Analysis
- max time kernel
101s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/10/2026, 12:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-19_95c39894264b349486e816d771b399c8_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-19_95c39894264b349486e816d771b399c8_elex_emotet_stop.exe
- Size 208KB
- Sample261020-phbkmsht7s
- SHA256 e7995a94477e55736e9ee326ae7514a8305af619d7ca98b9407c8e0f0cf79a8d
- MD5 95c39894264b349486e816d771b399c8
- SHA1 0ba6503d75c8abee3169b5ff14c45969ef65a9db
- SHA512 a9e887dd8df6ae4bcee41285f293109ed9d5f16be17c856a6bded1b3b278f89b552777a0da8d27f7e6ac010b3ed3318185dc4130a22cfda5ee3815a87a1aaa9b
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfp4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOxkEj1
- TLSH T143247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2864 ACN.exe 4264 UNKAKM.exe 5708 PBO.exe 5988 YBQOYR.exe 1216 BOV.exe 5056 VKAHK.exe 3940 FKCMWO.exe 4524 LKK.exe 4464 WDNTN.exe 4600 ATTBZQX.exe 4884 GTBO.exe 5080 AGGYTK.exe 3932 VUD.exe 5548 MCFM.exe 4520 VCHRK.exe 700 WFKV.exe 1460 UGSJY.exe 4712 PTXSJF.exe 5944 UTEG.exe 1156 RZKDH.exe 1484 XMJEDM.exe 5972 SHO.exe 2668 MVTXY.exe 1268 HIYGIMR.exe 4592 BVV.exe 2948 WRZHV.exe 4260 LMR.exe 688 WEME.exe 4720 CEUSFIT.exe 4084 CKUGGUO.exe 5644 IKBUQ.exe 6048 DYGDAX.exe 1876 POND.exe 6096 AGQWM.exe 4848 VUNGXWE.exe 3960 XROID.exe 2148 LXUFKVO.exe 3244 WQP.exe 4056 CQWLB.exe 2888 OIZWJ.exe 4668 KGFTRV.exe 2540 FTK.exe 5980 BZIAI.exe 4764 YEOXP.exe 4896 SSSGZH.exe 8 PXY.exe 4844 AQTO.exe 5996 LIW.exe 5496 JJEVGH.exe 5152 MWJEIHL.exe 5220 ACOB.exe 3412 IHHQZ.exe 3556 MXNYLOD.exe 5872 SAR.exe 3532 UNWFA.exe 3000 UGXHG.exe 2532 RLCEVBD.exe 3924 WOGCAS.exe 4912 HHBVAAN.exe 756 EMHSPKP.exe 2480 JNPG.exe 5332 JSPVA.exe 4696 RLQOOVI.exe 2332 OIWLVFC.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\OUW.exe RPZ.exe File created C:\windows\SysWOW64\DBPX.exe.bat MOENXU.exe File opened for modification C:\windows\SysWOW64\WWHHTB.exe HQCS.exe File opened for modification C:\windows\SysWOW64\ZNZR.exe OUW.exe File created C:\windows\SysWOW64\GAMBFAK.exe.bat XNBJ.exe File opened for modification C:\windows\SysWOW64\LSRM.exe RXM.exe File opened for modification C:\windows\SysWOW64\LKK.exe FKCMWO.exe File opened for modification C:\windows\SysWOW64\KYLLZ.exe OSFOKV.exe File opened for modification C:\windows\SysWOW64\ODA.exe AYUA.exe File created C:\windows\SysWOW64\ZXXGJK.exe.bat KSRJC.exe File created C:\windows\SysWOW64\MXNYLOD.exe IHHQZ.exe File created C:\windows\SysWOW64\TTA.exe.bat OIWLVFC.exe File created C:\windows\SysWOW64\LBGMV.exe ODA.exe File created C:\windows\SysWOW64\LSRM.exe.bat RXM.exe File created C:\windows\SysWOW64\VKAHK.exe.bat BOV.exe File created C:\windows\SysWOW64\CUQT.exe WTJFEP.exe File created C:\windows\SysWOW64\LKK.exe FKCMWO.exe File created C:\windows\SysWOW64\SAR.exe MXNYLOD.exe File created C:\windows\SysWOW64\ZNZR.exe OUW.exe File created C:\windows\SysWOW64\ZNZR.exe.bat OUW.exe File created C:\windows\SysWOW64\CUQT.exe.bat WTJFEP.exe File created C:\windows\SysWOW64\MXNYLOD.exe.bat IHHQZ.exe File created C:\windows\SysWOW64\KEVFHDL.exe NZPIATR.exe File opened for modification C:\windows\SysWOW64\LBGMV.exe ODA.exe File created C:\windows\SysWOW64\BVV.exe HIYGIMR.exe File opened for modification C:\windows\SysWOW64\ACOB.exe MWJEIHL.exe File created C:\windows\SysWOW64\OSFOKV.exe.bat ZNZR.exe File opened for modification C:\windows\SysWOW64\WNOZ.exe QSP.exe File created C:\windows\SysWOW64\WWHHTB.exe HQCS.exe File created C:\windows\SysWOW64\GAMBFAK.exe XNBJ.exe File opened for modification C:\windows\SysWOW64\KUTWQ.exe MUL.exe File created C:\windows\SysWOW64\VKAHK.exe BOV.exe File created C:\windows\SysWOW64\WFKV.exe.bat VCHRK.exe File created C:\windows\SysWOW64\DBPX.exe MOENXU.exe File created C:\windows\SysWOW64\BRY.exe.bat QYVXJLY.exe File created C:\windows\SysWOW64\ODA.exe AYUA.exe File created C:\windows\SysWOW64\ACOB.exe.bat MWJEIHL.exe File created C:\windows\SysWOW64\VFXXOX.exe YARA.exe File created C:\windows\SysWOW64\VCHRK.exe.bat MCFM.exe File opened for modification C:\windows\SysWOW64\RZKDH.exe UTEG.exe File created C:\windows\SysWOW64\IYFDD.exe GAMBFAK.exe File opened for modification C:\windows\SysWOW64\SAR.exe MXNYLOD.exe File opened for modification C:\windows\SysWOW64\PTXSJF.exe UGSJY.exe File created C:\windows\SysWOW64\ACOB.exe MWJEIHL.exe File created C:\windows\SysWOW64\LKK.exe.bat FKCMWO.exe File opened for modification C:\windows\SysWOW64\BVV.exe HIYGIMR.exe File opened for modification C:\windows\SysWOW64\JSPVA.exe JNPG.exe File created C:\windows\SysWOW64\NEZ.exe.bat ZZU.exe File created C:\windows\SysWOW64\ATTBZQX.exe.bat WDNTN.exe File opened for modification C:\windows\SysWOW64\WFKV.exe VCHRK.exe File created C:\windows\SysWOW64\RZKDH.exe.bat UTEG.exe File created C:\windows\SysWOW64\PXY.exe SSSGZH.exe File created C:\windows\SysWOW64\MZCYH.exe.bat KJIWBC.exe File opened for modification C:\windows\SysWOW64\OSFOKV.exe ZNZR.exe File opened for modification C:\windows\SysWOW64\YARA.exe YPIY.exe File opened for modification C:\windows\SysWOW64\IYFDD.exe GAMBFAK.exe File created C:\windows\SysWOW64\BVV.exe.bat HIYGIMR.exe File created C:\windows\SysWOW64\CQWLB.exe.bat WQP.exe File created C:\windows\SysWOW64\RLQOOVI.exe.bat JSPVA.exe File created C:\windows\SysWOW64\WARWBW.exe BNNM.exe File opened for modification C:\windows\SysWOW64\XNBJ.exe VPIPJ.exe File created C:\windows\SysWOW64\KGFTRV.exe OIZWJ.exe File created C:\windows\SysWOW64\VFXXOX.exe.bat YARA.exe File opened for modification C:\windows\SysWOW64\KEVFHDL.exe NZPIATR.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\WQP.exe LXUFKVO.exe File created C:\windows\system\LQNNOS.exe.bat VFXXOX.exe File created C:\windows\system\VPIPJ.exe NEZ.exe File created C:\windows\system\NML.exe.bat CUQT.exe File created C:\windows\system\LIW.exe.bat AQTO.exe File opened for modification C:\windows\FKCMWO.exe VKAHK.exe File created C:\windows\system\WTJFEP.exe.bat LBGMV.exe File opened for modification C:\windows\system\WDNTN.exe LKK.exe File created C:\windows\MOENXU.exe KYLLZ.exe File created C:\windows\YPIY.exe MZCYH.exe File opened for modification C:\windows\system\WTJFEP.exe LBGMV.exe File opened for modification C:\windows\ZPTKLH.exe OWQZ.exe File created C:\windows\XZFOUY.exe GOOQUD.exe File created C:\windows\system\OSPUL.exe CAM.exe File created C:\windows\system\QYVXJLY.exe.bat FFAMB.exe File created C:\windows\POND.exe.bat DYGDAX.exe File opened for modification C:\windows\LTMODM.exe WNOZ.exe File created C:\windows\system\HQCS.exe.bat KTWU.exe File created C:\windows\FKCMWO.exe VKAHK.exe File created C:\windows\ACN.exe.bat 2026-10-19_95c39894264b349486e816d771b399c8_elex_emotet_stop.exe File created C:\windows\system\WOGCAS.exe RLCEVBD.exe File created C:\windows\system\NZPIATR.exe IWTKVC.exe File created C:\windows\system\QSP.exe ZNEYC.exe File created C:\windows\BOV.exe.bat YBQOYR.exe File created C:\windows\GTBO.exe.bat ATTBZQX.exe File opened for modification C:\windows\system\NZPIATR.exe IWTKVC.exe File created C:\windows\JNPG.exe EMHSPKP.exe File opened for modification C:\windows\system\QYVXJLY.exe FFAMB.exe File created C:\windows\system\EYFUANG.exe.bat ZXXGJK.exe File opened for modification C:\windows\system\LMR.exe WRZHV.exe File created C:\windows\system\UNKAKM.exe ACN.exe File opened for modification C:\windows\system\UNKAKM.exe ACN.exe File created C:\windows\CEUSFIT.exe.bat WEME.exe File opened for modification C:\windows\system\BZIAI.exe FTK.exe File opened for modification C:\windows\CAM.exe XZFOUY.exe File opened for modification C:\windows\NJBI.exe BRY.exe File opened for modification C:\windows\system\HQCS.exe KTWU.exe File opened for modification C:\windows\system\UGSJY.exe WFKV.exe File created C:\windows\DYGDAX.exe IKBUQ.exe File opened for modification C:\windows\system\SSSGZH.exe YEOXP.exe File created C:\windows\AYIWEH.exe.bat WQTOAOO.exe File created C:\windows\BNNM.exe ZPTKLH.exe File created C:\windows\YPIY.exe.bat MZCYH.exe File opened for modification C:\windows\system\OUBN.exe KEVFHDL.exe File created C:\windows\system\MUL.exe.bat QOO.exe File opened for modification C:\windows\IKBUQ.exe CKUGGUO.exe File opened for modification C:\windows\system\OWQZ.exe OEIYXOG.exe File opened for modification C:\windows\system\GOOQUD.exe PBEYF.exe File created C:\windows\system\SSC.exe.bat HZZTXUP.exe File created C:\windows\system\UGSJY.exe.bat WFKV.exe File created C:\windows\system\AGQWM.exe.bat POND.exe File opened for modification C:\windows\system\SGUU.exe DBPX.exe File created C:\windows\XZFOUY.exe.bat GOOQUD.exe File created C:\windows\CAM.exe.bat XZFOUY.exe File created C:\windows\NJBI.exe BRY.exe File opened for modification C:\windows\ACN.exe 2026-10-19_95c39894264b349486e816d771b399c8_elex_emotet_stop.exe File opened for modification C:\windows\UGXHG.exe UNWFA.exe File opened for modification C:\windows\system\EMHSPKP.exe HHBVAAN.exe File created C:\windows\WMPHDTJ.exe LTMODM.exe File created C:\windows\system\XMJEDM.exe RZKDH.exe File created C:\windows\UGXHG.exe.bat UNWFA.exe File created C:\windows\system\AWYB.exe.bat BLI.exe File created C:\windows\HZZTXUP.exe KUTWQ.exe File created C:\windows\system\PBO.exe.bat UNKAKM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2288 cmd.exe 2752 cmd.exe 2064 cmd.exe 4916 cmd.exe 1004 cmd.exe 5952 cmd.exe 5836 cmd.exe 1188 cmd.exe 5896 cmd.exe 4688 cmd.exe 572 cmd.exe 5880 cmd.exe 5852 cmd.exe 2548 cmd.exe 5064 cmd.exe 3088 cmd.exe 3936 cmd.exe 4800 cmd.exe 1588 cmd.exe 1204 cmd.exe 4904 cmd.exe 3272 cmd.exe 2956 cmd.exe 2712 cmd.exe 3256 cmd.exe 5516 cmd.exe 3844 cmd.exe 1492 cmd.exe 2840 cmd.exe 4140 cmd.exe 5640 cmd.exe 4544 cmd.exe 2516 cmd.exe 3308 cmd.exe 3004 cmd.exe 1936 cmd.exe 2824 cmd.exe 4628 cmd.exe 2404 cmd.exe 852 cmd.exe 1304 cmd.exe 5432 cmd.exe 5240 cmd.exe 1196 cmd.exe 4484 cmd.exe 3848 cmd.exe 2640 cmd.exe 5444 cmd.exe 4488 cmd.exe 2772 cmd.exe 4176 cmd.exe 552 cmd.exe 1832 cmd.exe 1248 cmd.exe 4228 cmd.exe 3040 cmd.exe 2492 cmd.exe 592 cmd.exe 3468 cmd.exe 2328 cmd.exe 4092 cmd.exe 1016 cmd.exe 1924 cmd.exe 5636 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 552 4812 WerFault.exe 88 4216 2864 WerFault.exe 94 1756 4264 WerFault.exe 100 5856 5708 WerFault.exe 105 4760 5988 WerFault.exe 110 1380 1216 WerFault.exe 115 4056 5056 WerFault.exe 120 2356 3940 WerFault.exe 125 5784 4524 WerFault.exe 130 3636 4464 WerFault.exe 135 5384 4600 WerFault.exe 140 2916 4884 WerFault.exe 145 5872 5080 WerFault.exe 150 908 3932 WerFault.exe 155 4316 5548 WerFault.exe 160 4892 4520 WerFault.exe 165 4312 700 WerFault.exe 170 4536 1460 WerFault.exe 175 4912 4712 WerFault.exe 180 5952 5944 WerFault.exe 185 6048 1156 WerFault.exe 190 4924 1484 WerFault.exe 195 2072 5972 WerFault.exe 200 2328 2668 WerFault.exe 205 264 1268 WerFault.exe 210 4636 4592 WerFault.exe 215 4676 2948 WerFault.exe 220 2512 4260 WerFault.exe 225 5496 688 WerFault.exe 230 4912 4720 WerFault.exe 235 1600 4084 WerFault.exe 240 1096 5644 WerFault.exe 245 4924 6048 WerFault.exe 250 1816 1876 WerFault.exe 255 2632 6096 WerFault.exe 260 5924 4848 WerFault.exe 265 4644 3960 WerFault.exe 270 2444 2148 WerFault.exe 275 5576 3244 WerFault.exe 280 2752 4056 WerFault.exe 285 4204 2888 WerFault.exe 291 2892 4668 WerFault.exe 296 900 2540 WerFault.exe 301 5036 5980 WerFault.exe 306 5792 4764 WerFault.exe 311 3820 4896 WerFault.exe 316 5052 8 WerFault.exe 321 1252 4844 WerFault.exe 326 1820 5996 WerFault.exe 331 2068 5496 WerFault.exe 336 3328 5152 WerFault.exe 341 2480 5220 WerFault.exe 346 1568 3412 WerFault.exe 351 3572 3556 WerFault.exe 356 2988 5872 WerFault.exe 361 5280 3532 WerFault.exe 366 912 3000 WerFault.exe 371 628 2532 WerFault.exe 376 5112 3924 WerFault.exe 381 5408 4912 WerFault.exe 386 3808 756 WerFault.exe 391 2704 2480 WerFault.exe 396 4328 5332 WerFault.exe 401 2944 4696 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYVXJLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTXSJF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWJEIHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MZCYH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVTXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOGCAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRZHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YEOXP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RLQOOVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YARA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIWLVFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUNGXWE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WARWBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYIWEH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUBN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGSJY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFXXOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LTMODM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZZTXUP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LQNNOS.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4812 2026-10-19_95c39894264b349486e816d771b399c8_elex_emotet_stop.exe 4812 2026-10-19_95c39894264b349486e816d771b399c8_elex_emotet_stop.exe 2864 ACN.exe 2864 ACN.exe 4264 UNKAKM.exe 4264 UNKAKM.exe 5708 PBO.exe 5708 PBO.exe 5988 YBQOYR.exe 5988 YBQOYR.exe 1216 BOV.exe 1216 BOV.exe 5056 VKAHK.exe 5056 VKAHK.exe 3940 FKCMWO.exe 3940 FKCMWO.exe 4524 LKK.exe 4524 LKK.exe 4464 WDNTN.exe 4464 WDNTN.exe 4600 ATTBZQX.exe 4600 ATTBZQX.exe 4884 GTBO.exe 4884 GTBO.exe 5080 AGGYTK.exe 5080 AGGYTK.exe 3932 VUD.exe 3932 VUD.exe 5548 MCFM.exe 5548 MCFM.exe 4520 VCHRK.exe 4520 VCHRK.exe 700 WFKV.exe 700 WFKV.exe 1460 UGSJY.exe 1460 UGSJY.exe 4712 PTXSJF.exe 4712 PTXSJF.exe 5944 UTEG.exe 5944 UTEG.exe 1156 RZKDH.exe 1156 RZKDH.exe 1484 XMJEDM.exe 1484 XMJEDM.exe 5972 SHO.exe 5972 SHO.exe 2668 MVTXY.exe 2668 MVTXY.exe 1268 HIYGIMR.exe 1268 HIYGIMR.exe 4592 BVV.exe 4592 BVV.exe 2948 WRZHV.exe 2948 WRZHV.exe 4260 LMR.exe 4260 LMR.exe 688 WEME.exe 688 WEME.exe 4720 CEUSFIT.exe 4720 CEUSFIT.exe 4084 CKUGGUO.exe 4084 CKUGGUO.exe 5644 IKBUQ.exe 5644 IKBUQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4812 2026-10-19_95c39894264b349486e816d771b399c8_elex_emotet_stop.exe 4812 2026-10-19_95c39894264b349486e816d771b399c8_elex_emotet_stop.exe 2864 ACN.exe 2864 ACN.exe 4264 UNKAKM.exe 4264 UNKAKM.exe 5708 PBO.exe 5708 PBO.exe 5988 YBQOYR.exe 5988 YBQOYR.exe 1216 BOV.exe 1216 BOV.exe 5056 VKAHK.exe 5056 VKAHK.exe 3940 FKCMWO.exe 3940 FKCMWO.exe 4524 LKK.exe 4524 LKK.exe 4464 WDNTN.exe 4464 WDNTN.exe 4600 ATTBZQX.exe 4600 ATTBZQX.exe 4884 GTBO.exe 4884 GTBO.exe 5080 AGGYTK.exe 5080 AGGYTK.exe 3932 VUD.exe 3932 VUD.exe 5548 MCFM.exe 5548 MCFM.exe 4520 VCHRK.exe 4520 VCHRK.exe 700 WFKV.exe 700 WFKV.exe 1460 UGSJY.exe 1460 UGSJY.exe 4712 PTXSJF.exe 4712 PTXSJF.exe 5944 UTEG.exe 5944 UTEG.exe 1156 RZKDH.exe 1156 RZKDH.exe 1484 XMJEDM.exe 1484 XMJEDM.exe 5972 SHO.exe 5972 SHO.exe 2668 MVTXY.exe 2668 MVTXY.exe 1268 HIYGIMR.exe 1268 HIYGIMR.exe 4592 BVV.exe 4592 BVV.exe 2948 WRZHV.exe 2948 WRZHV.exe 4260 LMR.exe 4260 LMR.exe 688 WEME.exe 688 WEME.exe 4720 CEUSFIT.exe 4720 CEUSFIT.exe 4084 CKUGGUO.exe 4084 CKUGGUO.exe 5644 IKBUQ.exe 5644 IKBUQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4812 wrote to memory of 2772 4812 2026-10-19_95c39894264b349486e816d771b399c8_elex_emotet_stop.exe 90 PID 2772 wrote to memory of 2864 2772 cmd.exe 94 PID 2864 wrote to memory of 2708 2864 ACN.exe 96 PID 2708 wrote to memory of 4264 2708 cmd.exe 100 PID 4264 wrote to memory of 5484 4264 UNKAKM.exe 101 PID 5484 wrote to memory of 5708 5484 cmd.exe 105 PID 5708 wrote to memory of 4492 5708 PBO.exe 106 PID 4492 wrote to memory of 5988 4492 cmd.exe 110 PID 5988 wrote to memory of 5684 5988 YBQOYR.exe 111 PID 5684 wrote to memory of 1216 5684 cmd.exe 115 PID 1216 wrote to memory of 3848 1216 BOV.exe 116 PID 3848 wrote to memory of 5056 3848 cmd.exe 120 PID 5056 wrote to memory of 5044 5056 VKAHK.exe 121 PID 5044 wrote to memory of 3940 5044 cmd.exe 125 PID 3940 wrote to memory of 5656 3940 FKCMWO.exe 126 PID 5656 wrote to memory of 4524 5656 cmd.exe 130 PID 4524 wrote to memory of 2516 4524 LKK.exe 131 PID 2516 wrote to memory of 4464 2516 cmd.exe 135 PID 4464 wrote to memory of 1716 4464 WDNTN.exe 136 PID 1716 wrote to memory of 4600 1716 cmd.exe 140 PID 4600 wrote to memory of 4144 4600 ATTBZQX.exe 141 PID 4144 wrote to memory of 4884 4144 cmd.exe 145 PID 4884 wrote to memory of 5736 4884 GTBO.exe 146 PID 5736 wrote to memory of 5080 5736 cmd.exe 150 PID 5080 wrote to memory of 3040 5080 AGGYTK.exe 151 PID 3040 wrote to memory of 3932 3040 cmd.exe 155 PID 3932 wrote to memory of 3160 3932 VUD.exe 156 PID 3160 wrote to memory of 5548 3160 cmd.exe 160 PID 5548 wrote to memory of 6060 5548 MCFM.exe 161 PID 6060 wrote to memory of 4520 6060 cmd.exe 165 PID 4520 wrote to memory of 5832 4520 VCHRK.exe 166 PID 5832 wrote to memory of 700 5832 cmd.exe 170 PID 700 wrote to memory of 2144 700 WFKV.exe 171 PID 2144 wrote to memory of 1460 2144 cmd.exe 175 PID 1460 wrote to memory of 2492 1460 UGSJY.exe 176 PID 2492 wrote to memory of 4712 2492 cmd.exe 180 PID 4712 wrote to memory of 2356 4712 PTXSJF.exe 181 PID 2356 wrote to memory of 5944 2356 cmd.exe 185 PID 5944 wrote to memory of 2212 5944 UTEG.exe 186 PID 2212 wrote to memory of 1156 2212 cmd.exe 190 PID 1156 wrote to memory of 3636 1156 RZKDH.exe 191 PID 3636 wrote to memory of 1484 3636 cmd.exe 195 PID 1484 wrote to memory of 5384 1484 XMJEDM.exe 196 PID 5384 wrote to memory of 5972 5384 cmd.exe 200 PID 5972 wrote to memory of 3720 5972 SHO.exe 201 PID 3720 wrote to memory of 2668 3720 cmd.exe 205 PID 2668 wrote to memory of 1204 2668 MVTXY.exe 206 PID 1204 wrote to memory of 1268 1204 cmd.exe 210 PID 1268 wrote to memory of 6020 1268 HIYGIMR.exe 211 PID 6020 wrote to memory of 4592 6020 cmd.exe 215 PID 4592 wrote to memory of 3800 4592 BVV.exe 216 PID 3800 wrote to memory of 2948 3800 cmd.exe 220 PID 2948 wrote to memory of 2584 2948 WRZHV.exe 221 PID 2584 wrote to memory of 4260 2584 cmd.exe 225 PID 4260 wrote to memory of 2404 4260 LMR.exe 226 PID 2404 wrote to memory of 688 2404 cmd.exe 230 PID 688 wrote to memory of 852 688 WEME.exe 231 PID 852 wrote to memory of 4720 852 cmd.exe 235 PID 4720 wrote to memory of 2548 4720 CEUSFIT.exe 236 PID 2548 wrote to memory of 4084 2548 cmd.exe 240 PID 4084 wrote to memory of 4404 4084 CKUGGUO.exe 241 PID 4404 wrote to memory of 5644 4404 cmd.exe 245 PID 5644 wrote to memory of 5636 5644 IKBUQ.exe 246 PID 5636 wrote to memory of 6048 5636 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_95c39894264b349486e816d771b399c8_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_95c39894264b349486e816d771b399c8_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ACN.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\windows\ACN.exeC:\windows\ACN.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNKAKM.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\windows\system\UNKAKM.exeC:\windows\system\UNKAKM.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PBO.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\windows\system\PBO.exeC:\windows\system\PBO.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YBQOYR.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\windows\YBQOYR.exeC:\windows\YBQOYR.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOV.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\windows\BOV.exeC:\windows\BOV.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VKAHK.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\windows\SysWOW64\VKAHK.exeC:\windows\system32\VKAHK.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FKCMWO.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\windows\FKCMWO.exeC:\windows\FKCMWO.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LKK.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\SysWOW64\LKK.exeC:\windows\system32\LKK.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WDNTN.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\windows\system\WDNTN.exeC:\windows\system\WDNTN.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ATTBZQX.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\windows\SysWOW64\ATTBZQX.exeC:\windows\system32\ATTBZQX.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTBO.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\windows\GTBO.exeC:\windows\GTBO.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGGYTK.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\windows\AGGYTK.exeC:\windows\AGGYTK.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUD.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\windows\VUD.exeC:\windows\VUD.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MCFM.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\windows\system\MCFM.exeC:\windows\system\MCFM.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VCHRK.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\windows\SysWOW64\VCHRK.exeC:\windows\system32\VCHRK.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WFKV.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\windows\SysWOW64\WFKV.exeC:\windows\system32\WFKV.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGSJY.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\windows\system\UGSJY.exeC:\windows\system\UGSJY.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PTXSJF.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\windows\SysWOW64\PTXSJF.exeC:\windows\system32\PTXSJF.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTEG.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\windows\system\UTEG.exeC:\windows\system\UTEG.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RZKDH.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\windows\SysWOW64\RZKDH.exeC:\windows\system32\RZKDH.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XMJEDM.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\windows\system\XMJEDM.exeC:\windows\system\XMJEDM.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SHO.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\windows\SysWOW64\SHO.exeC:\windows\system32\SHO.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MVTXY.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\windows\MVTXY.exeC:\windows\MVTXY.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HIYGIMR.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\windows\system\HIYGIMR.exeC:\windows\system\HIYGIMR.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BVV.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\windows\SysWOW64\BVV.exeC:\windows\system32\BVV.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRZHV.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\windows\system\WRZHV.exeC:\windows\system\WRZHV.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMR.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\windows\system\LMR.exeC:\windows\system\LMR.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WEME.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\windows\WEME.exeC:\windows\WEME.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEUSFIT.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:852 -
C:\windows\CEUSFIT.exeC:\windows\CEUSFIT.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CKUGGUO.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\windows\SysWOW64\CKUGGUO.exeC:\windows\system32\CKUGGUO.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IKBUQ.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\windows\IKBUQ.exeC:\windows\IKBUQ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYGDAX.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\windows\DYGDAX.exeC:\windows\DYGDAX.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\POND.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5064 -
C:\windows\POND.exeC:\windows\POND.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AGQWM.exe.bat" "68⤵PID:5124
-
C:\windows\system\AGQWM.exeC:\windows\system\AGQWM.exe69⤵
- Executes dropped EXE
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VUNGXWE.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:5908 -
C:\windows\system\VUNGXWE.exeC:\windows\system\VUNGXWE.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XROID.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:5776 -
C:\windows\system\XROID.exeC:\windows\system\XROID.exe73⤵
- Executes dropped EXE
PID:3960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LXUFKVO.exe.bat" "74⤵PID:4752
-
C:\windows\system\LXUFKVO.exeC:\windows\system\LXUFKVO.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQP.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:4892 -
C:\windows\system\WQP.exeC:\windows\system\WQP.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQWLB.exe.bat" "78⤵PID:2012
-
C:\windows\SysWOW64\CQWLB.exeC:\windows\system32\CQWLB.exe79⤵
- Executes dropped EXE
PID:4056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OIZWJ.exe.bat" "80⤵
- Executes a command shell one-liner
PID:3308 -
C:\windows\OIZWJ.exeC:\windows\OIZWJ.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGFTRV.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:1872 -
C:\windows\SysWOW64\KGFTRV.exeC:\windows\system32\KGFTRV.exe83⤵
- Executes dropped EXE
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTK.exe.bat" "84⤵PID:1368
-
C:\windows\FTK.exeC:\windows\FTK.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BZIAI.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:3340 -
C:\windows\system\BZIAI.exeC:\windows\system\BZIAI.exe87⤵
- Executes dropped EXE
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YEOXP.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4176 -
C:\windows\YEOXP.exeC:\windows\YEOXP.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SSSGZH.exe.bat" "90⤵PID:1312
-
C:\windows\system\SSSGZH.exeC:\windows\system\SSSGZH.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PXY.exe.bat" "92⤵
- Executes a command shell one-liner
PID:1188 -
C:\windows\SysWOW64\PXY.exeC:\windows\system32\PXY.exe93⤵
- Executes dropped EXE
PID:8 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQTO.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:5492 -
C:\windows\system\AQTO.exeC:\windows\system\AQTO.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIW.exe.bat" "96⤵PID:5680
-
C:\windows\system\LIW.exeC:\windows\system\LIW.exe97⤵
- Executes dropped EXE
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JJEVGH.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3256 -
C:\windows\JJEVGH.exeC:\windows\JJEVGH.exe99⤵
- Executes dropped EXE
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MWJEIHL.exe.bat" "100⤵PID:3564
-
C:\windows\MWJEIHL.exeC:\windows\MWJEIHL.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACOB.exe.bat" "102⤵PID:4324
-
C:\windows\SysWOW64\ACOB.exeC:\windows\system32\ACOB.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IHHQZ.exe.bat" "104⤵PID:2940
-
C:\windows\system\IHHQZ.exeC:\windows\system\IHHQZ.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MXNYLOD.exe.bat" "106⤵
- Executes a command shell one-liner
PID:2288 -
C:\windows\SysWOW64\MXNYLOD.exeC:\windows\system32\MXNYLOD.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SAR.exe.bat" "108⤵PID:2348
-
C:\windows\SysWOW64\SAR.exeC:\windows\system32\SAR.exe109⤵
- Executes dropped EXE
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNWFA.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4488 -
C:\windows\system\UNWFA.exeC:\windows\system\UNWFA.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UGXHG.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2828 -
C:\windows\UGXHG.exeC:\windows\UGXHG.exe113⤵
- Executes dropped EXE
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLCEVBD.exe.bat" "114⤵
- Executes a command shell one-liner
PID:592 -
C:\windows\system\RLCEVBD.exeC:\windows\system\RLCEVBD.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WOGCAS.exe.bat" "116⤵
- Executes a command shell one-liner
PID:5896 -
C:\windows\system\WOGCAS.exeC:\windows\system\WOGCAS.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HHBVAAN.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:1652 -
C:\windows\system\HHBVAAN.exeC:\windows\system\HHBVAAN.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMHSPKP.exe.bat" "120⤵PID:3220
-
C:\windows\system\EMHSPKP.exeC:\windows\system\EMHSPKP.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-