Analysis
- max time kernel
89s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 03:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_e72d4692c03cb86cf3cbb86566817cb2_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-26_e72d4692c03cb86cf3cbb86566817cb2_elex_emotet_stop.exe
- Size 208KB
- Sample261027-ef91baat4x
- SHA256 c474780020f60a2d96bab324cd7ba050f4eafeefb2561154a50634cb12993921
- MD5 e72d4692c03cb86cf3cbb86566817cb2
- SHA1 3533fd8194ec778e7073f8b34eb9785db02b41f6
- SHA512 82243797ebc543ac6469c8e8b3adf6b885910473f2b73a9a55149e222f96b2f700389e8632eac10ca1664fe1e5a69a0e1cdea18fbeac8323417433316cfb41eb
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfz4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOLkEj1
- TLSH T19D247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3900 LGQMNA.exe 5980 STKABU.exe 3704 WCQ.exe 1476 LSRZMAV.exe 3652 KPLCH.exe 3160 KVDRJS.exe 1988 LYP.exe 4312 ATYZHC.exe 3820 JTAE.exe 4132 VPHSYXJ.exe 6044 QCEC.exe 4368 OAXFVKF.exe 2428 HVBA.exe 712 HYE.exe 4640 RGGJ.exe 2708 DONJEGG.exe 5536 MXPWI.exe 4568 FSTSNBK.exe 4740 RIAA.exe 1108 ELQR.exe 3844 PDLK.exe 5912 YLNPZJL.exe 2044 OGWBK.exe 5844 YEKNSEC.exe 4900 HNM.exe 4288 WDNSCXT.exe 4948 LYWEV.exe 2724 GLBOFKI.exe 5516 RDE.exe 956 XEMUW.exe 5784 ZCFO.exe 4872 DKM.exe 688 OCPHPQT.exe 5144 JQUQ.exe 2912 FVRNGZ.exe 4736 PDTTKXM.exe 5888 EYLFV.exe 5752 MEDTWW.exe 2180 SEL.exe 2840 UCQBVHZ.exe 4804 YSFBH.exe 5756 JLAUPH.exe 4828 GIGRWJ.exe 1960 GLJNC.exe 2528 ZONJHW.exe 1128 FPVF.exe 616 FUVL.exe 2880 ZIACKD.exe 5228 QVKUSAO.exe 1020 RADBB.exe 1716 GVU.exe 4300 TBUZOL.exe 3516 ZBCNFF.exe 5392 OSDEE.exe 1388 ENM.exe 2640 KIL.exe 2776 ZDVVNL.exe 1280 TQZ.exe 2104 OEEWZ.exe 1268 ZWHHIS.exe 5376 LPCAQAY.exe 1616 UCNSG.exe 3604 AXMTCA.exe 5872 NICR.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\WCQ.exe STKABU.exe File created C:\windows\SysWOW64\OCPHPQT.exe DKM.exe File opened for modification C:\windows\SysWOW64\EYLFV.exe PDTTKXM.exe File created C:\windows\SysWOW64\QCAQMIA.exe QHW.exe File opened for modification C:\windows\SysWOW64\STV.exe DYMQU.exe File opened for modification C:\windows\SysWOW64\ATYZHC.exe LYP.exe File created C:\windows\SysWOW64\FSTSNBK.exe.bat MXPWI.exe File created C:\windows\SysWOW64\TBUZOL.exe GVU.exe File created C:\windows\SysWOW64\LDVPBYM.exe PXXSTOK.exe File opened for modification C:\windows\SysWOW64\QHW.exe VTRDWLJ.exe File created C:\windows\SysWOW64\STV.exe.bat DYMQU.exe File created C:\windows\SysWOW64\FKMHA.exe.bat ZKEURKE.exe File created C:\windows\SysWOW64\FVRNGZ.exe JQUQ.exe File created C:\windows\SysWOW64\OSDEE.exe.bat ZBCNFF.exe File opened for modification C:\windows\SysWOW64\KTADHZ.exe VOVGSPA.exe File opened for modification C:\windows\SysWOW64\DFEYN.exe DZER.exe File created C:\windows\SysWOW64\DLAW.exe.bat GLSJDXA.exe File opened for modification C:\windows\SysWOW64\YIIGY.exe RNYTNOF.exe File created C:\windows\SysWOW64\YIIGY.exe.bat RNYTNOF.exe File created C:\windows\SysWOW64\FLTP.exe.bat PQKLCY.exe File opened for modification C:\windows\SysWOW64\DONJEGG.exe RGGJ.exe File created C:\windows\SysWOW64\ELQR.exe.bat RIAA.exe File opened for modification C:\windows\SysWOW64\XEMUW.exe RDE.exe File created C:\windows\SysWOW64\TBUZOL.exe.bat GVU.exe File opened for modification C:\windows\SysWOW64\NICR.exe AXMTCA.exe File created C:\windows\SysWOW64\NICR.exe.bat AXMTCA.exe File created C:\windows\SysWOW64\KTADHZ.exe VOVGSPA.exe File created C:\windows\SysWOW64\QCAQMIA.exe.bat QHW.exe File created C:\windows\SysWOW64\ELQR.exe RIAA.exe File created C:\windows\SysWOW64\VPHSYXJ.exe.bat EPFNVA.exe File created C:\windows\SysWOW64\FSTSNBK.exe MXPWI.exe File opened for modification C:\windows\SysWOW64\LDVPBYM.exe PXXSTOK.exe File created C:\windows\SysWOW64\DFEYN.exe DZER.exe File opened for modification C:\windows\SysWOW64\ORJBIC.exe XJHWF.exe File created C:\windows\SysWOW64\FKMHA.exe ZKEURKE.exe File created C:\windows\SysWOW64\WCQ.exe.bat STKABU.exe File created C:\windows\SysWOW64\ATYZHC.exe LYP.exe File opened for modification C:\windows\SysWOW64\JTAE.exe ATYZHC.exe File created C:\windows\SysWOW64\OGWBK.exe.bat YLNPZJL.exe File created C:\windows\SysWOW64\OSDEE.exe ZBCNFF.exe File created C:\windows\SysWOW64\QHW.exe.bat VTRDWLJ.exe File opened for modification C:\windows\SysWOW64\QCAQMIA.exe QHW.exe File created C:\windows\SysWOW64\DFEYN.exe.bat DZER.exe File created C:\windows\SysWOW64\OCPHPQT.exe.bat DKM.exe File created C:\windows\SysWOW64\FLTP.exe PQKLCY.exe File opened for modification C:\windows\SysWOW64\FLTP.exe PQKLCY.exe File created C:\windows\SysWOW64\OTVUYQ.exe.bat FLTP.exe File opened for modification C:\windows\SysWOW64\DLAW.exe GLSJDXA.exe File opened for modification C:\windows\SysWOW64\ZDVVNL.exe KIL.exe File created C:\windows\SysWOW64\HVBA.exe OAXFVKF.exe File created C:\windows\SysWOW64\DONJEGG.exe RGGJ.exe File opened for modification C:\windows\SysWOW64\OCPHPQT.exe DKM.exe File created C:\windows\SysWOW64\EYLFV.exe PDTTKXM.exe File created C:\windows\SysWOW64\PSXESJP.exe WPT.exe File opened for modification C:\windows\SysWOW64\AKKVU.exe DFEYN.exe File created C:\windows\SysWOW64\ZKEURKE.exe ORJBIC.exe File created C:\windows\SysWOW64\WCQ.exe STKABU.exe File opened for modification C:\windows\SysWOW64\KVDRJS.exe KPLCH.exe File opened for modification C:\windows\SysWOW64\ZBCNFF.exe TBUZOL.exe File opened for modification C:\windows\SysWOW64\OSDEE.exe ZBCNFF.exe File created C:\windows\SysWOW64\DLAW.exe GLSJDXA.exe File created C:\windows\SysWOW64\ORJBIC.exe.bat XJHWF.exe File opened for modification C:\windows\SysWOW64\OTVUYQ.exe FLTP.exe File created C:\windows\SysWOW64\JTAE.exe.bat ATYZHC.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\WDNSCXT.exe.bat HNM.exe File created C:\windows\system\ZCFO.exe.bat XEMUW.exe File created C:\windows\system\YSFBH.exe UCQBVHZ.exe File opened for modification C:\windows\system\GLJNC.exe GIGRWJ.exe File created C:\windows\ZWHHIS.exe OEEWZ.exe File created C:\windows\UCNSG.exe.bat LPCAQAY.exe File created C:\windows\OEVFSL.exe TRQW.exe File opened for modification C:\windows\EODAZH.exe DLAW.exe File opened for modification C:\windows\UCNSG.exe LPCAQAY.exe File opened for modification C:\windows\system\HUFVAHV.exe MHAMX.exe File created C:\windows\system\BUTYTCP.exe.bat VTMKK.exe File opened for modification C:\windows\YKNAB.exe PKLV.exe File created C:\windows\system\EOVSV.exe.bat FQCXING.exe File opened for modification C:\windows\system\HIZCPUO.exe FKMHA.exe File opened for modification C:\windows\CXXC.exe BUTYTCP.exe File created C:\windows\PQKLCY.exe.bat YIIGY.exe File created C:\windows\system\JKEHOG.exe.bat FUXH.exe File opened for modification C:\windows\system\DKM.exe ZCFO.exe File created C:\windows\ZONJHW.exe.bat GLJNC.exe File created C:\windows\LXFA.exe.bat QCAQMIA.exe File created C:\windows\LGQMNA.exe.bat 2026-10-26_e72d4692c03cb86cf3cbb86566817cb2_elex_emotet_stop.exe File created C:\windows\system\HNM.exe.bat YEKNSEC.exe File created C:\windows\WPT.exe BBPRCM.exe File created C:\windows\RIAA.exe.bat FSTSNBK.exe File opened for modification C:\windows\system\KIL.exe ENM.exe File opened for modification C:\windows\GLBOFKI.exe LYWEV.exe File opened for modification C:\windows\system\SEL.exe MEDTWW.exe File created C:\windows\DYMQU.exe EOVSV.exe File created C:\windows\LYP.exe.bat KVDRJS.exe File created C:\windows\WPT.exe.bat BBPRCM.exe File created C:\windows\system\WQA.exe.bat LXFA.exe File opened for modification C:\windows\FQCXING.exe WQA.exe File created C:\windows\ILDFVK.exe HIZCPUO.exe File created C:\windows\system\LPCAQAY.exe.bat ZWHHIS.exe File opened for modification C:\windows\system\RNYTNOF.exe CXXC.exe File created C:\windows\TRQW.exe CJO.exe File created C:\windows\system\HIZCPUO.exe FKMHA.exe File created C:\windows\system\RGGJ.exe HYE.exe File opened for modification C:\windows\system\RGGJ.exe HYE.exe File created C:\windows\system\YEKNSEC.exe OGWBK.exe File created C:\windows\system\MEDTWW.exe.bat EYLFV.exe File created C:\windows\system\PDTTKXM.exe FVRNGZ.exe File opened for modification C:\windows\system\QVKUSAO.exe ZIACKD.exe File created C:\windows\system\GVU.exe.bat RADBB.exe File opened for modification C:\windows\ZWHHIS.exe OEEWZ.exe File created C:\windows\FQCXING.exe.bat WQA.exe File created C:\windows\system\EOVSV.exe FQCXING.exe File opened for modification C:\windows\VBHD.exe KTADHZ.exe File opened for modification C:\windows\WPT.exe BBPRCM.exe File opened for modification C:\windows\system\FUXH.exe OTVUYQ.exe File created C:\windows\system\JKEHOG.exe FUXH.exe File opened for modification C:\windows\system\JLAUPH.exe YSFBH.exe File created C:\windows\system\VTRDWLJ.exe.bat RDDD.exe File opened for modification C:\windows\GLSJDXA.exe AKKVU.exe File opened for modification C:\windows\ILDFVK.exe HIZCPUO.exe File created C:\windows\HYE.exe.bat HVBA.exe File opened for modification C:\windows\STKABU.exe LGQMNA.exe File created C:\windows\system\MHAMX.exe.bat STV.exe File opened for modification C:\windows\XJHWF.exe EODAZH.exe File opened for modification C:\windows\system\BUTYTCP.exe VTMKK.exe File opened for modification C:\windows\system\MXPWI.exe DONJEGG.exe File created C:\windows\system\VTRDWLJ.exe RDDD.exe File created C:\windows\system\VTMKK.exe.bat MTK.exe File created C:\windows\system\FUXH.exe.bat OTVUYQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4528 cmd.exe 2144 cmd.exe 5308 cmd.exe 3892 cmd.exe 4320 cmd.exe 5096 cmd.exe 5676 cmd.exe 1500 cmd.exe 972 cmd.exe 3396 cmd.exe 5692 cmd.exe 5160 cmd.exe 5812 cmd.exe 3212 cmd.exe 1940 cmd.exe 4484 cmd.exe 4144 cmd.exe 4260 cmd.exe 2348 cmd.exe 5960 cmd.exe 1288 cmd.exe 2972 cmd.exe 2052 cmd.exe 1284 cmd.exe 5656 cmd.exe 4892 cmd.exe 5388 cmd.exe 4252 cmd.exe 2060 cmd.exe 4244 cmd.exe 2536 cmd.exe 1376 cmd.exe 4080 cmd.exe 3136 cmd.exe 1576 cmd.exe 5016 cmd.exe 5052 cmd.exe 2196 cmd.exe 3916 cmd.exe 3308 cmd.exe 1864 cmd.exe 1916 cmd.exe 6020 cmd.exe 264 cmd.exe 6140 cmd.exe 4548 cmd.exe 5436 cmd.exe 4136 cmd.exe 2068 cmd.exe 5164 cmd.exe 1488 cmd.exe 6072 cmd.exe 3168 cmd.exe 2980 cmd.exe 5824 cmd.exe 4324 cmd.exe 1720 cmd.exe 5132 cmd.exe 5572 cmd.exe 5260 cmd.exe 4856 cmd.exe 400 cmd.exe 2124 cmd.exe 2700 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4936 2984 WerFault.exe 89 3268 3900 WerFault.exe 93 3076 5980 WerFault.exe 100 6104 3704 WerFault.exe 105 4112 1476 WerFault.exe 110 5776 3652 WerFault.exe 115 5012 3160 WerFault.exe 120 560 1988 WerFault.exe 125 5528 4312 WerFault.exe 130 4740 3820 WerFault.exe 135 3196 3668 WerFault.exe 140 3468 4132 WerFault.exe 145 1348 6044 WerFault.exe 150 6120 4368 WerFault.exe 155 2840 2428 WerFault.exe 160 2076 712 WerFault.exe 165 3872 4640 WerFault.exe 170 1964 2708 WerFault.exe 175 4984 5536 WerFault.exe 180 904 4568 WerFault.exe 185 1532 4740 WerFault.exe 190 5688 1108 WerFault.exe 195 4180 3844 WerFault.exe 201 2732 5912 WerFault.exe 206 2288 2044 WerFault.exe 211 4892 5844 WerFault.exe 216 5552 4900 WerFault.exe 221 4816 4288 WerFault.exe 226 5452 4948 WerFault.exe 231 5140 2724 WerFault.exe 236 568 5516 WerFault.exe 241 2480 956 WerFault.exe 246 1092 5784 WerFault.exe 251 1924 4872 WerFault.exe 256 4052 688 WerFault.exe 261 3000 5144 WerFault.exe 266 776 2912 WerFault.exe 271 5620 4736 WerFault.exe 276 1128 5888 WerFault.exe 281 616 5752 WerFault.exe 287 5132 2180 WerFault.exe 292 5776 2840 WerFault.exe 297 4860 4804 WerFault.exe 302 5464 5756 WerFault.exe 307 2696 4828 WerFault.exe 312 944 1960 WerFault.exe 317 2140 2528 WerFault.exe 322 3132 1128 WerFault.exe 327 2540 616 WerFault.exe 332 1680 2880 WerFault.exe 337 1012 5228 WerFault.exe 342 5748 1020 WerFault.exe 347 5400 1716 WerFault.exe 352 944 4300 WerFault.exe 357 2140 3516 WerFault.exe 362 4492 5392 WerFault.exe 367 4464 1388 WerFault.exe 372 2184 2640 WerFault.exe 377 2736 2776 WerFault.exe 382 2168 1280 WerFault.exe 387 3156 2104 WerFault.exe 392 3484 1268 WerFault.exe 397 6120 5376 WerFault.exe 402 5540 1616 WerFault.exe 407 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRQW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-26_e72d4692c03cb86cf3cbb86566817cb2_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUTYTCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OAXFVKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZKEURKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLJNC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXPWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLSJDXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YEKNSEC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVDRJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EODAZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VTMKK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EOVSV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AKKVU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIGRWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWHHIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDTTKXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EPFNVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YLNPZJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYWEV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OTVUYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STKABU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XEMUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSFBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2984 2026-10-26_e72d4692c03cb86cf3cbb86566817cb2_elex_emotet_stop.exe 2984 2026-10-26_e72d4692c03cb86cf3cbb86566817cb2_elex_emotet_stop.exe 3900 LGQMNA.exe 3900 LGQMNA.exe 5980 STKABU.exe 5980 STKABU.exe 3704 WCQ.exe 3704 WCQ.exe 1476 LSRZMAV.exe 1476 LSRZMAV.exe 3652 KPLCH.exe 3652 KPLCH.exe 3160 KVDRJS.exe 3160 KVDRJS.exe 1988 LYP.exe 1988 LYP.exe 4312 ATYZHC.exe 4312 ATYZHC.exe 3668 EPFNVA.exe 3668 EPFNVA.exe 4132 VPHSYXJ.exe 4132 VPHSYXJ.exe 6044 QCEC.exe 6044 QCEC.exe 4368 OAXFVKF.exe 4368 OAXFVKF.exe 2428 HVBA.exe 2428 HVBA.exe 712 HYE.exe 712 HYE.exe 4640 RGGJ.exe 4640 RGGJ.exe 2708 DONJEGG.exe 2708 DONJEGG.exe 5536 MXPWI.exe 5536 MXPWI.exe 4568 FSTSNBK.exe 4568 FSTSNBK.exe 4740 RIAA.exe 4740 RIAA.exe 1108 ELQR.exe 1108 ELQR.exe 3844 PDLK.exe 3844 PDLK.exe 5912 YLNPZJL.exe 5912 YLNPZJL.exe 2044 OGWBK.exe 2044 OGWBK.exe 5844 YEKNSEC.exe 5844 YEKNSEC.exe 4900 HNM.exe 4900 HNM.exe 4288 WDNSCXT.exe 4288 WDNSCXT.exe 4948 LYWEV.exe 4948 LYWEV.exe 2724 GLBOFKI.exe 2724 GLBOFKI.exe 5516 RDE.exe 5516 RDE.exe 956 XEMUW.exe 956 XEMUW.exe 5784 ZCFO.exe 5784 ZCFO.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2984 2026-10-26_e72d4692c03cb86cf3cbb86566817cb2_elex_emotet_stop.exe 2984 2026-10-26_e72d4692c03cb86cf3cbb86566817cb2_elex_emotet_stop.exe 3900 LGQMNA.exe 3900 LGQMNA.exe 5980 STKABU.exe 5980 STKABU.exe 3704 WCQ.exe 3704 WCQ.exe 1476 LSRZMAV.exe 1476 LSRZMAV.exe 3652 KPLCH.exe 3652 KPLCH.exe 3160 KVDRJS.exe 3160 KVDRJS.exe 1988 LYP.exe 1988 LYP.exe 4312 ATYZHC.exe 4312 ATYZHC.exe 3668 EPFNVA.exe 3668 EPFNVA.exe 4132 VPHSYXJ.exe 4132 VPHSYXJ.exe 6044 QCEC.exe 6044 QCEC.exe 4368 OAXFVKF.exe 4368 OAXFVKF.exe 2428 HVBA.exe 2428 HVBA.exe 712 HYE.exe 712 HYE.exe 4640 RGGJ.exe 4640 RGGJ.exe 2708 DONJEGG.exe 2708 DONJEGG.exe 5536 MXPWI.exe 5536 MXPWI.exe 4568 FSTSNBK.exe 4568 FSTSNBK.exe 4740 RIAA.exe 4740 RIAA.exe 1108 ELQR.exe 1108 ELQR.exe 3844 PDLK.exe 3844 PDLK.exe 5912 YLNPZJL.exe 5912 YLNPZJL.exe 2044 OGWBK.exe 2044 OGWBK.exe 5844 YEKNSEC.exe 5844 YEKNSEC.exe 4900 HNM.exe 4900 HNM.exe 4288 WDNSCXT.exe 4288 WDNSCXT.exe 4948 LYWEV.exe 4948 LYWEV.exe 2724 GLBOFKI.exe 2724 GLBOFKI.exe 5516 RDE.exe 5516 RDE.exe 956 XEMUW.exe 956 XEMUW.exe 5784 ZCFO.exe 5784 ZCFO.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2984 wrote to memory of 932 2984 2026-10-26_e72d4692c03cb86cf3cbb86566817cb2_elex_emotet_stop.exe 90 PID 932 wrote to memory of 3900 932 cmd.exe 93 PID 3900 wrote to memory of 3212 3900 LGQMNA.exe 96 PID 3212 wrote to memory of 5980 3212 cmd.exe 100 PID 5980 wrote to memory of 3564 5980 STKABU.exe 101 PID 3564 wrote to memory of 3704 3564 cmd.exe 105 PID 3704 wrote to memory of 3916 3704 WCQ.exe 106 PID 3916 wrote to memory of 1476 3916 cmd.exe 110 PID 1476 wrote to memory of 3700 1476 LSRZMAV.exe 111 PID 3700 wrote to memory of 3652 3700 cmd.exe 115 PID 3652 wrote to memory of 4452 3652 KPLCH.exe 116 PID 4452 wrote to memory of 3160 4452 cmd.exe 120 PID 3160 wrote to memory of 1500 3160 KVDRJS.exe 121 PID 1500 wrote to memory of 1988 1500 cmd.exe 125 PID 1988 wrote to memory of 3852 1988 LYP.exe 126 PID 3852 wrote to memory of 4312 3852 cmd.exe 130 PID 4312 wrote to memory of 1692 4312 ATYZHC.exe 131 PID 1692 wrote to memory of 3820 1692 cmd.exe 135 PID 972 wrote to memory of 3668 972 cmd.exe 140 PID 3668 wrote to memory of 1520 3668 EPFNVA.exe 141 PID 1520 wrote to memory of 4132 1520 cmd.exe 145 PID 4132 wrote to memory of 3268 4132 VPHSYXJ.exe 146 PID 3268 wrote to memory of 6044 3268 cmd.exe 150 PID 6044 wrote to memory of 2080 6044 QCEC.exe 151 PID 2080 wrote to memory of 4368 2080 cmd.exe 155 PID 4368 wrote to memory of 3396 4368 OAXFVKF.exe 156 PID 3396 wrote to memory of 2428 3396 cmd.exe 160 PID 2428 wrote to memory of 4080 2428 HVBA.exe 161 PID 4080 wrote to memory of 712 4080 cmd.exe 165 PID 712 wrote to memory of 2656 712 HYE.exe 166 PID 2656 wrote to memory of 4640 2656 cmd.exe 170 PID 4640 wrote to memory of 3168 4640 RGGJ.exe 171 PID 3168 wrote to memory of 2708 3168 cmd.exe 175 PID 2708 wrote to memory of 3284 2708 DONJEGG.exe 176 PID 3284 wrote to memory of 5536 3284 cmd.exe 180 PID 5536 wrote to memory of 5996 5536 MXPWI.exe 181 PID 5996 wrote to memory of 4568 5996 cmd.exe 185 PID 4568 wrote to memory of 4672 4568 FSTSNBK.exe 186 PID 4672 wrote to memory of 4740 4672 cmd.exe 190 PID 4740 wrote to memory of 5108 4740 RIAA.exe 191 PID 5108 wrote to memory of 1108 5108 cmd.exe 195 PID 1108 wrote to memory of 3112 1108 ELQR.exe 197 PID 3112 wrote to memory of 3844 3112 cmd.exe 201 PID 3844 wrote to memory of 4768 3844 PDLK.exe 202 PID 4768 wrote to memory of 5912 4768 cmd.exe 206 PID 5912 wrote to memory of 6020 5912 YLNPZJL.exe 207 PID 6020 wrote to memory of 2044 6020 cmd.exe 211 PID 2044 wrote to memory of 2372 2044 OGWBK.exe 212 PID 2372 wrote to memory of 5844 2372 cmd.exe 216 PID 5844 wrote to memory of 6056 5844 YEKNSEC.exe 217 PID 6056 wrote to memory of 4900 6056 cmd.exe 221 PID 4900 wrote to memory of 1896 4900 HNM.exe 222 PID 1896 wrote to memory of 4288 1896 cmd.exe 226 PID 4288 wrote to memory of 5396 4288 WDNSCXT.exe 227 PID 5396 wrote to memory of 4948 5396 cmd.exe 231 PID 4948 wrote to memory of 5080 4948 LYWEV.exe 232 PID 5080 wrote to memory of 2724 5080 cmd.exe 236 PID 2724 wrote to memory of 5572 2724 GLBOFKI.exe 237 PID 5572 wrote to memory of 5516 5572 cmd.exe 241 PID 5516 wrote to memory of 1284 5516 RDE.exe 242 PID 1284 wrote to memory of 956 1284 cmd.exe 246 PID 956 wrote to memory of 5656 956 XEMUW.exe 247 PID 5656 wrote to memory of 5784 5656 cmd.exe 251 PID 5784 wrote to memory of 2348 5784 ZCFO.exe 252
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_e72d4692c03cb86cf3cbb86566817cb2_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e72d4692c03cb86cf3cbb86566817cb2_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGQMNA.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:932 -
C:\windows\LGQMNA.exeC:\windows\LGQMNA.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\STKABU.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\windows\STKABU.exeC:\windows\STKABU.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCQ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\windows\SysWOW64\WCQ.exeC:\windows\system32\WCQ.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LSRZMAV.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\windows\system\LSRZMAV.exeC:\windows\system\LSRZMAV.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPLCH.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\windows\KPLCH.exeC:\windows\KPLCH.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVDRJS.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\windows\SysWOW64\KVDRJS.exeC:\windows\system32\KVDRJS.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LYP.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\windows\LYP.exeC:\windows\LYP.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ATYZHC.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\windows\SysWOW64\ATYZHC.exeC:\windows\system32\ATYZHC.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JTAE.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\windows\SysWOW64\JTAE.exeC:\windows\system32\JTAE.exe19⤵
- Executes dropped EXE
PID:3820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EPFNVA.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:972 -
C:\windows\SysWOW64\EPFNVA.exeC:\windows\system32\EPFNVA.exe21⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPHSYXJ.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\windows\SysWOW64\VPHSYXJ.exeC:\windows\system32\VPHSYXJ.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCEC.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\windows\QCEC.exeC:\windows\QCEC.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OAXFVKF.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\windows\system\OAXFVKF.exeC:\windows\system\OAXFVKF.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVBA.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\windows\SysWOW64\HVBA.exeC:\windows\system32\HVBA.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYE.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\windows\HYE.exeC:\windows\HYE.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGGJ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\windows\system\RGGJ.exeC:\windows\system\RGGJ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DONJEGG.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\windows\SysWOW64\DONJEGG.exeC:\windows\system32\DONJEGG.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXPWI.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\windows\system\MXPWI.exeC:\windows\system\MXPWI.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FSTSNBK.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\windows\SysWOW64\FSTSNBK.exeC:\windows\system32\FSTSNBK.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RIAA.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\windows\RIAA.exeC:\windows\RIAA.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ELQR.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\windows\SysWOW64\ELQR.exeC:\windows\system32\ELQR.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PDLK.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\windows\PDLK.exeC:\windows\PDLK.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YLNPZJL.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\windows\YLNPZJL.exeC:\windows\YLNPZJL.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OGWBK.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\windows\SysWOW64\OGWBK.exeC:\windows\system32\OGWBK.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YEKNSEC.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\windows\system\YEKNSEC.exeC:\windows\system\YEKNSEC.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HNM.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\windows\system\HNM.exeC:\windows\system\HNM.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDNSCXT.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\windows\WDNSCXT.exeC:\windows\WDNSCXT.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYWEV.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\windows\system\LYWEV.exeC:\windows\system\LYWEV.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLBOFKI.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\windows\GLBOFKI.exeC:\windows\GLBOFKI.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDE.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\windows\RDE.exeC:\windows\RDE.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XEMUW.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\windows\SysWOW64\XEMUW.exeC:\windows\system32\XEMUW.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZCFO.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\system\ZCFO.exeC:\windows\system\ZCFO.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKM.exe.bat" "66⤵
- Executes a command shell one-liner
PID:2348 -
C:\windows\system\DKM.exeC:\windows\system\DKM.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OCPHPQT.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:4284 -
C:\windows\SysWOW64\OCPHPQT.exeC:\windows\system32\OCPHPQT.exe69⤵
- Executes dropped EXE
PID:688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JQUQ.exe.bat" "70⤵
- Executes a command shell one-liner
PID:1488 -
C:\windows\JQUQ.exeC:\windows\JQUQ.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FVRNGZ.exe.bat" "72⤵PID:1016
-
C:\windows\SysWOW64\FVRNGZ.exeC:\windows\system32\FVRNGZ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PDTTKXM.exe.bat" "74⤵PID:4816
-
C:\windows\system\PDTTKXM.exeC:\windows\system\PDTTKXM.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYLFV.exe.bat" "76⤵PID:3740
-
C:\windows\SysWOW64\EYLFV.exeC:\windows\system32\EYLFV.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEDTWW.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5252 -
C:\windows\system\MEDTWW.exeC:\windows\system\MEDTWW.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEL.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5260 -
C:\windows\system\SEL.exeC:\windows\system\SEL.exe81⤵
- Executes dropped EXE
PID:2180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UCQBVHZ.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3136 -
C:\windows\system\UCQBVHZ.exeC:\windows\system\UCQBVHZ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSFBH.exe.bat" "84⤵PID:1272
-
C:\windows\system\YSFBH.exeC:\windows\system\YSFBH.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLAUPH.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:264 -
C:\windows\system\JLAUPH.exeC:\windows\system\JLAUPH.exe87⤵
- Executes dropped EXE
PID:5756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GIGRWJ.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2144 -
C:\windows\system\GIGRWJ.exeC:\windows\system\GIGRWJ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GLJNC.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4856 -
C:\windows\system\GLJNC.exeC:\windows\system\GLJNC.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZONJHW.exe.bat" "92⤵PID:4584
-
C:\windows\ZONJHW.exeC:\windows\ZONJHW.exe93⤵
- Executes dropped EXE
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FPVF.exe.bat" "94⤵
- Executes a command shell one-liner
PID:5960 -
C:\windows\system\FPVF.exeC:\windows\system\FPVF.exe95⤵
- Executes dropped EXE
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FUVL.exe.bat" "96⤵
- Executes a command shell one-liner
PID:1940 -
C:\windows\system\FUVL.exeC:\windows\system\FUVL.exe97⤵
- Executes dropped EXE
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZIACKD.exe.bat" "98⤵
- Executes a command shell one-liner
PID:6072 -
C:\windows\system\ZIACKD.exeC:\windows\system\ZIACKD.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QVKUSAO.exe.bat" "100⤵PID:3276
-
C:\windows\system\QVKUSAO.exeC:\windows\system\QVKUSAO.exe101⤵
- Executes dropped EXE
PID:5228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RADBB.exe.bat" "102⤵PID:1472
-
C:\windows\RADBB.exeC:\windows\RADBB.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GVU.exe.bat" "104⤵
- Executes a command shell one-liner
PID:1576 -
C:\windows\system\GVU.exeC:\windows\system\GVU.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TBUZOL.exe.bat" "106⤵PID:3220
-
C:\windows\SysWOW64\TBUZOL.exeC:\windows\system32\TBUZOL.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZBCNFF.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:236 -
C:\windows\SysWOW64\ZBCNFF.exeC:\windows\system32\ZBCNFF.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OSDEE.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1288 -
C:\windows\SysWOW64\OSDEE.exeC:\windows\system32\OSDEE.exe111⤵
- Executes dropped EXE
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ENM.exe.bat" "112⤵PID:3464
-
C:\windows\system\ENM.exeC:\windows\system\ENM.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KIL.exe.bat" "114⤵PID:2240
-
C:\windows\system\KIL.exeC:\windows\system\KIL.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDVVNL.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6140 -
C:\windows\SysWOW64\ZDVVNL.exeC:\windows\system32\ZDVVNL.exe117⤵
- Executes dropped EXE
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TQZ.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4892 -
C:\windows\TQZ.exeC:\windows\TQZ.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OEEWZ.exe.bat" "120⤵PID:620
-
C:\windows\OEEWZ.exeC:\windows\OEEWZ.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-