Analysis
- max time kernel
91s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 04:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_96348d0cae0e78edec51ee7fc7b65978_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-22_96348d0cae0e78edec51ee7fc7b65978_elex_emotet_stop.exe
- Size 208KB
- Sample261024-eltkhshw7k
- SHA256 e78fa35d34f361ef3fbe135899a80fe1bf6645710027f241eb874ad9cddda408
- MD5 96348d0cae0e78edec51ee7fc7b65978
- SHA1 9638274c52228b78b0e129d7e9defdacb197abf6
- SHA512 c18479a90c76206e889d4127842f65dacb2a6221c0665598f3596c613e74e867710a153174620e5c7c3669d43cc264fdcf02f7c42a087ba622235d934f6277e6
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbIlUdL+LOfh4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbIlU5+LOZkEj1
- TLSH T114247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6128 XPEX.exe 4996 FCDEKGO.exe 2448 JFBRK.exe 4456 VVHZWSM.exe 1984 QIMI.exe 1520 EGSFNB.exe 5892 QWZ.exe 2192 SUSH.exe 6108 QUZV.exe 2520 WUHJYF.exe 1392 NFGZYAF.exe 6056 XDLTFI.exe 3960 QWBE.exe 2376 BOWXX.exe 3852 MHZQFYB.exe 1428 CCIU.exe 3040 PIQ.exe 5888 EDZKLR.exe 464 ZQE.exe 2728 KIZM.exe 4808 UJBZH.exe 3372 ZJJNQXT.exe 1496 FJQBZ.exe 4612 LFQBE.exe 564 AAZ.exe 1768 BNZU.exe 1352 RDYF.exe 1704 GYQJVB.exe 5268 IWJETYU.exe 2812 TOM.exe 1212 ZPTKLH.exe 4272 FPBYCB.exe 1556 FVTMDOG.exe 4084 LVBA.exe 6072 LBBOO.exe 4708 COLGDSY.exe 5656 ZTJELCA.exe 2648 THON.exe 4828 FZRGD.exe 5084 HXKIBG.exe 5800 MXS.exe 6124 HLXFV.exe 5396 NLETMCM.exe 1804 HYJC.exe 2272 TRM.exe 2408 HWSKD.exe 5852 ECQHSD.exe 5936 YPV.exe 2592 KIYJDKQ.exe 3092 EVCT.exe 4504 MBVHPPA.exe 2132 BEM.exe 2168 BJEAJ.exe 5428 REWMUJ.exe 5632 LSS.exe 3224 GNXFH.exe 2548 GTX.exe 3704 ODG.exe 1236 IYLE.exe 2868 URGXOH.exe 1952 JMXC.exe 1604 WPT.exe 4012 KUZX.exe 4732 CDBCXB.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\TBJ.exe.bat CTHQUWM.exe File created C:\windows\SysWOW64\KFINU.exe.bat MFBALRI.exe File opened for modification C:\windows\SysWOW64\SUSH.exe QWZ.exe File opened for modification C:\windows\SysWOW64\HWSKD.exe TRM.exe File created C:\windows\SysWOW64\FNIKV.exe.bat VAYSFXX.exe File created C:\windows\SysWOW64\CBPQR.exe.bat RJUX.exe File opened for modification C:\windows\SysWOW64\FNIKV.exe VAYSFXX.exe File created C:\windows\SysWOW64\QAEXMP.exe.bat RQDWYK.exe File created C:\windows\SysWOW64\SPH.exe QBCYEJH.exe File created C:\windows\SysWOW64\GKCZG.exe.bat WMOFZGR.exe File opened for modification C:\windows\SysWOW64\FCDEKGO.exe XPEX.exe File opened for modification C:\windows\SysWOW64\FZRGD.exe THON.exe File created C:\windows\SysWOW64\YOZ.exe YAZZECM.exe File created C:\windows\SysWOW64\VRUIR.exe.bat AEP.exe File created C:\windows\SysWOW64\CXV.exe HKRUAD.exe File created C:\windows\SysWOW64\YIBHT.exe HIZCPUO.exe File created C:\windows\SysWOW64\FGZBO.exe VXX.exe File created C:\windows\SysWOW64\YOZ.exe.bat YAZZECM.exe File opened for modification C:\windows\SysWOW64\FCTZQMG.exe TMNZE.exe File created C:\windows\SysWOW64\PZNDZ.exe EHKK.exe File opened for modification C:\windows\SysWOW64\CBPQR.exe RJUX.exe File opened for modification C:\windows\SysWOW64\XDLTFI.exe NFGZYAF.exe File created C:\windows\SysWOW64\JMXC.exe URGXOH.exe File opened for modification C:\windows\SysWOW64\QAEXMP.exe RQDWYK.exe File created C:\windows\SysWOW64\CBPQR.exe RJUX.exe File opened for modification C:\windows\SysWOW64\JFBRK.exe FCDEKGO.exe File created C:\windows\SysWOW64\SUSH.exe.bat QWZ.exe File opened for modification C:\windows\SysWOW64\AAZ.exe LFQBE.exe File opened for modification C:\windows\SysWOW64\FGZBO.exe VXX.exe File created C:\windows\SysWOW64\FGZBO.exe.bat VXX.exe File created C:\windows\SysWOW64\LIMJAJS.exe.bat KFINU.exe File opened for modification C:\windows\SysWOW64\THON.exe ZTJELCA.exe File created C:\windows\SysWOW64\FCTZQMG.exe TMNZE.exe File opened for modification C:\windows\SysWOW64\CXV.exe HKRUAD.exe File created C:\windows\SysWOW64\QUZV.exe SUSH.exe File created C:\windows\SysWOW64\XDLTFI.exe.bat NFGZYAF.exe File created C:\windows\SysWOW64\AAZ.exe LFQBE.exe File created C:\windows\SysWOW64\GNXFH.exe LSS.exe File created C:\windows\SysWOW64\ODG.exe GTX.exe File opened for modification C:\windows\SysWOW64\OCVE.exe FCTZQMG.exe File created C:\windows\SysWOW64\DIHCJ.exe HDCNUR.exe File opened for modification C:\windows\SysWOW64\HKRUAD.exe SPH.exe File opened for modification C:\windows\SysWOW64\WUHJYF.exe QUZV.exe File created C:\windows\SysWOW64\KIZM.exe ZQE.exe File created C:\windows\SysWOW64\GJE.exe CBPQR.exe File created C:\windows\SysWOW64\MHZQFYB.exe.bat BOWXX.exe File opened for modification C:\windows\SysWOW64\LSS.exe REWMUJ.exe File created C:\windows\SysWOW64\URGXOH.exe.bat IYLE.exe File created C:\windows\SysWOW64\HKRUAD.exe.bat SPH.exe File opened for modification C:\windows\SysWOW64\TBJ.exe CTHQUWM.exe File opened for modification C:\windows\SysWOW64\IWJETYU.exe GYQJVB.exe File created C:\windows\SysWOW64\FPBYCB.exe.bat ZPTKLH.exe File created C:\windows\SysWOW64\IAAMYVE.exe.bat AHSKKJP.exe File created C:\windows\SysWOW64\GKCZG.exe WMOFZGR.exe File created C:\windows\SysWOW64\JMXC.exe.bat URGXOH.exe File created C:\windows\SysWOW64\ODA.exe QIB.exe File created C:\windows\SysWOW64\CXV.exe.bat HKRUAD.exe File opened for modification C:\windows\SysWOW64\NIW.exe VAURI.exe File created C:\windows\SysWOW64\GJE.exe.bat CBPQR.exe File opened for modification C:\windows\SysWOW64\ZVQXC.exe OCVE.exe File opened for modification C:\windows\SysWOW64\DIHCJ.exe HDCNUR.exe File created C:\windows\SysWOW64\JJP.exe DIHCJ.exe File opened for modification C:\windows\SysWOW64\JJP.exe DIHCJ.exe File created C:\windows\SysWOW64\JFBRK.exe FCDEKGO.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\CZRVP.exe FTLY.exe File opened for modification C:\windows\GTX.exe GNXFH.exe File created C:\windows\GYQJVB.exe.bat RDYF.exe File created C:\windows\system\QIMI.exe VVHZWSM.exe File opened for modification C:\windows\system\QWBE.exe XDLTFI.exe File created C:\windows\FJQBZ.exe ZJJNQXT.exe File opened for modification C:\windows\system\LFQBE.exe FJQBZ.exe File created C:\windows\system\BJEAJ.exe.bat BEM.exe File created C:\windows\system\KXU.exe IAAMYVE.exe File created C:\windows\system\FVTMDOG.exe FPBYCB.exe File created C:\windows\LBBOO.exe LVBA.exe File created C:\windows\LBBOO.exe.bat LVBA.exe File opened for modification C:\windows\BEM.exe MBVHPPA.exe File created C:\windows\system\REWMUJ.exe.bat BJEAJ.exe File created C:\windows\EJHFW.exe.bat TQEM.exe File opened for modification C:\windows\system\ZARZWVH.exe EEMPM.exe File created C:\windows\BOWXX.exe.bat QWBE.exe File created C:\windows\CCIU.exe.bat MHZQFYB.exe File created C:\windows\system\LVBA.exe FVTMDOG.exe File opened for modification C:\windows\system\NLETMCM.exe HLXFV.exe File opened for modification C:\windows\UDILXA.exe ODA.exe File opened for modification C:\windows\system\ELYXH.exe KXU.exe File created C:\windows\system\RQDWYK.exe NIW.exe File created C:\windows\CZRVP.exe.bat FTLY.exe File opened for modification C:\windows\EGSFNB.exe QIMI.exe File opened for modification C:\windows\ZJJNQXT.exe UJBZH.exe File created C:\windows\system\YBCIGE.exe YIBHT.exe File created C:\windows\ZPTKLH.exe TOM.exe File created C:\windows\HXKIBG.exe.bat FZRGD.exe File created C:\windows\system\TRM.exe.bat HYJC.exe File created C:\windows\system\IYLE.exe.bat ODG.exe File opened for modification C:\windows\WPT.exe JMXC.exe File opened for modification C:\windows\system\CDBCXB.exe KUZX.exe File created C:\windows\YAZZECM.exe.bat CDBCXB.exe File created C:\windows\system\AHSKKJP.exe UHKXB.exe File created C:\windows\system\LVBA.exe.bat FVTMDOG.exe File created C:\windows\system\MXS.exe.bat HXKIBG.exe File opened for modification C:\windows\YAZZECM.exe CDBCXB.exe File created C:\windows\system\KXU.exe.bat IAAMYVE.exe File opened for modification C:\windows\EJHFW.exe TQEM.exe File created C:\windows\system\VGIFNGZ.exe.bat YBCIGE.exe File opened for modification C:\windows\EEMPM.exe ZCQJHW.exe File opened for modification C:\windows\VXX.exe ZARZWVH.exe File created C:\windows\system\UJBZH.exe KIZM.exe File opened for modification C:\windows\system\UJBZH.exe KIZM.exe File opened for modification C:\windows\system\FVTMDOG.exe FPBYCB.exe File opened for modification C:\windows\system\MXS.exe HXKIBG.exe File created C:\windows\system\HYJC.exe.bat NLETMCM.exe File opened for modification C:\windows\FJQBZ.exe ZJJNQXT.exe File opened for modification C:\windows\system\RJUX.exe LIMJAJS.exe File created C:\windows\KIYJDKQ.exe YPV.exe File created C:\windows\system\TOM.exe IWJETYU.exe File created C:\windows\HTEKRC.exe.bat FGZBO.exe File created C:\windows\system\WMOFZGR.exe.bat CZRVP.exe File opened for modification C:\windows\system\PKYD.exe GJE.exe File opened for modification C:\windows\system\XPEX.exe 2026-10-22_96348d0cae0e78edec51ee7fc7b65978_elex_emotet_stop.exe File created C:\windows\system\EDZKLR.exe PIQ.exe File created C:\windows\RDYF.exe BNZU.exe File created C:\windows\system\HYJC.exe NLETMCM.exe File created C:\windows\system\ECQHSD.exe HWSKD.exe File created C:\windows\TMNZE.exe EOH.exe File created C:\windows\VXX.exe.bat ZARZWVH.exe File opened for modification C:\windows\system\WMOFZGR.exe CZRVP.exe File created C:\windows\YPV.exe ECQHSD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2496 cmd.exe 2188 cmd.exe 1188 cmd.exe 1464 cmd.exe 5156 cmd.exe 4236 cmd.exe 2120 cmd.exe 948 cmd.exe 3260 cmd.exe 4988 cmd.exe 6020 cmd.exe 6104 cmd.exe 5596 cmd.exe 4520 cmd.exe 2836 cmd.exe 5408 cmd.exe 4064 cmd.exe 4468 cmd.exe 2124 cmd.exe 6052 cmd.exe 5028 cmd.exe 1732 cmd.exe 1304 cmd.exe 5436 cmd.exe 4948 cmd.exe 6096 cmd.exe 5092 cmd.exe 2752 cmd.exe 2644 cmd.exe 3784 cmd.exe 3544 cmd.exe 4736 cmd.exe 2904 cmd.exe 4704 cmd.exe 4804 cmd.exe 3720 cmd.exe 1980 cmd.exe 4060 cmd.exe 5512 cmd.exe 2328 cmd.exe 1460 cmd.exe 2028 cmd.exe 3420 cmd.exe 4560 cmd.exe 4420 cmd.exe 4836 cmd.exe 4944 cmd.exe 4016 cmd.exe 1848 cmd.exe 3752 cmd.exe 4376 cmd.exe 1192 cmd.exe 2528 cmd.exe 1664 cmd.exe 2800 cmd.exe 5620 cmd.exe 4580 cmd.exe 6092 cmd.exe 3736 cmd.exe 5136 cmd.exe 4876 cmd.exe 4300 cmd.exe 1276 cmd.exe 5964 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1960 1652 WerFault.exe 89 4492 6128 WerFault.exe 94 2964 4996 WerFault.exe 100 4712 2448 WerFault.exe 105 1752 4456 WerFault.exe 110 2360 1984 WerFault.exe 115 2572 1520 WerFault.exe 120 720 5892 WerFault.exe 125 4624 2192 WerFault.exe 130 2168 6108 WerFault.exe 135 5356 2520 WerFault.exe 140 4808 1392 WerFault.exe 145 2528 6056 WerFault.exe 150 1496 3960 WerFault.exe 156 1656 2376 WerFault.exe 161 6052 3852 WerFault.exe 166 2968 1428 WerFault.exe 171 5616 3040 WerFault.exe 176 1176 5888 WerFault.exe 181 3992 464 WerFault.exe 186 5640 2728 WerFault.exe 191 5748 4808 WerFault.exe 196 3448 3372 WerFault.exe 201 5624 1496 WerFault.exe 206 4684 4612 WerFault.exe 211 5752 564 WerFault.exe 216 1940 1768 WerFault.exe 220 1604 1352 WerFault.exe 226 5020 1704 WerFault.exe 231 876 5268 WerFault.exe 236 2764 2812 WerFault.exe 241 5532 1212 WerFault.exe 246 1500 4272 WerFault.exe 251 2360 1556 WerFault.exe 256 3824 4084 WerFault.exe 261 3888 6072 WerFault.exe 266 2836 4708 WerFault.exe 271 4824 5656 WerFault.exe 276 5012 2648 WerFault.exe 281 5252 4828 WerFault.exe 286 5000 5084 WerFault.exe 292 4176 5800 WerFault.exe 297 3328 6124 WerFault.exe 302 4720 5396 WerFault.exe 307 4588 1804 WerFault.exe 312 5876 2272 WerFault.exe 317 5064 2408 WerFault.exe 322 2040 5852 WerFault.exe 327 4500 5936 WerFault.exe 332 1500 2592 WerFault.exe 337 5840 3092 WerFault.exe 342 1468 4504 WerFault.exe 347 2284 2132 WerFault.exe 352 3212 2168 WerFault.exe 357 4044 5428 WerFault.exe 362 5356 5632 WerFault.exe 367 2740 3224 WerFault.exe 372 1744 2548 WerFault.exe 377 1412 3704 WerFault.exe 382 3296 1236 WerFault.exe 387 4208 2868 WerFault.exe 392 3972 1952 WerFault.exe 397 4952 1604 WerFault.exe 402 960 4012 WerFault.exe 407 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYQJVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJQBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YAZZECM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZVQXC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFQBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZCQJHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYLE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNIKV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECQHSD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHKK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHZQFYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBCIGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FGZBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMTJVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBPQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDCNUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AHSKKJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUHJYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QAEXMP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPBYCB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBCYEJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIMJAJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VVHZWSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLXFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GNXFH.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1652 2026-10-22_96348d0cae0e78edec51ee7fc7b65978_elex_emotet_stop.exe 1652 2026-10-22_96348d0cae0e78edec51ee7fc7b65978_elex_emotet_stop.exe 6128 XPEX.exe 6128 XPEX.exe 4996 FCDEKGO.exe 4996 FCDEKGO.exe 2448 JFBRK.exe 2448 JFBRK.exe 4456 VVHZWSM.exe 4456 VVHZWSM.exe 1984 QIMI.exe 1984 QIMI.exe 1520 EGSFNB.exe 1520 EGSFNB.exe 5892 QWZ.exe 5892 QWZ.exe 2192 SUSH.exe 2192 SUSH.exe 6108 QUZV.exe 6108 QUZV.exe 2520 WUHJYF.exe 2520 WUHJYF.exe 1392 NFGZYAF.exe 1392 NFGZYAF.exe 6056 XDLTFI.exe 6056 XDLTFI.exe 3960 QWBE.exe 3960 QWBE.exe 2376 BOWXX.exe 2376 BOWXX.exe 3852 MHZQFYB.exe 3852 MHZQFYB.exe 1428 CCIU.exe 1428 CCIU.exe 3040 PIQ.exe 3040 PIQ.exe 5888 EDZKLR.exe 5888 EDZKLR.exe 464 ZQE.exe 464 ZQE.exe 2728 KIZM.exe 2728 KIZM.exe 4808 UJBZH.exe 4808 UJBZH.exe 3372 ZJJNQXT.exe 3372 ZJJNQXT.exe 1496 FJQBZ.exe 1496 FJQBZ.exe 4612 LFQBE.exe 4612 LFQBE.exe 564 AAZ.exe 564 AAZ.exe 1768 BNZU.exe 1768 BNZU.exe 1352 RDYF.exe 1352 RDYF.exe 1704 GYQJVB.exe 1704 GYQJVB.exe 5268 IWJETYU.exe 5268 IWJETYU.exe 2812 TOM.exe 2812 TOM.exe 1212 ZPTKLH.exe 1212 ZPTKLH.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1652 2026-10-22_96348d0cae0e78edec51ee7fc7b65978_elex_emotet_stop.exe 1652 2026-10-22_96348d0cae0e78edec51ee7fc7b65978_elex_emotet_stop.exe 6128 XPEX.exe 6128 XPEX.exe 4996 FCDEKGO.exe 4996 FCDEKGO.exe 2448 JFBRK.exe 2448 JFBRK.exe 4456 VVHZWSM.exe 4456 VVHZWSM.exe 1984 QIMI.exe 1984 QIMI.exe 1520 EGSFNB.exe 1520 EGSFNB.exe 5892 QWZ.exe 5892 QWZ.exe 2192 SUSH.exe 2192 SUSH.exe 6108 QUZV.exe 6108 QUZV.exe 2520 WUHJYF.exe 2520 WUHJYF.exe 1392 NFGZYAF.exe 1392 NFGZYAF.exe 6056 XDLTFI.exe 6056 XDLTFI.exe 3960 QWBE.exe 3960 QWBE.exe 2376 BOWXX.exe 2376 BOWXX.exe 3852 MHZQFYB.exe 3852 MHZQFYB.exe 1428 CCIU.exe 1428 CCIU.exe 3040 PIQ.exe 3040 PIQ.exe 5888 EDZKLR.exe 5888 EDZKLR.exe 464 ZQE.exe 464 ZQE.exe 2728 KIZM.exe 2728 KIZM.exe 4808 UJBZH.exe 4808 UJBZH.exe 3372 ZJJNQXT.exe 3372 ZJJNQXT.exe 1496 FJQBZ.exe 1496 FJQBZ.exe 4612 LFQBE.exe 4612 LFQBE.exe 564 AAZ.exe 564 AAZ.exe 1768 BNZU.exe 1768 BNZU.exe 1352 RDYF.exe 1352 RDYF.exe 1704 GYQJVB.exe 1704 GYQJVB.exe 5268 IWJETYU.exe 5268 IWJETYU.exe 2812 TOM.exe 2812 TOM.exe 1212 ZPTKLH.exe 1212 ZPTKLH.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1652 wrote to memory of 4876 1652 2026-10-22_96348d0cae0e78edec51ee7fc7b65978_elex_emotet_stop.exe 90 PID 4876 wrote to memory of 6128 4876 cmd.exe 94 PID 6128 wrote to memory of 4600 6128 XPEX.exe 96 PID 4600 wrote to memory of 4996 4600 cmd.exe 100 PID 4996 wrote to memory of 5512 4996 FCDEKGO.exe 101 PID 5512 wrote to memory of 2448 5512 cmd.exe 105 PID 2448 wrote to memory of 4064 2448 JFBRK.exe 106 PID 4064 wrote to memory of 4456 4064 cmd.exe 110 PID 4456 wrote to memory of 1632 4456 VVHZWSM.exe 111 PID 1632 wrote to memory of 1984 1632 cmd.exe 115 PID 1984 wrote to memory of 2328 1984 QIMI.exe 116 PID 2328 wrote to memory of 1520 2328 cmd.exe 120 PID 1520 wrote to memory of 3308 1520 EGSFNB.exe 121 PID 3308 wrote to memory of 5892 3308 cmd.exe 125 PID 5892 wrote to memory of 1564 5892 QWZ.exe 126 PID 1564 wrote to memory of 2192 1564 cmd.exe 130 PID 2192 wrote to memory of 1728 2192 SUSH.exe 131 PID 1728 wrote to memory of 6108 1728 cmd.exe 135 PID 6108 wrote to memory of 2496 6108 QUZV.exe 136 PID 2496 wrote to memory of 2520 2496 cmd.exe 140 PID 2520 wrote to memory of 3784 2520 WUHJYF.exe 141 PID 1392 wrote to memory of 4048 1392 NFGZYAF.exe 146 PID 4048 wrote to memory of 6056 4048 cmd.exe 150 PID 6056 wrote to memory of 2964 6056 XDLTFI.exe 152 PID 2964 wrote to memory of 3960 2964 cmd.exe 156 PID 3960 wrote to memory of 4248 3960 QWBE.exe 157 PID 4248 wrote to memory of 2376 4248 cmd.exe 161 PID 2376 wrote to memory of 3260 2376 BOWXX.exe 162 PID 3260 wrote to memory of 3852 3260 cmd.exe 166 PID 3852 wrote to memory of 3512 3852 MHZQFYB.exe 167 PID 3512 wrote to memory of 1428 3512 cmd.exe 171 PID 1428 wrote to memory of 3544 1428 CCIU.exe 172 PID 3544 wrote to memory of 3040 3544 cmd.exe 176 PID 3040 wrote to memory of 5212 3040 PIQ.exe 177 PID 5212 wrote to memory of 5888 5212 cmd.exe 181 PID 5888 wrote to memory of 1232 5888 EDZKLR.exe 182 PID 1232 wrote to memory of 464 1232 cmd.exe 186 PID 464 wrote to memory of 4308 464 ZQE.exe 187 PID 4308 wrote to memory of 2728 4308 cmd.exe 191 PID 2728 wrote to memory of 4988 2728 KIZM.exe 192 PID 4988 wrote to memory of 4808 4988 cmd.exe 196 PID 4808 wrote to memory of 1932 4808 UJBZH.exe 197 PID 1932 wrote to memory of 3372 1932 cmd.exe 201 PID 3372 wrote to memory of 4836 3372 ZJJNQXT.exe 202 PID 4836 wrote to memory of 1496 4836 cmd.exe 206 PID 1496 wrote to memory of 6020 1496 FJQBZ.exe 207 PID 6020 wrote to memory of 4612 6020 cmd.exe 211 PID 4612 wrote to memory of 4944 4612 LFQBE.exe 212 PID 4944 wrote to memory of 564 4944 cmd.exe 216 PID 564 wrote to memory of 4260 564 AAZ.exe 217 PID 4260 wrote to memory of 1768 4260 cmd.exe 220 PID 1768 wrote to memory of 4060 1768 BNZU.exe 222 PID 4060 wrote to memory of 1352 4060 cmd.exe 226 PID 1352 wrote to memory of 4468 1352 RDYF.exe 227 PID 4468 wrote to memory of 1704 4468 cmd.exe 231 PID 1704 wrote to memory of 4016 1704 GYQJVB.exe 232 PID 4016 wrote to memory of 5268 4016 cmd.exe 236 PID 5268 wrote to memory of 1748 5268 IWJETYU.exe 237 PID 1748 wrote to memory of 2812 1748 cmd.exe 241 PID 2812 wrote to memory of 4768 2812 TOM.exe 242 PID 4768 wrote to memory of 1212 4768 cmd.exe 246 PID 1212 wrote to memory of 3172 1212 ZPTKLH.exe 247 PID 3172 wrote to memory of 4272 3172 cmd.exe 251 PID 4272 wrote to memory of 4848 4272 FPBYCB.exe 252
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_96348d0cae0e78edec51ee7fc7b65978_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_96348d0cae0e78edec51ee7fc7b65978_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPEX.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\windows\system\XPEX.exeC:\windows\system\XPEX.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCDEKGO.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\windows\SysWOW64\FCDEKGO.exeC:\windows\system32\FCDEKGO.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JFBRK.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\windows\SysWOW64\JFBRK.exeC:\windows\system32\JFBRK.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVHZWSM.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\windows\system\VVHZWSM.exeC:\windows\system\VVHZWSM.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIMI.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\windows\system\QIMI.exeC:\windows\system\QIMI.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EGSFNB.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\windows\EGSFNB.exeC:\windows\EGSFNB.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWZ.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\windows\system\QWZ.exeC:\windows\system\QWZ.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUSH.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\windows\SysWOW64\SUSH.exeC:\windows\system32\SUSH.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUZV.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\windows\SysWOW64\QUZV.exeC:\windows\system32\QUZV.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WUHJYF.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\windows\SysWOW64\WUHJYF.exeC:\windows\system32\WUHJYF.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFGZYAF.exe.bat" "22⤵
- Executes a command shell one-liner
PID:3784 -
C:\windows\NFGZYAF.exeC:\windows\NFGZYAF.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XDLTFI.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\windows\SysWOW64\XDLTFI.exeC:\windows\system32\XDLTFI.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWBE.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\windows\system\QWBE.exeC:\windows\system\QWBE.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOWXX.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\windows\BOWXX.exeC:\windows\BOWXX.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MHZQFYB.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\windows\SysWOW64\MHZQFYB.exeC:\windows\system32\MHZQFYB.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCIU.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\windows\CCIU.exeC:\windows\CCIU.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PIQ.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\windows\system\PIQ.exeC:\windows\system\PIQ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EDZKLR.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\windows\system\EDZKLR.exeC:\windows\system\EDZKLR.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQE.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\windows\SysWOW64\ZQE.exeC:\windows\system32\ZQE.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KIZM.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\windows\SysWOW64\KIZM.exeC:\windows\system32\KIZM.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UJBZH.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\windows\system\UJBZH.exeC:\windows\system\UJBZH.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZJJNQXT.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\windows\ZJJNQXT.exeC:\windows\ZJJNQXT.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJQBZ.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\windows\FJQBZ.exeC:\windows\FJQBZ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFQBE.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\windows\system\LFQBE.exeC:\windows\system\LFQBE.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAZ.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\windows\SysWOW64\AAZ.exeC:\windows\system32\AAZ.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BNZU.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\windows\system\BNZU.exeC:\windows\system\BNZU.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDYF.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\windows\RDYF.exeC:\windows\RDYF.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYQJVB.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\GYQJVB.exeC:\windows\GYQJVB.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IWJETYU.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\windows\SysWOW64\IWJETYU.exeC:\windows\system32\IWJETYU.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TOM.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\windows\system\TOM.exeC:\windows\system\TOM.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPTKLH.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\windows\ZPTKLH.exeC:\windows\ZPTKLH.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPBYCB.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\windows\SysWOW64\FPBYCB.exeC:\windows\system32\FPBYCB.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FVTMDOG.exe.bat" "66⤵PID:4848
-
C:\windows\system\FVTMDOG.exeC:\windows\system\FVTMDOG.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVBA.exe.bat" "68⤵
- Executes a command shell one-liner
PID:6104 -
C:\windows\system\LVBA.exeC:\windows\system\LVBA.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LBBOO.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:5712 -
C:\windows\LBBOO.exeC:\windows\LBBOO.exe71⤵
- Executes dropped EXE
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\COLGDSY.exe.bat" "72⤵PID:2952
-
C:\windows\system\COLGDSY.exeC:\windows\system\COLGDSY.exe73⤵
- Executes dropped EXE
PID:4708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZTJELCA.exe.bat" "74⤵PID:4452
-
C:\windows\SysWOW64\ZTJELCA.exeC:\windows\system32\ZTJELCA.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THON.exe.bat" "76⤵PID:5444
-
C:\windows\SysWOW64\THON.exeC:\windows\system32\THON.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FZRGD.exe.bat" "78⤵PID:2236
-
C:\windows\SysWOW64\FZRGD.exeC:\windows\system32\FZRGD.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HXKIBG.exe.bat" "80⤵
- Executes a command shell one-liner
PID:2188 -
C:\windows\HXKIBG.exeC:\windows\HXKIBG.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXS.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:4164 -
C:\windows\system\MXS.exeC:\windows\system\MXS.exe83⤵
- Executes dropped EXE
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HLXFV.exe.bat" "84⤵
- Executes a command shell one-liner
PID:1460 -
C:\windows\system\HLXFV.exeC:\windows\system\HLXFV.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLETMCM.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:2932 -
C:\windows\system\NLETMCM.exeC:\windows\system\NLETMCM.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HYJC.exe.bat" "88⤵
- Executes a command shell one-liner
PID:1188 -
C:\windows\system\HYJC.exeC:\windows\system\HYJC.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRM.exe.bat" "90⤵PID:1828
-
C:\windows\system\TRM.exeC:\windows\system\TRM.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWSKD.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:5504 -
C:\windows\SysWOW64\HWSKD.exeC:\windows\system32\HWSKD.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECQHSD.exe.bat" "94⤵PID:2708
-
C:\windows\system\ECQHSD.exeC:\windows\system\ECQHSD.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YPV.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4736 -
C:\windows\YPV.exeC:\windows\YPV.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIYJDKQ.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2904 -
C:\windows\KIYJDKQ.exeC:\windows\KIYJDKQ.exe99⤵
- Executes dropped EXE
PID:2592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EVCT.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5636 -
C:\windows\SysWOW64\EVCT.exeC:\windows\system32\EVCT.exe101⤵
- Executes dropped EXE
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MBVHPPA.exe.bat" "102⤵PID:6076
-
C:\windows\SysWOW64\MBVHPPA.exeC:\windows\system32\MBVHPPA.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BEM.exe.bat" "104⤵PID:1356
-
C:\windows\BEM.exeC:\windows\BEM.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BJEAJ.exe.bat" "106⤵PID:3824
-
C:\windows\system\BJEAJ.exeC:\windows\system\BJEAJ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\REWMUJ.exe.bat" "108⤵
- Executes a command shell one-liner
PID:4300 -
C:\windows\system\REWMUJ.exeC:\windows\system\REWMUJ.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LSS.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:6136 -
C:\windows\SysWOW64\LSS.exeC:\windows\system32\LSS.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GNXFH.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:6048 -
C:\windows\SysWOW64\GNXFH.exeC:\windows\system32\GNXFH.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTX.exe.bat" "114⤵
- Executes a command shell one-liner
PID:1848 -
C:\windows\GTX.exeC:\windows\GTX.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ODG.exe.bat" "116⤵PID:4764
-
C:\windows\SysWOW64\ODG.exeC:\windows\system32\ODG.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IYLE.exe.bat" "118⤵PID:3096
-
C:\windows\system\IYLE.exeC:\windows\system\IYLE.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\URGXOH.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:5296 -
C:\windows\SysWOW64\URGXOH.exeC:\windows\system32\URGXOH.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-