Analysis
- max time kernel
90s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 23:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_0261155721c6ac3117178036795158cb_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-22_0261155721c6ac3117178036795158cb_elex_emotet_stop.exe
- Size 208KB
- Sample261024-254k6afh94
- SHA256 592e82c3084fc77dfc6c84623192b465dfeab814dd33c06be540042f154b7896
- MD5 0261155721c6ac3117178036795158cb
- SHA1 b41a461537e7a0c600c0406f6d74f4f7e4dd25b3
- SHA512 6843230c83785bae35c9e4a9d444c02a728961d9191a13d175244b6640519ac318835fe89b304334d51a4937d3a52b427c43610e0c024515ff163ebe67ee7bcb
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUtL+LOfX4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUp+LO/kEj1
- TLSH T1D2247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5904 WQRQGAZ.exe 5252 HCQSLA.exe 3020 JZWE.exe 5988 TXK.exe 4272 SIMPRXI.exe 6140 RTPFAD.exe 3472 IBECMU.exe 3556 TTTNWV.exe 6092 PRTYF.exe 2088 THAHKZN.exe 2868 RSCXSF.exe 708 HNUB.exe 4952 ZQYXRP.exe 5708 ATB.exe 3400 NWK.exe 5812 BCSLMT.exe 2532 QXBP.exe 1500 FNCGEC.exe 5964 JVJOQ.exe 720 EQOYBUS.exe 1648 IYUY.exe 3736 MBTTNFQ.exe 5696 FCIEWGY.exe 4984 GXMI.exe 1396 ASDJV.exe 4772 GFCKAK.exe 5704 KVJSM.exe 2936 UTO.exe 3544 PGTW.exe 5052 ZEZI.exe 5376 KXCBT.exe 4400 TFEGXY.exe 5676 JANS.exe 1456 MIUSULN.exe 1864 EQW.exe 5568 YEBHI.exe 4492 IED.exe 2612 ZRNM.exe 5064 TFSVLK.exe 3276 DNUAPIL.exe 5636 SDVAV.exe 4904 JQFKLA.exe 4496 EEKBV.exe 4364 EJCQX.exe 4440 IZR.exe 2680 OAZDS.exe 2488 INWNCZR.exe 4788 ISW.exe 3880 YNFGPZ.exe 2928 AJKPZZR.exe 2824 RUVF.exe 3392 THSOSE.exe 5108 DHUC.exe 5212 HXICIUS.exe 3864 BKFL.exe 4828 TTHQV.exe 2332 RJA.exe 2980 ARCYMCT.exe 4460 QHD.exe 404 KUIHD.exe 1920 CZT.exe 3376 LIVE.exe 3584 PQBMIK.exe 4232 PDTTKXM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\UTO.exe KVJSM.exe File created C:\windows\SysWOW64\UTO.exe.bat KVJSM.exe File created C:\windows\SysWOW64\KXCBT.exe ZEZI.exe File created C:\windows\SysWOW64\KUIHD.exe QHD.exe File opened for modification C:\windows\SysWOW64\KBQNORU.exe QGLEE.exe File created C:\windows\SysWOW64\DPG.exe XPZ.exe File opened for modification C:\windows\SysWOW64\MDPBXL.exe SPKR.exe File opened for modification C:\windows\SysWOW64\YJEQY.exe DWZ.exe File created C:\windows\SysWOW64\SIMPRXI.exe TXK.exe File created C:\windows\SysWOW64\ACY.exe.bat LHODT.exe File created C:\windows\SysWOW64\GYXQJ.exe ACY.exe File created C:\windows\SysWOW64\GYXQJ.exe.bat ACY.exe File created C:\windows\SysWOW64\MATEW.exe.bat AIQM.exe File created C:\windows\SysWOW64\THSOSE.exe.bat RUVF.exe File opened for modification C:\windows\SysWOW64\ACY.exe LHODT.exe File created C:\windows\SysWOW64\DPG.exe.bat XPZ.exe File created C:\windows\SysWOW64\VHIYFAJ.exe AUMOU.exe File opened for modification C:\windows\SysWOW64\YEBHI.exe EQW.exe File created C:\windows\SysWOW64\AJKPZZR.exe YNFGPZ.exe File opened for modification C:\windows\SysWOW64\AJKPZZR.exe YNFGPZ.exe File created C:\windows\SysWOW64\THSOSE.exe RUVF.exe File created C:\windows\SysWOW64\SKKD.exe.bat GUDDHG.exe File created C:\windows\SysWOW64\YJEQY.exe.bat DWZ.exe File opened for modification C:\windows\SysWOW64\LTCWAA.exe QGXMY.exe File created C:\windows\SysWOW64\HXICIUS.exe.bat DHUC.exe File created C:\windows\SysWOW64\SKKD.exe GUDDHG.exe File opened for modification C:\windows\SysWOW64\QGXMY.exe WLS.exe File opened for modification C:\windows\SysWOW64\SIMPRXI.exe TXK.exe File created C:\windows\SysWOW64\UTO.exe KVJSM.exe File created C:\windows\SysWOW64\KBQNORU.exe.bat QGLEE.exe File created C:\windows\SysWOW64\LTCWAA.exe QGXMY.exe File opened for modification C:\windows\SysWOW64\PRTYF.exe TTTNWV.exe File created C:\windows\SysWOW64\OAZDS.exe.bat IZR.exe File opened for modification C:\windows\SysWOW64\DPG.exe XPZ.exe File created C:\windows\SysWOW64\MATEW.exe AIQM.exe File created C:\windows\SysWOW64\MBTTNFQ.exe IYUY.exe File created C:\windows\SysWOW64\SDVAV.exe.bat DNUAPIL.exe File created C:\windows\SysWOW64\KBQNORU.exe QGLEE.exe File opened for modification C:\windows\SysWOW64\VSIT.exe AFEKOGH.exe File created C:\windows\SysWOW64\VSIT.exe.bat AFEKOGH.exe File created C:\windows\SysWOW64\QGXMY.exe WLS.exe File opened for modification C:\windows\SysWOW64\MATEW.exe AIQM.exe File created C:\windows\SysWOW64\SIMPRXI.exe.bat TXK.exe File opened for modification C:\windows\SysWOW64\KXCBT.exe ZEZI.exe File created C:\windows\SysWOW64\KXCBT.exe.bat ZEZI.exe File created C:\windows\SysWOW64\YEBHI.exe EQW.exe File opened for modification C:\windows\SysWOW64\SDVAV.exe DNUAPIL.exe File opened for modification C:\windows\SysWOW64\YNFGPZ.exe ISW.exe File created C:\windows\SysWOW64\YNFGPZ.exe.bat ISW.exe File created C:\windows\SysWOW64\MDPBXL.exe SPKR.exe File created C:\windows\SysWOW64\JZWE.exe HCQSLA.exe File opened for modification C:\windows\SysWOW64\JZWE.exe HCQSLA.exe File opened for modification C:\windows\SysWOW64\QXBP.exe BCSLMT.exe File created C:\windows\SysWOW64\QXBP.exe.bat BCSLMT.exe File created C:\windows\SysWOW64\ALCZTEF.exe GYXQJ.exe File created C:\windows\SysWOW64\TFEGXY.exe.bat KXCBT.exe File created C:\windows\SysWOW64\OAZDS.exe IZR.exe File opened for modification C:\windows\SysWOW64\ALCZTEF.exe GYXQJ.exe File created C:\windows\SysWOW64\VHIYFAJ.exe.bat AUMOU.exe File opened for modification C:\windows\SysWOW64\WQRQGAZ.exe 2026-10-22_0261155721c6ac3117178036795158cb_elex_emotet_stop.exe File created C:\windows\SysWOW64\WQRQGAZ.exe.bat 2026-10-22_0261155721c6ac3117178036795158cb_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\HXICIUS.exe DHUC.exe File created C:\windows\SysWOW64\ACY.exe LHODT.exe File created C:\windows\SysWOW64\YJEQY.exe DWZ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\EJEEHOS.exe.bat YJEQY.exe File created C:\windows\MQAFHU.exe.bat DPG.exe File created C:\windows\BLSJ.exe MQAFHU.exe File opened for modification C:\windows\WMPHDTJ.exe BYKXB.exe File opened for modification C:\windows\system\TXK.exe JZWE.exe File created C:\windows\HNUB.exe RSCXSF.exe File created C:\windows\system\GVYOYBO.exe.bat MATEW.exe File created C:\windows\IED.exe YEBHI.exe File created C:\windows\system\TFSVLK.exe ZRNM.exe File created C:\windows\system\LIVE.exe CZT.exe File opened for modification C:\windows\DKWUIMY.exe SRTCAF.exe File created C:\windows\GJOR.exe.bat JLQUMWS.exe File created C:\windows\system\FCIEWGY.exe MBTTNFQ.exe File created C:\windows\IED.exe.bat YEBHI.exe File created C:\windows\DHUC.exe.bat THSOSE.exe File created C:\windows\system\QHD.exe.bat ARCYMCT.exe File created C:\windows\XEWS.exe CQRJGFN.exe File created C:\windows\DLIGD.exe SSFNV.exe File created C:\windows\GUDDHG.exe CMWVUNK.exe File created C:\windows\NWK.exe ATB.exe File created C:\windows\system\PGTW.exe.bat UTO.exe File opened for modification C:\windows\CZT.exe KUIHD.exe File opened for modification C:\windows\BYKXB.exe BLSJ.exe File opened for modification C:\windows\XVSTFSB.exe MDPBXL.exe File created C:\windows\system\TXK.exe.bat JZWE.exe File created C:\windows\system\GXMI.exe FCIEWGY.exe File opened for modification C:\windows\system\GFCKAK.exe ASDJV.exe File created C:\windows\GHXZ.exe RBRKC.exe File opened for modification C:\windows\system\GVYOYBO.exe MATEW.exe File created C:\windows\AFEKOGH.exe PMIRGZ.exe File created C:\windows\MQAFHU.exe DPG.exe File created C:\windows\THAHKZN.exe PRTYF.exe File opened for modification C:\windows\EQOYBUS.exe JVJOQ.exe File created C:\windows\IYUY.exe EQOYBUS.exe File created C:\windows\system\RJA.exe TTHQV.exe File created C:\windows\system\VCOLZ.exe PCH.exe File created C:\windows\system\TXK.exe JZWE.exe File created C:\windows\system\ZEZI.exe.bat PGTW.exe File created C:\windows\system\DNUAPIL.exe TFSVLK.exe File opened for modification C:\windows\ARCYMCT.exe RJA.exe File created C:\windows\system\PCH.exe EJEEHOS.exe File created C:\windows\system\PGTW.exe UTO.exe File opened for modification C:\windows\system\SRTCAF.exe XEWS.exe File created C:\windows\JLQUMWS.exe.bat DLIGD.exe File opened for modification C:\windows\system\PQBMIK.exe LIVE.exe File opened for modification C:\windows\JVJOQ.exe FNCGEC.exe File created C:\windows\JLQUMWS.exe DLIGD.exe File created C:\windows\system\ZEZI.exe PGTW.exe File created C:\windows\system\ZRNM.exe.bat IED.exe File created C:\windows\system\TFSVLK.exe.bat ZRNM.exe File created C:\windows\system\RSCXSF.exe THAHKZN.exe File opened for modification C:\windows\system\SPKR.exe SKKD.exe File created C:\windows\system\JQFKLA.exe.bat SDVAV.exe File opened for modification C:\windows\system\PDTTKXM.exe PQBMIK.exe File created C:\windows\system\SRTCAF.exe XEWS.exe File created C:\windows\BYKXB.exe.bat BLSJ.exe File created C:\windows\MWFC.exe GVYOYBO.exe File opened for modification C:\windows\system\RUVF.exe AJKPZZR.exe File created C:\windows\system\PDTTKXM.exe.bat PQBMIK.exe File opened for modification C:\windows\PMIRGZ.exe AJRMV.exe File created C:\windows\GJOR.exe JLQUMWS.exe File created C:\windows\system\LHODT.exe ZPTKLH.exe File created C:\windows\system\SPKR.exe.bat SKKD.exe File opened for modification C:\windows\BKFL.exe HXICIUS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4344 cmd.exe 5028 cmd.exe 5740 cmd.exe 5832 cmd.exe 1244 cmd.exe 2192 cmd.exe 4532 cmd.exe 2500 cmd.exe 3384 cmd.exe 3324 cmd.exe 5736 cmd.exe 5908 cmd.exe 2760 cmd.exe 5880 cmd.exe 1688 cmd.exe 2972 cmd.exe 4844 cmd.exe 5724 cmd.exe 4688 cmd.exe 4432 cmd.exe 2556 cmd.exe 6076 cmd.exe 2580 cmd.exe 4932 cmd.exe 2892 cmd.exe 2160 cmd.exe 6012 cmd.exe 1180 cmd.exe 2352 cmd.exe 1880 cmd.exe 3240 cmd.exe 5688 cmd.exe 4852 cmd.exe 2428 cmd.exe 1412 cmd.exe 5268 cmd.exe 2180 cmd.exe 4704 cmd.exe 1912 cmd.exe 1536 cmd.exe 4748 cmd.exe 2880 cmd.exe 3044 cmd.exe 2516 cmd.exe 4468 cmd.exe 5624 cmd.exe 1276 cmd.exe 4568 cmd.exe 4204 cmd.exe 4948 cmd.exe 5972 cmd.exe 5928 cmd.exe 4120 cmd.exe 5116 cmd.exe 1308 cmd.exe 1416 cmd.exe 2140 cmd.exe 3484 cmd.exe 4068 cmd.exe 5992 cmd.exe 5728 cmd.exe 3564 cmd.exe 4780 cmd.exe 5412 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1316 5808 WerFault.exe 88 4976 5904 WerFault.exe 93 5880 5252 WerFault.exe 99 5868 3020 WerFault.exe 104 5612 5988 WerFault.exe 109 5784 4272 WerFault.exe 114 3316 6140 WerFault.exe 119 5492 3472 WerFault.exe 124 2348 3556 WerFault.exe 129 1884 6092 WerFault.exe 133 3136 2088 WerFault.exe 139 2324 2868 WerFault.exe 144 4292 708 WerFault.exe 149 5116 4952 WerFault.exe 154 5024 5708 WerFault.exe 159 2624 3400 WerFault.exe 164 5412 5812 WerFault.exe 169 1256 2532 WerFault.exe 174 2752 1500 WerFault.exe 178 3336 5964 WerFault.exe 184 1016 720 WerFault.exe 189 3948 1648 WerFault.exe 194 4292 3736 WerFault.exe 199 5116 5696 WerFault.exe 204 2084 4984 WerFault.exe 209 1444 1396 WerFault.exe 214 2444 4772 WerFault.exe 219 2556 5704 WerFault.exe 224 2036 2936 WerFault.exe 229 4408 3544 WerFault.exe 234 4664 5052 WerFault.exe 239 5032 5376 WerFault.exe 244 2864 4400 WerFault.exe 249 1048 5676 WerFault.exe 254 900 1456 WerFault.exe 259 5712 1864 WerFault.exe 264 724 5568 WerFault.exe 269 928 4492 WerFault.exe 275 4732 2612 WerFault.exe 280 3880 5064 WerFault.exe 285 404 3276 WerFault.exe 290 4512 5636 WerFault.exe 295 1204 4904 WerFault.exe 300 5940 4496 WerFault.exe 305 2112 4364 WerFault.exe 310 3864 4440 WerFault.exe 315 3732 2680 WerFault.exe 320 4428 2488 WerFault.exe 325 3536 4788 WerFault.exe 330 2972 3880 WerFault.exe 335 5388 2928 WerFault.exe 340 2784 2824 WerFault.exe 345 4748 3392 WerFault.exe 350 4868 5108 WerFault.exe 355 4624 5212 WerFault.exe 360 4432 3864 WerFault.exe 365 4060 4828 WerFault.exe 370 3536 2332 WerFault.exe 375 2724 2980 WerFault.exe 380 1308 4460 WerFault.exe 385 5880 404 WerFault.exe 390 3552 1920 WerFault.exe 395 2800 3376 WerFault.exe 400 932 3584 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JANS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BYKXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEKBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THAHKZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DWZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUIHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ATB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EQOYBUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNFGPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HNUB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVJSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJKPZZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_0261155721c6ac3117178036795158cb_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PRTYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KBQNORU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGLEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VHIYFAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HCQSLA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ISW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCSLMT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMWVUNK.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5808 2026-10-22_0261155721c6ac3117178036795158cb_elex_emotet_stop.exe 5808 2026-10-22_0261155721c6ac3117178036795158cb_elex_emotet_stop.exe 5904 WQRQGAZ.exe 5904 WQRQGAZ.exe 5252 HCQSLA.exe 5252 HCQSLA.exe 3020 JZWE.exe 3020 JZWE.exe 5988 TXK.exe 5988 TXK.exe 4272 SIMPRXI.exe 4272 SIMPRXI.exe 6140 RTPFAD.exe 6140 RTPFAD.exe 3472 IBECMU.exe 3472 IBECMU.exe 3556 TTTNWV.exe 3556 TTTNWV.exe 6092 PRTYF.exe 6092 PRTYF.exe 2088 THAHKZN.exe 2088 THAHKZN.exe 2868 RSCXSF.exe 2868 RSCXSF.exe 708 HNUB.exe 708 HNUB.exe 4952 ZQYXRP.exe 4952 ZQYXRP.exe 5708 ATB.exe 5708 ATB.exe 3400 NWK.exe 3400 NWK.exe 5812 BCSLMT.exe 5812 BCSLMT.exe 2532 QXBP.exe 2532 QXBP.exe 1500 FNCGEC.exe 1500 FNCGEC.exe 5964 JVJOQ.exe 5964 JVJOQ.exe 720 EQOYBUS.exe 720 EQOYBUS.exe 1648 IYUY.exe 1648 IYUY.exe 3736 MBTTNFQ.exe 3736 MBTTNFQ.exe 5696 FCIEWGY.exe 5696 FCIEWGY.exe 4984 GXMI.exe 4984 GXMI.exe 1396 ASDJV.exe 1396 ASDJV.exe 4772 GFCKAK.exe 4772 GFCKAK.exe 5704 KVJSM.exe 5704 KVJSM.exe 2936 UTO.exe 2936 UTO.exe 3544 PGTW.exe 3544 PGTW.exe 5052 ZEZI.exe 5052 ZEZI.exe 5376 KXCBT.exe 5376 KXCBT.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5808 2026-10-22_0261155721c6ac3117178036795158cb_elex_emotet_stop.exe 5808 2026-10-22_0261155721c6ac3117178036795158cb_elex_emotet_stop.exe 5904 WQRQGAZ.exe 5904 WQRQGAZ.exe 5252 HCQSLA.exe 5252 HCQSLA.exe 3020 JZWE.exe 3020 JZWE.exe 5988 TXK.exe 5988 TXK.exe 4272 SIMPRXI.exe 4272 SIMPRXI.exe 6140 RTPFAD.exe 6140 RTPFAD.exe 3472 IBECMU.exe 3472 IBECMU.exe 3556 TTTNWV.exe 3556 TTTNWV.exe 6092 PRTYF.exe 6092 PRTYF.exe 2088 THAHKZN.exe 2088 THAHKZN.exe 2868 RSCXSF.exe 2868 RSCXSF.exe 708 HNUB.exe 708 HNUB.exe 4952 ZQYXRP.exe 4952 ZQYXRP.exe 5708 ATB.exe 5708 ATB.exe 3400 NWK.exe 3400 NWK.exe 5812 BCSLMT.exe 5812 BCSLMT.exe 2532 QXBP.exe 2532 QXBP.exe 1500 FNCGEC.exe 1500 FNCGEC.exe 5964 JVJOQ.exe 5964 JVJOQ.exe 720 EQOYBUS.exe 720 EQOYBUS.exe 1648 IYUY.exe 1648 IYUY.exe 3736 MBTTNFQ.exe 3736 MBTTNFQ.exe 5696 FCIEWGY.exe 5696 FCIEWGY.exe 4984 GXMI.exe 4984 GXMI.exe 1396 ASDJV.exe 1396 ASDJV.exe 4772 GFCKAK.exe 4772 GFCKAK.exe 5704 KVJSM.exe 5704 KVJSM.exe 2936 UTO.exe 2936 UTO.exe 3544 PGTW.exe 3544 PGTW.exe 5052 ZEZI.exe 5052 ZEZI.exe 5376 KXCBT.exe 5376 KXCBT.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5808 wrote to memory of 5144 5808 2026-10-22_0261155721c6ac3117178036795158cb_elex_emotet_stop.exe 89 PID 5144 wrote to memory of 5904 5144 cmd.exe 93 PID 5904 wrote to memory of 3240 5904 WQRQGAZ.exe 95 PID 3240 wrote to memory of 5252 3240 cmd.exe 99 PID 5252 wrote to memory of 360 5252 HCQSLA.exe 100 PID 360 wrote to memory of 3020 360 cmd.exe 104 PID 3020 wrote to memory of 5912 3020 JZWE.exe 105 PID 5912 wrote to memory of 5988 5912 cmd.exe 109 PID 5988 wrote to memory of 3068 5988 TXK.exe 110 PID 3068 wrote to memory of 4272 3068 cmd.exe 114 PID 4272 wrote to memory of 1080 4272 SIMPRXI.exe 115 PID 1080 wrote to memory of 6140 1080 cmd.exe 119 PID 6140 wrote to memory of 1200 6140 RTPFAD.exe 120 PID 1200 wrote to memory of 3472 1200 cmd.exe 124 PID 3472 wrote to memory of 4844 3472 IBECMU.exe 125 PID 4844 wrote to memory of 3556 4844 cmd.exe 129 PID 3556 wrote to memory of 4324 3556 TTTNWV.exe 130 PID 4324 wrote to memory of 6092 4324 cmd.exe 133 PID 6092 wrote to memory of 2792 6092 PRTYF.exe 135 PID 2792 wrote to memory of 2088 2792 cmd.exe 139 PID 2088 wrote to memory of 4124 2088 THAHKZN.exe 140 PID 4124 wrote to memory of 2868 4124 cmd.exe 144 PID 2868 wrote to memory of 2704 2868 RSCXSF.exe 145 PID 2704 wrote to memory of 708 2704 cmd.exe 149 PID 708 wrote to memory of 5688 708 HNUB.exe 150 PID 5688 wrote to memory of 4952 5688 cmd.exe 154 PID 4952 wrote to memory of 2516 4952 ZQYXRP.exe 155 PID 2516 wrote to memory of 5708 2516 cmd.exe 159 PID 5708 wrote to memory of 2040 5708 ATB.exe 160 PID 2040 wrote to memory of 3400 2040 cmd.exe 164 PID 3400 wrote to memory of 5268 3400 NWK.exe 165 PID 5268 wrote to memory of 5812 5268 cmd.exe 169 PID 5812 wrote to memory of 5960 5812 BCSLMT.exe 170 PID 5960 wrote to memory of 2532 5960 cmd.exe 174 PID 2532 wrote to memory of 2656 2532 QXBP.exe 175 PID 2656 wrote to memory of 1500 2656 cmd.exe 178 PID 1500 wrote to memory of 2500 1500 FNCGEC.exe 180 PID 2500 wrote to memory of 5964 2500 cmd.exe 184 PID 5964 wrote to memory of 2892 5964 JVJOQ.exe 185 PID 2892 wrote to memory of 720 2892 cmd.exe 189 PID 720 wrote to memory of 2180 720 EQOYBUS.exe 190 PID 2180 wrote to memory of 1648 2180 cmd.exe 194 PID 1648 wrote to memory of 5148 1648 IYUY.exe 195 PID 5148 wrote to memory of 3736 5148 cmd.exe 199 PID 3736 wrote to memory of 5728 3736 MBTTNFQ.exe 200 PID 5728 wrote to memory of 5696 5728 cmd.exe 204 PID 5696 wrote to memory of 3152 5696 FCIEWGY.exe 205 PID 3152 wrote to memory of 4984 3152 cmd.exe 209 PID 4984 wrote to memory of 2992 4984 GXMI.exe 210 PID 2992 wrote to memory of 1396 2992 cmd.exe 214 PID 1396 wrote to memory of 4900 1396 ASDJV.exe 215 PID 4900 wrote to memory of 4772 4900 cmd.exe 219 PID 4772 wrote to memory of 5992 4772 GFCKAK.exe 220 PID 5992 wrote to memory of 5704 5992 cmd.exe 224 PID 5704 wrote to memory of 1888 5704 KVJSM.exe 225 PID 1888 wrote to memory of 2936 1888 cmd.exe 229 PID 2936 wrote to memory of 3244 2936 UTO.exe 230 PID 3244 wrote to memory of 3544 3244 cmd.exe 234 PID 3544 wrote to memory of 4304 3544 PGTW.exe 235 PID 4304 wrote to memory of 5052 4304 cmd.exe 239 PID 5052 wrote to memory of 4080 5052 ZEZI.exe 240 PID 4080 wrote to memory of 5376 4080 cmd.exe 244 PID 5376 wrote to memory of 5700 5376 KXCBT.exe 245 PID 5700 wrote to memory of 4400 5700 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_0261155721c6ac3117178036795158cb_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_0261155721c6ac3117178036795158cb_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQRQGAZ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\windows\SysWOW64\WQRQGAZ.exeC:\windows\system32\WQRQGAZ.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HCQSLA.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\windows\HCQSLA.exeC:\windows\HCQSLA.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JZWE.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:360 -
C:\windows\SysWOW64\JZWE.exeC:\windows\system32\JZWE.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TXK.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\windows\system\TXK.exeC:\windows\system\TXK.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SIMPRXI.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\windows\SysWOW64\SIMPRXI.exeC:\windows\system32\SIMPRXI.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTPFAD.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\windows\RTPFAD.exeC:\windows\RTPFAD.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBECMU.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\windows\system\IBECMU.exeC:\windows\system\IBECMU.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TTTNWV.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\windows\system\TTTNWV.exeC:\windows\system\TTTNWV.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRTYF.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\windows\SysWOW64\PRTYF.exeC:\windows\system32\PRTYF.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THAHKZN.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\windows\THAHKZN.exeC:\windows\THAHKZN.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSCXSF.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\windows\system\RSCXSF.exeC:\windows\system\RSCXSF.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNUB.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\windows\HNUB.exeC:\windows\HNUB.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZQYXRP.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\windows\system\ZQYXRP.exeC:\windows\system\ZQYXRP.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATB.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\windows\system\ATB.exeC:\windows\system\ATB.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NWK.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\windows\NWK.exeC:\windows\NWK.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCSLMT.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\windows\BCSLMT.exeC:\windows\BCSLMT.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QXBP.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\windows\SysWOW64\QXBP.exeC:\windows\system32\QXBP.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FNCGEC.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\windows\system\FNCGEC.exeC:\windows\system\FNCGEC.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVJOQ.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\windows\JVJOQ.exeC:\windows\JVJOQ.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQOYBUS.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\EQOYBUS.exeC:\windows\EQOYBUS.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYUY.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\windows\IYUY.exeC:\windows\IYUY.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MBTTNFQ.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\windows\SysWOW64\MBTTNFQ.exeC:\windows\system32\MBTTNFQ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FCIEWGY.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\windows\system\FCIEWGY.exeC:\windows\system\FCIEWGY.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXMI.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\windows\system\GXMI.exeC:\windows\system\GXMI.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASDJV.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\windows\system\ASDJV.exeC:\windows\system\ASDJV.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GFCKAK.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\windows\system\GFCKAK.exeC:\windows\system\GFCKAK.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KVJSM.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\windows\KVJSM.exeC:\windows\KVJSM.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTO.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\windows\SysWOW64\UTO.exeC:\windows\system32\UTO.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGTW.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\windows\system\PGTW.exeC:\windows\system\PGTW.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZEZI.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\windows\system\ZEZI.exeC:\windows\system\ZEZI.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXCBT.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\windows\SysWOW64\KXCBT.exeC:\windows\system32\KXCBT.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TFEGXY.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\windows\SysWOW64\TFEGXY.exeC:\windows\system32\TFEGXY.exe65⤵
- Executes dropped EXE
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JANS.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4852 -
C:\windows\JANS.exeC:\windows\JANS.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MIUSULN.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:2684 -
C:\windows\system\MIUSULN.exeC:\windows\system\MIUSULN.exe69⤵
- Executes dropped EXE
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQW.exe.bat" "70⤵PID:1928
-
C:\windows\EQW.exeC:\windows\EQW.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YEBHI.exe.bat" "72⤵PID:5468
-
C:\windows\SysWOW64\YEBHI.exeC:\windows\system32\YEBHI.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IED.exe.bat" "74⤵PID:3264
-
C:\windows\IED.exeC:\windows\IED.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRNM.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:2416 -
C:\windows\system\ZRNM.exeC:\windows\system\ZRNM.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFSVLK.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5616 -
C:\windows\system\TFSVLK.exeC:\windows\system\TFSVLK.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNUAPIL.exe.bat" "80⤵
- Executes a command shell one-liner
PID:1688 -
C:\windows\system\DNUAPIL.exeC:\windows\system\DNUAPIL.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDVAV.exe.bat" "82⤵PID:2196
-
C:\windows\SysWOW64\SDVAV.exeC:\windows\system32\SDVAV.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JQFKLA.exe.bat" "84⤵PID:6084
-
C:\windows\system\JQFKLA.exeC:\windows\system\JQFKLA.exe85⤵
- Executes dropped EXE
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EEKBV.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:4792 -
C:\windows\system\EEKBV.exeC:\windows\system\EEKBV.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EJCQX.exe.bat" "88⤵PID:900
-
C:\windows\system\EJCQX.exeC:\windows\system\EJCQX.exe89⤵
- Executes dropped EXE
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZR.exe.bat" "90⤵PID:356
-
C:\windows\IZR.exeC:\windows\IZR.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OAZDS.exe.bat" "92⤵
- Executes a command shell one-liner
PID:5928 -
C:\windows\SysWOW64\OAZDS.exeC:\windows\system32\OAZDS.exe93⤵
- Executes dropped EXE
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\INWNCZR.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5724 -
C:\windows\INWNCZR.exeC:\windows\INWNCZR.exe95⤵
- Executes dropped EXE
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ISW.exe.bat" "96⤵PID:2016
-
C:\windows\system\ISW.exeC:\windows\system\ISW.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNFGPZ.exe.bat" "98⤵PID:5040
-
C:\windows\SysWOW64\YNFGPZ.exeC:\windows\system32\YNFGPZ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJKPZZR.exe.bat" "100⤵PID:4660
-
C:\windows\SysWOW64\AJKPZZR.exeC:\windows\system32\AJKPZZR.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RUVF.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:5680 -
C:\windows\system\RUVF.exeC:\windows\system\RUVF.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THSOSE.exe.bat" "104⤵PID:3348
-
C:\windows\SysWOW64\THSOSE.exeC:\windows\system32\THSOSE.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DHUC.exe.bat" "106⤵PID:5840
-
C:\windows\DHUC.exeC:\windows\DHUC.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXICIUS.exe.bat" "108⤵PID:5424
-
C:\windows\SysWOW64\HXICIUS.exeC:\windows\system32\HXICIUS.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKFL.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4120 -
C:\windows\BKFL.exeC:\windows\BKFL.exe111⤵
- Executes dropped EXE
PID:3864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TTHQV.exe.bat" "112⤵PID:3416
-
C:\windows\TTHQV.exeC:\windows\TTHQV.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RJA.exe.bat" "114⤵PID:4732
-
C:\windows\system\RJA.exeC:\windows\system\RJA.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ARCYMCT.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4704 -
C:\windows\ARCYMCT.exeC:\windows\ARCYMCT.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHD.exe.bat" "118⤵
- Executes a command shell one-liner
PID:4688 -
C:\windows\system\QHD.exeC:\windows\system\QHD.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUIHD.exe.bat" "120⤵PID:5320
-
C:\windows\SysWOW64\KUIHD.exeC:\windows\system32\KUIHD.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-