG.exe File opened for modification C:\windows\system\KGYWM.exe BGWR.exe File opened for modification C:\windows\KVGJK.exe QHB.exe File created C:\windows\JDOM.exe DDGZPE.exe File opened for modification C:\windows\LHCVMIW.exe HRV.exe File created C:\windows\LBLFHSZ.exe GVTQRX.exe File created C:\windows\AHNMDF.exe.bat POKUV.exe File created C:\windows\system\XCYLGK.exe.bat FZVHSMJ.exe File created C:\windows\LYY.exe CQWMFF.exe File created C:\windows\system\LIJJKMN.exe LCJVJZ.exe File created C:\windows\RKFGPN.exe.bat LKXS.exe File created C:\windows\JLZVTAS.exe FDTN.exe File created C:\windows\ISONU.exe.bat YUB.exe File opened for modification C:\windows\DNRZZ.exe VSHNGKF.exe File created C:\windows\RBRKC.exe PLYI.exe File created C:\windows\ISONU.exe YUB.exe File created C:\windows\system\LXPXLM.exe.bat GXHK.exe File created C:\windows\CJX.exe GYGND.exe File opened for modification C:\windows\HLT.exe QYIIPLP.exe File created C:\windows\BGWR.exe.bat GTSIYPI.exe File created C:\windows\system\OVDRXJ.exe RPFUQAV.exe File created C:\windows\system\NRTCPO.exe TEOT.exe File created C:\windows\system\JDUV.exe JIQAEIV.exe File created C:\windows\FYYPW.exe.bat FFPVI.exe File created C:\windows\HRV.exe NDQDXY.exe File created C:\windows\HRV.exe.bat NDQDXY.exe File opened for modification C:\windows\BGWR.exe GTSIYPI.exe File opened for modification C:\windows\GYGND.exe OVDRXJ.exe File created C:\windows\system\XOFWNM.exe MWKLN.exe File created C:\windows\LHCVMIW.exe.bat HRV.exe File created C:\windows\system\YDUGH.exe.bat DQQ.exe File opened for modification C:\windows\system\TEOT.exe HLT.exe File created C:\windows\system\XCYLGK.exe FZVHSMJ.exe File opened for modification C:\windows\system\POODSAU.exe JTWUNXF.exe File created C:\windows\system\VSHNGKF.exe EJFHD.exe File opened for modification C:\windows\system\PGZW.exe JLZVTAS.exe File created C:\windows\system\UGGKH.exe.bat PGZW.exe File created C:\windows\PJL.exe PQD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4412 cmd.exe 1900 cmd.exe 3384 cmd.exe 1896 cmd.exe 5784 cmd.exe 2428 cmd.exe 5260 cmd.exe 3488 cmd.exe 1040 cmd.exe 4364 cmd.exe 552 cmd.exe 5424 cmd.exe 1764 cmd.exe 1852 cmd.exe 3248 cmd.exe 3816 cmd.exe 4484 cmd.exe 1320 cmd.exe 2724 cmd.exe 2968 cmd.exe 5824 cmd.exe 1212 cmd.exe 236 cmd.exe 3352 cmd.exe 432 cmd.exe 2012 cmd.exe 2088 cmd.exe 6004 cmd.exe 2796 cmd.exe 4436 cmd.exe 2912 cmd.exe 5532 cmd.exe 4984 cmd.exe 4128 cmd.exe 4588 cmd.exe 5972 cmd.exe 3116 cmd.exe 2348 cmd.exe 4316 cmd.exe 5792 cmd.exe 4144 cmd.exe 5416 cmd.exe 4832 cmd.exe 3400 cmd.exe 868 cmd.exe 4260 cmd.exe 3752 cmd.exe 5912 cmd.exe 5228 cmd.exe 1620 cmd.exe 5012 cmd.exe 1760 cmd.exe 5756 cmd.exe 2496 cmd.exe 4348 cmd.exe 2132 cmd.exe 5508 cmd.exe 3504 cmd.exe 3960 cmd.exe 4880 cmd.exe 4384 cmd.exe 5556 cmd.exe 4208 cmd.exe 4556 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1880 3560 WerFault.exe 88 3828 4768 WerFault.exe 94 5148 3604 WerFault.exe 100 2680 5316 WerFault.exe 105 5788 3480 WerFault.exe 110 2244 2940 WerFault.exe 115 4888 696 WerFault.exe 120 2840 4532 WerFault.exe 125 2088 5548 WerFault.exe 130 2780 2364 WerFault.exe 135 2844 4352 WerFault.exe 140 2524 6124 WerFault.exe 145 3136 2188 WerFault.exe 150 3312 4740 WerFault.exe 155 3460 5148 WerFault.exe 160 4484 240 WerFault.exe 165 5684 2128 WerFault.exe 170 1484 3844 WerFault.exe 175 1164 4152 WerFault.exe 180 3308 4120 WerFault.exe 185 4956 1576 WerFault.exe 190 3268 5660 WerFault.exe 195 5444 3764 WerFault.exe 200 3436 1580 WerFault.exe 205 4712 5440 WerFault.exe 210 3460 1520 WerFault.exe 215 4736 4616 WerFault.exe 220 2244 4652 WerFault.exe 225 4360 3232 WerFault.exe 230 4192 3500 WerFault.exe 235 3308 2772 WerFault.exe 240 5232 912 WerFault.exe 245 1140 3788 WerFault.exe 250 4580 4296 WerFault.exe 255 4180 2600 WerFault.exe 260 2132 1868 WerFault.exe 265 5788 2308 WerFault.exe 270 4856 3608 WerFault.exe 275 712 1284 WerFault.exe 281 1304 1484 WerFault.exe 286 6140 3684 WerFault.exe 291 3140 5264 WerFault.exe 296 5160 1240 WerFault.exe 301 4828 1416 WerFault.exe 306 3436 5560 WerFault.exe 311 5736 5936 WerFault.exe 316 5536 5748 WerFault.exe 321 2064 952 WerFault.exe 326 5096 5892 WerFault.exe 331 264 3144 WerFault.exe 336 6024 1388 WerFault.exe 341 3276 5432 WerFault.exe 346 3832 4264 WerFault.exe 351 5256 4560 WerFault.exe 356 5620 2608 WerFault.exe 361 2592 4960 WerFault.exe 366 296 5964 WerFault.exe 371 1132 2656 WerFault.exe 376 4160 3676 WerFault.exe 381 2244 4928 WerFault.exe 386 1444 1000 WerFault.exe 391 2896 4540 WerFault.exe 396 1808 4636 WerFault.exe 401 1056 5232 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RWSIVSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AHNMDF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WNBCSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGGKH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LRQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YHZNWER.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVGJK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLVNQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEOT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNRLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JQVBS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVBKSXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDQDXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVDRXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RKFGPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYGND.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKXS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WJNZL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TZFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCJVJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BGWR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXRQXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GRXP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDUGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZVHSMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KFTHKN.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3560 2026-10-15_f129a8341f0c5bc7912e99f34add065c_elex_emotet_stop.exe 3560 2026-10-15_f129a8341f0c5bc7912e99f34add065c_elex_emotet_stop.exe 4768 USTYTRY.exe 4768 USTYTRY.exe 3604 SLLUFSV.exe 3604 SLLUFSV.exe 5316 RWNKOG.exe 5316 RWNKOG.exe 3480 GRXP.exe 3480 GRXP.exe 2940 YUB.exe 2940 YUB.exe 696 ISONU.exe 696 ISONU.exe 4532 PFN.exe 4532 PFN.exe 5548 CQWMFF.exe 5548 CQWMFF.exe 2364 LYY.exe 2364 LYY.exe 4352 MTCNWS.exe 4352 MTCNWS.exe 6124 QJIV.exe 6124 QJIV.exe 2188 QMMRNB.exe 2188 QMMRNB.exe 4740 WFU.exe 4740 WFU.exe 5148 EVVEDQ.exe 5148 EVVEDQ.exe 240 JVCS.exe 240 JVCS.exe 2128 KYGNRJ.exe 2128 KYGNRJ.exe 3844 DBKRFZY.exe 3844 DBKRFZY.exe 4152 JBSFO.exe 4152 JBSFO.exe 4120 TZFZ.exe 4120 TZFZ.exe 1576 LCJVJZ.exe 1576 LCJVJZ.exe 5660 LIJJKMN.exe 5660 LIJJKMN.exe 3764 GTSIYPI.exe 3764 GTSIYPI.exe 1580 BGWR.exe 1580 BGWR.exe 5440 KGYWM.exe 5440 KGYWM.exe 1520 ABI.exe 1520 ABI.exe 4616 GXHK.exe 4616 GXHK.exe 4652 LXPXLM.exe 4652 LXPXLM.exe 3232 VFRCOKA.exe 3232 VFRCOKA.exe 3500 PSWM.exe 3500 PSWM.exe 2772 OIHPMPP.exe 2772 OIHPMPP.exe 912 ZBKA.exe 912 ZBKA.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3560 2026-10-15_f129a8341f0c5bc7912e99f34add065c_elex_emotet_stop.exe 3560 2026-10-15_f129a8341f0c5bc7912e99f34add065c_elex_emotet_stop.exe 4768 USTYTRY.exe 4768 USTYTRY.exe 3604 SLLUFSV.exe 3604 SLLUFSV.exe 5316 RWNKOG.exe 5316 RWNKOG.exe 3480 GRXP.exe 3480 GRXP.exe 2940 YUB.exe 2940 YUB.exe 696 ISONU.exe 696 ISONU.exe 4532 PFN.exe 4532 PFN.exe 5548 CQWMFF.exe 5548 CQWMFF.exe 2364 LYY.exe 2364 LYY.exe 4352 MTCNWS.exe 4352 MTCNWS.exe 6124 QJIV.exe 6124 QJIV.exe 2188 QMMRNB.exe 2188 QMMRNB.exe 4740 WFU.exe 4740 WFU.exe 5148 EVVEDQ.exe 5148 EVVEDQ.exe 240 JVCS.exe 240 JVCS.exe 2128 KYGNRJ.exe 2128 KYGNRJ.exe 3844 DBKRFZY.exe 3844 DBKRFZY.exe 4152 JBSFO.exe 4152 JBSFO.exe 4120 TZFZ.exe 4120 TZFZ.exe 1576 LCJVJZ.exe 1576 LCJVJZ.exe 5660 LIJJKMN.exe 5660 LIJJKMN.exe 3764 GTSIYPI.exe 3764 GTSIYPI.exe 1580 BGWR.exe 1580 BGWR.exe 5440 KGYWM.exe 5440 KGYWM.exe 1520 ABI.exe 1520 ABI.exe 4616 GXHK.exe 4616 GXHK.exe 4652 LXPXLM.exe 4652 LXPXLM.exe 3232 VFRCOKA.exe 3232 VFRCOKA.exe 3500 PSWM.exe 3500 PSWM.exe 2772 OIHPMPP.exe 2772 OIHPMPP.exe 912 ZBKA.exe 912 ZBKA.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3560 wrote to memory of 1700 3560 2026-10-15_f129a8341f0c5bc7912e99f34add065c_elex_emotet_stop.exe 90 PID 1700 wrote to memory of 4768 1700 cmd.exe 94 PID 4768 wrote to memory of 5488 4768 USTYTRY.exe 96 PID 5488 wrote to memory of 3604 5488 cmd.exe 100 PID 3604 wrote to memory of 4236 3604 SLLUFSV.exe 101 PID 4236 wrote to memory of 5316 4236 cmd.exe 105 PID 5316 wrote to memory of 3488 5316 RWNKOG.exe 106 PID 3488 wrote to memory of 3480 3488 cmd.exe 110 PID 3480 wrote to memory of 432 3480 GRXP.exe 111 PID 432 wrote to memory of 2940 432 cmd.exe 115 PID 2940 wrote to memory of 868 2940 YUB.exe 116 PID 868 wrote to memory of 696 868 cmd.exe 120 PID 696 wrote to memory of 6132 696 ISONU.exe 121 PID 6132 wrote to memory of 4532 6132 cmd.exe 125 PID 4532 wrote to memory of 1764 4532 PFN.exe 126 PID 1764 wrote to memory of 5548 1764 cmd.exe 130 PID 5548 wrote to memory of 4092 5548 CQWMFF.exe 131 PID 4092 wrote to memory of 2364 4092 cmd.exe 135 PID 2364 wrote to memory of 5728 2364 LYY.exe 136 PID 5728 wrote to memory of 4352 5728 cmd.exe 140 PID 4352 wrote to memory of 1620 4352 MTCNWS.exe 141 PID 1620 wrote to memory of 6124 1620 cmd.exe 145 PID 6124 wrote to memory of 2104 6124 QJIV.exe 146 PID 2104 wrote to memory of 2188 2104 cmd.exe 150 PID 2188 wrote to memory of 2968 2188 QMMRNB.exe 151 PID 2968 wrote to memory of 4740 2968 cmd.exe 155 PID 4740 wrote to memory of 5140 4740 WFU.exe 156 PID 5140 wrote to memory of 5148 5140 cmd.exe 160 PID 5148 wrote to memory of 5708 5148 EVVEDQ.exe 161 PID 5708 wrote to memory of 240 5708 cmd.exe 165 PID 240 wrote to memory of 2612 240 JVCS.exe 166 PID 2612 wrote to memory of 2128 2612 cmd.exe 170 PID 2128 wrote to memory of 2348 2128 KYGNRJ.exe 171 PID 2348 wrote to memory of 3844 2348 cmd.exe 175 PID 3844 wrote to memory of 2340 3844 DBKRFZY.exe 176 PID 2340 wrote to memory of 4152 2340 cmd.exe 180 PID 4152 wrote to memory of 1904 4152 JBSFO.exe 181 PID 1904 wrote to memory of 4120 1904 cmd.exe 185 PID 4120 wrote to memory of 5368 4120 TZFZ.exe 186 PID 5368 wrote to memory of 1576 5368 cmd.exe 190 PID 1576 wrote to memory of 3360 1576 LCJVJZ.exe 191 PID 3360 wrote to memory of 5660 3360 cmd.exe 195 PID 5660 wrote to memory of 3384 5660 LIJJKMN.exe 196 PID 3384 wrote to memory of 3764 3384 cmd.exe 200 PID 3764 wrote to memory of 704 3764 GTSIYPI.exe 201 PID 704 wrote to memory of 1580 704 cmd.exe 205 PID 1580 wrote to memory of 3132 1580 BGWR.exe 206 PID 3132 wrote to memory of 5440 3132 cmd.exe 210 PID 5440 wrote to memory of 248 5440 KGYWM.exe 211 PID 248 wrote to memory of 1520 248 cmd.exe 215 PID 1520 wrote to memory of 2852 1520 ABI.exe 216 PID 2852 wrote to memory of 4616 2852 cmd.exe 220 PID 4616 wrote to memory of 2496 4616 GXHK.exe 221 PID 2496 wrote to memory of 4652 2496 cmd.exe 225 PID 4652 wrote to memory of 3656 4652 LXPXLM.exe 226 PID 3656 wrote to memory of 3232 3656 cmd.exe 230 PID 3232 wrote to memory of 4984 3232 VFRCOKA.exe 231 PID 4984 wrote to memory of 3500 4984 cmd.exe 235 PID 3500 wrote to memory of 4260 3500 PSWM.exe 236 PID 4260 wrote to memory of 2772 4260 cmd.exe 240 PID 2772 wrote to memory of 5012 2772 OIHPMPP.exe 241 PID 5012 wrote to memory of 912 5012 cmd.exe 245 PID 912 wrote to memory of 1768 912 ZBKA.exe 246 PID 1768 wrote to memory of 3788 1768 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-15_f129a8341f0c5bc7912e99f34add065c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-15_f129a8341f0c5bc7912e99f34add065c_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\USTYTRY.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\windows\USTYTRY.exeC:\windows\USTYTRY.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SLLUFSV.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\windows\system\SLLUFSV.exeC:\windows\system\SLLUFSV.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RWNKOG.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\windows\SysWOW64\RWNKOG.exeC:\windows\system32\RWNKOG.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GRXP.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\windows\GRXP.exeC:\windows\GRXP.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUB.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:432 -
C:\windows\YUB.exeC:\windows\YUB.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ISONU.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:868 -
C:\windows\ISONU.exeC:\windows\ISONU.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PFN.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\windows\SysWOW64\PFN.exeC:\windows\system32\PFN.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CQWMFF.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\windows\system\CQWMFF.exeC:\windows\system\CQWMFF.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LYY.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\windows\LYY.exeC:\windows\LYY.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MTCNWS.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\windows\system\MTCNWS.exeC:\windows\system\MTCNWS.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QJIV.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\windows\QJIV.exeC:\windows\QJIV.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QMMRNB.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\windows\QMMRNB.exeC:\windows\QMMRNB.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WFU.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\windows\system\WFU.exeC:\windows\system\WFU.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EVVEDQ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\windows\system\EVVEDQ.exeC:\windows\system\EVVEDQ.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVCS.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\windows\JVCS.exeC:\windows\JVCS.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYGNRJ.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\windows\system\KYGNRJ.exeC:\windows\system\KYGNRJ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBKRFZY.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\windows\SysWOW64\DBKRFZY.exeC:\windows\system32\DBKRFZY.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JBSFO.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\windows\SysWOW64\JBSFO.exeC:\windows\system32\JBSFO.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TZFZ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\windows\SysWOW64\TZFZ.exeC:\windows\system32\TZFZ.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCJVJZ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\windows\LCJVJZ.exeC:\windows\LCJVJZ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIJJKMN.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\windows\system\LIJJKMN.exeC:\windows\system\LIJJKMN.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTSIYPI.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\windows\GTSIYPI.exeC:\windows\GTSIYPI.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BGWR.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:704 -
C:\windows\BGWR.exeC:\windows\BGWR.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KGYWM.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\windows\system\KGYWM.exeC:\windows\system\KGYWM.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABI.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:248 -
C:\windows\SysWOW64\ABI.exeC:\windows\system32\ABI.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXHK.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\windows\system\GXHK.exeC:\windows\system\GXHK.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LXPXLM.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\windows\system\LXPXLM.exeC:\windows\system\LXPXLM.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VFRCOKA.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\windows\system\VFRCOKA.exeC:\windows\system\VFRCOKA.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PSWM.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\windows\SysWOW64\PSWM.exeC:\windows\system32\PSWM.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OIHPMPP.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\windows\SysWOW64\OIHPMPP.exeC:\windows\system32\OIHPMPP.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBKA.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\windows\ZBKA.exeC:\windows\ZBKA.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LRQ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\windows\SysWOW64\LRQ.exeC:\windows\system32\LRQ.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\URSN.exe.bat" "66⤵PID:4868
-
C:\windows\SysWOW64\URSN.exeC:\windows\system32\URSN.exe67⤵
- Executes dropped EXE
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YHZNWER.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:5444 -
C:\windows\system\YHZNWER.exeC:\windows\system\YHZNWER.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QHB.exe.bat" "70⤵PID:5692
-
C:\windows\SysWOW64\QHB.exeC:\windows\system32\QHB.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KVGJK.exe.bat" "72⤵PID:1364
-
C:\windows\KVGJK.exeC:\windows\KVGJK.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WNBCSR.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4316 -
C:\windows\WNBCSR.exeC:\windows\WNBCSR.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QJG.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5824 -
C:\windows\QJG.exeC:\windows\QJG.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WJNZL.exe.bat" "78⤵PID:3432
-
C:\windows\WJNZL.exeC:\windows\WJNZL.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RWSIVSC.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4792 -
C:\windows\SysWOW64\RWSIVSC.exeC:\windows\system32\RWSIVSC.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LKXS.exe.bat" "82⤵PID:4592
-
C:\windows\SysWOW64\LKXS.exeC:\windows\system32\LKXS.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RKFGPN.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3504 -
C:\windows\RKFGPN.exeC:\windows\RKFGPN.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RPFUQAV.exe.bat" "86⤵
- Executes a command shell one-liner
PID:1852 -
C:\windows\RPFUQAV.exeC:\windows\RPFUQAV.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVDRXJ.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3752 -
C:\windows\system\OVDRXJ.exeC:\windows\system\OVDRXJ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYGND.exe.bat" "90⤵PID:3076
-
C:\windows\GYGND.exeC:\windows\GYGND.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CJX.exe.bat" "92⤵PID:2312
-
C:\windows\CJX.exeC:\windows\CJX.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COXA.exe.bat" "94⤵PID:2708
-
C:\windows\SysWOW64\COXA.exeC:\windows\system32\COXA.exe95⤵
- Executes dropped EXE
PID:952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WCUJDP.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:5220 -
C:\windows\WCUJDP.exeC:\windows\WCUJDP.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LXLO.exe.bat" "98⤵PID:4804
-
C:\windows\SysWOW64\LXLO.exeC:\windows\system32\LXLO.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNMNUXI.exe.bat" "100⤵PID:1328
-
C:\windows\SysWOW64\BNMNUXI.exeC:\windows\system32\BNMNUXI.exe101⤵
- Executes dropped EXE
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FDTN.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:3000 -
C:\windows\system\FDTN.exeC:\windows\system\FDTN.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLZVTAS.exe.bat" "104⤵PID:1696
-
C:\windows\JLZVTAS.exeC:\windows\JLZVTAS.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGZW.exe.bat" "106⤵
- Executes a command shell one-liner
PID:1896 -
C:\windows\system\PGZW.exeC:\windows\system\PGZW.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGGKH.exe.bat" "108⤵PID:2552
-
C:\windows\system\UGGKH.exeC:\windows\system\UGGKH.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WEME.exe.bat" "110⤵PID:1824
-
C:\windows\WEME.exeC:\windows\WEME.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OFOJRL.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2144 -
C:\windows\SysWOW64\OFOJRL.exeC:\windows\system32\OFOJRL.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CKUGGUO.exe.bat" "114⤵PID:4272
-
C:\windows\SysWOW64\CKUGGUO.exeC:\windows\system32\CKUGGUO.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YVCXV.exe.bat" "116⤵
- Executes a command shell one-liner
PID:1212 -
C:\windows\SysWOW64\YVCXV.exeC:\windows\system32\YVCXV.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIHOXFY.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3960 -
C:\windows\SIHOXFY.exeC:\windows\SIHOXFY.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQJ.exe.bat" "120⤵PID:4700
-
C:\windows\SysWOW64\CQJ.exeC:\windows\system32\CQJ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-