Analysis
- max time kernel
95s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/10/2026, 12:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-25_cc0d2a747a489343b153b82516eee9e3_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-25_cc0d2a747a489343b153b82516eee9e3_elex_emotet_stop.exe
- Size 208KB
- Sample261026-pc3ryaey8k
- SHA256 1d8dda0f2369f0630cf3db5d153ded954f8bb0729f1d28d476923d38fd252636
- MD5 cc0d2a747a489343b153b82516eee9e3
- SHA1 2710c0df74d3d8d68e336bb07ae1c80edbdfc6a2
- SHA512 5956c361e902918b47cae00f7ebc90da6dda888f94fc8562a3d7ac3b7647658161ccdbe31e6c233dae390d6875d5ec04313a376ed560528afc8e4801ffa0980e
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlydL+LOf14pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFly5+LONkEj1
- TLSH T19C247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5504 QIZ.exe 944 AQN.exe 5460 EYBZO.exe 4584 ZTYJZPA.exe 5068 FUGW.exe 4472 ZHKGSR.exe 4416 GCKHXUG.exe 2808 AQOQ.exe 3368 PLYCSG.exe 6084 NGXDXJL.exe 3808 TGFRG.exe 3432 DEKL.exe 2916 WZWHAK.exe 4936 GXCBI.exe 4564 VNDB.exe 2288 KQMFA.exe 2748 SVZM.exe 1308 SBRAMEB.exe 4444 IWIEF.exe 3872 TPDX.exe 4532 CXFKQDT.exe 2504 XKKU.exe 4340 ZYPDDD.exe 2880 XYXRMF.exe 2792 ATB.exe 3512 UGGKH.exe 4884 PULTRFY.exe 3084 KHQ.exe 5716 UFW.exe 5636 KYYNRTK.exe 5104 LTKJ.exe 4840 YDTH.exe 5000 CLZPXM.exe 4684 FHE.exe 3592 MXFQGZ.exe 5852 YFMY.exe 5196 TSQHC.exe 5192 NNVRFRF.exe 1168 NTV.exe 4188 IGAPQ.exe 3768 OHICHYY.exe 2468 XPC.exe 3784 DPKVUY.exe 5388 YDOFEYQ.exe 5144 PDQS.exe 236 NBKNDIA.exe 1152 ZTF.exe 1816 ZZFU.exe 2924 TMKDPD.exe 3572 OZO.exe 2324 UAWBI.exe 2944 QFUYX.exe 5800 NLAVEQ.exe 3132 HYE.exe 2184 HEFT.exe 6044 EJCQX.exe 6052 KJKDGH.exe 2520 EXP.exe 4368 SITL.exe 5944 BIVQZ.exe 2768 SVF.exe 4256 NIKSZ.exe 6064 HEPJJA.exe 1376 CRM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\KHQ.exe.bat PULTRFY.exe File opened for modification C:\windows\SysWOW64\ZHKGSR.exe FUGW.exe File opened for modification C:\windows\SysWOW64\KQMFA.exe VNDB.exe File opened for modification C:\windows\SysWOW64\TPDX.exe IWIEF.exe File created C:\windows\SysWOW64\YFMY.exe.bat MXFQGZ.exe File opened for modification C:\windows\SysWOW64\PDQS.exe YDOFEYQ.exe File created C:\windows\SysWOW64\PHWNOAD.exe.bat AMNJ.exe File created C:\windows\SysWOW64\DEKL.exe.bat TGFRG.exe File opened for modification C:\windows\SysWOW64\IXUV.exe WERCW.exe File opened for modification C:\windows\SysWOW64\XYD.exe RXWAHEU.exe File created C:\windows\SysWOW64\AMNJ.exe.bat PTSQV.exe File opened for modification C:\windows\SysWOW64\PHWNOAD.exe AMNJ.exe File created C:\windows\SysWOW64\EJJMBGC.exe WDRYAB.exe File opened for modification C:\windows\SysWOW64\YWOW.exe EJJMBGC.exe File created C:\windows\SysWOW64\FYIV.exe.bat TFF.exe File created C:\windows\SysWOW64\JTK.exe DYLBH.exe File created C:\windows\SysWOW64\UKTJJ.exe.bat DZULK.exe File opened for modification C:\windows\SysWOW64\KHQ.exe PULTRFY.exe File created C:\windows\SysWOW64\KYYNRTK.exe UFW.exe File created C:\windows\SysWOW64\ZHKGSR.exe FUGW.exe File created C:\windows\SysWOW64\TPDX.exe.bat IWIEF.exe File created C:\windows\SysWOW64\WERCW.exe CRM.exe File created C:\windows\SysWOW64\XYD.exe.bat RXWAHEU.exe File opened for modification C:\windows\SysWOW64\JTK.exe DYLBH.exe File created C:\windows\SysWOW64\JTK.exe.bat DYLBH.exe File opened for modification C:\windows\SysWOW64\KYYNRTK.exe UFW.exe File opened for modification C:\windows\SysWOW64\UDFCDZR.exe JKCJVR.exe File opened for modification C:\windows\SysWOW64\AJMEO.exe PQJM.exe File created C:\windows\SysWOW64\VPSHMSR.exe ABNYBS.exe File opened for modification C:\windows\SysWOW64\EJJMBGC.exe WDRYAB.exe File created C:\windows\SysWOW64\FYIV.exe TFF.exe File opened for modification C:\windows\SysWOW64\YOM.exe MWJLFGV.exe File opened for modification C:\windows\SysWOW64\DZULK.exe HUWO.exe File created C:\windows\SysWOW64\NGXDXJL.exe PLYCSG.exe File created C:\windows\SysWOW64\KQMFA.exe.bat VNDB.exe File opened for modification C:\windows\SysWOW64\CXFKQDT.exe TPDX.exe File opened for modification C:\windows\SysWOW64\ZYPDDD.exe XKKU.exe File created C:\windows\SysWOW64\KYYNRTK.exe.bat UFW.exe File created C:\windows\SysWOW64\YFMY.exe MXFQGZ.exe File created C:\windows\SysWOW64\UDFCDZR.exe JKCJVR.exe File created C:\windows\SysWOW64\VPSHMSR.exe.bat ABNYBS.exe File created C:\windows\SysWOW64\ZYPDDD.exe XKKU.exe File created C:\windows\SysWOW64\ZYPDDD.exe.bat XKKU.exe File created C:\windows\SysWOW64\WERCW.exe.bat CRM.exe File created C:\windows\SysWOW64\IXUV.exe.bat WERCW.exe File created C:\windows\SysWOW64\WHGDQ.exe HMWZ.exe File created C:\windows\SysWOW64\YWOW.exe.bat EJJMBGC.exe File created C:\windows\SysWOW64\NZXAWBA.exe.bat YWOW.exe File created C:\windows\SysWOW64\KYQJGR.exe.bat FYIV.exe File created C:\windows\SysWOW64\CXFKQDT.exe.bat TPDX.exe File opened for modification C:\windows\SysWOW64\FUGW.exe ZTYJZPA.exe File created C:\windows\SysWOW64\FUGW.exe.bat ZTYJZPA.exe File opened for modification C:\windows\SysWOW64\NGXDXJL.exe PLYCSG.exe File opened for modification C:\windows\SysWOW64\DEKL.exe TGFRG.exe File created C:\windows\SysWOW64\KQMFA.exe VNDB.exe File created C:\windows\SysWOW64\PDQS.exe YDOFEYQ.exe File created C:\windows\SysWOW64\AMNJ.exe PTSQV.exe File created C:\windows\SysWOW64\KJKDGH.exe EJCQX.exe File created C:\windows\SysWOW64\DPKVUY.exe.bat XPC.exe File created C:\windows\SysWOW64\WHGDQ.exe.bat HMWZ.exe File created C:\windows\SysWOW64\UDFCDZR.exe.bat JKCJVR.exe File created C:\windows\SysWOW64\TFF.exe.bat XAZ.exe File opened for modification C:\windows\SysWOW64\VALANWA.exe VVKUDRX.exe File opened for modification C:\windows\SysWOW64\AMNJ.exe PTSQV.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\ILNCPF.exe.bat OQIT.exe File created C:\windows\UTT.exe.bat ILNCPF.exe File opened for modification C:\windows\system\PLYCSG.exe AQOQ.exe File created C:\windows\system\SVZM.exe KQMFA.exe File created C:\windows\RXWAHEU.exe.bat IXUV.exe File opened for modification C:\windows\PQJM.exe UDFCDZR.exe File created C:\windows\system\KWZYS.exe.bat ZEEG.exe File opened for modification C:\windows\system\LTKJ.exe KYYNRTK.exe File opened for modification C:\windows\NTV.exe NNVRFRF.exe File created C:\windows\BIVQZ.exe.bat SITL.exe File created C:\windows\system\ECANM.exe.bat DZWKGR.exe File opened for modification C:\windows\system\QIZ.exe 2026-10-25_cc0d2a747a489343b153b82516eee9e3_elex_emotet_stop.exe File opened for modification C:\windows\system\IWIEF.exe SBRAMEB.exe File created C:\windows\system\UFW.exe.bat KHQ.exe File created C:\windows\system\IGAPQ.exe.bat NTV.exe File created C:\windows\TMKDPD.exe.bat ZZFU.exe File opened for modification C:\windows\system\EXP.exe KJKDGH.exe File created C:\windows\system\FJZWIQP.exe KVUNY.exe File created C:\windows\system\ZZFU.exe ZTF.exe File opened for modification C:\windows\system\UGGKH.exe ATB.exe File opened for modification C:\windows\NBKNDIA.exe PDQS.exe File created C:\windows\system\EJCQX.exe.bat HEFT.exe File created C:\windows\system\GMWV.exe UTT.exe File opened for modification C:\windows\system\CJPUANN.exe ODKXT.exe File created C:\windows\system\KWZYS.exe ZEEG.exe File opened for modification C:\windows\FHE.exe CLZPXM.exe File created C:\windows\HYE.exe.bat NLAVEQ.exe File opened for modification C:\windows\system\SVF.exe BIVQZ.exe File opened for modification C:\windows\system\ILNCPF.exe OQIT.exe File created C:\windows\ODKXT.exe.bat RGE.exe File created C:\windows\YDTH.exe.bat LTKJ.exe File created C:\windows\system\NLAVEQ.exe QFUYX.exe File created C:\windows\system\AQN.exe QIZ.exe File created C:\windows\ODKXT.exe RGE.exe File created C:\windows\system\PXXSTOK.exe.bat UKTJJ.exe File opened for modification C:\windows\system\RTCC.exe PXXSTOK.exe File opened for modification C:\windows\system\ZEEG.exe FJZWIQP.exe File created C:\windows\system\PTSQV.exe JTK.exe File created C:\windows\KCBE.exe.bat PHWNOAD.exe File opened for modification C:\windows\system\RGE.exe RSM.exe File created C:\windows\system\JKCJVR.exe.bat WHGDQ.exe File created C:\windows\system\HUFVAHV.exe.bat KWZYS.exe File opened for modification C:\windows\MWJLFGV.exe KYQJGR.exe File created C:\windows\system\DZWKGR.exe.bat GTM.exe File opened for modification C:\windows\TGFRG.exe NGXDXJL.exe File created C:\windows\WZWHAK.exe.bat DEKL.exe File created C:\windows\system\ATB.exe XYXRMF.exe File created C:\windows\FHE.exe.bat CLZPXM.exe File opened for modification C:\windows\MXFQGZ.exe FHE.exe File created C:\windows\NTV.exe.bat NNVRFRF.exe File opened for modification C:\windows\system\NIKSZ.exe SVF.exe File created C:\windows\OQIT.exe BNZU.exe File created C:\windows\MXFQGZ.exe.bat FHE.exe File created C:\windows\system\XPC.exe.bat OHICHYY.exe File created C:\windows\REZO.exe.bat GMWV.exe File opened for modification C:\windows\system\XAZ.exe NZXAWBA.exe File opened for modification C:\windows\system\NLAVEQ.exe QFUYX.exe File opened for modification C:\windows\SITL.exe EXP.exe File created C:\windows\system\OBKMJU.exe.bat CJPUANN.exe File created C:\windows\PQJM.exe UDFCDZR.exe File created C:\windows\system\VBJCIG.exe RTCC.exe File created C:\windows\system\SZGDB.exe ECANM.exe File opened for modification C:\windows\AQOQ.exe GCKHXUG.exe File created C:\windows\system\IWIEF.exe.bat SBRAMEB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2508 cmd.exe 6036 cmd.exe 5096 cmd.exe 2948 cmd.exe 5152 cmd.exe 2060 cmd.exe 4312 cmd.exe 2996 cmd.exe 4552 cmd.exe 4180 cmd.exe 1124 cmd.exe 2680 cmd.exe 3684 cmd.exe 5056 cmd.exe 5712 cmd.exe 6132 cmd.exe 3200 cmd.exe 4132 cmd.exe 4348 cmd.exe 5236 cmd.exe 4328 cmd.exe 3268 cmd.exe 4200 cmd.exe 3860 cmd.exe 1108 cmd.exe 2388 cmd.exe 5500 cmd.exe 5060 cmd.exe 4292 cmd.exe 1488 cmd.exe 124 cmd.exe 3504 cmd.exe 200 cmd.exe 4576 cmd.exe 6128 cmd.exe 3968 cmd.exe 1496 cmd.exe 5508 cmd.exe 6016 cmd.exe 1148 cmd.exe 2196 cmd.exe 4560 cmd.exe 2424 cmd.exe 3764 cmd.exe 3564 cmd.exe 5564 cmd.exe 5492 cmd.exe 4092 cmd.exe 4192 cmd.exe 3232 cmd.exe 4712 cmd.exe 916 cmd.exe 2252 cmd.exe 5668 cmd.exe 984 cmd.exe 5200 cmd.exe 5584 cmd.exe 5128 cmd.exe 1444 cmd.exe 4452 cmd.exe 3040 cmd.exe 2304 cmd.exe 3376 cmd.exe 5872 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4312 4888 WerFault.exe 87 4628 5504 WerFault.exe 93 2752 944 WerFault.exe 99 5832 5460 WerFault.exe 104 5196 4584 WerFault.exe 108 4588 5068 WerFault.exe 114 1884 4472 WerFault.exe 119 1244 4416 WerFault.exe 124 4116 2808 WerFault.exe 129 4940 3368 WerFault.exe 134 6064 6084 WerFault.exe 139 5408 3808 WerFault.exe 144 1428 3432 WerFault.exe 149 5960 2916 WerFault.exe 154 4544 4936 WerFault.exe 159 1824 4564 WerFault.exe 164 4988 2288 WerFault.exe 169 1884 2748 WerFault.exe 174 5932 1308 WerFault.exe 179 1416 4444 WerFault.exe 184 2648 3872 WerFault.exe 189 5376 4532 WerFault.exe 194 3132 2504 WerFault.exe 199 3592 4340 WerFault.exe 204 400 2880 WerFault.exe 209 4640 2792 WerFault.exe 214 4904 3512 WerFault.exe 219 2084 4884 WerFault.exe 224 2796 3084 WerFault.exe 229 1080 5716 WerFault.exe 234 4280 5636 WerFault.exe 239 5896 5104 WerFault.exe 244 2680 4840 WerFault.exe 249 3692 5000 WerFault.exe 254 4136 4684 WerFault.exe 259 4176 3592 WerFault.exe 264 2352 5852 WerFault.exe 269 4904 5196 WerFault.exe 274 1676 5192 WerFault.exe 280 2100 1168 WerFault.exe 285 3472 4188 WerFault.exe 290 2640 3768 WerFault.exe 295 4804 2468 WerFault.exe 300 1936 3784 WerFault.exe 305 5808 5388 WerFault.exe 310 3284 5144 WerFault.exe 315 5884 236 WerFault.exe 320 5988 1152 WerFault.exe 325 4448 1816 WerFault.exe 330 5380 2924 WerFault.exe 335 1808 3572 WerFault.exe 340 1432 2324 WerFault.exe 345 900 2944 WerFault.exe 350 4244 5800 WerFault.exe 355 2476 3132 WerFault.exe 360 1364 2184 WerFault.exe 365 204 6044 WerFault.exe 370 3920 6052 WerFault.exe 375 1888 2520 WerFault.exe 380 4896 4368 WerFault.exe 385 1416 5944 WerFault.exe 390 752 2768 WerFault.exe 395 5396 4256 WerFault.exe 400 3092 6064 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJPUANN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VVKUDRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZHKGSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UAWBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PLYCSG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPXNX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NLAVEQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGFRG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYXRMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDOFEYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYBZO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KCBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWZYS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUFVAHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IWIEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYYNRTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIVQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILNCPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AQOQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTSQV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LTKJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZWKGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VALANWA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGXDXJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NIKSZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJJMBGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4888 2026-10-25_cc0d2a747a489343b153b82516eee9e3_elex_emotet_stop.exe 4888 2026-10-25_cc0d2a747a489343b153b82516eee9e3_elex_emotet_stop.exe 5504 QIZ.exe 5504 QIZ.exe 944 AQN.exe 944 AQN.exe 5460 EYBZO.exe 5460 EYBZO.exe 4584 ZTYJZPA.exe 4584 ZTYJZPA.exe 5068 FUGW.exe 5068 FUGW.exe 4472 ZHKGSR.exe 4472 ZHKGSR.exe 4416 GCKHXUG.exe 4416 GCKHXUG.exe 2808 AQOQ.exe 2808 AQOQ.exe 3368 PLYCSG.exe 3368 PLYCSG.exe 6084 NGXDXJL.exe 6084 NGXDXJL.exe 3808 TGFRG.exe 3808 TGFRG.exe 3432 DEKL.exe 3432 DEKL.exe 2916 WZWHAK.exe 2916 WZWHAK.exe 4936 GXCBI.exe 4936 GXCBI.exe 4564 VNDB.exe 4564 VNDB.exe 2288 KQMFA.exe 2288 KQMFA.exe 2748 SVZM.exe 2748 SVZM.exe 1308 SBRAMEB.exe 1308 SBRAMEB.exe 4444 IWIEF.exe 4444 IWIEF.exe 3872 TPDX.exe 3872 TPDX.exe 4532 CXFKQDT.exe 4532 CXFKQDT.exe 2504 XKKU.exe 2504 XKKU.exe 4340 ZYPDDD.exe 4340 ZYPDDD.exe 2880 XYXRMF.exe 2880 XYXRMF.exe 2792 ATB.exe 2792 ATB.exe 3512 UGGKH.exe 3512 UGGKH.exe 4884 PULTRFY.exe 4884 PULTRFY.exe 3084 KHQ.exe 3084 KHQ.exe 5716 UFW.exe 5716 UFW.exe 5636 KYYNRTK.exe 5636 KYYNRTK.exe 5104 LTKJ.exe 5104 LTKJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4888 2026-10-25_cc0d2a747a489343b153b82516eee9e3_elex_emotet_stop.exe 4888 2026-10-25_cc0d2a747a489343b153b82516eee9e3_elex_emotet_stop.exe 5504 QIZ.exe 5504 QIZ.exe 944 AQN.exe 944 AQN.exe 5460 EYBZO.exe 5460 EYBZO.exe 4584 ZTYJZPA.exe 4584 ZTYJZPA.exe 5068 FUGW.exe 5068 FUGW.exe 4472 ZHKGSR.exe 4472 ZHKGSR.exe 4416 GCKHXUG.exe 4416 GCKHXUG.exe 2808 AQOQ.exe 2808 AQOQ.exe 3368 PLYCSG.exe 3368 PLYCSG.exe 6084 NGXDXJL.exe 6084 NGXDXJL.exe 3808 TGFRG.exe 3808 TGFRG.exe 3432 DEKL.exe 3432 DEKL.exe 2916 WZWHAK.exe 2916 WZWHAK.exe 4936 GXCBI.exe 4936 GXCBI.exe 4564 VNDB.exe 4564 VNDB.exe 2288 KQMFA.exe 2288 KQMFA.exe 2748 SVZM.exe 2748 SVZM.exe 1308 SBRAMEB.exe 1308 SBRAMEB.exe 4444 IWIEF.exe 4444 IWIEF.exe 3872 TPDX.exe 3872 TPDX.exe 4532 CXFKQDT.exe 4532 CXFKQDT.exe 2504 XKKU.exe 2504 XKKU.exe 4340 ZYPDDD.exe 4340 ZYPDDD.exe 2880 XYXRMF.exe 2880 XYXRMF.exe 2792 ATB.exe 2792 ATB.exe 3512 UGGKH.exe 3512 UGGKH.exe 4884 PULTRFY.exe 4884 PULTRFY.exe 3084 KHQ.exe 3084 KHQ.exe 5716 UFW.exe 5716 UFW.exe 5636 KYYNRTK.exe 5636 KYYNRTK.exe 5104 LTKJ.exe 5104 LTKJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4888 wrote to memory of 4756 4888 2026-10-25_cc0d2a747a489343b153b82516eee9e3_elex_emotet_stop.exe 89 PID 4756 wrote to memory of 5504 4756 cmd.exe 93 PID 5504 wrote to memory of 2196 5504 QIZ.exe 95 PID 2196 wrote to memory of 944 2196 cmd.exe 99 PID 944 wrote to memory of 4560 944 AQN.exe 100 PID 4560 wrote to memory of 5460 4560 cmd.exe 104 PID 5460 wrote to memory of 200 5460 EYBZO.exe 105 PID 200 wrote to memory of 4584 200 cmd.exe 108 PID 4584 wrote to memory of 4576 4584 ZTYJZPA.exe 110 PID 4576 wrote to memory of 5068 4576 cmd.exe 114 PID 5068 wrote to memory of 4100 5068 FUGW.exe 115 PID 4100 wrote to memory of 4472 4100 cmd.exe 119 PID 4472 wrote to memory of 1216 4472 ZHKGSR.exe 120 PID 1216 wrote to memory of 4416 1216 cmd.exe 124 PID 4416 wrote to memory of 2036 4416 GCKHXUG.exe 125 PID 2036 wrote to memory of 2808 2036 cmd.exe 129 PID 2808 wrote to memory of 3192 2808 AQOQ.exe 130 PID 3192 wrote to memory of 3368 3192 cmd.exe 134 PID 3368 wrote to memory of 2424 3368 PLYCSG.exe 135 PID 2424 wrote to memory of 6084 2424 cmd.exe 139 PID 6084 wrote to memory of 4324 6084 NGXDXJL.exe 140 PID 4324 wrote to memory of 3808 4324 cmd.exe 144 PID 3808 wrote to memory of 4200 3808 TGFRG.exe 145 PID 4200 wrote to memory of 3432 4200 cmd.exe 149 PID 3432 wrote to memory of 4312 3432 DEKL.exe 150 PID 4312 wrote to memory of 2916 4312 cmd.exe 154 PID 2916 wrote to memory of 3764 2916 WZWHAK.exe 155 PID 3764 wrote to memory of 4936 3764 cmd.exe 159 PID 4936 wrote to memory of 3220 4936 GXCBI.exe 160 PID 3220 wrote to memory of 4564 3220 cmd.exe 164 PID 4564 wrote to memory of 2372 4564 VNDB.exe 165 PID 2372 wrote to memory of 2288 2372 cmd.exe 169 PID 2288 wrote to memory of 4748 2288 KQMFA.exe 170 PID 4748 wrote to memory of 2748 4748 cmd.exe 174 PID 2748 wrote to memory of 3732 2748 SVZM.exe 175 PID 3732 wrote to memory of 1308 3732 cmd.exe 179 PID 1308 wrote to memory of 6004 1308 SBRAMEB.exe 180 PID 6004 wrote to memory of 4444 6004 cmd.exe 184 PID 4444 wrote to memory of 4192 4444 IWIEF.exe 185 PID 4192 wrote to memory of 3872 4192 cmd.exe 189 PID 3872 wrote to memory of 2496 3872 TPDX.exe 190 PID 2496 wrote to memory of 4532 2496 cmd.exe 194 PID 4532 wrote to memory of 5400 4532 CXFKQDT.exe 195 PID 5400 wrote to memory of 2504 5400 cmd.exe 199 PID 2504 wrote to memory of 2488 2504 XKKU.exe 200 PID 2488 wrote to memory of 4340 2488 cmd.exe 204 PID 4340 wrote to memory of 4120 4340 ZYPDDD.exe 205 PID 4120 wrote to memory of 2880 4120 cmd.exe 209 PID 2880 wrote to memory of 4320 2880 XYXRMF.exe 210 PID 4320 wrote to memory of 2792 4320 cmd.exe 214 PID 2792 wrote to memory of 6136 2792 ATB.exe 215 PID 6136 wrote to memory of 3512 6136 cmd.exe 219 PID 3512 wrote to memory of 2688 3512 UGGKH.exe 220 PID 2688 wrote to memory of 4884 2688 cmd.exe 224 PID 4884 wrote to memory of 2040 4884 PULTRFY.exe 225 PID 2040 wrote to memory of 3084 2040 cmd.exe 229 PID 3084 wrote to memory of 5060 3084 KHQ.exe 230 PID 5060 wrote to memory of 5716 5060 cmd.exe 234 PID 5716 wrote to memory of 3252 5716 UFW.exe 235 PID 3252 wrote to memory of 5636 3252 cmd.exe 239 PID 5636 wrote to memory of 2144 5636 KYYNRTK.exe 240 PID 2144 wrote to memory of 5104 2144 cmd.exe 244 PID 5104 wrote to memory of 4292 5104 LTKJ.exe 245 PID 4292 wrote to memory of 4840 4292 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_cc0d2a747a489343b153b82516eee9e3_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_cc0d2a747a489343b153b82516eee9e3_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIZ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\windows\system\QIZ.exeC:\windows\system\QIZ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQN.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\windows\system\AQN.exeC:\windows\system\AQN.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EYBZO.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\windows\system\EYBZO.exeC:\windows\system\EYBZO.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZTYJZPA.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:200 -
C:\windows\system\ZTYJZPA.exeC:\windows\system\ZTYJZPA.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FUGW.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\windows\SysWOW64\FUGW.exeC:\windows\system32\FUGW.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZHKGSR.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\windows\SysWOW64\ZHKGSR.exeC:\windows\system32\ZHKGSR.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCKHXUG.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\windows\system\GCKHXUG.exeC:\windows\system\GCKHXUG.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AQOQ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\windows\AQOQ.exeC:\windows\AQOQ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PLYCSG.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\windows\system\PLYCSG.exeC:\windows\system\PLYCSG.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NGXDXJL.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\windows\SysWOW64\NGXDXJL.exeC:\windows\system32\NGXDXJL.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TGFRG.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\windows\TGFRG.exeC:\windows\TGFRG.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DEKL.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\windows\SysWOW64\DEKL.exeC:\windows\system32\DEKL.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WZWHAK.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\windows\WZWHAK.exeC:\windows\WZWHAK.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXCBI.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\windows\system\GXCBI.exeC:\windows\system\GXCBI.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VNDB.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\windows\system\VNDB.exeC:\windows\system\VNDB.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KQMFA.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\windows\SysWOW64\KQMFA.exeC:\windows\system32\KQMFA.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SVZM.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\windows\system\SVZM.exeC:\windows\system\SVZM.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SBRAMEB.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\windows\system\SBRAMEB.exeC:\windows\system\SBRAMEB.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IWIEF.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\windows\system\IWIEF.exeC:\windows\system\IWIEF.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TPDX.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\windows\SysWOW64\TPDX.exeC:\windows\system32\TPDX.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CXFKQDT.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\windows\SysWOW64\CXFKQDT.exeC:\windows\system32\CXFKQDT.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XKKU.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\windows\system\XKKU.exeC:\windows\system\XKKU.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZYPDDD.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\windows\SysWOW64\ZYPDDD.exeC:\windows\system32\ZYPDDD.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYXRMF.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\windows\XYXRMF.exeC:\windows\XYXRMF.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATB.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\windows\system\ATB.exeC:\windows\system\ATB.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGGKH.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\windows\system\UGGKH.exeC:\windows\system\UGGKH.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PULTRFY.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\windows\system\PULTRFY.exeC:\windows\system\PULTRFY.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KHQ.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\windows\SysWOW64\KHQ.exeC:\windows\system32\KHQ.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UFW.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\windows\system\UFW.exeC:\windows\system\UFW.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYYNRTK.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\windows\SysWOW64\KYYNRTK.exeC:\windows\system32\KYYNRTK.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LTKJ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\windows\system\LTKJ.exeC:\windows\system\LTKJ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDTH.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\windows\YDTH.exeC:\windows\YDTH.exe65⤵
- Executes dropped EXE
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLZPXM.exe.bat" "66⤵PID:2516
-
C:\windows\system\CLZPXM.exeC:\windows\system\CLZPXM.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHE.exe.bat" "68⤵PID:5136
-
C:\windows\FHE.exeC:\windows\FHE.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXFQGZ.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4132 -
C:\windows\MXFQGZ.exeC:\windows\MXFQGZ.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YFMY.exe.bat" "72⤵PID:4548
-
C:\windows\SysWOW64\YFMY.exeC:\windows\system32\YFMY.exe73⤵
- Executes dropped EXE
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSQHC.exe.bat" "74⤵PID:3448
-
C:\windows\TSQHC.exeC:\windows\TSQHC.exe75⤵
- Executes dropped EXE
PID:5196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NNVRFRF.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:4228 -
C:\windows\system\NNVRFRF.exeC:\windows\system\NNVRFRF.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NTV.exe.bat" "78⤵PID:6060
-
C:\windows\NTV.exeC:\windows\NTV.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IGAPQ.exe.bat" "80⤵PID:1692
-
C:\windows\system\IGAPQ.exeC:\windows\system\IGAPQ.exe81⤵
- Executes dropped EXE
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHICHYY.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:1276 -
C:\windows\SysWOW64\OHICHYY.exeC:\windows\system32\OHICHYY.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPC.exe.bat" "84⤵PID:1084
-
C:\windows\system\XPC.exeC:\windows\system\XPC.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DPKVUY.exe.bat" "86⤵
- Executes a command shell one-liner
PID:3232 -
C:\windows\SysWOW64\DPKVUY.exeC:\windows\system32\DPKVUY.exe87⤵
- Executes dropped EXE
PID:3784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDOFEYQ.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2680 -
C:\windows\system\YDOFEYQ.exeC:\windows\system\YDOFEYQ.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDQS.exe.bat" "90⤵PID:3024
-
C:\windows\SysWOW64\PDQS.exeC:\windows\system32\PDQS.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NBKNDIA.exe.bat" "92⤵
- Executes a command shell one-liner
PID:3860 -
C:\windows\NBKNDIA.exeC:\windows\NBKNDIA.exe93⤵
- Executes dropped EXE
PID:236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTF.exe.bat" "94⤵PID:3584
-
C:\windows\ZTF.exeC:\windows\ZTF.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZFU.exe.bat" "96⤵
- Executes a command shell one-liner
PID:6128 -
C:\windows\system\ZZFU.exeC:\windows\system\ZZFU.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TMKDPD.exe.bat" "98⤵PID:3516
-
C:\windows\TMKDPD.exeC:\windows\TMKDPD.exe99⤵
- Executes dropped EXE
PID:2924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OZO.exe.bat" "100⤵
- Executes a command shell one-liner
PID:2996 -
C:\windows\OZO.exeC:\windows\OZO.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UAWBI.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:3240 -
C:\windows\UAWBI.exeC:\windows\UAWBI.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFUYX.exe.bat" "104⤵PID:5156
-
C:\windows\system\QFUYX.exeC:\windows\system\QFUYX.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLAVEQ.exe.bat" "106⤵PID:2408
-
C:\windows\system\NLAVEQ.exeC:\windows\system\NLAVEQ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYE.exe.bat" "108⤵PID:5624
-
C:\windows\HYE.exeC:\windows\HYE.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HEFT.exe.bat" "110⤵
- Executes a command shell one-liner
PID:3564 -
C:\windows\system\HEFT.exeC:\windows\system\HEFT.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EJCQX.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3200 -
C:\windows\system\EJCQX.exeC:\windows\system\EJCQX.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJKDGH.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:1760 -
C:\windows\SysWOW64\KJKDGH.exeC:\windows\system32\KJKDGH.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXP.exe.bat" "116⤵PID:6040
-
C:\windows\system\EXP.exeC:\windows\system\EXP.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SITL.exe.bat" "118⤵PID:2452
-
C:\windows\SITL.exeC:\windows\SITL.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BIVQZ.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5236 -
C:\windows\BIVQZ.exeC:\windows\BIVQZ.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-