Analysis
- max time kernel
91s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 03:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_9960efc8dc181073fdf5c07cad4f4123_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-22_9960efc8dc181073fdf5c07cad4f4123_elex_emotet_stop.exe
- Size 208KB
- Sample261024-d5d4hastaw
- SHA256 3a355b111e5c8e6c9b23b5ab961c6dc0026e18567df93a8a8dfa5f19fb3c894c
- MD5 9960efc8dc181073fdf5c07cad4f4123
- SHA1 ba19f0961711b7fcf9379b5b06b12def8bd88083
- SHA512 9681c34632b627cf519d280481b8a4905df8561c9f490e751efde44d6d1f9c64a76b35c21ac55d92735643211ca701ba0a0b67fd1c59bd9fead5266d5b503e4d
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfn4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOvkEj1
- TLSH T109247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5064 BTD.exe 1596 GODVJQ.exe 5312 XPFAMNK.exe 1160 NKOMX.exe 3304 YCRXFP.exe 5876 RFV.exe 2056 LTAKV.exe 3016 VRGF.exe 4956 ZHMFPGV.exe 2848 YRPVXM.exe 2516 CZE.exe 2640 MXJ.exe 2876 GSOY.exe 592 MGNHG.exe 5536 VTY.exe 1920 WWCVB.exe 1172 RJGELCX.exe 1060 LXLO.exe 4092 KHO.exe 4184 FDTN.exe 4884 ZQYXRP.exe 2928 LJTPZWA.exe 4192 QJADI.exe 2360 CCDW.exe 6004 NUGPR.exe 2540 CPQ.exe 4764 CVQH.exe 6064 DYULRDL.exe 3224 MLE.exe 4652 DLGIKFB.exe 2840 PEBBSM.exe 2184 UEJ.exe 5628 JKPMI.exe 2620 RPPSK.exe 1952 PQW.exe 1776 RLTX.exe 1592 DDWI.exe 3372 FTK.exe 2736 BZIAI.exe 3904 HZPNR.exe 4272 EFVLYJI.exe 2520 YSAU.exe 4496 JLVNQ.exe 2144 VDYGRY.exe 5072 ELALCDW.exe 696 TGJPN.exe 3936 UJNTTGG.exe 1824 FCQ.exe 6088 QVTW.exe 3088 AAEOZ.exe 5004 AOW.exe 3376 WLC.exe 4920 CLJOR.exe 5716 XHOXBQM.exe 2332 RUT.exe 2812 MHYQV.exe 1964 XATJWX.exe 576 ANY.exe 6052 LGBL.exe 5992 GBFUQE.exe 6056 PGQMGIL.exe 4900 AZT.exe 4108 BCXJU.exe 5020 GCEWLIL.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\EXU.exe.bat NSJTI.exe File created C:\windows\SysWOW64\KGAOYM.exe.bat NICR.exe File created C:\windows\SysWOW64\VUQEZV.exe REJ.exe File created C:\windows\SysWOW64\KFP.exe.bat RJLBI.exe File created C:\windows\SysWOW64\VXS.exe KFP.exe File opened for modification C:\windows\SysWOW64\LXLO.exe RJGELCX.exe File created C:\windows\SysWOW64\LXLO.exe.bat RJGELCX.exe File created C:\windows\SysWOW64\AAEOZ.exe.bat QVTW.exe File opened for modification C:\windows\SysWOW64\WLC.exe AOW.exe File created C:\windows\SysWOW64\MHYQV.exe.bat RUT.exe File created C:\windows\SysWOW64\WCBHQB.exe AFVKJS.exe File created C:\windows\SysWOW64\VYDHGBO.exe KGAOYM.exe File opened for modification C:\windows\SysWOW64\VUQEZV.exe REJ.exe File created C:\windows\SysWOW64\NKOMX.exe XPFAMNK.exe File created C:\windows\SysWOW64\FZIZTOO.exe.bat UGN.exe File created C:\windows\SysWOW64\HXXA.exe DPQSYZR.exe File opened for modification C:\windows\SysWOW64\EXU.exe NSJTI.exe File created C:\windows\SysWOW64\NICR.exe YFL.exe File created C:\windows\SysWOW64\VZQTBI.exe VUQEZV.exe File opened for modification C:\windows\SysWOW64\HZPNR.exe BZIAI.exe File opened for modification C:\windows\SysWOW64\RUT.exe XHOXBQM.exe File created C:\windows\SysWOW64\RUT.exe.bat XHOXBQM.exe File created C:\windows\SysWOW64\VRPK.exe GWGYYV.exe File opened for modification C:\windows\SysWOW64\HXXA.exe DPQSYZR.exe File created C:\windows\SysWOW64\KFP.exe RJLBI.exe File opened for modification C:\windows\SysWOW64\GSOY.exe MXJ.exe File created C:\windows\SysWOW64\WWCVB.exe.bat VTY.exe File created C:\windows\SysWOW64\NUGPR.exe.bat CCDW.exe File created C:\windows\SysWOW64\WLC.exe.bat AOW.exe File created C:\windows\SysWOW64\AFVKJS.exe.bat DZPNC.exe File opened for modification C:\windows\SysWOW64\JLLU.exe ELDGJC.exe File created C:\windows\SysWOW64\VXS.exe.bat KFP.exe File created C:\windows\SysWOW64\QSXH.exe.bat VXS.exe File opened for modification C:\windows\SysWOW64\FZIZTOO.exe UGN.exe File opened for modification C:\windows\SysWOW64\VRPK.exe GWGYYV.exe File created C:\windows\SysWOW64\KGAOYM.exe NICR.exe File created C:\windows\SysWOW64\JLLU.exe ELDGJC.exe File created C:\windows\SysWOW64\RJLBI.exe.bat XOH.exe File created C:\windows\SysWOW64\QSXH.exe VXS.exe File opened for modification C:\windows\SysWOW64\FCQ.exe UJNTTGG.exe File opened for modification C:\windows\SysWOW64\AAEOZ.exe QVTW.exe File created C:\windows\SysWOW64\WLC.exe AOW.exe File created C:\windows\SysWOW64\ANY.exe.bat XATJWX.exe File created C:\windows\SysWOW64\MHYQV.exe RUT.exe File created C:\windows\SysWOW64\PGQMGIL.exe.bat GBFUQE.exe File created C:\windows\SysWOW64\GSOY.exe MXJ.exe File created C:\windows\SysWOW64\WCBHQB.exe.bat AFVKJS.exe File created C:\windows\SysWOW64\JZNH.exe BLM.exe File opened for modification C:\windows\SysWOW64\JZNH.exe BLM.exe File opened for modification C:\windows\SysWOW64\VYDHGBO.exe KGAOYM.exe File created C:\windows\SysWOW64\GODVJQ.exe.bat BTD.exe File created C:\windows\SysWOW64\RUT.exe XHOXBQM.exe File created C:\windows\SysWOW64\LGBL.exe ANY.exe File created C:\windows\SysWOW64\LGBL.exe.bat ANY.exe File opened for modification C:\windows\SysWOW64\PGQMGIL.exe GBFUQE.exe File created C:\windows\SysWOW64\JLLU.exe.bat ELDGJC.exe File opened for modification C:\windows\SysWOW64\KFP.exe RJLBI.exe File created C:\windows\SysWOW64\RPPSK.exe JKPMI.exe File created C:\windows\SysWOW64\FCQ.exe.bat UJNTTGG.exe File created C:\windows\SysWOW64\AFVKJS.exe DZPNC.exe File created C:\windows\SysWOW64\VRPK.exe.bat GWGYYV.exe File created C:\windows\SysWOW64\VYDHGBO.exe.bat KGAOYM.exe File created C:\windows\SysWOW64\VUQEZV.exe.bat REJ.exe File created C:\windows\SysWOW64\VZQTBI.exe.bat VUQEZV.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\DLGIKFB.exe MLE.exe File created C:\windows\system\LKSH.exe.bat PFUJRVZ.exe File opened for modification C:\windows\AIY.exe LKSH.exe File created C:\windows\AIY.exe.bat LKSH.exe File opened for modification C:\windows\system\BTD.exe 2026-10-22_9960efc8dc181073fdf5c07cad4f4123_elex_emotet_stop.exe File created C:\windows\system\XPFAMNK.exe.bat GODVJQ.exe File created C:\windows\system\AZT.exe.bat PGQMGIL.exe File opened for modification C:\windows\QJADI.exe LJTPZWA.exe File created C:\windows\system\ELALCDW.exe VDYGRY.exe File created C:\windows\system\CLJOR.exe WLC.exe File opened for modification C:\windows\XHOXBQM.exe CLJOR.exe File created C:\windows\system\GBFUQE.exe.bat LGBL.exe File opened for modification C:\windows\SVZH.exe GCEWLIL.exe File opened for modification C:\windows\PFUJRVZ.exe XXSEOX.exe File opened for modification C:\windows\YLVS.exe JFQV.exe File created C:\windows\system\LTAKV.exe.bat RFV.exe File created C:\windows\system\GBFUQE.exe LGBL.exe File created C:\windows\DDDX.exe.bat HXXA.exe File opened for modification C:\windows\QOFMV.exe BIAOGI.exe File created C:\windows\YLVS.exe JFQV.exe File opened for modification C:\windows\system\GCEWLIL.exe BCXJU.exe File created C:\windows\system\RBNAMCE.exe EYXKYZJ.exe File opened for modification C:\windows\system\CLJOR.exe WLC.exe File created C:\windows\system\UNBN.exe.bat DDDX.exe File opened for modification C:\windows\GVVF.exe EXU.exe File created C:\windows\system\ZQYXRP.exe.bat FDTN.exe File created C:\windows\system\EFVLYJI.exe.bat HZPNR.exe File created C:\windows\system\EYXKYZJ.exe.bat CAEH.exe File created C:\windows\VTY.exe MGNHG.exe File opened for modification C:\windows\system\CPQ.exe NUGPR.exe File created C:\windows\XATJWX.exe.bat MHYQV.exe File opened for modification C:\windows\system\UDDNQOS.exe AIY.exe File created C:\windows\BAPH.exe VZQTBI.exe File opened for modification C:\windows\system\JFQV.exe BAPH.exe File opened for modification C:\windows\system\FDTN.exe KHO.exe File opened for modification C:\windows\CCDW.exe QJADI.exe File created C:\windows\system\PQW.exe RPPSK.exe File created C:\windows\SAZW.exe SVZH.exe File created C:\windows\system\MLLAL.exe.bat WQTOAOO.exe File created C:\windows\system\XPIEP.exe.bat VRPK.exe File opened for modification C:\windows\DLGIKFB.exe MLE.exe File opened for modification C:\windows\system\PEBBSM.exe DLGIKFB.exe File created C:\windows\SAZW.exe.bat SVZH.exe File created C:\windows\UGN.exe.bat JOKODZJ.exe File opened for modification C:\windows\system\RBNAMCE.exe EYXKYZJ.exe File created C:\windows\YCRXFP.exe.bat NKOMX.exe File opened for modification C:\windows\system\JKPMI.exe UEJ.exe File created C:\windows\UGN.exe JOKODZJ.exe File opened for modification C:\windows\NSJTI.exe CZOAAH.exe File opened for modification C:\windows\system\RJGELCX.exe WWCVB.exe File created C:\windows\system\CPQ.exe NUGPR.exe File created C:\windows\system\BLM.exe GYQJVB.exe File opened for modification C:\windows\GVIV.exe UNBN.exe File created C:\windows\SBCVYRJ.exe.bat QOFMV.exe File opened for modification C:\windows\BAPH.exe VZQTBI.exe File created C:\windows\system\ELALCDW.exe.bat VDYGRY.exe File created C:\windows\system\LTAKV.exe RFV.exe File created C:\windows\system\MLE.exe DYULRDL.exe File created C:\windows\system\BCXJU.exe.bat AZT.exe File created C:\windows\WQTOAOO.exe.bat WCBHQB.exe File created C:\windows\system\ZQYXRP.exe FDTN.exe File opened for modification C:\windows\LJTPZWA.exe ZQYXRP.exe File created C:\windows\QJADI.exe LJTPZWA.exe File created C:\windows\PFUJRVZ.exe XXSEOX.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3516 cmd.exe 5700 cmd.exe 2996 cmd.exe 5016 cmd.exe 1780 cmd.exe 5344 cmd.exe 3948 cmd.exe 5044 cmd.exe 4572 cmd.exe 792 cmd.exe 3668 cmd.exe 5968 cmd.exe 1876 cmd.exe 4296 cmd.exe 2992 cmd.exe 5776 cmd.exe 4188 cmd.exe 4584 cmd.exe 3836 cmd.exe 1388 cmd.exe 2004 cmd.exe 2800 cmd.exe 4260 cmd.exe 2624 cmd.exe 1324 cmd.exe 2776 cmd.exe 5580 cmd.exe 4608 cmd.exe 4780 cmd.exe 2036 cmd.exe 1520 cmd.exe 3296 cmd.exe 3000 cmd.exe 5768 cmd.exe 4504 cmd.exe 1524 cmd.exe 2512 cmd.exe 5080 cmd.exe 3524 cmd.exe 5944 cmd.exe 5696 cmd.exe 2080 cmd.exe 5548 cmd.exe 4320 cmd.exe 5244 cmd.exe 5520 cmd.exe 1632 cmd.exe 724 cmd.exe 2688 cmd.exe 1604 cmd.exe 4464 cmd.exe 3272 cmd.exe 1112 cmd.exe 1304 cmd.exe 3396 cmd.exe 3428 cmd.exe 2060 cmd.exe 1276 cmd.exe 2140 cmd.exe 2904 cmd.exe 5900 cmd.exe 3472 cmd.exe 3740 cmd.exe 4080 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4464 2692 WerFault.exe 87 3308 5064 WerFault.exe 93 3872 1596 WerFault.exe 99 4984 5312 WerFault.exe 104 1500 1160 WerFault.exe 109 5436 3304 WerFault.exe 114 1080 5876 WerFault.exe 119 2776 2056 WerFault.exe 124 5848 3016 WerFault.exe 129 4884 4956 WerFault.exe 134 5488 2848 WerFault.exe 139 4520 2516 WerFault.exe 144 1616 2640 WerFault.exe 149 2816 2876 WerFault.exe 154 2540 592 WerFault.exe 159 3436 5536 WerFault.exe 164 3372 1920 WerFault.exe 169 3224 1172 WerFault.exe 174 4652 1060 WerFault.exe 179 2052 4092 WerFault.exe 184 2392 4184 WerFault.exe 189 676 4884 WerFault.exe 194 4592 2928 WerFault.exe 199 4324 4192 WerFault.exe 204 4256 2360 WerFault.exe 209 5328 6004 WerFault.exe 214 3368 2540 WerFault.exe 219 1876 4764 WerFault.exe 224 1604 6064 WerFault.exe 229 5384 3224 WerFault.exe 234 3668 4652 WerFault.exe 239 5968 2840 WerFault.exe 244 1336 2184 WerFault.exe 249 3332 5628 WerFault.exe 254 5020 2620 WerFault.exe 259 1600 1952 WerFault.exe 264 2720 1776 WerFault.exe 269 5424 1592 WerFault.exe 274 4780 3372 WerFault.exe 279 4260 2736 WerFault.exe 285 4632 3904 WerFault.exe 290 1756 4272 WerFault.exe 295 5016 2520 WerFault.exe 300 4292 4496 WerFault.exe 305 1460 2144 WerFault.exe 310 3044 5072 WerFault.exe 315 5740 696 WerFault.exe 320 1720 3936 WerFault.exe 325 864 1824 WerFault.exe 330 3844 6088 WerFault.exe 335 2740 3088 WerFault.exe 340 2084 5004 WerFault.exe 345 4320 3376 WerFault.exe 350 1252 4920 WerFault.exe 355 1496 5716 WerFault.exe 360 4308 2332 WerFault.exe 365 2860 2812 WerFault.exe 370 4576 1964 WerFault.exe 375 2680 576 WerFault.exe 380 4768 6052 WerFault.exe 385 2956 5992 WerFault.exe 390 1328 6056 WerFault.exe 395 3452 4900 WerFault.exe 400 2464 4108 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVTW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLJOR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QOFMV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGBL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQTOAOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WWCVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFUJRVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLLU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYXKYZJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KFP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJTPZWA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPPSK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGAOYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWGYYV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUIDT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RJLBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RJGELCX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZHMFPGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZPNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFVKJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YLVS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAEOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MLLAL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VTY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGJPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NICR.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2692 2026-10-22_9960efc8dc181073fdf5c07cad4f4123_elex_emotet_stop.exe 2692 2026-10-22_9960efc8dc181073fdf5c07cad4f4123_elex_emotet_stop.exe 5064 BTD.exe 5064 BTD.exe 1596 GODVJQ.exe 1596 GODVJQ.exe 5312 XPFAMNK.exe 5312 XPFAMNK.exe 1160 NKOMX.exe 1160 NKOMX.exe 3304 YCRXFP.exe 3304 YCRXFP.exe 5876 RFV.exe 5876 RFV.exe 2056 LTAKV.exe 2056 LTAKV.exe 3016 VRGF.exe 3016 VRGF.exe 4956 ZHMFPGV.exe 4956 ZHMFPGV.exe 2848 YRPVXM.exe 2848 YRPVXM.exe 2516 CZE.exe 2516 CZE.exe 2640 MXJ.exe 2640 MXJ.exe 2876 GSOY.exe 2876 GSOY.exe 592 MGNHG.exe 592 MGNHG.exe 5536 VTY.exe 5536 VTY.exe 1920 WWCVB.exe 1920 WWCVB.exe 1172 RJGELCX.exe 1172 RJGELCX.exe 1060 LXLO.exe 1060 LXLO.exe 4092 KHO.exe 4092 KHO.exe 4184 FDTN.exe 4184 FDTN.exe 4884 ZQYXRP.exe 4884 ZQYXRP.exe 2928 LJTPZWA.exe 2928 LJTPZWA.exe 4192 QJADI.exe 4192 QJADI.exe 2360 CCDW.exe 2360 CCDW.exe 6004 NUGPR.exe 6004 NUGPR.exe 2540 CPQ.exe 2540 CPQ.exe 4764 CVQH.exe 4764 CVQH.exe 6064 DYULRDL.exe 6064 DYULRDL.exe 3224 MLE.exe 3224 MLE.exe 4652 DLGIKFB.exe 4652 DLGIKFB.exe 2840 PEBBSM.exe 2840 PEBBSM.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2692 2026-10-22_9960efc8dc181073fdf5c07cad4f4123_elex_emotet_stop.exe 2692 2026-10-22_9960efc8dc181073fdf5c07cad4f4123_elex_emotet_stop.exe 5064 BTD.exe 5064 BTD.exe 1596 GODVJQ.exe 1596 GODVJQ.exe 5312 XPFAMNK.exe 5312 XPFAMNK.exe 1160 NKOMX.exe 1160 NKOMX.exe 3304 YCRXFP.exe 3304 YCRXFP.exe 5876 RFV.exe 5876 RFV.exe 2056 LTAKV.exe 2056 LTAKV.exe 3016 VRGF.exe 3016 VRGF.exe 4956 ZHMFPGV.exe 4956 ZHMFPGV.exe 2848 YRPVXM.exe 2848 YRPVXM.exe 2516 CZE.exe 2516 CZE.exe 2640 MXJ.exe 2640 MXJ.exe 2876 GSOY.exe 2876 GSOY.exe 592 MGNHG.exe 592 MGNHG.exe 5536 VTY.exe 5536 VTY.exe 1920 WWCVB.exe 1920 WWCVB.exe 1172 RJGELCX.exe 1172 RJGELCX.exe 1060 LXLO.exe 1060 LXLO.exe 4092 KHO.exe 4092 KHO.exe 4184 FDTN.exe 4184 FDTN.exe 4884 ZQYXRP.exe 4884 ZQYXRP.exe 2928 LJTPZWA.exe 2928 LJTPZWA.exe 4192 QJADI.exe 4192 QJADI.exe 2360 CCDW.exe 2360 CCDW.exe 6004 NUGPR.exe 6004 NUGPR.exe 2540 CPQ.exe 2540 CPQ.exe 4764 CVQH.exe 4764 CVQH.exe 6064 DYULRDL.exe 6064 DYULRDL.exe 3224 MLE.exe 3224 MLE.exe 4652 DLGIKFB.exe 4652 DLGIKFB.exe 2840 PEBBSM.exe 2840 PEBBSM.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2692 wrote to memory of 1276 2692 2026-10-22_9960efc8dc181073fdf5c07cad4f4123_elex_emotet_stop.exe 89 PID 1276 wrote to memory of 5064 1276 cmd.exe 93 PID 5064 wrote to memory of 4664 5064 BTD.exe 95 PID 4664 wrote to memory of 1596 4664 cmd.exe 99 PID 1596 wrote to memory of 3020 1596 GODVJQ.exe 100 PID 3020 wrote to memory of 5312 3020 cmd.exe 104 PID 5312 wrote to memory of 6020 5312 XPFAMNK.exe 105 PID 6020 wrote to memory of 1160 6020 cmd.exe 109 PID 1160 wrote to memory of 4216 1160 NKOMX.exe 110 PID 4216 wrote to memory of 3304 4216 cmd.exe 114 PID 3304 wrote to memory of 6028 3304 YCRXFP.exe 115 PID 6028 wrote to memory of 5876 6028 cmd.exe 119 PID 5876 wrote to memory of 2616 5876 RFV.exe 120 PID 2616 wrote to memory of 2056 2616 cmd.exe 124 PID 2056 wrote to memory of 1116 2056 LTAKV.exe 125 PID 1116 wrote to memory of 3016 1116 cmd.exe 129 PID 3016 wrote to memory of 3132 3016 VRGF.exe 130 PID 3132 wrote to memory of 4956 3132 cmd.exe 134 PID 4956 wrote to memory of 4188 4956 ZHMFPGV.exe 135 PID 4188 wrote to memory of 2848 4188 cmd.exe 139 PID 2848 wrote to memory of 4572 2848 YRPVXM.exe 140 PID 4572 wrote to memory of 2516 4572 cmd.exe 144 PID 2516 wrote to memory of 1844 2516 CZE.exe 145 PID 1844 wrote to memory of 2640 1844 cmd.exe 149 PID 2640 wrote to memory of 5636 2640 MXJ.exe 150 PID 5636 wrote to memory of 2876 5636 cmd.exe 154 PID 2876 wrote to memory of 4976 2876 GSOY.exe 155 PID 4976 wrote to memory of 592 4976 cmd.exe 159 PID 592 wrote to memory of 4388 592 MGNHG.exe 160 PID 4388 wrote to memory of 5536 4388 cmd.exe 164 PID 5536 wrote to memory of 2940 5536 VTY.exe 165 PID 2940 wrote to memory of 1920 2940 cmd.exe 169 PID 1920 wrote to memory of 2448 1920 WWCVB.exe 170 PID 2448 wrote to memory of 1172 2448 cmd.exe 174 PID 1172 wrote to memory of 5920 1172 RJGELCX.exe 175 PID 5920 wrote to memory of 1060 5920 cmd.exe 179 PID 1060 wrote to memory of 468 1060 LXLO.exe 180 PID 468 wrote to memory of 4092 468 cmd.exe 184 PID 4092 wrote to memory of 5320 4092 KHO.exe 185 PID 5320 wrote to memory of 4184 5320 cmd.exe 189 PID 4184 wrote to memory of 2140 4184 FDTN.exe 190 PID 2140 wrote to memory of 4884 2140 cmd.exe 194 PID 4884 wrote to memory of 1096 4884 ZQYXRP.exe 195 PID 1096 wrote to memory of 2928 1096 cmd.exe 199 PID 2928 wrote to memory of 2904 2928 LJTPZWA.exe 200 PID 2904 wrote to memory of 4192 2904 cmd.exe 204 PID 4192 wrote to memory of 3396 4192 QJADI.exe 205 PID 3396 wrote to memory of 2360 3396 cmd.exe 209 PID 2360 wrote to memory of 3688 2360 CCDW.exe 210 PID 3688 wrote to memory of 6004 3688 cmd.exe 214 PID 6004 wrote to memory of 5900 6004 NUGPR.exe 215 PID 5900 wrote to memory of 2540 5900 cmd.exe 219 PID 2540 wrote to memory of 3040 2540 CPQ.exe 220 PID 3040 wrote to memory of 4764 3040 cmd.exe 224 PID 4764 wrote to memory of 2688 4764 CVQH.exe 225 PID 2688 wrote to memory of 6064 2688 cmd.exe 229 PID 6064 wrote to memory of 2096 6064 DYULRDL.exe 230 PID 2096 wrote to memory of 3224 2096 cmd.exe 234 PID 3224 wrote to memory of 4132 3224 MLE.exe 235 PID 4132 wrote to memory of 4652 4132 cmd.exe 239 PID 4652 wrote to memory of 2624 4652 DLGIKFB.exe 240 PID 2624 wrote to memory of 2840 2624 cmd.exe 244 PID 2840 wrote to memory of 2128 2840 PEBBSM.exe 245 PID 2128 wrote to memory of 2184 2128 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_9960efc8dc181073fdf5c07cad4f4123_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_9960efc8dc181073fdf5c07cad4f4123_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTD.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\windows\system\BTD.exeC:\windows\system\BTD.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GODVJQ.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\windows\SysWOW64\GODVJQ.exeC:\windows\system32\GODVJQ.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPFAMNK.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\windows\system\XPFAMNK.exeC:\windows\system\XPFAMNK.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NKOMX.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\windows\SysWOW64\NKOMX.exeC:\windows\system32\NKOMX.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCRXFP.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\YCRXFP.exeC:\windows\YCRXFP.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RFV.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\windows\RFV.exeC:\windows\RFV.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LTAKV.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\windows\system\LTAKV.exeC:\windows\system\LTAKV.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRGF.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\windows\VRGF.exeC:\windows\VRGF.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZHMFPGV.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\windows\ZHMFPGV.exeC:\windows\ZHMFPGV.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YRPVXM.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\windows\YRPVXM.exeC:\windows\YRPVXM.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZE.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\windows\system\CZE.exeC:\windows\system\CZE.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXJ.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\windows\MXJ.exeC:\windows\MXJ.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSOY.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\windows\SysWOW64\GSOY.exeC:\windows\system32\GSOY.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MGNHG.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\windows\MGNHG.exeC:\windows\MGNHG.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VTY.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\windows\VTY.exeC:\windows\VTY.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WWCVB.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\windows\SysWOW64\WWCVB.exeC:\windows\system32\WWCVB.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RJGELCX.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\windows\system\RJGELCX.exeC:\windows\system\RJGELCX.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LXLO.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\windows\SysWOW64\LXLO.exeC:\windows\system32\LXLO.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KHO.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:468 -
C:\windows\KHO.exeC:\windows\KHO.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FDTN.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\windows\system\FDTN.exeC:\windows\system\FDTN.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZQYXRP.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\windows\system\ZQYXRP.exeC:\windows\system\ZQYXRP.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJTPZWA.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\windows\LJTPZWA.exeC:\windows\LJTPZWA.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QJADI.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\windows\QJADI.exeC:\windows\QJADI.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCDW.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\windows\CCDW.exeC:\windows\CCDW.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NUGPR.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\windows\SysWOW64\NUGPR.exeC:\windows\system32\NUGPR.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPQ.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\windows\system\CPQ.exeC:\windows\system\CPQ.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CVQH.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\windows\system\CVQH.exeC:\windows\system\CVQH.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYULRDL.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\windows\DYULRDL.exeC:\windows\DYULRDL.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLE.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\windows\system\MLE.exeC:\windows\system\MLE.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DLGIKFB.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\windows\DLGIKFB.exeC:\windows\DLGIKFB.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEBBSM.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\windows\system\PEBBSM.exeC:\windows\system\PEBBSM.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UEJ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\windows\system\UEJ.exeC:\windows\system\UEJ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JKPMI.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5244 -
C:\windows\system\JKPMI.exeC:\windows\system\JKPMI.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RPPSK.exe.bat" "68⤵PID:2108
-
C:\windows\SysWOW64\RPPSK.exeC:\windows\system32\RPPSK.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQW.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4584 -
C:\windows\system\PQW.exeC:\windows\system\PQW.exe71⤵
- Executes dropped EXE
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLTX.exe.bat" "72⤵PID:4256
-
C:\windows\system\RLTX.exeC:\windows\system\RLTX.exe73⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDWI.exe.bat" "74⤵PID:3204
-
C:\windows\SysWOW64\DDWI.exeC:\windows\system32\DDWI.exe75⤵
- Executes dropped EXE
PID:1592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTK.exe.bat" "76⤵
- Executes a command shell one-liner
PID:1520 -
C:\windows\FTK.exeC:\windows\FTK.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BZIAI.exe.bat" "78⤵PID:5428
-
C:\windows\system\BZIAI.exeC:\windows\system\BZIAI.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HZPNR.exe.bat" "80⤵PID:5880
-
C:\windows\SysWOW64\HZPNR.exeC:\windows\system32\HZPNR.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EFVLYJI.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2080 -
C:\windows\system\EFVLYJI.exeC:\windows\system\EFVLYJI.exe83⤵
- Executes dropped EXE
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YSAU.exe.bat" "84⤵PID:5672
-
C:\windows\SysWOW64\YSAU.exeC:\windows\system32\YSAU.exe85⤵
- Executes dropped EXE
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLVNQ.exe.bat" "86⤵PID:4420
-
C:\windows\system\JLVNQ.exeC:\windows\system\JLVNQ.exe87⤵
- Executes dropped EXE
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VDYGRY.exe.bat" "88⤵PID:4684
-
C:\windows\VDYGRY.exeC:\windows\VDYGRY.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELALCDW.exe.bat" "90⤵
- Executes a command shell one-liner
PID:792 -
C:\windows\system\ELALCDW.exeC:\windows\system\ELALCDW.exe91⤵
- Executes dropped EXE
PID:5072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGJPN.exe.bat" "92⤵PID:5268
-
C:\windows\system\TGJPN.exeC:\windows\system\TGJPN.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UJNTTGG.exe.bat" "94⤵
- Executes a command shell one-liner
PID:1324 -
C:\windows\system\UJNTTGG.exeC:\windows\system\UJNTTGG.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCQ.exe.bat" "96⤵
- Executes a command shell one-liner
PID:4504 -
C:\windows\SysWOW64\FCQ.exeC:\windows\system32\FCQ.exe97⤵
- Executes dropped EXE
PID:1824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVTW.exe.bat" "98⤵
- Executes a command shell one-liner
PID:1604 -
C:\windows\QVTW.exeC:\windows\QVTW.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAEOZ.exe.bat" "100⤵PID:3448
-
C:\windows\SysWOW64\AAEOZ.exeC:\windows\system32\AAEOZ.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOW.exe.bat" "102⤵
- Executes a command shell one-liner
PID:3668 -
C:\windows\system\AOW.exeC:\windows\system\AOW.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLC.exe.bat" "104⤵
- Executes a command shell one-liner
PID:2776 -
C:\windows\SysWOW64\WLC.exeC:\windows\system32\WLC.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLJOR.exe.bat" "106⤵
- Executes a command shell one-liner
PID:5520 -
C:\windows\system\CLJOR.exeC:\windows\system\CLJOR.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHOXBQM.exe.bat" "108⤵PID:4324
-
C:\windows\XHOXBQM.exeC:\windows\XHOXBQM.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUT.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3428 -
C:\windows\SysWOW64\RUT.exeC:\windows\system32\RUT.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MHYQV.exe.bat" "112⤵PID:816
-
C:\windows\SysWOW64\MHYQV.exeC:\windows\system32\MHYQV.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XATJWX.exe.bat" "114⤵PID:3584
-
C:\windows\XATJWX.exeC:\windows\XATJWX.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANY.exe.bat" "116⤵PID:4880
-
C:\windows\SysWOW64\ANY.exeC:\windows\system32\ANY.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGBL.exe.bat" "118⤵
- Executes a command shell one-liner
PID:4080 -
C:\windows\SysWOW64\LGBL.exeC:\windows\system32\LGBL.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GBFUQE.exe.bat" "120⤵PID:5908
-
C:\windows\system\GBFUQE.exeC:\windows\system\GBFUQE.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-