Analysis
- max time kernel
108s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/10/2026, 23:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_ffae46ff2da5b85bcef57ce8f1ab2017_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-22_ffae46ff2da5b85bcef57ce8f1ab2017_elex_emotet_stop.exe
- Size 208KB
- Sample261022-3qs2jsbg64
- SHA256 9a5071d139a4b2c7239f9f0a612a0cec6bdb765b4f2e47b65d015f5f8b611cc6
- MD5 ffae46ff2da5b85bcef57ce8f1ab2017
- SHA1 b16dba3bf01084cbc229c0542171ce40f397bffc
- SHA512 50370cd4b6dfa1208c48ceaef273b9e1cffb2958f4d8a0d9e3e521130e15943afcce0bb8c2c12220e8601c0d55d37bd53f9021748b49b2f3cece6bd648702705
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfH4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOPkEj1
- TLSH T132247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4332 LCQ.exe 4048 ASDJV.exe 2564 MVOWEUS.exe 5444 MBGLFZV.exe 4968 PWLU.exe 4736 TERUCRX.exe 1552 ZEZI.exe 2736 ZKZWM.exe 5572 TFEGXY.exe 5116 OSJ.exe 5900 FGTH.exe 3768 FLTWY.exe 4256 LMTKHKX.exe 3716 PUIS.exe 2624 PHAGVHO.exe 2928 BPGG.exe 3796 USSKNP.exe 4832 ZTAX.exe 3548 DBGYIK.exe 1128 EEKBV.exe 5824 NEMGZX.exe 200 TEU.exe 4284 QKS.exe 3756 GVQ.exe 5656 BIVQZ.exe 4728 HIDEQYB.exe 2488 BEHW.exe 4040 WREFCX.exe 3344 EBNYQC.exe 3760 PUQRYRI.exe 5356 ANT.exe 6072 PSR.exe 5660 KFVQQ.exe 2536 LDXLW.exe 4924 XLD.exe 4504 JEYL.exe 1376 HEGZAZ.exe 560 OXPTODQ.exe 4668 APS.exe 2092 WVXI.exe 3656 FVRNGZ.exe 6112 ROUGHHR.exe 4748 VEBG.exe 4976 BEJCKTO.exe 3216 VRN.exe 712 SXT.exe 1240 UNMD.exe 2680 ZNUQJU.exe 1988 ABUFSHR.exe 3500 RGFXAEF.exe 4612 CYIQ.exe 1896 VBLLOBW.exe 3032 ACT.exe 784 CAM.exe 5748 OSPUL.exe 5108 KYNJSJ.exe 760 VQQCB.exe 4720 KOWZIAO.exe 5440 HTCW.exe 5856 SMX.exe 5196 AFFIL.exe 5320 LXIBTL.exe 2692 RXQPCFC.exe 4688 RDIDESX.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\VRN.exe BEJCKTO.exe File created C:\windows\SysWOW64\RGFXAEF.exe.bat ABUFSHR.exe File created C:\windows\SysWOW64\VEBG.exe.bat ROUGHHR.exe File created C:\windows\SysWOW64\SMX.exe HTCW.exe File created C:\windows\SysWOW64\EIY.exe.bat HCA.exe File created C:\windows\SysWOW64\WMTFL.exe WGBQJ.exe File created C:\windows\SysWOW64\EGW.exe CIVNJ.exe File created C:\windows\SysWOW64\EGW.exe.bat CIVNJ.exe File created C:\windows\SysWOW64\MVOWEUS.exe.bat ASDJV.exe File created C:\windows\SysWOW64\TFEGXY.exe.bat ZKZWM.exe File created C:\windows\SysWOW64\DBGYIK.exe.bat ZTAX.exe File created C:\windows\SysWOW64\NEMGZX.exe EEKBV.exe File created C:\windows\SysWOW64\ROUGHHR.exe.bat FVRNGZ.exe File created C:\windows\SysWOW64\LHMTNU.exe.bat MWVDOA.exe File created C:\windows\SysWOW64\NRIQPJ.exe SEDZ.exe File opened for modification C:\windows\SysWOW64\WMTFL.exe WGBQJ.exe File created C:\windows\SysWOW64\LHMTNU.exe MWVDOA.exe File created C:\windows\SysWOW64\KRJAUT.exe KEJUS.exe File created C:\windows\SysWOW64\KEVFHDL.exe.bat YMSNH.exe File created C:\windows\SysWOW64\RHTHWO.exe.bat LHMTNU.exe File created C:\windows\SysWOW64\HTZ.exe.bat HNZYIDM.exe File created C:\windows\SysWOW64\BTJPR.exe DSB.exe File created C:\windows\SysWOW64\KRJAUT.exe.bat KEJUS.exe File created C:\windows\SysWOW64\ANT.exe.bat PUQRYRI.exe File created C:\windows\SysWOW64\KYNJSJ.exe.bat OSPUL.exe File created C:\windows\SysWOW64\YMSNH.exe.bat NTXU.exe File created C:\windows\SysWOW64\BRFX.exe.bat KEVFHDL.exe File created C:\windows\SysWOW64\RHTHWO.exe LHMTNU.exe File created C:\windows\SysWOW64\YSHQ.exe CMB.exe File created C:\windows\SysWOW64\RZTO.exe.bat CCVRUWE.exe File created C:\windows\SysWOW64\FGTH.exe.bat OSJ.exe File opened for modification C:\windows\SysWOW64\NEMGZX.exe EEKBV.exe File opened for modification C:\windows\SysWOW64\ROUGHHR.exe FVRNGZ.exe File opened for modification C:\windows\SysWOW64\HCA.exe RRC.exe File opened for modification C:\windows\SysWOW64\XAJMCCW.exe JPN.exe File opened for modification C:\windows\SysWOW64\IYSBLB.exe LTME.exe File opened for modification C:\windows\SysWOW64\CYIQ.exe RGFXAEF.exe File opened for modification C:\windows\SysWOW64\MVOWEUS.exe ASDJV.exe File opened for modification C:\windows\SysWOW64\TFEGXY.exe ZKZWM.exe File created C:\windows\SysWOW64\HEGZAZ.exe JEYL.exe File created C:\windows\SysWOW64\RGFXAEF.exe ABUFSHR.exe File opened for modification C:\windows\SysWOW64\KSHDAX.exe BRFX.exe File opened for modification C:\windows\SysWOW64\SEDZ.exe QGKE.exe File opened for modification C:\windows\SysWOW64\HEGZAZ.exe JEYL.exe File created C:\windows\SysWOW64\ROUGHHR.exe FVRNGZ.exe File opened for modification C:\windows\SysWOW64\YMSNH.exe NTXU.exe File created C:\windows\SysWOW64\NRIQPJ.exe.bat SEDZ.exe File created C:\windows\SysWOW64\XAJMCCW.exe JPN.exe File opened for modification C:\windows\SysWOW64\CMB.exe WMTFL.exe File created C:\windows\SysWOW64\DUNVQEU.exe.bat HPPXJV.exe File opened for modification C:\windows\SysWOW64\DBGYIK.exe ZTAX.exe File created C:\windows\SysWOW64\OCVE.exe.bat DJSTL.exe File created C:\windows\SysWOW64\JPN.exe NRIQPJ.exe File opened for modification C:\windows\SysWOW64\RPI.exe MEEI.exe File opened for modification C:\windows\SysWOW64\EGW.exe CIVNJ.exe File created C:\windows\SysWOW64\LPFZSH.exe.bat JREWMK.exe File opened for modification C:\windows\SysWOW64\KFVQQ.exe PSR.exe File created C:\windows\SysWOW64\QKS.exe.bat TEU.exe File created C:\windows\SysWOW64\BRFX.exe KEVFHDL.exe File created C:\windows\SysWOW64\HXNAP.exe.bat KSHDAX.exe File created C:\windows\SysWOW64\LTME.exe.bat MADD.exe File opened for modification C:\windows\SysWOW64\LDXLW.exe KFVQQ.exe File opened for modification C:\windows\SysWOW64\KYNJSJ.exe OSPUL.exe File created C:\windows\SysWOW64\KIGRI.exe.bat EIY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\VTRDWLJ.exe MGHLGO.exe File created C:\windows\KKXA.exe.bat OERD.exe File opened for modification C:\windows\system\HPPXJV.exe KRJAUT.exe File created C:\windows\system\SAYIZJA.exe.bat ZHDQR.exe File created C:\windows\OSJ.exe.bat TFEGXY.exe File opened for modification C:\windows\ZNUQJU.exe UNMD.exe File created C:\windows\RORFR.exe RDIDESX.exe File created C:\windows\NTXU.exe.bat RORFR.exe File created C:\windows\system\DSB.exe.bat SAYIZJA.exe File opened for modification C:\windows\system\FLTWY.exe FGTH.exe File created C:\windows\BIVQZ.exe GVQ.exe File created C:\windows\WREFCX.exe BEHW.exe File created C:\windows\GMM.exe VTRDWLJ.exe File created C:\windows\system\WINZANR.exe.bat DNWWERI.exe File created C:\windows\LCQ.exe 2026-10-22_ffae46ff2da5b85bcef57ce8f1ab2017_elex_emotet_stop.exe File created C:\windows\system\MGHLGO.exe KIGRI.exe File created C:\windows\QGKE.exe HTZ.exe File opened for modification C:\windows\PSR.exe ANT.exe File opened for modification C:\windows\system\SAYIZJA.exe ZHDQR.exe File created C:\windows\TLGNBWE.exe.bat OIC.exe File created C:\windows\system\AFFIL.exe.bat SMX.exe File created C:\windows\ZHDQR.exe.bat KKXA.exe File created C:\windows\system\ZEZI.exe TERUCRX.exe File created C:\windows\system\ZKZWM.exe ZEZI.exe File created C:\windows\system\FLTWY.exe.bat FGTH.exe File opened for modification C:\windows\XLD.exe LDXLW.exe File opened for modification C:\windows\system\OERD.exe IEKQMGN.exe File opened for modification C:\windows\system\ASDJV.exe LCQ.exe File created C:\windows\system\SXT.exe VRN.exe File created C:\windows\VQQCB.exe KYNJSJ.exe File opened for modification C:\windows\system\UHTP.exe NPKN.exe File created C:\windows\MEEI.exe EUWO.exe File created C:\windows\system\WGBQJ.exe.bat BLW.exe File opened for modification C:\windows\IEKQMGN.exe IYSBLB.exe File created C:\windows\system\OSPUL.exe CAM.exe File created C:\windows\system\USSKNP.exe.bat BPGG.exe File created C:\windows\NTXU.exe RORFR.exe File created C:\windows\system\GAWHYE.exe.bat UHTP.exe File created C:\windows\LCQ.exe.bat 2026-10-22_ffae46ff2da5b85bcef57ce8f1ab2017_elex_emotet_stop.exe File created C:\windows\KGMPRWW.exe IILVLZ.exe File opened for modification C:\windows\OIC.exe IIVTN.exe File opened for modification C:\windows\system\VTGZFB.exe EGW.exe File created C:\windows\system\OXPTODQ.exe HEGZAZ.exe File created C:\windows\system\DXH.exe.bat LPFZSH.exe File opened for modification C:\windows\system\OSPUL.exe CAM.exe File created C:\windows\system\TEU.exe NEMGZX.exe File opened for modification C:\windows\HIDEQYB.exe BIVQZ.exe File created C:\windows\XLD.exe LDXLW.exe File created C:\windows\HTCW.exe KOWZIAO.exe File opened for modification C:\windows\RORFR.exe RDIDESX.exe File created C:\windows\NRJFVU.exe FGBEHP.exe File created C:\windows\EUWO.exe CWC.exe File opened for modification C:\windows\VBLLOBW.exe CYIQ.exe File created C:\windows\system\RXQPCFC.exe LXIBTL.exe File created C:\windows\system\RRC.exe.bat RHTHWO.exe File opened for modification C:\windows\OUGLB.exe RPI.exe File opened for modification C:\windows\KKXA.exe OERD.exe File opened for modification C:\windows\system\DNWWERI.exe DUNVQEU.exe File created C:\windows\system\EEKBV.exe DBGYIK.exe File opened for modification C:\windows\GMM.exe VTRDWLJ.exe File created C:\windows\system\HNZYIDM.exe.bat WVWFHV.exe File created C:\windows\system\SAYIZJA.exe ZHDQR.exe File opened for modification C:\windows\system\WINZANR.exe DNWWERI.exe File opened for modification C:\windows\system\CKNKHT.exe XAJMCCW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3264 cmd.exe 2792 cmd.exe 4840 cmd.exe 1676 cmd.exe 4128 cmd.exe 3136 cmd.exe 2416 cmd.exe 5228 cmd.exe 4752 cmd.exe 3004 cmd.exe 1944 cmd.exe 4620 cmd.exe 756 cmd.exe 692 cmd.exe 5840 cmd.exe 896 cmd.exe 5988 cmd.exe 1208 cmd.exe 2996 cmd.exe 1864 cmd.exe 5164 cmd.exe 5088 cmd.exe 4180 cmd.exe 3200 cmd.exe 4868 cmd.exe 2332 cmd.exe 5452 cmd.exe 2156 cmd.exe 5524 cmd.exe 2972 cmd.exe 4108 cmd.exe 2768 cmd.exe 4360 cmd.exe 2724 cmd.exe 4724 cmd.exe 3936 cmd.exe 1724 cmd.exe 6052 cmd.exe 3368 cmd.exe 5048 cmd.exe 3836 cmd.exe 3812 cmd.exe 2800 cmd.exe 256 cmd.exe 4704 cmd.exe 8 cmd.exe 3352 cmd.exe 4592 cmd.exe 2304 cmd.exe 4488 cmd.exe 4740 cmd.exe 4436 cmd.exe 4236 cmd.exe 2524 cmd.exe 5432 cmd.exe 4732 cmd.exe 2336 cmd.exe 1200 cmd.exe 4280 cmd.exe 3544 cmd.exe 2896 cmd.exe 2036 cmd.exe 2836 cmd.exe 4564 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 244 4760 WerFault.exe 88 2612 4332 WerFault.exe 93 6088 4048 WerFault.exe 100 2800 2564 WerFault.exe 105 6036 5444 WerFault.exe 110 2684 4968 WerFault.exe 115 3212 4736 WerFault.exe 120 3348 1552 WerFault.exe 125 5836 2736 WerFault.exe 130 4180 5572 WerFault.exe 135 5048 5116 WerFault.exe 140 6132 5900 WerFault.exe 144 1440 3768 WerFault.exe 150 4656 4256 WerFault.exe 155 5400 3716 WerFault.exe 160 4152 2624 WerFault.exe 165 1444 2928 WerFault.exe 170 1368 3796 WerFault.exe 175 5164 4832 WerFault.exe 180 2916 3548 WerFault.exe 185 3188 1128 WerFault.exe 190 4696 5824 WerFault.exe 195 3008 200 WerFault.exe 200 4624 4284 WerFault.exe 205 3032 3756 WerFault.exe 210 2280 5656 WerFault.exe 215 2684 4728 WerFault.exe 220 4688 2488 WerFault.exe 225 1612 4040 WerFault.exe 230 692 3344 WerFault.exe 235 5360 3760 WerFault.exe 240 1948 5356 WerFault.exe 245 2792 6072 WerFault.exe 250 3004 5660 WerFault.exe 255 2068 2536 WerFault.exe 260 3940 4924 WerFault.exe 265 5068 4504 WerFault.exe 270 3112 1376 WerFault.exe 275 4320 560 WerFault.exe 280 2848 4668 WerFault.exe 285 5708 2092 WerFault.exe 291 5148 3656 WerFault.exe 296 6100 6112 WerFault.exe 301 2724 4748 WerFault.exe 306 5548 4976 WerFault.exe 311 1332 3216 WerFault.exe 316 1456 712 WerFault.exe 321 5644 1240 WerFault.exe 326 4720 2680 WerFault.exe 331 1380 1988 WerFault.exe 336 2760 3500 WerFault.exe 341 3480 4612 WerFault.exe 346 3336 1896 WerFault.exe 351 2872 3032 WerFault.exe 356 2344 784 WerFault.exe 361 5228 5748 WerFault.exe 366 2328 5108 WerFault.exe 371 4588 760 WerFault.exe 376 5416 4720 WerFault.exe 381 2248 5440 WerFault.exe 386 6000 5856 WerFault.exe 391 3448 5196 WerFault.exe 396 5972 5320 WerFault.exe 401 5040 2692 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFEGXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SIRU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNUQJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKKJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WREFCX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHTHWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FGBEHP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBGLFZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KFVQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHAGVHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABUFSHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXIBTL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NRJFVU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGFXAEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYIQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHMTNU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MCSWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HTCW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGMPRWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSPUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIGRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CIVNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROUGHHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJKKDU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DUNVQEU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KOWZIAO.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4760 2026-10-22_ffae46ff2da5b85bcef57ce8f1ab2017_elex_emotet_stop.exe 4760 2026-10-22_ffae46ff2da5b85bcef57ce8f1ab2017_elex_emotet_stop.exe 4332 LCQ.exe 4332 LCQ.exe 4048 ASDJV.exe 4048 ASDJV.exe 2564 MVOWEUS.exe 2564 MVOWEUS.exe 5444 MBGLFZV.exe 5444 MBGLFZV.exe 4968 PWLU.exe 4968 PWLU.exe 4736 TERUCRX.exe 4736 TERUCRX.exe 1552 ZEZI.exe 1552 ZEZI.exe 2736 ZKZWM.exe 2736 ZKZWM.exe 5572 TFEGXY.exe 5572 TFEGXY.exe 5116 OSJ.exe 5116 OSJ.exe 5900 FGTH.exe 5900 FGTH.exe 3768 FLTWY.exe 3768 FLTWY.exe 4256 LMTKHKX.exe 4256 LMTKHKX.exe 3716 PUIS.exe 3716 PUIS.exe 2624 PHAGVHO.exe 2624 PHAGVHO.exe 2928 BPGG.exe 2928 BPGG.exe 3796 USSKNP.exe 3796 USSKNP.exe 4832 ZTAX.exe 4832 ZTAX.exe 3548 DBGYIK.exe 3548 DBGYIK.exe 1128 EEKBV.exe 1128 EEKBV.exe 5824 NEMGZX.exe 5824 NEMGZX.exe 200 TEU.exe 200 TEU.exe 4284 QKS.exe 4284 QKS.exe 3756 GVQ.exe 3756 GVQ.exe 5656 BIVQZ.exe 5656 BIVQZ.exe 4728 HIDEQYB.exe 4728 HIDEQYB.exe 2488 BEHW.exe 2488 BEHW.exe 4040 WREFCX.exe 4040 WREFCX.exe 3344 EBNYQC.exe 3344 EBNYQC.exe 3760 PUQRYRI.exe 3760 PUQRYRI.exe 5356 ANT.exe 5356 ANT.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4760 2026-10-22_ffae46ff2da5b85bcef57ce8f1ab2017_elex_emotet_stop.exe 4760 2026-10-22_ffae46ff2da5b85bcef57ce8f1ab2017_elex_emotet_stop.exe 4332 LCQ.exe 4332 LCQ.exe 4048 ASDJV.exe 4048 ASDJV.exe 2564 MVOWEUS.exe 2564 MVOWEUS.exe 5444 MBGLFZV.exe 5444 MBGLFZV.exe 4968 PWLU.exe 4968 PWLU.exe 4736 TERUCRX.exe 4736 TERUCRX.exe 1552 ZEZI.exe 1552 ZEZI.exe 2736 ZKZWM.exe 2736 ZKZWM.exe 5572 TFEGXY.exe 5572 TFEGXY.exe 5116 OSJ.exe 5116 OSJ.exe 5900 FGTH.exe 5900 FGTH.exe 3768 FLTWY.exe 3768 FLTWY.exe 4256 LMTKHKX.exe 4256 LMTKHKX.exe 3716 PUIS.exe 3716 PUIS.exe 2624 PHAGVHO.exe 2624 PHAGVHO.exe 2928 BPGG.exe 2928 BPGG.exe 3796 USSKNP.exe 3796 USSKNP.exe 4832 ZTAX.exe 4832 ZTAX.exe 3548 DBGYIK.exe 3548 DBGYIK.exe 1128 EEKBV.exe 1128 EEKBV.exe 5824 NEMGZX.exe 5824 NEMGZX.exe 200 TEU.exe 200 TEU.exe 4284 QKS.exe 4284 QKS.exe 3756 GVQ.exe 3756 GVQ.exe 5656 BIVQZ.exe 5656 BIVQZ.exe 4728 HIDEQYB.exe 4728 HIDEQYB.exe 2488 BEHW.exe 2488 BEHW.exe 4040 WREFCX.exe 4040 WREFCX.exe 3344 EBNYQC.exe 3344 EBNYQC.exe 3760 PUQRYRI.exe 3760 PUQRYRI.exe 5356 ANT.exe 5356 ANT.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4760 wrote to memory of 1848 4760 2026-10-22_ffae46ff2da5b85bcef57ce8f1ab2017_elex_emotet_stop.exe 90 PID 1848 wrote to memory of 4332 1848 cmd.exe 93 PID 4332 wrote to memory of 1284 4332 LCQ.exe 96 PID 1284 wrote to memory of 4048 1284 cmd.exe 100 PID 4048 wrote to memory of 2996 4048 ASDJV.exe 101 PID 2996 wrote to memory of 2564 2996 cmd.exe 105 PID 2564 wrote to memory of 3812 2564 MVOWEUS.exe 106 PID 3812 wrote to memory of 5444 3812 cmd.exe 110 PID 5444 wrote to memory of 1140 5444 MBGLFZV.exe 111 PID 1140 wrote to memory of 4968 1140 cmd.exe 115 PID 4968 wrote to memory of 5288 4968 PWLU.exe 116 PID 5288 wrote to memory of 4736 5288 cmd.exe 120 PID 4736 wrote to memory of 2444 4736 TERUCRX.exe 121 PID 2444 wrote to memory of 1552 2444 cmd.exe 125 PID 1552 wrote to memory of 4592 1552 ZEZI.exe 126 PID 4592 wrote to memory of 2736 4592 cmd.exe 130 PID 2736 wrote to memory of 2332 2736 ZKZWM.exe 131 PID 2332 wrote to memory of 5572 2332 cmd.exe 135 PID 5572 wrote to memory of 5880 5572 TFEGXY.exe 136 PID 5880 wrote to memory of 5116 5880 cmd.exe 140 PID 5116 wrote to memory of 5452 5116 OSJ.exe 141 PID 5452 wrote to memory of 5900 5452 cmd.exe 144 PID 5900 wrote to memory of 5316 5900 FGTH.exe 146 PID 5316 wrote to memory of 3768 5316 cmd.exe 150 PID 3768 wrote to memory of 3396 3768 FLTWY.exe 151 PID 3396 wrote to memory of 4256 3396 cmd.exe 155 PID 4256 wrote to memory of 1112 4256 LMTKHKX.exe 156 PID 1112 wrote to memory of 3716 1112 cmd.exe 160 PID 3716 wrote to memory of 2800 3716 PUIS.exe 161 PID 2800 wrote to memory of 2624 2800 cmd.exe 165 PID 2624 wrote to memory of 2072 2624 PHAGVHO.exe 166 PID 2072 wrote to memory of 2928 2072 cmd.exe 170 PID 2928 wrote to memory of 1448 2928 BPGG.exe 171 PID 1448 wrote to memory of 3796 1448 cmd.exe 175 PID 3796 wrote to memory of 4344 3796 USSKNP.exe 176 PID 4344 wrote to memory of 4832 4344 cmd.exe 180 PID 4832 wrote to memory of 3932 4832 ZTAX.exe 181 PID 3932 wrote to memory of 3548 3932 cmd.exe 185 PID 3548 wrote to memory of 1672 3548 DBGYIK.exe 186 PID 1672 wrote to memory of 1128 1672 cmd.exe 190 PID 1128 wrote to memory of 1724 1128 EEKBV.exe 191 PID 1724 wrote to memory of 5824 1724 cmd.exe 195 PID 5824 wrote to memory of 52 5824 NEMGZX.exe 196 PID 52 wrote to memory of 200 52 cmd.exe 200 PID 200 wrote to memory of 3180 200 TEU.exe 201 PID 3180 wrote to memory of 4284 3180 cmd.exe 205 PID 4284 wrote to memory of 2856 4284 QKS.exe 206 PID 2856 wrote to memory of 3756 2856 cmd.exe 210 PID 3756 wrote to memory of 1864 3756 GVQ.exe 211 PID 1864 wrote to memory of 5656 1864 cmd.exe 215 PID 5656 wrote to memory of 4564 5656 BIVQZ.exe 216 PID 4564 wrote to memory of 4728 4564 cmd.exe 220 PID 4728 wrote to memory of 2304 4728 HIDEQYB.exe 221 PID 2304 wrote to memory of 2488 2304 cmd.exe 225 PID 2488 wrote to memory of 4336 2488 BEHW.exe 226 PID 4336 wrote to memory of 4040 4336 cmd.exe 230 PID 4040 wrote to memory of 4732 4040 WREFCX.exe 231 PID 4732 wrote to memory of 3344 4732 cmd.exe 235 PID 3344 wrote to memory of 4580 3344 EBNYQC.exe 236 PID 4580 wrote to memory of 3760 4580 cmd.exe 240 PID 3760 wrote to memory of 3176 3760 PUQRYRI.exe 241 PID 3176 wrote to memory of 5356 3176 cmd.exe 245 PID 5356 wrote to memory of 1832 5356 ANT.exe 246 PID 1832 wrote to memory of 6072 1832 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_ffae46ff2da5b85bcef57ce8f1ab2017_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_ffae46ff2da5b85bcef57ce8f1ab2017_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCQ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\windows\LCQ.exeC:\windows\LCQ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASDJV.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\windows\system\ASDJV.exeC:\windows\system\ASDJV.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVOWEUS.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\windows\SysWOW64\MVOWEUS.exeC:\windows\system32\MVOWEUS.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MBGLFZV.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\windows\system\MBGLFZV.exeC:\windows\system\MBGLFZV.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWLU.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\windows\PWLU.exeC:\windows\PWLU.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TERUCRX.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\windows\TERUCRX.exeC:\windows\TERUCRX.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZEZI.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\windows\system\ZEZI.exeC:\windows\system\ZEZI.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZKZWM.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\windows\system\ZKZWM.exeC:\windows\system\ZKZWM.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TFEGXY.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\windows\SysWOW64\TFEGXY.exeC:\windows\system32\TFEGXY.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OSJ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\windows\OSJ.exeC:\windows\OSJ.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGTH.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\windows\SysWOW64\FGTH.exeC:\windows\system32\FGTH.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FLTWY.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\windows\system\FLTWY.exeC:\windows\system\FLTWY.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMTKHKX.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\windows\system\LMTKHKX.exeC:\windows\system\LMTKHKX.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUIS.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\windows\PUIS.exeC:\windows\PUIS.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PHAGVHO.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\windows\PHAGVHO.exeC:\windows\PHAGVHO.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BPGG.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\windows\BPGG.exeC:\windows\BPGG.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USSKNP.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\windows\system\USSKNP.exeC:\windows\system\USSKNP.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTAX.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\ZTAX.exeC:\windows\ZTAX.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBGYIK.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\windows\SysWOW64\DBGYIK.exeC:\windows\system32\DBGYIK.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EEKBV.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\windows\system\EEKBV.exeC:\windows\system\EEKBV.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NEMGZX.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\windows\SysWOW64\NEMGZX.exeC:\windows\system32\NEMGZX.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEU.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:52 -
C:\windows\system\TEU.exeC:\windows\system\TEU.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKS.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\windows\SysWOW64\QKS.exeC:\windows\system32\QKS.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GVQ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\windows\SysWOW64\GVQ.exeC:\windows\system32\GVQ.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BIVQZ.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\windows\BIVQZ.exeC:\windows\BIVQZ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIDEQYB.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\windows\HIDEQYB.exeC:\windows\HIDEQYB.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BEHW.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\windows\system\BEHW.exeC:\windows\system\BEHW.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WREFCX.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\windows\WREFCX.exeC:\windows\WREFCX.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EBNYQC.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\windows\EBNYQC.exeC:\windows\EBNYQC.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUQRYRI.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\PUQRYRI.exeC:\windows\PUQRYRI.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANT.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\windows\SysWOW64\ANT.exeC:\windows\system32\ANT.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PSR.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\windows\PSR.exeC:\windows\PSR.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KFVQQ.exe.bat" "66⤵PID:252
-
C:\windows\SysWOW64\KFVQQ.exeC:\windows\system32\KFVQQ.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LDXLW.exe.bat" "68⤵PID:3284
-
C:\windows\SysWOW64\LDXLW.exeC:\windows\system32\LDXLW.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XLD.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:5716 -
C:\windows\XLD.exeC:\windows\XLD.exe71⤵
- Executes dropped EXE
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JEYL.exe.bat" "72⤵
- Executes a command shell one-liner
PID:6052 -
C:\windows\SysWOW64\JEYL.exeC:\windows\system32\JEYL.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HEGZAZ.exe.bat" "74⤵PID:2424
-
C:\windows\SysWOW64\HEGZAZ.exeC:\windows\system32\HEGZAZ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXPTODQ.exe.bat" "76⤵PID:1632
-
C:\windows\system\OXPTODQ.exeC:\windows\system\OXPTODQ.exe77⤵
- Executes dropped EXE
PID:560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\APS.exe.bat" "78⤵
- Executes a command shell one-liner
PID:4488 -
C:\windows\system\APS.exeC:\windows\system\APS.exe79⤵
- Executes dropped EXE
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WVXI.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:1984 -
C:\windows\system\WVXI.exeC:\windows\system\WVXI.exe81⤵
- Executes dropped EXE
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FVRNGZ.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4740 -
C:\windows\SysWOW64\FVRNGZ.exeC:\windows\system32\FVRNGZ.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ROUGHHR.exe.bat" "84⤵PID:5932
-
C:\windows\SysWOW64\ROUGHHR.exeC:\windows\system32\ROUGHHR.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEBG.exe.bat" "86⤵PID:4196
-
C:\windows\SysWOW64\VEBG.exeC:\windows\system32\VEBG.exe87⤵
- Executes dropped EXE
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BEJCKTO.exe.bat" "88⤵PID:5780
-
C:\windows\system\BEJCKTO.exeC:\windows\system\BEJCKTO.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRN.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:5592 -
C:\windows\SysWOW64\VRN.exeC:\windows\system32\VRN.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SXT.exe.bat" "92⤵PID:5556
-
C:\windows\system\SXT.exeC:\windows\system\SXT.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UNMD.exe.bat" "94⤵PID:4896
-
C:\windows\UNMD.exeC:\windows\UNMD.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNUQJU.exe.bat" "96⤵
- Executes a command shell one-liner
PID:1944 -
C:\windows\ZNUQJU.exeC:\windows\ZNUQJU.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABUFSHR.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3368 -
C:\windows\system\ABUFSHR.exeC:\windows\system\ABUFSHR.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RGFXAEF.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5048 -
C:\windows\SysWOW64\RGFXAEF.exeC:\windows\system32\RGFXAEF.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYIQ.exe.bat" "102⤵PID:2860
-
C:\windows\SysWOW64\CYIQ.exeC:\windows\system32\CYIQ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VBLLOBW.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4620 -
C:\windows\VBLLOBW.exeC:\windows\VBLLOBW.exe105⤵
- Executes dropped EXE
PID:1896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ACT.exe.bat" "106⤵PID:4780
-
C:\windows\system\ACT.exeC:\windows\system\ACT.exe107⤵
- Executes dropped EXE
PID:3032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAM.exe.bat" "108⤵
- Executes a command shell one-liner
PID:2336 -
C:\windows\CAM.exeC:\windows\CAM.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OSPUL.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:1388 -
C:\windows\system\OSPUL.exeC:\windows\system\OSPUL.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYNJSJ.exe.bat" "112⤵PID:4676
-
C:\windows\SysWOW64\KYNJSJ.exeC:\windows\system32\KYNJSJ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQQCB.exe.bat" "114⤵PID:940
-
C:\windows\VQQCB.exeC:\windows\VQQCB.exe115⤵
- Executes dropped EXE
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KOWZIAO.exe.bat" "116⤵PID:5576
-
C:\windows\KOWZIAO.exeC:\windows\KOWZIAO.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HTCW.exe.bat" "118⤵PID:3504
-
C:\windows\HTCW.exeC:\windows\HTCW.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SMX.exe.bat" "120⤵PID:704
-
C:\windows\SysWOW64\SMX.exeC:\windows\system32\SMX.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-