Analysis
- max time kernel
92s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 11:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_61ede3907351c5400e408607d51e163c_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-22_61ede3907351c5400e408607d51e163c_elex_emotet_stop.exe
- Size 208KB
- Sample261024-nah43stxe1
- SHA256 2d70ecad2ee68d8053edf54af92378b8d7a23486dfeb0508299367cf7e7d89e0
- MD5 61ede3907351c5400e408607d51e163c
- SHA1 8286764f96d29d0cad88e8386b484e738245646f
- SHA512 5bf640cacdeb9cfa2640b0168eeb0629e2736598f78789e82ef00cd7daa99f63e499cb2e9cca99b2503831a0d11fa24f9f700b4d5d3a7bf5f014c140f3c03b1b
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfx4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOJkEj1
- TLSH T1CE247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3900 CMUXBZV.exe 4748 DDKA.exe 2404 HLY.exe 4732 NLY.exe 6056 YEBHI.exe 548 IED.exe 4700 CZIDV.exe 5648 DULZJEE.exe 5960 JVTN.exe 4060 DQYWCY.exe 5008 JQFKLA.exe 4704 VJIDTHL.exe 4304 SJQQ.exe 1936 RUGOC.exe 2632 MHLYMW.exe 4508 GVQ.exe 2256 PIBZEA.exe 4564 HIDEQYB.exe 5916 SBY.exe 1068 YBFL.exe 3620 HJHYLFU.exe 5592 NKPLUHV.exe 5444 WKRRXE.exe 4592 MFA.exe 2388 GAFEA.exe 4928 OGFTCE.exe 4924 DBPX.exe 4612 PTSQV.exe 2824 YCMDZD.exe 4252 ECTR.exe 3408 AAZ.exe 3304 BNZU.exe 4260 STKMGRJ.exe 6012 GYQJVB.exe 4952 OEIYXOG.exe 4560 ZWL.exe 3104 XXSEOX.exe 3736 JPNXWFM.exe 4720 JSZT.exe 4068 PSHHLX.exe 6076 MYF.exe 2552 VYHJ.exe 5888 EMRBL.exe 3316 DWPZS.exe 3388 XKMIVVZ.exe 2396 UPS.exe 5440 DDDX.exe 5764 YQH.exe 5112 OBYWBW.exe 5132 ROD.exe 3704 FUIDT.exe 3716 LUQRKZR.exe 3232 DUS.exe 4360 MHCODC.exe 3432 MNDCEHK.exe 3020 ITAZLQ.exe 1708 ULDSUYU.exe 5484 ZLLGD.exe 4272 FMTUMCW.exe 2100 VCU.exe 4788 TCBHCS.exe 3492 MVERKZK.exe 4996 XNZ.exe 5104 SBEUU.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\GAFEA.exe.bat MFA.exe File opened for modification C:\windows\SysWOW64\OGFTCE.exe GAFEA.exe File opened for modification C:\windows\SysWOW64\XKMIVVZ.exe DWPZS.exe File created C:\windows\SysWOW64\TCBHCS.exe.bat VCU.exe File created C:\windows\SysWOW64\MVERKZK.exe TCBHCS.exe File created C:\windows\SysWOW64\MFA.exe.bat WKRRXE.exe File created C:\windows\SysWOW64\PHPC.exe UMK.exe File created C:\windows\SysWOW64\QCRZFIS.exe ZRSJFOW.exe File created C:\windows\SysWOW64\YCMDZD.exe.bat PTSQV.exe File opened for modification C:\windows\SysWOW64\EIY.exe ECGPPSJ.exe File created C:\windows\SysWOW64\DKX.exe ZCQJHW.exe File created C:\windows\SysWOW64\OQSQD.exe OCAC.exe File created C:\windows\SysWOW64\XPAA.exe.bat RPSNVBS.exe File opened for modification C:\windows\SysWOW64\MRIMUA.exe PTKP.exe File opened for modification C:\windows\SysWOW64\URWXLWA.exe AZTELPL.exe File opened for modification C:\windows\SysWOW64\SJQQ.exe VJIDTHL.exe File created C:\windows\SysWOW64\PIBZEA.exe.bat GVQ.exe File opened for modification C:\windows\SysWOW64\MFA.exe WKRRXE.exe File created C:\windows\SysWOW64\EIY.exe.bat ECGPPSJ.exe File created C:\windows\SysWOW64\YPFXWHV.exe.bat XJLFCHR.exe File created C:\windows\SysWOW64\IPU.exe.bat URWXLWA.exe File created C:\windows\SysWOW64\JKGRUAS.exe.bat DKZDD.exe File created C:\windows\SysWOW64\WZNJV.exe.bat WTNVT.exe File opened for modification C:\windows\SysWOW64\XEVAV.exe ORLI.exe File created C:\windows\SysWOW64\XNZ.exe.bat MVERKZK.exe File opened for modification C:\windows\SysWOW64\WZNJV.exe WTNVT.exe File created C:\windows\SysWOW64\PSCCA.exe.bat QCRZFIS.exe File opened for modification C:\windows\SysWOW64\OQSQD.exe OCAC.exe File created C:\windows\SysWOW64\OGFTCE.exe GAFEA.exe File opened for modification C:\windows\SysWOW64\PHPC.exe UMK.exe File created C:\windows\SysWOW64\HJHYLFU.exe YBFL.exe File opened for modification C:\windows\SysWOW64\ITAZLQ.exe MNDCEHK.exe File opened for modification C:\windows\SysWOW64\TCBHCS.exe VCU.exe File opened for modification C:\windows\SysWOW64\YOM.exe GGKRJ.exe File created C:\windows\SysWOW64\RCU.exe.bat CWOVXW.exe File created C:\windows\SysWOW64\OQSQD.exe.bat OCAC.exe File created C:\windows\SysWOW64\SJQQ.exe.bat VJIDTHL.exe File opened for modification C:\windows\SysWOW64\STKMGRJ.exe BNZU.exe File created C:\windows\SysWOW64\ZWL.exe OEIYXOG.exe File created C:\windows\SysWOW64\PSHHLX.exe.bat JSZT.exe File created C:\windows\SysWOW64\XKMIVVZ.exe DWPZS.exe File created C:\windows\SysWOW64\LUQRKZR.exe.bat FUIDT.exe File created C:\windows\SysWOW64\FDAAZ.exe PSCCA.exe File opened for modification C:\windows\SysWOW64\NLY.exe HLY.exe File opened for modification C:\windows\SysWOW64\ZWL.exe OEIYXOG.exe File opened for modification C:\windows\SysWOW64\PSHHLX.exe JSZT.exe File created C:\windows\SysWOW64\URWXLWA.exe.bat AZTELPL.exe File opened for modification C:\windows\SysWOW64\RGFWWDP.exe GNCDO.exe File created C:\windows\SysWOW64\ZWL.exe.bat OEIYXOG.exe File opened for modification C:\windows\SysWOW64\OCAC.exe DKX.exe File opened for modification C:\windows\SysWOW64\RPSNVBS.exe PRR.exe File created C:\windows\SysWOW64\YEBHI.exe NLY.exe File created C:\windows\SysWOW64\SJQQ.exe VJIDTHL.exe File created C:\windows\SysWOW64\GAFEA.exe MFA.exe File created C:\windows\SysWOW64\FMTUMCW.exe ZLLGD.exe File created C:\windows\SysWOW64\RGFWWDP.exe.bat GNCDO.exe File created C:\windows\SysWOW64\DBPX.exe OGFTCE.exe File created C:\windows\SysWOW64\YCMDZD.exe PTSQV.exe File created C:\windows\SysWOW64\OCAC.exe DKX.exe File created C:\windows\SysWOW64\VJIDTHL.exe.bat JQFKLA.exe File created C:\windows\SysWOW64\LUQRKZR.exe FUIDT.exe File opened for modification C:\windows\SysWOW64\IPU.exe URWXLWA.exe File created C:\windows\SysWOW64\RCU.exe CWOVXW.exe File created C:\windows\SysWOW64\XEVAV.exe ORLI.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\ROD.exe OBYWBW.exe File opened for modification C:\windows\SBY.exe HIDEQYB.exe File created C:\windows\SBY.exe.bat HIDEQYB.exe File opened for modification C:\windows\system\YBFL.exe SBY.exe File opened for modification C:\windows\system\BNZU.exe AAZ.exe File created C:\windows\system\OEIYXOG.exe GYQJVB.exe File created C:\windows\GBSKFSC.exe BBSWW.exe File opened for modification C:\windows\system\LAKC.exe TNZ.exe File created C:\windows\XIEM.exe.bat RIXYQIK.exe File opened for modification C:\windows\GRQYINY.exe PGSAISD.exe File opened for modification C:\windows\XIEM.exe RIXYQIK.exe File created C:\windows\UMK.exe YOM.exe File created C:\windows\system\DKZDD.exe.bat IPU.exe File created C:\windows\system\CUXD.exe RCU.exe File created C:\windows\system\CUXD.exe.bat RCU.exe File opened for modification C:\windows\system\PRR.exe LJKKDU.exe File opened for modification C:\windows\system\LJKKDU.exe FJDX.exe File opened for modification C:\windows\system\DWPZS.exe EMRBL.exe File created C:\windows\JPNXWFM.exe XXSEOX.exe File opened for modification C:\windows\system\SELGKYA.exe WZNJV.exe File created C:\windows\CMUXBZV.exe 2026-10-22_61ede3907351c5400e408607d51e163c_elex_emotet_stop.exe File created C:\windows\system\MYF.exe.bat PSHHLX.exe File opened for modification C:\windows\VYHJ.exe MYF.exe File opened for modification C:\windows\system\MNDCEHK.exe MHCODC.exe File opened for modification C:\windows\system\XJLFCHR.exe MRIMUA.exe File created C:\windows\IIVTN.exe.bat XPAA.exe File created C:\windows\CMUXBZV.exe.bat 2026-10-22_61ede3907351c5400e408607d51e163c_elex_emotet_stop.exe File created C:\windows\system\DWPZS.exe EMRBL.exe File created C:\windows\system\SELGKYA.exe WZNJV.exe File opened for modification C:\windows\system\ORLI.exe OLL.exe File created C:\windows\system\LJKKDU.exe.bat FJDX.exe File opened for modification C:\windows\MHLYMW.exe RUGOC.exe File created C:\windows\MHLYMW.exe.bat RUGOC.exe File created C:\windows\system\XICVON.exe.bat CUXD.exe File created C:\windows\ROD.exe.bat OBYWBW.exe File created C:\windows\system\ECGPPSJ.exe PHPC.exe File created C:\windows\system\DKZDD.exe IPU.exe File created C:\windows\CZIDV.exe IED.exe File opened for modification C:\windows\JPNXWFM.exe XXSEOX.exe File created C:\windows\GRQYINY.exe PGSAISD.exe File created C:\windows\ZRSJFOW.exe.bat XEVAV.exe File created C:\windows\FJDX.exe.bat FVD.exe File created C:\windows\JPNXWFM.exe.bat XXSEOX.exe File created C:\windows\system\SBEUU.exe XNZ.exe File created C:\windows\system\FVD.exe OQSQD.exe File opened for modification C:\windows\RUGOC.exe SJQQ.exe File created C:\windows\CZIDV.exe.bat IED.exe File opened for modification C:\windows\JSZT.exe JPNXWFM.exe File created C:\windows\VYHJ.exe.bat MYF.exe File created C:\windows\system\MNDCEHK.exe.bat MHCODC.exe File created C:\windows\VCU.exe FMTUMCW.exe File created C:\windows\AZTELPL.exe GBSKFSC.exe File opened for modification C:\windows\system\XICVON.exe CUXD.exe File opened for modification C:\windows\ROD.exe OBYWBW.exe File created C:\windows\PTKP.exe NVJNGT.exe File created C:\windows\system\PTSQV.exe DBPX.exe File created C:\windows\system\BNZU.exe.bat AAZ.exe File opened for modification C:\windows\AZTELPL.exe GBSKFSC.exe File created C:\windows\JVTN.exe.bat DULZJEE.exe File opened for modification C:\windows\system\NRQQ.exe SELGKYA.exe File created C:\windows\system\PRR.exe.bat LJKKDU.exe File created C:\windows\system\DQYWCY.exe JVTN.exe File created C:\windows\VVKUDRX.exe.bat YPFXWHV.exe File created C:\windows\system\YBFL.exe.bat SBY.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4692 cmd.exe 5968 cmd.exe 1260 cmd.exe 5608 cmd.exe 3264 cmd.exe 2176 cmd.exe 3940 cmd.exe 2352 cmd.exe 4724 cmd.exe 5840 cmd.exe 5748 cmd.exe 1056 cmd.exe 5820 cmd.exe 4912 cmd.exe 5324 cmd.exe 1124 cmd.exe 2380 cmd.exe 6128 cmd.exe 4956 cmd.exe 4416 cmd.exe 2612 cmd.exe 6092 cmd.exe 1548 cmd.exe 1064 cmd.exe 2840 cmd.exe 2484 cmd.exe 5908 cmd.exe 808 cmd.exe 2516 cmd.exe 5580 cmd.exe 856 cmd.exe 6004 cmd.exe 5952 cmd.exe 2084 cmd.exe 5604 cmd.exe 5568 cmd.exe 4132 cmd.exe 4932 cmd.exe 1956 cmd.exe 2912 cmd.exe 1608 cmd.exe 4400 cmd.exe 2764 cmd.exe 4696 cmd.exe 2844 cmd.exe 4180 cmd.exe 1300 cmd.exe 3016 cmd.exe 248 cmd.exe 1100 cmd.exe 2208 cmd.exe 4108 cmd.exe 5792 cmd.exe 4916 cmd.exe 5360 cmd.exe 2336 cmd.exe 1576 cmd.exe 672 cmd.exe 2716 cmd.exe 2356 cmd.exe 4456 cmd.exe 5028 cmd.exe 2232 cmd.exe 2300 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3852 5564 WerFault.exe 86 2344 3900 WerFault.exe 92 4520 4748 WerFault.exe 98 1728 2404 WerFault.exe 103 1868 4732 WerFault.exe 108 2820 6056 WerFault.exe 113 1544 548 WerFault.exe 118 2908 4700 WerFault.exe 123 2108 5648 WerFault.exe 128 3412 5960 WerFault.exe 133 4092 4060 WerFault.exe 138 5568 5008 WerFault.exe 143 4752 4704 WerFault.exe 148 4532 4304 WerFault.exe 153 2500 1936 WerFault.exe 158 6080 2632 WerFault.exe 163 4764 4508 WerFault.exe 168 3124 2256 WerFault.exe 173 3112 4564 WerFault.exe 178 672 5916 WerFault.exe 183 4272 1068 WerFault.exe 188 1208 3620 WerFault.exe 193 1008 5592 WerFault.exe 198 3520 5444 WerFault.exe 203 5200 4592 WerFault.exe 208 460 2388 WerFault.exe 213 3104 4928 WerFault.exe 218 1172 4924 WerFault.exe 223 2840 4612 WerFault.exe 228 3700 2824 WerFault.exe 233 1140 4252 WerFault.exe 238 2532 3408 WerFault.exe 243 5652 3304 WerFault.exe 248 1592 4260 WerFault.exe 253 5852 6012 WerFault.exe 258 5072 4952 WerFault.exe 263 948 4560 WerFault.exe 268 5440 3104 WerFault.exe 273 6064 3736 WerFault.exe 278 4152 4720 WerFault.exe 283 1576 4068 WerFault.exe 289 5924 6076 WerFault.exe 294 2096 2552 WerFault.exe 299 1280 5888 WerFault.exe 304 5368 3316 WerFault.exe 309 4920 3388 WerFault.exe 314 1172 2396 WerFault.exe 319 3924 5440 WerFault.exe 324 2108 5764 WerFault.exe 329 4248 5112 WerFault.exe 334 3292 5132 WerFault.exe 339 1256 3704 WerFault.exe 344 6024 3716 WerFault.exe 349 4100 3232 WerFault.exe 354 5508 4360 WerFault.exe 359 3052 3432 WerFault.exe 364 3112 3020 WerFault.exe 369 4672 1708 WerFault.exe 374 3524 5484 WerFault.exe 379 1388 4272 WerFault.exe 384 4072 2100 WerFault.exe 389 4752 4788 WerFault.exe 394 1944 3492 WerFault.exe 399 5024 4996 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGFWWDP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORLI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPSNVBS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBEUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGSAISD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIBZEA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIDEQYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQYWCY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKGRUAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUXD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NRQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JQFKLA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNZU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XEVAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VJIDTHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VVKUDRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBSKFSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUQRKZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCRZFIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSZT.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5564 2026-10-22_61ede3907351c5400e408607d51e163c_elex_emotet_stop.exe 5564 2026-10-22_61ede3907351c5400e408607d51e163c_elex_emotet_stop.exe 3900 CMUXBZV.exe 3900 CMUXBZV.exe 4748 DDKA.exe 4748 DDKA.exe 2404 HLY.exe 2404 HLY.exe 4732 NLY.exe 4732 NLY.exe 6056 YEBHI.exe 6056 YEBHI.exe 548 IED.exe 548 IED.exe 4700 CZIDV.exe 4700 CZIDV.exe 5648 DULZJEE.exe 5648 DULZJEE.exe 5960 JVTN.exe 5960 JVTN.exe 4060 DQYWCY.exe 4060 DQYWCY.exe 5008 JQFKLA.exe 5008 JQFKLA.exe 4704 VJIDTHL.exe 4704 VJIDTHL.exe 4304 SJQQ.exe 4304 SJQQ.exe 1936 RUGOC.exe 1936 RUGOC.exe 2632 MHLYMW.exe 2632 MHLYMW.exe 4508 GVQ.exe 4508 GVQ.exe 2256 PIBZEA.exe 2256 PIBZEA.exe 4564 HIDEQYB.exe 4564 HIDEQYB.exe 5916 SBY.exe 5916 SBY.exe 1068 YBFL.exe 1068 YBFL.exe 3620 HJHYLFU.exe 3620 HJHYLFU.exe 5592 NKPLUHV.exe 5592 NKPLUHV.exe 5444 WKRRXE.exe 5444 WKRRXE.exe 4592 MFA.exe 4592 MFA.exe 2388 GAFEA.exe 2388 GAFEA.exe 4928 OGFTCE.exe 4928 OGFTCE.exe 4924 DBPX.exe 4924 DBPX.exe 4612 PTSQV.exe 4612 PTSQV.exe 2824 YCMDZD.exe 2824 YCMDZD.exe 4252 ECTR.exe 4252 ECTR.exe 3408 AAZ.exe 3408 AAZ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5564 2026-10-22_61ede3907351c5400e408607d51e163c_elex_emotet_stop.exe 5564 2026-10-22_61ede3907351c5400e408607d51e163c_elex_emotet_stop.exe 3900 CMUXBZV.exe 3900 CMUXBZV.exe 4748 DDKA.exe 4748 DDKA.exe 2404 HLY.exe 2404 HLY.exe 4732 NLY.exe 4732 NLY.exe 6056 YEBHI.exe 6056 YEBHI.exe 548 IED.exe 548 IED.exe 4700 CZIDV.exe 4700 CZIDV.exe 5648 DULZJEE.exe 5648 DULZJEE.exe 5960 JVTN.exe 5960 JVTN.exe 4060 DQYWCY.exe 4060 DQYWCY.exe 5008 JQFKLA.exe 5008 JQFKLA.exe 4704 VJIDTHL.exe 4704 VJIDTHL.exe 4304 SJQQ.exe 4304 SJQQ.exe 1936 RUGOC.exe 1936 RUGOC.exe 2632 MHLYMW.exe 2632 MHLYMW.exe 4508 GVQ.exe 4508 GVQ.exe 2256 PIBZEA.exe 2256 PIBZEA.exe 4564 HIDEQYB.exe 4564 HIDEQYB.exe 5916 SBY.exe 5916 SBY.exe 1068 YBFL.exe 1068 YBFL.exe 3620 HJHYLFU.exe 3620 HJHYLFU.exe 5592 NKPLUHV.exe 5592 NKPLUHV.exe 5444 WKRRXE.exe 5444 WKRRXE.exe 4592 MFA.exe 4592 MFA.exe 2388 GAFEA.exe 2388 GAFEA.exe 4928 OGFTCE.exe 4928 OGFTCE.exe 4924 DBPX.exe 4924 DBPX.exe 4612 PTSQV.exe 4612 PTSQV.exe 2824 YCMDZD.exe 2824 YCMDZD.exe 4252 ECTR.exe 4252 ECTR.exe 3408 AAZ.exe 3408 AAZ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5564 wrote to memory of 4416 5564 2026-10-22_61ede3907351c5400e408607d51e163c_elex_emotet_stop.exe 88 PID 4416 wrote to memory of 3900 4416 cmd.exe 92 PID 3900 wrote to memory of 2688 3900 CMUXBZV.exe 94 PID 2688 wrote to memory of 4748 2688 cmd.exe 98 PID 4748 wrote to memory of 4284 4748 DDKA.exe 99 PID 4284 wrote to memory of 2404 4284 cmd.exe 103 PID 2404 wrote to memory of 4696 2404 HLY.exe 104 PID 4696 wrote to memory of 4732 4696 cmd.exe 108 PID 4732 wrote to memory of 3452 4732 NLY.exe 109 PID 3452 wrote to memory of 6056 3452 cmd.exe 113 PID 6056 wrote to memory of 1536 6056 YEBHI.exe 114 PID 1536 wrote to memory of 548 1536 cmd.exe 118 PID 548 wrote to memory of 5536 548 IED.exe 119 PID 5536 wrote to memory of 4700 5536 cmd.exe 123 PID 4700 wrote to memory of 5892 4700 CZIDV.exe 124 PID 5892 wrote to memory of 5648 5892 cmd.exe 128 PID 5648 wrote to memory of 2508 5648 DULZJEE.exe 129 PID 2508 wrote to memory of 5960 2508 cmd.exe 133 PID 5960 wrote to memory of 5068 5960 JVTN.exe 134 PID 5068 wrote to memory of 4060 5068 cmd.exe 138 PID 4060 wrote to memory of 2352 4060 DQYWCY.exe 139 PID 2352 wrote to memory of 5008 2352 cmd.exe 143 PID 5008 wrote to memory of 6072 5008 JQFKLA.exe 144 PID 6072 wrote to memory of 4704 6072 cmd.exe 148 PID 4704 wrote to memory of 4828 4704 VJIDTHL.exe 149 PID 4828 wrote to memory of 4304 4828 cmd.exe 153 PID 4304 wrote to memory of 2548 4304 SJQQ.exe 154 PID 2548 wrote to memory of 1936 2548 cmd.exe 158 PID 1936 wrote to memory of 1056 1936 RUGOC.exe 159 PID 1056 wrote to memory of 2632 1056 cmd.exe 163 PID 2632 wrote to memory of 4948 2632 MHLYMW.exe 164 PID 4948 wrote to memory of 4508 4948 cmd.exe 168 PID 4508 wrote to memory of 3952 4508 GVQ.exe 169 PID 3952 wrote to memory of 2256 3952 cmd.exe 173 PID 2256 wrote to memory of 4516 2256 PIBZEA.exe 174 PID 4516 wrote to memory of 4564 4516 cmd.exe 178 PID 4564 wrote to memory of 3024 4564 HIDEQYB.exe 179 PID 3024 wrote to memory of 5916 3024 cmd.exe 183 PID 5916 wrote to memory of 3220 5916 SBY.exe 184 PID 3220 wrote to memory of 1068 3220 cmd.exe 188 PID 1068 wrote to memory of 2484 1068 YBFL.exe 189 PID 2484 wrote to memory of 3620 2484 cmd.exe 193 PID 3620 wrote to memory of 4580 3620 HJHYLFU.exe 194 PID 4580 wrote to memory of 5592 4580 cmd.exe 198 PID 5592 wrote to memory of 5820 5592 NKPLUHV.exe 199 PID 5820 wrote to memory of 5444 5820 cmd.exe 203 PID 5444 wrote to memory of 5992 5444 WKRRXE.exe 204 PID 5992 wrote to memory of 4592 5992 cmd.exe 208 PID 4592 wrote to memory of 2700 4592 MFA.exe 209 PID 2700 wrote to memory of 2388 2700 cmd.exe 213 PID 2388 wrote to memory of 988 2388 GAFEA.exe 214 PID 988 wrote to memory of 4928 988 cmd.exe 218 PID 4928 wrote to memory of 1240 4928 OGFTCE.exe 219 PID 1240 wrote to memory of 4924 1240 cmd.exe 223 PID 4924 wrote to memory of 3876 4924 DBPX.exe 224 PID 3876 wrote to memory of 4612 3876 cmd.exe 228 PID 4612 wrote to memory of 1608 4612 PTSQV.exe 229 PID 1608 wrote to memory of 2824 1608 cmd.exe 233 PID 2824 wrote to memory of 1716 2824 YCMDZD.exe 234 PID 1716 wrote to memory of 4252 1716 cmd.exe 238 PID 4252 wrote to memory of 3080 4252 ECTR.exe 239 PID 3080 wrote to memory of 3408 3080 cmd.exe 243 PID 3408 wrote to memory of 3648 3408 AAZ.exe 244 PID 3648 wrote to memory of 3304 3648 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_61ede3907351c5400e408607d51e163c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_61ede3907351c5400e408607d51e163c_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMUXBZV.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\windows\CMUXBZV.exeC:\windows\CMUXBZV.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDKA.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\windows\SysWOW64\DDKA.exeC:\windows\system32\DDKA.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLY.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\windows\HLY.exeC:\windows\HLY.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NLY.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\windows\SysWOW64\NLY.exeC:\windows\system32\NLY.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YEBHI.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\windows\SysWOW64\YEBHI.exeC:\windows\system32\YEBHI.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IED.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\windows\IED.exeC:\windows\IED.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZIDV.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\windows\CZIDV.exeC:\windows\CZIDV.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DULZJEE.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\windows\SysWOW64\DULZJEE.exeC:\windows\system32\DULZJEE.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVTN.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\windows\JVTN.exeC:\windows\JVTN.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQYWCY.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\windows\system\DQYWCY.exeC:\windows\system\DQYWCY.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JQFKLA.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\windows\system\JQFKLA.exeC:\windows\system\JQFKLA.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VJIDTHL.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\windows\SysWOW64\VJIDTHL.exeC:\windows\system32\VJIDTHL.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SJQQ.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\windows\SysWOW64\SJQQ.exeC:\windows\system32\SJQQ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RUGOC.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\windows\RUGOC.exeC:\windows\RUGOC.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MHLYMW.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\windows\MHLYMW.exeC:\windows\MHLYMW.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GVQ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\windows\SysWOW64\GVQ.exeC:\windows\system32\GVQ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PIBZEA.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\windows\SysWOW64\PIBZEA.exeC:\windows\system32\PIBZEA.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIDEQYB.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\windows\HIDEQYB.exeC:\windows\HIDEQYB.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBY.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\windows\SBY.exeC:\windows\SBY.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBFL.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\windows\system\YBFL.exeC:\windows\system\YBFL.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HJHYLFU.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\windows\SysWOW64\HJHYLFU.exeC:\windows\system32\HJHYLFU.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NKPLUHV.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\SysWOW64\NKPLUHV.exeC:\windows\system32\NKPLUHV.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WKRRXE.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\windows\WKRRXE.exeC:\windows\WKRRXE.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MFA.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\windows\SysWOW64\MFA.exeC:\windows\system32\MFA.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GAFEA.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\windows\SysWOW64\GAFEA.exeC:\windows\system32\GAFEA.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OGFTCE.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\windows\SysWOW64\OGFTCE.exeC:\windows\system32\OGFTCE.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBPX.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\windows\SysWOW64\DBPX.exeC:\windows\system32\DBPX.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PTSQV.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\windows\system\PTSQV.exeC:\windows\system\PTSQV.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YCMDZD.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\windows\SysWOW64\YCMDZD.exeC:\windows\system32\YCMDZD.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ECTR.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\windows\ECTR.exeC:\windows\ECTR.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAZ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\windows\SysWOW64\AAZ.exeC:\windows\system32\AAZ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BNZU.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\windows\system\BNZU.exeC:\windows\system\BNZU.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STKMGRJ.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4724 -
C:\windows\SysWOW64\STKMGRJ.exeC:\windows\system32\STKMGRJ.exe67⤵
- Executes dropped EXE
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYQJVB.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5952 -
C:\windows\GYQJVB.exeC:\windows\GYQJVB.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OEIYXOG.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2084 -
C:\windows\system\OEIYXOG.exeC:\windows\system\OEIYXOG.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZWL.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4108 -
C:\windows\SysWOW64\ZWL.exeC:\windows\system32\ZWL.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXSEOX.exe.bat" "74⤵PID:1332
-
C:\windows\system\XXSEOX.exeC:\windows\system\XXSEOX.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JPNXWFM.exe.bat" "76⤵PID:3008
-
C:\windows\JPNXWFM.exeC:\windows\JPNXWFM.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JSZT.exe.bat" "78⤵PID:3712
-
C:\windows\JSZT.exeC:\windows\JSZT.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PSHHLX.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5604 -
C:\windows\SysWOW64\PSHHLX.exeC:\windows\system32\PSHHLX.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MYF.exe.bat" "82⤵PID:1140
-
C:\windows\system\MYF.exeC:\windows\system\MYF.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VYHJ.exe.bat" "84⤵PID:4584
-
C:\windows\VYHJ.exeC:\windows\VYHJ.exe85⤵
- Executes dropped EXE
PID:2552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMRBL.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2612 -
C:\windows\system\EMRBL.exeC:\windows\system\EMRBL.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DWPZS.exe.bat" "88⤵
- Executes a command shell one-liner
PID:5908 -
C:\windows\system\DWPZS.exeC:\windows\system\DWPZS.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XKMIVVZ.exe.bat" "90⤵PID:1848
-
C:\windows\SysWOW64\XKMIVVZ.exeC:\windows\system32\XKMIVVZ.exe91⤵
- Executes dropped EXE
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPS.exe.bat" "92⤵PID:692
-
C:\windows\UPS.exeC:\windows\UPS.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DDDX.exe.bat" "94⤵PID:5596
-
C:\windows\DDDX.exeC:\windows\DDDX.exe95⤵
- Executes dropped EXE
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQH.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:2672 -
C:\windows\system\YQH.exeC:\windows\system\YQH.exe97⤵
- Executes dropped EXE
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OBYWBW.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5840 -
C:\windows\system\OBYWBW.exeC:\windows\system\OBYWBW.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ROD.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4912 -
C:\windows\ROD.exeC:\windows\ROD.exe101⤵
- Executes dropped EXE
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FUIDT.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1576 -
C:\windows\system\FUIDT.exeC:\windows\system\FUIDT.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LUQRKZR.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5568 -
C:\windows\SysWOW64\LUQRKZR.exeC:\windows\system32\LUQRKZR.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DUS.exe.bat" "106⤵PID:4112
-
C:\windows\system\DUS.exeC:\windows\system\DUS.exe107⤵
- Executes dropped EXE
PID:3232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MHCODC.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:808 -
C:\windows\MHCODC.exeC:\windows\MHCODC.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MNDCEHK.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4352 -
C:\windows\system\MNDCEHK.exeC:\windows\system\MNDCEHK.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ITAZLQ.exe.bat" "112⤵PID:2068
-
C:\windows\SysWOW64\ITAZLQ.exeC:\windows\system32\ITAZLQ.exe113⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ULDSUYU.exe.bat" "114⤵PID:4288
-
C:\windows\system\ULDSUYU.exeC:\windows\system\ULDSUYU.exe115⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZLLGD.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4132 -
C:\windows\system\ZLLGD.exeC:\windows\system\ZLLGD.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FMTUMCW.exe.bat" "118⤵PID:5428
-
C:\windows\SysWOW64\FMTUMCW.exeC:\windows\system32\FMTUMCW.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VCU.exe.bat" "120⤵PID:4124
-
C:\windows\VCU.exeC:\windows\VCU.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-