Analysis
- max time kernel
108s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/10/2026, 22:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-21_6c0d058208e558b3cd050acca087c6e5_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-21_6c0d058208e558b3cd050acca087c6e5_elex_emotet_stop.exe
- Size 208KB
- Sample261022-2mda9avtdw
- SHA256 b71c8b37347ae2c807b14433351d232b317e33ebbcc27387454355b602e29b7b
- MD5 6c0d058208e558b3cd050acca087c6e5
- SHA1 ae3bb708fa6274b4c0bf9347adc34ff43f97d38a
- SHA512 a0a04a3fcbb57cdc375fc33e307f7ad5317c3a03fef29f98771f3ac650588a16c512f5a90f4dca42410a314face3b728bef2afa60697fc8fd3f9c42d7cb42073
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlydL+LOf84pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFly5+LOEkEj1
- TLSH T124247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5100 SKPHE.exe 5564 GIBTPEM.exe 3292 BTJKD.exe 4204 KTLPHN.exe 2268 AJMON.exe 3436 ZCVQT.exe 5696 WHBFIOP.exe 3840 YXUHGLX.exe 3104 UDAEVVZ.exe 5224 ADHS.exe 4736 MWKLN.exe 4856 XOFWNM.exe 876 GBQODIT.exe 3460 RUT.exe 3200 ZALV.exe 3124 UNQEXC.exe 2536 DAAW.exe 992 ZGG.exe 1948 LYJMU.exe 5852 LBNIHGY.exe 4364 JUVW.exe 5756 PPUEVDP.exe 2584 GCEWLIL.exe 4796 SVZH.exe 1120 SAZW.exe 2860 JOKODZJ.exe 3808 SOM.exe 5684 YOTOXY.exe 4300 JHWZFGC.exe 5328 VZRSGN.exe 5288 PVW.exe 2732 MSCZX.exe 5988 STKMGRJ.exe 1144 BBM.exe 1952 MTHK.exe 6048 MEPM.exe 4700 XXSEOX.exe 4988 PFUJRVZ.exe 5548 LKSH.exe 5304 JLAUPH.exe 4624 GIGRWJ.exe 3016 XRIW.exe 2896 SEMGKO.exe 2112 VUT.exe 5740 QHYPZ.exe 3272 AFEKOGH.exe 2576 PDJH.exe 3388 LIPECA.exe 4900 GVU.exe 2680 ROPGVHH.exe 4596 GEQXT.exe 3900 MEYLKFF.exe 4224 SFFZT.exe 4412 BNHEXE.exe 2024 NFKXFMY.exe 1476 JLQUMWS.exe 4688 JWRV.exe 4668 EJVFKA.exe 2764 PBYXL.exe 5248 GKA.exe 1760 SCVVW.exe 3660 BQGNM.exe 4316 MIJGUYF.exe 5104 OYKABVN.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\JHWZFGC.exe.bat YOTOXY.exe File created C:\windows\SysWOW64\VZRSGN.exe JHWZFGC.exe File created C:\windows\SysWOW64\MEPM.exe.bat MTHK.exe File opened for modification C:\windows\SysWOW64\EJVFKA.exe JWRV.exe File created C:\windows\SysWOW64\WAJMK.exe.bat HUDX.exe File created C:\windows\SysWOW64\IUQH.exe.bat CUQT.exe File created C:\windows\SysWOW64\UDAEVVZ.exe YXUHGLX.exe File opened for modification C:\windows\SysWOW64\JHWZFGC.exe YOTOXY.exe File created C:\windows\SysWOW64\BQGNM.exe SCVVW.exe File created C:\windows\SysWOW64\PPUEVDP.exe JUVW.exe File created C:\windows\SysWOW64\JSQQ.exe.bat UMK.exe File created C:\windows\SysWOW64\CUQT.exe.bat GWLWGIS.exe File created C:\windows\SysWOW64\DHB.exe MWK.exe File created C:\windows\SysWOW64\RUT.exe GBQODIT.exe File created C:\windows\SysWOW64\SCVVW.exe.bat GKA.exe File created C:\windows\SysWOW64\MIJGUYF.exe BQGNM.exe File created C:\windows\SysWOW64\OYKABVN.exe MIJGUYF.exe File opened for modification C:\windows\SysWOW64\BLC.exe FFWSMI.exe File opened for modification C:\windows\SysWOW64\TZKLNS.exe IHPSF.exe File opened for modification C:\windows\SysWOW64\YXUHGLX.exe WHBFIOP.exe File created C:\windows\SysWOW64\JUVW.exe LBNIHGY.exe File created C:\windows\SysWOW64\SEMGKO.exe XRIW.exe File opened for modification C:\windows\SysWOW64\BNHEXE.exe SFFZT.exe File created C:\windows\SysWOW64\NQYO.exe HPRABIA.exe File opened for modification C:\windows\SysWOW64\RUT.exe GBQODIT.exe File opened for modification C:\windows\SysWOW64\MIJGUYF.exe BQGNM.exe File created C:\windows\SysWOW64\DVYESO.exe XVQQ.exe File created C:\windows\SysWOW64\MTHK.exe.bat BBM.exe File created C:\windows\SysWOW64\MEPM.exe MTHK.exe File opened for modification C:\windows\SysWOW64\SCVVW.exe GKA.exe File created C:\windows\SysWOW64\WWHHTB.exe HQCS.exe File created C:\windows\SysWOW64\NIW.exe KNSNJSF.exe File created C:\windows\SysWOW64\JUVW.exe.bat LBNIHGY.exe File created C:\windows\SysWOW64\HUDX.exe.bat SZTKSX.exe File created C:\windows\SysWOW64\QBENKBZ.exe NOZEA.exe File created C:\windows\SysWOW64\DHB.exe.bat MWK.exe File created C:\windows\SysWOW64\TBFUAZ.exe IJCBA.exe File created C:\windows\SysWOW64\UDYGDF.exe.bat SFXMXJE.exe File created C:\windows\SysWOW64\BNHEXE.exe SFFZT.exe File created C:\windows\SysWOW64\EJVFKA.exe.bat JWRV.exe File opened for modification C:\windows\SysWOW64\GKA.exe PBYXL.exe File created C:\windows\SysWOW64\SCVVW.exe GKA.exe File created C:\windows\SysWOW64\TBFUAZ.exe.bat IJCBA.exe File opened for modification C:\windows\SysWOW64\MTHK.exe BBM.exe File created C:\windows\SysWOW64\SEMGKO.exe.bat XRIW.exe File opened for modification C:\windows\SysWOW64\PDJH.exe AFEKOGH.exe File created C:\windows\SysWOW64\GKA.exe.bat PBYXL.exe File created C:\windows\SysWOW64\QHW.exe.bat GTM.exe File opened for modification C:\windows\SysWOW64\IGF.exe XOCTMA.exe File created C:\windows\SysWOW64\ZALV.exe RUT.exe File created C:\windows\SysWOW64\FXVN.exe.bat JSQQ.exe File opened for modification C:\windows\SysWOW64\SWRZ.exe FLV.exe File opened for modification C:\windows\SysWOW64\CUQT.exe GWLWGIS.exe File opened for modification C:\windows\SysWOW64\DHB.exe MWK.exe File opened for modification C:\windows\SysWOW64\MEPM.exe MTHK.exe File opened for modification C:\windows\SysWOW64\WAJMK.exe HUDX.exe File created C:\windows\SysWOW64\XOCTMA.exe DTXKK.exe File opened for modification C:\windows\SysWOW64\NQYO.exe HPRABIA.exe File created C:\windows\SysWOW64\SYFASLM.exe HGCHK.exe File opened for modification C:\windows\SysWOW64\TBFUAZ.exe IJCBA.exe File created C:\windows\SysWOW64\YOTOXY.exe SOM.exe File created C:\windows\SysWOW64\VZRSGN.exe.bat JHWZFGC.exe File opened for modification C:\windows\SysWOW64\GTM.exe MGHLGO.exe File created C:\windows\SysWOW64\AJMON.exe KTLPHN.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\ZGG.exe.bat DAAW.exe File created C:\windows\JOKODZJ.exe.bat SAZW.exe File created C:\windows\system\GIGRWJ.exe JLAUPH.exe File created C:\windows\SVZH.exe GCEWLIL.exe File opened for modification C:\windows\SAZW.exe SVZH.exe File created C:\windows\PFUJRVZ.exe.bat XXSEOX.exe File opened for modification C:\windows\NFKXFMY.exe BNHEXE.exe File created C:\windows\system\GIKPEV.exe YYCOQR.exe File opened for modification C:\windows\SCNEALU.exe WWHHTB.exe File opened for modification C:\windows\CDGAFF.exe NIW.exe File opened for modification C:\windows\HGSXD.exe FIZVXP.exe File created C:\windows\system\GCEWLIL.exe.bat PPUEVDP.exe File created C:\windows\system\GIKPEV.exe.bat YYCOQR.exe File opened for modification C:\windows\system\ZKRKYQZ.exe NSWRQB.exe File created C:\windows\IHPSF.exe YZNN.exe File created C:\windows\ZISH.exe.bat OQP.exe File opened for modification C:\windows\KNSNJSF.exe KHRYIF.exe File created C:\windows\system\BQSTCKP.exe PXPIUC.exe File created C:\windows\system\CGW.exe.bat RNTT.exe File created C:\windows\MWK.exe.bat SJFQNQ.exe File created C:\windows\UALEOMU.exe YUFHH.exe File created C:\windows\BBM.exe.bat STKMGRJ.exe File created C:\windows\system\GVU.exe LIPECA.exe File created C:\windows\YUFHH.exe.bat DHB.exe File opened for modification C:\windows\system\UNQEXC.exe ZALV.exe File created C:\windows\system\XXSEOX.exe.bat MEPM.exe File created C:\windows\UMK.exe SWRZ.exe File created C:\windows\SCNEALU.exe WWHHTB.exe File created C:\windows\system\JWRV.exe.bat JLQUMWS.exe File created C:\windows\system\PBYXL.exe.bat EJVFKA.exe File opened for modification C:\windows\YYCOQR.exe WAJMK.exe File created C:\windows\system\AZQSMR.exe.bat QRO.exe File created C:\windows\system\HLMM.exe DVYESO.exe File created C:\windows\UALEOMU.exe.bat YUFHH.exe File created C:\windows\MSCZX.exe PVW.exe File opened for modification C:\windows\UMK.exe SWRZ.exe File created C:\windows\HGSXD.exe FIZVXP.exe File created C:\windows\system\SFXMXJE.exe.bat MFXYO.exe File created C:\windows\system\ZCVQT.exe.bat AJMON.exe File opened for modification C:\windows\system\NPKN.exe SCNEALU.exe File opened for modification C:\windows\system\ADHS.exe UDAEVVZ.exe File created C:\windows\system\BQSTCKP.exe.bat PXPIUC.exe File opened for modification C:\windows\system\HLMM.exe DVYESO.exe File created C:\windows\system\QVSJ.exe.bat QQA.exe File created C:\windows\JLQUMWS.exe NFKXFMY.exe File created C:\windows\system\DJK.exe HLMM.exe File opened for modification C:\windows\system\CGW.exe RNTT.exe File created C:\windows\system\GVU.exe.bat LIPECA.exe File opened for modification C:\windows\system\GIKPEV.exe YYCOQR.exe File created C:\windows\system\ZKRKYQZ.exe NSWRQB.exe File created C:\windows\system\DTXKK.exe.bat ZKRKYQZ.exe File created C:\windows\system\IPHBW.exe.bat IKPNV.exe File created C:\windows\FIZVXP.exe ZISH.exe File created C:\windows\IPJ.exe FCEHZW.exe File created C:\windows\system\ADHS.exe UDAEVVZ.exe File opened for modification C:\windows\system\KHRYIF.exe PUNP.exe File created C:\windows\MWK.exe SJFQNQ.exe File created C:\windows\GEQXT.exe ROPGVHH.exe File created C:\windows\HGCHK.exe CDGAFF.exe File created C:\windows\system\DXKP.exe DJK.exe File created C:\windows\system\KTLPHN.exe BTJKD.exe File created C:\windows\system\MWKLN.exe.bat ADHS.exe File created C:\windows\system\XOFWNM.exe.bat MWKLN.exe File opened for modification C:\windows\XRIW.exe GIGRWJ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1516 cmd.exe 4600 cmd.exe 2892 cmd.exe 4504 cmd.exe 5604 cmd.exe 916 cmd.exe 4804 cmd.exe 2444 cmd.exe 2620 cmd.exe 1056 cmd.exe 8 cmd.exe 5844 cmd.exe 484 cmd.exe 4528 cmd.exe 3132 cmd.exe 2080 cmd.exe 4616 cmd.exe 616 cmd.exe 3316 cmd.exe 4556 cmd.exe 1156 cmd.exe 1280 cmd.exe 2068 cmd.exe 5996 cmd.exe 2096 cmd.exe 3560 cmd.exe 4304 cmd.exe 5896 cmd.exe 4936 cmd.exe 5632 cmd.exe 3528 cmd.exe 2840 cmd.exe 5764 cmd.exe 3236 cmd.exe 2660 cmd.exe 5808 cmd.exe 2648 cmd.exe 1528 cmd.exe 3440 cmd.exe 264 cmd.exe 3512 cmd.exe 4272 cmd.exe 792 cmd.exe 1388 cmd.exe 5712 cmd.exe 4480 cmd.exe 2940 cmd.exe 4696 cmd.exe 1600 cmd.exe 5228 cmd.exe 1828 cmd.exe 4440 cmd.exe 6028 cmd.exe 2788 cmd.exe 4324 cmd.exe 1152 cmd.exe 2412 cmd.exe 1876 cmd.exe 3484 cmd.exe 4640 cmd.exe 236 cmd.exe 5908 cmd.exe 5828 cmd.exe 4416 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2460 2500 WerFault.exe 88 2844 5100 WerFault.exe 94 2608 5564 WerFault.exe 100 916 3292 WerFault.exe 105 5908 4204 WerFault.exe 110 4240 2268 WerFault.exe 115 1876 3436 WerFault.exe 120 3476 5696 WerFault.exe 125 6016 3840 WerFault.exe 130 3448 3104 WerFault.exe 135 3376 5224 WerFault.exe 140 2660 4736 WerFault.exe 145 3992 4856 WerFault.exe 150 6000 876 WerFault.exe 155 240 3460 WerFault.exe 160 3428 3200 WerFault.exe 165 1468 3124 WerFault.exe 170 1384 2536 WerFault.exe 175 3440 992 WerFault.exe 180 2120 1948 WerFault.exe 185 5596 5852 WerFault.exe 190 4640 4364 WerFault.exe 195 4928 5756 WerFault.exe 200 3976 2584 WerFault.exe 205 1256 4796 WerFault.exe 210 4412 1120 WerFault.exe 215 2664 2860 WerFault.exe 220 5024 3808 WerFault.exe 225 4152 5684 WerFault.exe 230 2940 4300 WerFault.exe 235 3740 5328 WerFault.exe 240 252 5288 WerFault.exe 245 1152 2732 WerFault.exe 250 200 5988 WerFault.exe 255 3260 1144 WerFault.exe 260 1376 1952 WerFault.exe 265 3548 6048 WerFault.exe 270 1196 4700 WerFault.exe 275 1060 4988 WerFault.exe 280 4668 5548 WerFault.exe 285 4860 5304 WerFault.exe 290 1124 4624 WerFault.exe 296 5420 3016 WerFault.exe 301 1256 2896 WerFault.exe 306 4412 2112 WerFault.exe 311 5648 5740 WerFault.exe 316 3164 3272 WerFault.exe 321 4152 2576 WerFault.exe 326 4248 3388 WerFault.exe 331 4924 4900 WerFault.exe 336 2028 2680 WerFault.exe 341 6000 4596 WerFault.exe 346 5244 3900 WerFault.exe 351 476 4224 WerFault.exe 356 4992 4412 WerFault.exe 361 2784 2024 WerFault.exe 366 5516 1476 WerFault.exe 371 5444 4688 WerFault.exe 376 3456 4668 WerFault.exe 381 4912 2764 WerFault.exe 386 5824 5248 WerFault.exe 391 1152 1760 WerFault.exe 396 4512 3660 WerFault.exe 401 3052 4316 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPVWMEB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UALEOMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEMGKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROPGVHH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAHXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYZZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JOKODZJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFKXFMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCVVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZRFO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBNIHGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YYCOQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUQH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZKRKYQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KHRYIF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IPHBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YIBHT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IPJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJMON.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PPUEVDP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VZRSGN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHPSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZCVQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDAEVVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHWZFGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAJMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIKPEV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDGAFF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DTXKK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCEHZW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WHBFIOP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTHK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MGHLGO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFXMXJE.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2500 2026-10-21_6c0d058208e558b3cd050acca087c6e5_elex_emotet_stop.exe 2500 2026-10-21_6c0d058208e558b3cd050acca087c6e5_elex_emotet_stop.exe 5100 SKPHE.exe 5100 SKPHE.exe 5564 GIBTPEM.exe 5564 GIBTPEM.exe 3292 BTJKD.exe 3292 BTJKD.exe 4204 KTLPHN.exe 4204 KTLPHN.exe 2268 AJMON.exe 2268 AJMON.exe 3436 ZCVQT.exe 3436 ZCVQT.exe 5696 WHBFIOP.exe 5696 WHBFIOP.exe 3840 YXUHGLX.exe 3840 YXUHGLX.exe 3104 UDAEVVZ.exe 3104 UDAEVVZ.exe 5224 ADHS.exe 5224 ADHS.exe 4736 MWKLN.exe 4736 MWKLN.exe 4856 XOFWNM.exe 4856 XOFWNM.exe 876 GBQODIT.exe 876 GBQODIT.exe 3460 RUT.exe 3460 RUT.exe 3200 ZALV.exe 3200 ZALV.exe 3124 UNQEXC.exe 3124 UNQEXC.exe 2536 DAAW.exe 2536 DAAW.exe 992 ZGG.exe 992 ZGG.exe 1948 LYJMU.exe 1948 LYJMU.exe 5852 LBNIHGY.exe 5852 LBNIHGY.exe 4364 JUVW.exe 4364 JUVW.exe 5756 PPUEVDP.exe 5756 PPUEVDP.exe 2584 GCEWLIL.exe 2584 GCEWLIL.exe 4796 SVZH.exe 4796 SVZH.exe 1120 SAZW.exe 1120 SAZW.exe 2860 JOKODZJ.exe 2860 JOKODZJ.exe 3808 SOM.exe 3808 SOM.exe 5684 YOTOXY.exe 5684 YOTOXY.exe 4300 JHWZFGC.exe 4300 JHWZFGC.exe 5328 VZRSGN.exe 5328 VZRSGN.exe 5288 PVW.exe 5288 PVW.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2500 2026-10-21_6c0d058208e558b3cd050acca087c6e5_elex_emotet_stop.exe 2500 2026-10-21_6c0d058208e558b3cd050acca087c6e5_elex_emotet_stop.exe 5100 SKPHE.exe 5100 SKPHE.exe 5564 GIBTPEM.exe 5564 GIBTPEM.exe 3292 BTJKD.exe 3292 BTJKD.exe 4204 KTLPHN.exe 4204 KTLPHN.exe 2268 AJMON.exe 2268 AJMON.exe 3436 ZCVQT.exe 3436 ZCVQT.exe 5696 WHBFIOP.exe 5696 WHBFIOP.exe 3840 YXUHGLX.exe 3840 YXUHGLX.exe 3104 UDAEVVZ.exe 3104 UDAEVVZ.exe 5224 ADHS.exe 5224 ADHS.exe 4736 MWKLN.exe 4736 MWKLN.exe 4856 XOFWNM.exe 4856 XOFWNM.exe 876 GBQODIT.exe 876 GBQODIT.exe 3460 RUT.exe 3460 RUT.exe 3200 ZALV.exe 3200 ZALV.exe 3124 UNQEXC.exe 3124 UNQEXC.exe 2536 DAAW.exe 2536 DAAW.exe 992 ZGG.exe 992 ZGG.exe 1948 LYJMU.exe 1948 LYJMU.exe 5852 LBNIHGY.exe 5852 LBNIHGY.exe 4364 JUVW.exe 4364 JUVW.exe 5756 PPUEVDP.exe 5756 PPUEVDP.exe 2584 GCEWLIL.exe 2584 GCEWLIL.exe 4796 SVZH.exe 4796 SVZH.exe 1120 SAZW.exe 1120 SAZW.exe 2860 JOKODZJ.exe 2860 JOKODZJ.exe 3808 SOM.exe 3808 SOM.exe 5684 YOTOXY.exe 5684 YOTOXY.exe 4300 JHWZFGC.exe 4300 JHWZFGC.exe 5328 VZRSGN.exe 5328 VZRSGN.exe 5288 PVW.exe 5288 PVW.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2500 wrote to memory of 5044 2500 2026-10-21_6c0d058208e558b3cd050acca087c6e5_elex_emotet_stop.exe 90 PID 5044 wrote to memory of 5100 5044 cmd.exe 94 PID 5100 wrote to memory of 236 5100 SKPHE.exe 96 PID 236 wrote to memory of 5564 236 cmd.exe 100 PID 5564 wrote to memory of 4848 5564 GIBTPEM.exe 101 PID 4848 wrote to memory of 3292 4848 cmd.exe 105 PID 3292 wrote to memory of 696 3292 BTJKD.exe 106 PID 696 wrote to memory of 4204 696 cmd.exe 110 PID 4204 wrote to memory of 3316 4204 KTLPHN.exe 111 PID 3316 wrote to memory of 2268 3316 cmd.exe 115 PID 2268 wrote to memory of 2648 2268 AJMON.exe 116 PID 2648 wrote to memory of 3436 2648 cmd.exe 120 PID 3436 wrote to memory of 1516 3436 ZCVQT.exe 121 PID 1516 wrote to memory of 5696 1516 cmd.exe 125 PID 5696 wrote to memory of 1848 5696 WHBFIOP.exe 126 PID 1848 wrote to memory of 3840 1848 cmd.exe 130 PID 3840 wrote to memory of 3308 3840 YXUHGLX.exe 131 PID 3308 wrote to memory of 3104 3308 cmd.exe 135 PID 3104 wrote to memory of 4188 3104 UDAEVVZ.exe 136 PID 4188 wrote to memory of 5224 4188 cmd.exe 140 PID 5224 wrote to memory of 4336 5224 ADHS.exe 141 PID 4336 wrote to memory of 4736 4336 cmd.exe 145 PID 4736 wrote to memory of 4432 4736 MWKLN.exe 146 PID 4432 wrote to memory of 4856 4432 cmd.exe 150 PID 4856 wrote to memory of 2328 4856 XOFWNM.exe 151 PID 2328 wrote to memory of 876 2328 cmd.exe 155 PID 876 wrote to memory of 3524 876 GBQODIT.exe 156 PID 3524 wrote to memory of 3460 3524 cmd.exe 160 PID 3460 wrote to memory of 3220 3460 RUT.exe 161 PID 3220 wrote to memory of 3200 3220 cmd.exe 165 PID 3200 wrote to memory of 2788 3200 ZALV.exe 166 PID 2788 wrote to memory of 3124 2788 cmd.exe 170 PID 3124 wrote to memory of 4744 3124 UNQEXC.exe 171 PID 4744 wrote to memory of 2536 4744 cmd.exe 175 PID 2536 wrote to memory of 5868 2536 DAAW.exe 176 PID 5868 wrote to memory of 992 5868 cmd.exe 180 PID 992 wrote to memory of 4600 992 ZGG.exe 181 PID 4600 wrote to memory of 1948 4600 cmd.exe 185 PID 1948 wrote to memory of 2840 1948 LYJMU.exe 186 PID 2840 wrote to memory of 5852 2840 cmd.exe 190 PID 5852 wrote to memory of 4360 5852 LBNIHGY.exe 191 PID 4360 wrote to memory of 4364 4360 cmd.exe 195 PID 4364 wrote to memory of 4324 4364 JUVW.exe 196 PID 4324 wrote to memory of 5756 4324 cmd.exe 200 PID 5756 wrote to memory of 4168 5756 PPUEVDP.exe 201 PID 4168 wrote to memory of 2584 4168 cmd.exe 205 PID 2584 wrote to memory of 1208 2584 GCEWLIL.exe 206 PID 1208 wrote to memory of 4796 1208 cmd.exe 210 PID 4796 wrote to memory of 620 4796 SVZH.exe 211 PID 620 wrote to memory of 1120 620 cmd.exe 215 PID 1120 wrote to memory of 3512 1120 SAZW.exe 216 PID 3512 wrote to memory of 2860 3512 cmd.exe 220 PID 2860 wrote to memory of 3968 2860 JOKODZJ.exe 221 PID 3968 wrote to memory of 3808 3968 cmd.exe 225 PID 3808 wrote to memory of 5788 3808 SOM.exe 226 PID 5788 wrote to memory of 5684 5788 cmd.exe 230 PID 5684 wrote to memory of 4272 5684 YOTOXY.exe 231 PID 4272 wrote to memory of 4300 4272 cmd.exe 235 PID 4300 wrote to memory of 4260 4300 JHWZFGC.exe 236 PID 4260 wrote to memory of 5328 4260 cmd.exe 240 PID 5328 wrote to memory of 2468 5328 VZRSGN.exe 241 PID 2468 wrote to memory of 5288 2468 cmd.exe 245 PID 5288 wrote to memory of 260 5288 PVW.exe 246 PID 260 wrote to memory of 2732 260 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-21_6c0d058208e558b3cd050acca087c6e5_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-21_6c0d058208e558b3cd050acca087c6e5_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SKPHE.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\windows\system\SKPHE.exeC:\windows\system\SKPHE.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GIBTPEM.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:236 -
C:\windows\system\GIBTPEM.exeC:\windows\system\GIBTPEM.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTJKD.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\windows\system\BTJKD.exeC:\windows\system\BTJKD.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTLPHN.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:696 -
C:\windows\system\KTLPHN.exeC:\windows\system\KTLPHN.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJMON.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\windows\SysWOW64\AJMON.exeC:\windows\system32\AJMON.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZCVQT.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\windows\system\ZCVQT.exeC:\windows\system\ZCVQT.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WHBFIOP.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\windows\SysWOW64\WHBFIOP.exeC:\windows\system32\WHBFIOP.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXUHGLX.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\windows\SysWOW64\YXUHGLX.exeC:\windows\system32\YXUHGLX.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UDAEVVZ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\windows\SysWOW64\UDAEVVZ.exeC:\windows\system32\UDAEVVZ.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADHS.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\windows\system\ADHS.exeC:\windows\system\ADHS.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MWKLN.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\windows\system\MWKLN.exeC:\windows\system\MWKLN.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOFWNM.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\windows\system\XOFWNM.exeC:\windows\system\XOFWNM.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GBQODIT.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\windows\GBQODIT.exeC:\windows\GBQODIT.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUT.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\windows\SysWOW64\RUT.exeC:\windows\system32\RUT.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZALV.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\windows\SysWOW64\ZALV.exeC:\windows\system32\ZALV.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNQEXC.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\windows\system\UNQEXC.exeC:\windows\system\UNQEXC.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAAW.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\windows\system\DAAW.exeC:\windows\system\DAAW.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGG.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\windows\system\ZGG.exeC:\windows\system\ZGG.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYJMU.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\windows\system\LYJMU.exeC:\windows\system\LYJMU.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LBNIHGY.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\windows\system\LBNIHGY.exeC:\windows\system\LBNIHGY.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUVW.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\windows\SysWOW64\JUVW.exeC:\windows\system32\JUVW.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PPUEVDP.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\windows\SysWOW64\PPUEVDP.exeC:\windows\system32\PPUEVDP.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCEWLIL.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\windows\system\GCEWLIL.exeC:\windows\system\GCEWLIL.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVZH.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\windows\SVZH.exeC:\windows\SVZH.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SAZW.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:620 -
C:\windows\SAZW.exeC:\windows\SAZW.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JOKODZJ.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\windows\JOKODZJ.exeC:\windows\JOKODZJ.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SOM.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\windows\system\SOM.exeC:\windows\system\SOM.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YOTOXY.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\windows\SysWOW64\YOTOXY.exeC:\windows\system32\YOTOXY.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JHWZFGC.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\windows\SysWOW64\JHWZFGC.exeC:\windows\system32\JHWZFGC.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZRSGN.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\windows\SysWOW64\VZRSGN.exeC:\windows\system32\VZRSGN.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVW.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\windows\SysWOW64\PVW.exeC:\windows\system32\PVW.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MSCZX.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:260 -
C:\windows\MSCZX.exeC:\windows\MSCZX.exe65⤵
- Executes dropped EXE
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STKMGRJ.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:1568 -
C:\windows\SysWOW64\STKMGRJ.exeC:\windows\system32\STKMGRJ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BBM.exe.bat" "68⤵PID:5792
-
C:\windows\BBM.exeC:\windows\BBM.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MTHK.exe.bat" "70⤵PID:1340
-
C:\windows\SysWOW64\MTHK.exeC:\windows\system32\MTHK.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MEPM.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4696 -
C:\windows\SysWOW64\MEPM.exeC:\windows\system32\MEPM.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXSEOX.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2444 -
C:\windows\system\XXSEOX.exeC:\windows\system\XXSEOX.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFUJRVZ.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2892 -
C:\windows\PFUJRVZ.exeC:\windows\PFUJRVZ.exe77⤵
- Executes dropped EXE
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LKSH.exe.bat" "78⤵PID:4792
-
C:\windows\system\LKSH.exeC:\windows\system\LKSH.exe79⤵
- Executes dropped EXE
PID:5548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLAUPH.exe.bat" "80⤵PID:1456
-
C:\windows\system\JLAUPH.exeC:\windows\system\JLAUPH.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GIGRWJ.exe.bat" "82⤵PID:5644
-
C:\windows\system\GIGRWJ.exeC:\windows\system\GIGRWJ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRIW.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4480 -
C:\windows\XRIW.exeC:\windows\XRIW.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEMGKO.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:756 -
C:\windows\SysWOW64\SEMGKO.exeC:\windows\system32\SEMGKO.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUT.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:4180 -
C:\windows\VUT.exeC:\windows\VUT.exe89⤵
- Executes dropped EXE
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHYPZ.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4556 -
C:\windows\system\QHYPZ.exeC:\windows\system\QHYPZ.exe91⤵
- Executes dropped EXE
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFEKOGH.exe.bat" "92⤵PID:1468
-
C:\windows\AFEKOGH.exeC:\windows\AFEKOGH.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDJH.exe.bat" "94⤵PID:4612
-
C:\windows\SysWOW64\PDJH.exeC:\windows\system32\PDJH.exe95⤵
- Executes dropped EXE
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIPECA.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1156 -
C:\windows\system\LIPECA.exeC:\windows\system\LIPECA.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GVU.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2940 -
C:\windows\system\GVU.exeC:\windows\system\GVU.exe99⤵
- Executes dropped EXE
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ROPGVHH.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5764 -
C:\windows\ROPGVHH.exeC:\windows\ROPGVHH.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GEQXT.exe.bat" "102⤵
- Executes a command shell one-liner
PID:1528 -
C:\windows\GEQXT.exeC:\windows\GEQXT.exe103⤵
- Executes dropped EXE
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEYLKFF.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4528 -
C:\windows\system\MEYLKFF.exeC:\windows\system\MEYLKFF.exe105⤵
- Executes dropped EXE
PID:3900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFFZT.exe.bat" "106⤵PID:5076
-
C:\windows\SFFZT.exeC:\windows\SFFZT.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNHEXE.exe.bat" "108⤵PID:6060
-
C:\windows\SysWOW64\BNHEXE.exeC:\windows\system32\BNHEXE.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFKXFMY.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4304 -
C:\windows\NFKXFMY.exeC:\windows\NFKXFMY.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLQUMWS.exe.bat" "112⤵PID:4788
-
C:\windows\JLQUMWS.exeC:\windows\JLQUMWS.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWRV.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5896 -
C:\windows\system\JWRV.exeC:\windows\system\JWRV.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EJVFKA.exe.bat" "116⤵PID:2464
-
C:\windows\SysWOW64\EJVFKA.exeC:\windows\system32\EJVFKA.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PBYXL.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4780 -
C:\windows\system\PBYXL.exeC:\windows\system\PBYXL.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GKA.exe.bat" "120⤵PID:2608
-
C:\windows\SysWOW64\GKA.exeC:\windows\system32\GKA.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-