Analysis
- max time kernel
91s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 21:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_a66a408a00b26811229c90096273498d_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-28_a66a408a00b26811229c90096273498d_elex_emotet_stop.exe
- Size 208KB
- Sample261029-1mappatsbt
- SHA256 8de7ac7766738c2c32e1dfc0887567211b21c25dad5d44c2c2fadc1daa818fa6
- MD5 a66a408a00b26811229c90096273498d
- SHA1 0c1c886c22b25992531d619138f8cfdcf2ff8772
- SHA512 b7da0f7a9672b96c81baf290fc33a92e7cbc559dd461d4cec81cd0ad44c54f66c00b480442cd6ea5c245cfcdf1d090efc519a45b3448ca229e74ffa53581cde4
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfa4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOikEj1
- TLSH T1E6247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3500 MFZYY.exe 1236 CSYF.exe 2664 RIZXYVL.exe 4336 DBUPYK.exe 2920 XOZZJ.exe 3740 BEOHVVE.exe 4780 WSKQ.exe 3076 QFPAPU.exe 4500 CYSSQKW.exe 5748 ANDNLP.exe 5336 DJIFNPT.exe 5192 MJKK.exe 2828 VRMPC.exe 5992 HZTPOCL.exe 1936 LPZXAUH.exe 3356 PXOX.exe 1700 KLTGPM.exe 2176 BTNUSKM.exe 2016 KTPZ.exe 3256 HZVOL.exe 1344 FZC.exe 3524 HMHT.exe 4212 PCIKLO.exe 2108 VDQ.exe 2540 DQU.exe 3220 URWS.exe 2408 SREFRP.exe 1112 UEJ.exe 3716 GXMI.exe 5340 RPPSK.exe 1084 MLUKUDM.exe 2952 AIRZBNG.exe 2028 GIZN.exe 6128 RBCFS.exe 4220 GEM.exe 3856 OKMY.exe 3380 MKTUWQ.exe 2064 JHRJDA.exe 2452 PDQS.exe 2760 YQBK.exe 3352 VWHZFK.exe 3228 GOKSNRY.exe 4140 CMHPUBA.exe 1988 OEK.exe 1476 ZXNA.exe 1772 FXVOTSY.exe 2656 ZTAX.exe 3876 ZYSM.exe 2372 HJBF.exe 2308 SBEYTQ.exe 4092 IEN.exe 4476 YPDA.exe 1980 VNJXT.exe 4552 TNRLCJ.exe 1640 EGUEKRI.exe 1416 MYVX.exe 5848 XRY.exe 4572 UWDNN.exe 3292 FPYGOB.exe 5808 ACD.exe 4576 WIJNFDM.exe 120 HAMF.exe 4880 FAUTWM.exe 3168 QTPEFUK.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\URWS.exe DQU.exe File created C:\windows\SysWOW64\MYVX.exe EGUEKRI.exe File created C:\windows\SysWOW64\JHRJDA.exe.bat MKTUWQ.exe File created C:\windows\SysWOW64\VDOY.exe.bat MVU.exe File opened for modification C:\windows\SysWOW64\CMAE.exe NWZ.exe File created C:\windows\SysWOW64\DZULK.exe HUWO.exe File created C:\windows\SysWOW64\DZULK.exe.bat HUWO.exe File opened for modification C:\windows\SysWOW64\GNXFH.exe LSS.exe File created C:\windows\SysWOW64\URWS.exe DQU.exe File created C:\windows\SysWOW64\HMHT.exe FZC.exe File opened for modification C:\windows\SysWOW64\WIJNFDM.exe ACD.exe File created C:\windows\SysWOW64\DSTM.exe TSR.exe File created C:\windows\SysWOW64\LEYXF.exe FJZWIQP.exe File created C:\windows\SysWOW64\LEYXF.exe.bat FJZWIQP.exe File created C:\windows\SysWOW64\RIZXYVL.exe.bat CSYF.exe File created C:\windows\SysWOW64\ANDNLP.exe.bat CYSSQKW.exe File opened for modification C:\windows\SysWOW64\KLTGPM.exe PXOX.exe File opened for modification C:\windows\SysWOW64\GOKSNRY.exe VWHZFK.exe File created C:\windows\SysWOW64\OEK.exe.bat CMHPUBA.exe File created C:\windows\SysWOW64\TNRLCJ.exe.bat VNJXT.exe File created C:\windows\SysWOW64\VDQ.exe.bat PCIKLO.exe File created C:\windows\SysWOW64\MKTUWQ.exe OKMY.exe File opened for modification C:\windows\SysWOW64\FNJL.exe ZMBXZJD.exe File created C:\windows\SysWOW64\AIRZBNG.exe MLUKUDM.exe File created C:\windows\SysWOW64\JHRJDA.exe MKTUWQ.exe File created C:\windows\SysWOW64\WIJNFDM.exe ACD.exe File created C:\windows\SysWOW64\CMAE.exe.bat NWZ.exe File created C:\windows\SysWOW64\GNXFH.exe LSS.exe File created C:\windows\SysWOW64\KLTGPM.exe PXOX.exe File created C:\windows\SysWOW64\NWZ.exe QQTIWT.exe File created C:\windows\SysWOW64\PSXESJP.exe.bat DZULK.exe File created C:\windows\SysWOW64\PDQS.exe JHRJDA.exe File created C:\windows\SysWOW64\PDQS.exe.bat JHRJDA.exe File created C:\windows\SysWOW64\CMAE.exe NWZ.exe File opened for modification C:\windows\SysWOW64\PSXESJP.exe DZULK.exe File created C:\windows\SysWOW64\WQGUHAZ.exe.bat AKAXSR.exe File opened for modification C:\windows\SysWOW64\KVUNY.exe TIKV.exe File created C:\windows\SysWOW64\KTPZ.exe BTNUSKM.exe File created C:\windows\SysWOW64\RBCFS.exe.bat GIZN.exe File created C:\windows\SysWOW64\VNJXT.exe.bat YPDA.exe File opened for modification C:\windows\SysWOW64\KKXBOT.exe JPLYI.exe File created C:\windows\SysWOW64\MGSESSJ.exe.bat YBMHLJP.exe File created C:\windows\SysWOW64\KVUNY.exe TIKV.exe File opened for modification C:\windows\SysWOW64\RBCFS.exe GIZN.exe File created C:\windows\SysWOW64\KJH.exe EJZ.exe File opened for modification C:\windows\SysWOW64\JPLYI.exe DODKZBW.exe File created C:\windows\SysWOW64\MGSESSJ.exe YBMHLJP.exe File opened for modification C:\windows\SysWOW64\DZULK.exe HUWO.exe File created C:\windows\SysWOW64\VDQ.exe PCIKLO.exe File created C:\windows\SysWOW64\GOKSNRY.exe VWHZFK.exe File created C:\windows\SysWOW64\KVUNY.exe.bat TIKV.exe File created C:\windows\SysWOW64\ANDNLP.exe CYSSQKW.exe File created C:\windows\SysWOW64\UWDNN.exe XRY.exe File opened for modification C:\windows\SysWOW64\KJH.exe EJZ.exe File created C:\windows\SysWOW64\AIRZBNG.exe.bat MLUKUDM.exe File created C:\windows\SysWOW64\RPPSK.exe GXMI.exe File opened for modification C:\windows\SysWOW64\ANDNLP.exe CYSSQKW.exe File opened for modification C:\windows\SysWOW64\HMHT.exe FZC.exe File opened for modification C:\windows\SysWOW64\RPPSK.exe GXMI.exe File created C:\windows\SysWOW64\VNJXT.exe YPDA.exe File created C:\windows\SysWOW64\MJHZ.exe.bat SNKQNJM.exe File created C:\windows\SysWOW64\LSS.exe.bat REWMUJ.exe File opened for modification C:\windows\SysWOW64\AIRZBNG.exe MLUKUDM.exe File created C:\windows\SysWOW64\MKTUWQ.exe.bat OKMY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\FJZWIQP.exe.bat KVUNY.exe File created C:\windows\ZXNA.exe OEK.exe File created C:\windows\system\ZYSM.exe ZTAX.exe File opened for modification C:\windows\FZC.exe HZVOL.exe File opened for modification C:\windows\SBEYTQ.exe HJBF.exe File opened for modification C:\windows\AACP.exe GNXFH.exe File created C:\windows\QFPAPU.exe.bat WSKQ.exe File created C:\windows\HZVOL.exe.bat KTPZ.exe File created C:\windows\FZC.exe HZVOL.exe File opened for modification C:\windows\system\TIKV.exe CXLX.exe File created C:\windows\system\WSKQ.exe BEOHVVE.exe File created C:\windows\MJKK.exe DJIFNPT.exe File opened for modification C:\windows\system\BTNUSKM.exe KLTGPM.exe File created C:\windows\AKAXSR.exe PSXESJP.exe File opened for modification C:\windows\system\YBKSY.exe MJHZ.exe File created C:\windows\IEYLWNG.exe.bat LEYXF.exe File opened for modification C:\windows\CSYF.exe MFZYY.exe File created C:\windows\system\FPYGOB.exe UWDNN.exe File opened for modification C:\windows\KMS.exe QTPEFUK.exe File created C:\windows\system\RGR.exe WLMYJA.exe File created C:\windows\system\TSR.exe.bat KKXBOT.exe File opened for modification C:\windows\AKAXSR.exe PSXESJP.exe File created C:\windows\system\CXLX.exe.bat NCCTXE.exe File created C:\windows\system\HZTPOCL.exe VRMPC.exe File created C:\windows\system\FPYGOB.exe.bat UWDNN.exe File created C:\windows\FAUTWM.exe HAMF.exe File created C:\windows\system\OSPUL.exe TFK.exe File created C:\windows\system\NCCTXE.exe YMB.exe File created C:\windows\system\CVKT.exe.bat AXIR.exe File created C:\windows\BEOHVVE.exe.bat XOZZJ.exe File created C:\windows\FAUTWM.exe.bat HAMF.exe File opened for modification C:\windows\system\UZQPNAK.exe YBKSY.exe File created C:\windows\system\NCCTXE.exe.bat YMB.exe File created C:\windows\DBUPYK.exe RIZXYVL.exe File created C:\windows\system\ZYSM.exe.bat ZTAX.exe File opened for modification C:\windows\QPOWBM.exe EXLDT.exe File created C:\windows\QPOWBM.exe.bat EXLDT.exe File created C:\windows\VQQCB.exe NDYNZ.exe File opened for modification C:\windows\system\DJIFNPT.exe ANDNLP.exe File created C:\windows\system\OKMY.exe GEM.exe File opened for modification C:\windows\system\HUWO.exe MGSESSJ.exe File created C:\windows\system\IEN.exe.bat SBEYTQ.exe File opened for modification C:\windows\system\ZYSM.exe ZTAX.exe File opened for modification C:\windows\system\XZOW.exe WQGUHAZ.exe File created C:\windows\system\TFK.exe.bat XZFOUY.exe File opened for modification C:\windows\system\DODKZBW.exe UGJFOE.exe File created C:\windows\DBUPYK.exe.bat RIZXYVL.exe File created C:\windows\system\HZTPOCL.exe.bat VRMPC.exe File created C:\windows\system\BTNUSKM.exe.bat KLTGPM.exe File created C:\windows\SREFRP.exe.bat URWS.exe File created C:\windows\SBEYTQ.exe HJBF.exe File created C:\windows\QFPAPU.exe WSKQ.exe File created C:\windows\OZQBBMG.exe XZOW.exe File created C:\windows\system\TIKV.exe CXLX.exe File opened for modification C:\windows\DBUPYK.exe RIZXYVL.exe File created C:\windows\system\UEJ.exe.bat SREFRP.exe File opened for modification C:\windows\system\ACD.exe FPYGOB.exe File created C:\windows\system\QQTIWT.exe.bat VDOY.exe File opened for modification C:\windows\system\TSR.exe KKXBOT.exe File created C:\windows\system\CMHPUBA.exe GOKSNRY.exe File opened for modification C:\windows\system\PXOX.exe LPZXAUH.exe File opened for modification C:\windows\system\HJBF.exe ZYSM.exe File created C:\windows\HAMF.exe WIJNFDM.exe File opened for modification C:\windows\VQQCB.exe NDYNZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6028 cmd.exe 980 cmd.exe 5764 cmd.exe 5596 cmd.exe 2984 cmd.exe 1248 cmd.exe 2848 cmd.exe 6124 cmd.exe 4980 cmd.exe 6032 cmd.exe 4944 cmd.exe 3504 cmd.exe 4488 cmd.exe 5264 cmd.exe 4704 cmd.exe 5032 cmd.exe 3776 cmd.exe 4716 cmd.exe 2104 cmd.exe 2392 cmd.exe 4356 cmd.exe 564 cmd.exe 3632 cmd.exe 4256 cmd.exe 4752 cmd.exe 4616 cmd.exe 4084 cmd.exe 4892 cmd.exe 3120 cmd.exe 2036 cmd.exe 5564 cmd.exe 4964 cmd.exe 2860 cmd.exe 4812 cmd.exe 4312 cmd.exe 5856 cmd.exe 2636 cmd.exe 4472 cmd.exe 4864 cmd.exe 52 cmd.exe 4496 cmd.exe 3364 cmd.exe 1064 cmd.exe 1992 cmd.exe 5368 cmd.exe 2804 cmd.exe 3448 cmd.exe 1264 cmd.exe 4436 cmd.exe 1200 cmd.exe 240 cmd.exe 5036 cmd.exe 2488 cmd.exe 5480 cmd.exe 3956 cmd.exe 1932 cmd.exe 4904 cmd.exe 5772 cmd.exe 2864 cmd.exe 1472 cmd.exe 4804 cmd.exe 4508 cmd.exe 4320 cmd.exe 4244 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2460 4152 WerFault.exe 88 108 3500 WerFault.exe 93 1164 1236 WerFault.exe 99 1476 2664 WerFault.exe 104 3356 4336 WerFault.exe 109 4404 2920 WerFault.exe 114 1160 3740 WerFault.exe 119 2316 4780 WerFault.exe 124 5812 3076 WerFault.exe 129 1272 4500 WerFault.exe 134 1960 5748 WerFault.exe 139 2192 5336 WerFault.exe 144 236 5192 WerFault.exe 149 5752 2828 WerFault.exe 154 2844 5992 WerFault.exe 159 3684 1936 WerFault.exe 164 5964 3356 WerFault.exe 169 4580 1700 WerFault.exe 174 2908 2176 WerFault.exe 179 5812 2016 WerFault.exe 183 696 3256 WerFault.exe 189 3348 1344 WerFault.exe 194 5368 3524 WerFault.exe 199 5784 4212 WerFault.exe 204 4816 2108 WerFault.exe 209 4384 2540 WerFault.exe 214 1148 3220 WerFault.exe 219 1416 2408 WerFault.exe 224 3436 1112 WerFault.exe 229 5356 3716 WerFault.exe 234 5044 5340 WerFault.exe 239 1480 1084 WerFault.exe 244 5572 2952 WerFault.exe 249 2508 2028 WerFault.exe 254 5096 6128 WerFault.exe 259 1984 4220 WerFault.exe 264 2036 3856 WerFault.exe 269 5080 3380 WerFault.exe 274 700 2064 WerFault.exe 279 4536 2452 WerFault.exe 284 1340 2760 WerFault.exe 290 2916 3352 WerFault.exe 295 5988 3228 WerFault.exe 300 1052 4140 WerFault.exe 305 1244 1988 WerFault.exe 310 1148 1476 WerFault.exe 315 2580 1772 WerFault.exe 320 3004 2656 WerFault.exe 325 5920 3876 WerFault.exe 330 3476 2372 WerFault.exe 335 1480 2308 WerFault.exe 340 4596 4092 WerFault.exe 345 1652 4476 WerFault.exe 350 1164 1980 WerFault.exe 355 5948 4552 WerFault.exe 360 5532 1640 WerFault.exe 365 4456 1416 WerFault.exe 370 4520 5848 WerFault.exe 375 4536 4572 WerFault.exe 380 5708 3292 WerFault.exe 385 52 5808 WerFault.exe 390 1552 4576 WerFault.exe 395 3872 120 WerFault.exe 400 5948 4880 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LPZXAUH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EGUEKRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSXESJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URWS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMAE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBMHLJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHRJDA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBUPYK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXVOTSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZYSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZULK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTNUSKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XZFOUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GNXFH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MGSESSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIRZBNG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WIJNFDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AACP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSPUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CVKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPPSK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDQS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DODKZBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCIKLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFZYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SREFRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JPLYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPDA.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4152 2026-10-28_a66a408a00b26811229c90096273498d_elex_emotet_stop.exe 4152 2026-10-28_a66a408a00b26811229c90096273498d_elex_emotet_stop.exe 3500 MFZYY.exe 3500 MFZYY.exe 1236 CSYF.exe 1236 CSYF.exe 2664 RIZXYVL.exe 2664 RIZXYVL.exe 4336 DBUPYK.exe 4336 DBUPYK.exe 2920 XOZZJ.exe 2920 XOZZJ.exe 3740 BEOHVVE.exe 3740 BEOHVVE.exe 4780 WSKQ.exe 4780 WSKQ.exe 3076 QFPAPU.exe 3076 QFPAPU.exe 4500 CYSSQKW.exe 4500 CYSSQKW.exe 5748 ANDNLP.exe 5748 ANDNLP.exe 5336 DJIFNPT.exe 5336 DJIFNPT.exe 5192 MJKK.exe 5192 MJKK.exe 2828 VRMPC.exe 2828 VRMPC.exe 5992 HZTPOCL.exe 5992 HZTPOCL.exe 1936 LPZXAUH.exe 1936 LPZXAUH.exe 3356 PXOX.exe 3356 PXOX.exe 1700 KLTGPM.exe 1700 KLTGPM.exe 2176 BTNUSKM.exe 2176 BTNUSKM.exe 2016 KTPZ.exe 2016 KTPZ.exe 3256 HZVOL.exe 3256 HZVOL.exe 1344 FZC.exe 1344 FZC.exe 3524 HMHT.exe 3524 HMHT.exe 4212 PCIKLO.exe 4212 PCIKLO.exe 2108 VDQ.exe 2108 VDQ.exe 2540 DQU.exe 2540 DQU.exe 3220 URWS.exe 3220 URWS.exe 2408 SREFRP.exe 2408 SREFRP.exe 1112 UEJ.exe 1112 UEJ.exe 3716 GXMI.exe 3716 GXMI.exe 5340 RPPSK.exe 5340 RPPSK.exe 1084 MLUKUDM.exe 1084 MLUKUDM.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4152 2026-10-28_a66a408a00b26811229c90096273498d_elex_emotet_stop.exe 4152 2026-10-28_a66a408a00b26811229c90096273498d_elex_emotet_stop.exe 3500 MFZYY.exe 3500 MFZYY.exe 1236 CSYF.exe 1236 CSYF.exe 2664 RIZXYVL.exe 2664 RIZXYVL.exe 4336 DBUPYK.exe 4336 DBUPYK.exe 2920 XOZZJ.exe 2920 XOZZJ.exe 3740 BEOHVVE.exe 3740 BEOHVVE.exe 4780 WSKQ.exe 4780 WSKQ.exe 3076 QFPAPU.exe 3076 QFPAPU.exe 4500 CYSSQKW.exe 4500 CYSSQKW.exe 5748 ANDNLP.exe 5748 ANDNLP.exe 5336 DJIFNPT.exe 5336 DJIFNPT.exe 5192 MJKK.exe 5192 MJKK.exe 2828 VRMPC.exe 2828 VRMPC.exe 5992 HZTPOCL.exe 5992 HZTPOCL.exe 1936 LPZXAUH.exe 1936 LPZXAUH.exe 3356 PXOX.exe 3356 PXOX.exe 1700 KLTGPM.exe 1700 KLTGPM.exe 2176 BTNUSKM.exe 2176 BTNUSKM.exe 2016 KTPZ.exe 2016 KTPZ.exe 3256 HZVOL.exe 3256 HZVOL.exe 1344 FZC.exe 1344 FZC.exe 3524 HMHT.exe 3524 HMHT.exe 4212 PCIKLO.exe 4212 PCIKLO.exe 2108 VDQ.exe 2108 VDQ.exe 2540 DQU.exe 2540 DQU.exe 3220 URWS.exe 3220 URWS.exe 2408 SREFRP.exe 2408 SREFRP.exe 1112 UEJ.exe 1112 UEJ.exe 3716 GXMI.exe 3716 GXMI.exe 5340 RPPSK.exe 5340 RPPSK.exe 1084 MLUKUDM.exe 1084 MLUKUDM.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4152 wrote to memory of 4716 4152 2026-10-28_a66a408a00b26811229c90096273498d_elex_emotet_stop.exe 89 PID 4716 wrote to memory of 3500 4716 cmd.exe 93 PID 3500 wrote to memory of 4524 3500 MFZYY.exe 95 PID 4524 wrote to memory of 1236 4524 cmd.exe 99 PID 1236 wrote to memory of 1820 1236 CSYF.exe 100 PID 1820 wrote to memory of 2664 1820 cmd.exe 104 PID 2664 wrote to memory of 5264 2664 RIZXYVL.exe 105 PID 5264 wrote to memory of 4336 5264 cmd.exe 109 PID 4336 wrote to memory of 6036 4336 DBUPYK.exe 110 PID 6036 wrote to memory of 2920 6036 cmd.exe 114 PID 2920 wrote to memory of 1560 2920 XOZZJ.exe 115 PID 1560 wrote to memory of 3740 1560 cmd.exe 119 PID 3740 wrote to memory of 4640 3740 BEOHVVE.exe 120 PID 4640 wrote to memory of 4780 4640 cmd.exe 124 PID 4780 wrote to memory of 4192 4780 WSKQ.exe 125 PID 4192 wrote to memory of 3076 4192 cmd.exe 129 PID 3076 wrote to memory of 3364 3076 QFPAPU.exe 130 PID 3364 wrote to memory of 4500 3364 cmd.exe 134 PID 4500 wrote to memory of 6040 4500 CYSSQKW.exe 135 PID 6040 wrote to memory of 5748 6040 cmd.exe 139 PID 5748 wrote to memory of 3528 5748 ANDNLP.exe 140 PID 3528 wrote to memory of 5336 3528 cmd.exe 144 PID 5336 wrote to memory of 1248 5336 DJIFNPT.exe 145 PID 1248 wrote to memory of 5192 1248 cmd.exe 149 PID 5192 wrote to memory of 4116 5192 MJKK.exe 150 PID 4116 wrote to memory of 2828 4116 cmd.exe 154 PID 2828 wrote to memory of 4584 2828 VRMPC.exe 155 PID 4584 wrote to memory of 5992 4584 cmd.exe 159 PID 5992 wrote to memory of 3960 5992 HZTPOCL.exe 160 PID 3960 wrote to memory of 1936 3960 cmd.exe 164 PID 1936 wrote to memory of 976 1936 LPZXAUH.exe 165 PID 976 wrote to memory of 3356 976 cmd.exe 169 PID 3356 wrote to memory of 4240 3356 PXOX.exe 170 PID 4240 wrote to memory of 1700 4240 cmd.exe 174 PID 1700 wrote to memory of 1064 1700 KLTGPM.exe 175 PID 1064 wrote to memory of 2176 1064 cmd.exe 179 PID 2176 wrote to memory of 3520 2176 BTNUSKM.exe 180 PID 3520 wrote to memory of 2016 3520 cmd.exe 183 PID 2016 wrote to memory of 4752 2016 KTPZ.exe 185 PID 4752 wrote to memory of 3256 4752 cmd.exe 189 PID 3256 wrote to memory of 5464 3256 HZVOL.exe 190 PID 5464 wrote to memory of 1344 5464 cmd.exe 194 PID 1344 wrote to memory of 4292 1344 FZC.exe 195 PID 4292 wrote to memory of 3524 4292 cmd.exe 199 PID 3524 wrote to memory of 2912 3524 HMHT.exe 200 PID 2912 wrote to memory of 4212 2912 cmd.exe 204 PID 4212 wrote to memory of 108 4212 PCIKLO.exe 205 PID 108 wrote to memory of 2108 108 cmd.exe 209 PID 2108 wrote to memory of 4164 2108 VDQ.exe 210 PID 4164 wrote to memory of 2540 4164 cmd.exe 214 PID 2540 wrote to memory of 3892 2540 DQU.exe 215 PID 3892 wrote to memory of 3220 3892 cmd.exe 219 PID 3220 wrote to memory of 5232 3220 URWS.exe 220 PID 5232 wrote to memory of 2408 5232 cmd.exe 224 PID 2408 wrote to memory of 5964 2408 SREFRP.exe 225 PID 5964 wrote to memory of 1112 5964 cmd.exe 229 PID 1112 wrote to memory of 3916 1112 UEJ.exe 230 PID 3916 wrote to memory of 3716 3916 cmd.exe 234 PID 3716 wrote to memory of 2424 3716 GXMI.exe 235 PID 2424 wrote to memory of 5340 2424 cmd.exe 239 PID 5340 wrote to memory of 3384 5340 RPPSK.exe 240 PID 3384 wrote to memory of 1084 3384 cmd.exe 244 PID 1084 wrote to memory of 896 1084 MLUKUDM.exe 245 PID 896 wrote to memory of 2952 896 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_a66a408a00b26811229c90096273498d_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_a66a408a00b26811229c90096273498d_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MFZYY.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\windows\SysWOW64\MFZYY.exeC:\windows\system32\MFZYY.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CSYF.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\windows\CSYF.exeC:\windows\CSYF.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIZXYVL.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\windows\SysWOW64\RIZXYVL.exeC:\windows\system32\RIZXYVL.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DBUPYK.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\windows\DBUPYK.exeC:\windows\DBUPYK.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOZZJ.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\windows\system\XOZZJ.exeC:\windows\system\XOZZJ.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BEOHVVE.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\windows\BEOHVVE.exeC:\windows\BEOHVVE.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSKQ.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\windows\system\WSKQ.exeC:\windows\system\WSKQ.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QFPAPU.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\windows\QFPAPU.exeC:\windows\QFPAPU.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYSSQKW.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\windows\system\CYSSQKW.exeC:\windows\system\CYSSQKW.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANDNLP.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\windows\SysWOW64\ANDNLP.exeC:\windows\system32\ANDNLP.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DJIFNPT.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\windows\system\DJIFNPT.exeC:\windows\system\DJIFNPT.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MJKK.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\windows\MJKK.exeC:\windows\MJKK.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VRMPC.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\windows\system\VRMPC.exeC:\windows\system\VRMPC.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HZTPOCL.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\windows\system\HZTPOCL.exeC:\windows\system\HZTPOCL.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LPZXAUH.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\windows\system\LPZXAUH.exeC:\windows\system\LPZXAUH.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PXOX.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:976 -
C:\windows\system\PXOX.exeC:\windows\system\PXOX.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLTGPM.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\windows\SysWOW64\KLTGPM.exeC:\windows\system32\KLTGPM.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTNUSKM.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\windows\system\BTNUSKM.exeC:\windows\system\BTNUSKM.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KTPZ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\windows\SysWOW64\KTPZ.exeC:\windows\system32\KTPZ.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HZVOL.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\windows\HZVOL.exeC:\windows\HZVOL.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZC.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\windows\FZC.exeC:\windows\FZC.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HMHT.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\windows\SysWOW64\HMHT.exeC:\windows\system32\HMHT.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCIKLO.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\windows\SysWOW64\PCIKLO.exeC:\windows\system32\PCIKLO.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDQ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:108 -
C:\windows\SysWOW64\VDQ.exeC:\windows\system32\VDQ.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQU.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\windows\system\DQU.exeC:\windows\system\DQU.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\URWS.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\windows\SysWOW64\URWS.exeC:\windows\system32\URWS.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SREFRP.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\windows\SREFRP.exeC:\windows\SREFRP.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UEJ.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\windows\system\UEJ.exeC:\windows\system\UEJ.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXMI.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\windows\system\GXMI.exeC:\windows\system\GXMI.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RPPSK.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\windows\SysWOW64\RPPSK.exeC:\windows\system32\RPPSK.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLUKUDM.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\windows\SysWOW64\MLUKUDM.exeC:\windows\system32\MLUKUDM.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AIRZBNG.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\windows\SysWOW64\AIRZBNG.exeC:\windows\system32\AIRZBNG.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIZN.exe.bat" "66⤵PID:1192
-
C:\windows\GIZN.exeC:\windows\GIZN.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RBCFS.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:928 -
C:\windows\SysWOW64\RBCFS.exeC:\windows\system32\RBCFS.exe69⤵
- Executes dropped EXE
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GEM.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:1252 -
C:\windows\system\GEM.exeC:\windows\system\GEM.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKMY.exe.bat" "72⤵PID:3244
-
C:\windows\system\OKMY.exeC:\windows\system\OKMY.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MKTUWQ.exe.bat" "74⤵PID:2748
-
C:\windows\SysWOW64\MKTUWQ.exeC:\windows\system32\MKTUWQ.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JHRJDA.exe.bat" "76⤵PID:4860
-
C:\windows\SysWOW64\JHRJDA.exeC:\windows\system32\JHRJDA.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDQS.exe.bat" "78⤵
- Executes a command shell one-liner
PID:1992 -
C:\windows\SysWOW64\PDQS.exeC:\windows\system32\PDQS.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQBK.exe.bat" "80⤵PID:3420
-
C:\windows\YQBK.exeC:\windows\YQBK.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWHZFK.exe.bat" "82⤵PID:708
-
C:\windows\SysWOW64\VWHZFK.exeC:\windows\system32\VWHZFK.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GOKSNRY.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:3204 -
C:\windows\SysWOW64\GOKSNRY.exeC:\windows\system32\GOKSNRY.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CMHPUBA.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:2672 -
C:\windows\system\CMHPUBA.exeC:\windows\system\CMHPUBA.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OEK.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:2292 -
C:\windows\SysWOW64\OEK.exeC:\windows\system32\OEK.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZXNA.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4496 -
C:\windows\ZXNA.exeC:\windows\ZXNA.exe91⤵
- Executes dropped EXE
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXVOTSY.exe.bat" "92⤵
- Executes a command shell one-liner
PID:1932 -
C:\windows\system\FXVOTSY.exeC:\windows\system\FXVOTSY.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTAX.exe.bat" "94⤵PID:4252
-
C:\windows\ZTAX.exeC:\windows\ZTAX.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZYSM.exe.bat" "96⤵PID:4580
-
C:\windows\system\ZYSM.exeC:\windows\system\ZYSM.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HJBF.exe.bat" "98⤵
- Executes a command shell one-liner
PID:1264 -
C:\windows\system\HJBF.exeC:\windows\system\HJBF.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBEYTQ.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:3032 -
C:\windows\SBEYTQ.exeC:\windows\SBEYTQ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IEN.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:4624 -
C:\windows\system\IEN.exeC:\windows\system\IEN.exe103⤵
- Executes dropped EXE
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YPDA.exe.bat" "104⤵PID:3268
-
C:\windows\SysWOW64\YPDA.exeC:\windows\system32\YPDA.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNJXT.exe.bat" "106⤵PID:5988
-
C:\windows\SysWOW64\VNJXT.exeC:\windows\system32\VNJXT.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TNRLCJ.exe.bat" "108⤵PID:4432
-
C:\windows\SysWOW64\TNRLCJ.exeC:\windows\system32\TNRLCJ.exe109⤵
- Executes dropped EXE
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EGUEKRI.exe.bat" "110⤵PID:5432
-
C:\windows\system\EGUEKRI.exeC:\windows\system\EGUEKRI.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MYVX.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2624 -
C:\windows\SysWOW64\MYVX.exeC:\windows\system32\MYVX.exe113⤵
- Executes dropped EXE
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XRY.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4616 -
C:\windows\system\XRY.exeC:\windows\system\XRY.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UWDNN.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:4420 -
C:\windows\SysWOW64\UWDNN.exeC:\windows\system32\UWDNN.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FPYGOB.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:1948 -
C:\windows\system\FPYGOB.exeC:\windows\system\FPYGOB.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ACD.exe.bat" "120⤵
- Executes a command shell one-liner
PID:4704 -
C:\windows\system\ACD.exeC:\windows\system\ACD.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-