Analysis
- max time kernel
69s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 18:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_cb92bdc17b465f35fbe00ed97867c429_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-28_cb92bdc17b465f35fbe00ed97867c429_elex_emotet_stop.exe
- Size 208KB
- Sample261029-w4gr4sft6p
- SHA256 e749a38cb2c0ecda65670df9b7c97012c3c6414fadc179b7ffddfa23f443ac42
- MD5 cb92bdc17b465f35fbe00ed97867c429
- SHA1 3c16f08a02f01133b5980c1209a9a3c7e7282899
- SHA512 263935c137197b3e613a573312a8aabbdac1862b162d99a0fb3345071f1372b72b9af2680bdfe0d1ecb2dcd4ba12e63284c75f8de6e0698dec2493f55d920a8a
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcKL+LOfb4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlcS+LOjkEj1
- TLSH T189247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3972 NEMQZ.exe 2612 SXQN.exe 3764 INEXUL.exe 1380 FDROKS.exe 4492 AMA.exe 4504 KJFFYVW.exe 1264 BSUDLMZ.exe 6020 LPZXAUH.exe 2976 RLLQGR.exe 2564 JLZVTAS.exe 4944 XGL.exe 6016 FUQ.exe 1784 FZC.exe 5656 AXCNWF.exe 1128 CVQH.exe 2328 HAAX.exe 4260 SOH.exe 2908 CLZPXM.exe 1532 HMJSB.exe 3616 ENLU.exe 5924 XFAF.exe 4240 IYIQ.exe 5116 LGQMNA.exe 4148 KZT.exe 6060 MMK.exe 2040 YZRC.exe 5360 RSZN.exe 1848 EDPMJFR.exe 1312 DNSCST.exe 1208 RLSN.exe 2008 KMIYL.exe 2988 SRUF.exe 5540 AFZM.exe 2652 NIPKVFK.exe 4280 RLNXV.exe 5176 NVW.exe 3548 ULXVPW.exe 2960 EJCQX.exe 2028 KEOJD.exe 4908 UCCDS.exe 1076 JSPVA.exe 3292 IDSD.exe 5156 BEHW.exe 1240 JJMC.exe 2476 DCBN.exe 3684 TMEDDD.exe 4948 JCFV.exe 1372 ALUA.exe 4696 OGFTCE.exe 4572 JTWUNXF.exe 5600 IMZKWD.exe 5488 GXC.exe 2300 HASWT.exe 2740 PFFDE.exe 2496 JTEB.exe 2232 RGR.exe 3516 IHF.exe 2900 ZPTKLH.exe 5848 RXAPXQ.exe 3624 TFJEE.exe 2104 UIZ.exe 3272 AEKBHIT.exe 3520 MHVO.exe 5044 GZKZ.exe - Drops file in System32 directory 63 IoCs
description ioc Process File created C:\windows\SysWOW64\BNHEXE.exe.bat MXUU.exe File opened for modification C:\windows\SysWOW64\HASWT.exe GXC.exe File created C:\windows\SysWOW64\HASWT.exe.bat GXC.exe File created C:\windows\SysWOW64\IHF.exe RGR.exe File created C:\windows\SysWOW64\AXCNWF.exe.bat FZC.exe File opened for modification C:\windows\SysWOW64\JSPVA.exe UCCDS.exe File created C:\windows\SysWOW64\HMJSB.exe.bat CLZPXM.exe File created C:\windows\SysWOW64\MMK.exe.bat KZT.exe File created C:\windows\SysWOW64\SRUF.exe.bat KMIYL.exe File created C:\windows\SysWOW64\NVW.exe.bat RLNXV.exe File opened for modification C:\windows\SysWOW64\UCCDS.exe KEOJD.exe File created C:\windows\SysWOW64\XFAF.exe.bat ENLU.exe File opened for modification C:\windows\SysWOW64\MMK.exe KZT.exe File created C:\windows\SysWOW64\FUQ.exe.bat XGL.exe File created C:\windows\SysWOW64\INEXUL.exe SXQN.exe File created C:\windows\SysWOW64\RLLQGR.exe LPZXAUH.exe File created C:\windows\SysWOW64\ULXVPW.exe NVW.exe File created C:\windows\SysWOW64\JSPVA.exe.bat UCCDS.exe File created C:\windows\SysWOW64\RNJ.exe.bat GZKZ.exe File created C:\windows\SysWOW64\XFAF.exe ENLU.exe File created C:\windows\SysWOW64\IYIQ.exe XFAF.exe File created C:\windows\SysWOW64\SRUF.exe KMIYL.exe File created C:\windows\SysWOW64\IHF.exe.bat RGR.exe File created C:\windows\SysWOW64\SNLQF.exe.bat OUBN.exe File created C:\windows\SysWOW64\MMK.exe KZT.exe File created C:\windows\SysWOW64\SNLQF.exe OUBN.exe File opened for modification C:\windows\SysWOW64\SNLQF.exe OUBN.exe File opened for modification C:\windows\SysWOW64\IYIQ.exe XFAF.exe File created C:\windows\SysWOW64\NVW.exe RLNXV.exe File created C:\windows\SysWOW64\ULXVPW.exe.bat NVW.exe File created C:\windows\SysWOW64\HASWT.exe GXC.exe File created C:\windows\SysWOW64\RNJ.exe GZKZ.exe File opened for modification C:\windows\SysWOW64\BNHEXE.exe MXUU.exe File opened for modification C:\windows\SysWOW64\FUQ.exe XGL.exe File opened for modification C:\windows\SysWOW64\SRUF.exe KMIYL.exe File opened for modification C:\windows\SysWOW64\OGFTCE.exe ALUA.exe File created C:\windows\SysWOW64\UCCDS.exe KEOJD.exe File created C:\windows\SysWOW64\TMEDDD.exe.bat DCBN.exe File created C:\windows\SysWOW64\OGFTCE.exe.bat ALUA.exe File created C:\windows\SysWOW64\FUQ.exe XGL.exe File opened for modification C:\windows\SysWOW64\AXCNWF.exe FZC.exe File created C:\windows\SysWOW64\INEXUL.exe.bat SXQN.exe File created C:\windows\SysWOW64\FDROKS.exe.bat INEXUL.exe File opened for modification C:\windows\SysWOW64\XFAF.exe ENLU.exe File opened for modification C:\windows\SysWOW64\TMEDDD.exe DCBN.exe File created C:\windows\SysWOW64\OGFTCE.exe ALUA.exe File created C:\windows\SysWOW64\AXCNWF.exe FZC.exe File opened for modification C:\windows\SysWOW64\NVW.exe RLNXV.exe File created C:\windows\SysWOW64\UCCDS.exe.bat KEOJD.exe File created C:\windows\SysWOW64\BNHEXE.exe MXUU.exe File created C:\windows\SysWOW64\TMEDDD.exe DCBN.exe File opened for modification C:\windows\SysWOW64\IHF.exe RGR.exe File created C:\windows\SysWOW64\RLLQGR.exe.bat LPZXAUH.exe File created C:\windows\SysWOW64\JSPVA.exe UCCDS.exe File opened for modification C:\windows\SysWOW64\FDROKS.exe INEXUL.exe File opened for modification C:\windows\SysWOW64\ULXVPW.exe NVW.exe File opened for modification C:\windows\SysWOW64\INEXUL.exe SXQN.exe File created C:\windows\SysWOW64\IYIQ.exe.bat XFAF.exe File opened for modification C:\windows\SysWOW64\HMJSB.exe CLZPXM.exe File created C:\windows\SysWOW64\FDROKS.exe INEXUL.exe File opened for modification C:\windows\SysWOW64\RLLQGR.exe LPZXAUH.exe File created C:\windows\SysWOW64\HMJSB.exe CLZPXM.exe File opened for modification C:\windows\SysWOW64\RNJ.exe GZKZ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\ENLU.exe HMJSB.exe File opened for modification C:\windows\KMIYL.exe RLSN.exe File created C:\windows\system\GXC.exe IMZKWD.exe File created C:\windows\system\MXUU.exe.bat CZOAAH.exe File created C:\windows\QOFMV.exe.bat TVWJKN.exe File opened for modification C:\windows\system\CVQH.exe AXCNWF.exe File created C:\windows\SOH.exe HAAX.exe File created C:\windows\system\BEHW.exe IDSD.exe File opened for modification C:\windows\system\UIZ.exe TFJEE.exe File opened for modification C:\windows\PLNRCTN.exe HGBKZUS.exe File opened for modification C:\windows\GHXZ.exe PWMRI.exe File created C:\windows\system\CVQH.exe AXCNWF.exe File created C:\windows\system\KZT.exe.bat LGQMNA.exe File created C:\windows\JCFV.exe TMEDDD.exe File created C:\windows\system\BSUDLMZ.exe.bat KJFFYVW.exe File created C:\windows\NIPKVFK.exe.bat AFZM.exe File created C:\windows\system\KEOJD.exe.bat EJCQX.exe File opened for modification C:\windows\system\PFFDE.exe HASWT.exe File created C:\windows\system\UIZ.exe.bat TFJEE.exe File created C:\windows\AEKBHIT.exe UIZ.exe File opened for modification C:\windows\ALUA.exe JCFV.exe File created C:\windows\MHVO.exe.bat AEKBHIT.exe File created C:\windows\GHXZ.exe.bat PWMRI.exe File created C:\windows\system\BEHW.exe.bat IDSD.exe File opened for modification C:\windows\TFJEE.exe RXAPXQ.exe File created C:\windows\WSC.exe RNJ.exe File created C:\windows\ZRFDB.exe PLNRCTN.exe File opened for modification C:\windows\ZRFDB.exe PLNRCTN.exe File created C:\windows\SOH.exe.bat HAAX.exe File opened for modification C:\windows\DNSCST.exe EDPMJFR.exe File created C:\windows\KMIYL.exe.bat RLSN.exe File opened for modification C:\windows\IDSD.exe JSPVA.exe File created C:\windows\system\OUBN.exe GHXZ.exe File opened for modification C:\windows\system\BSUDLMZ.exe KJFFYVW.exe File created C:\windows\XGL.exe JLZVTAS.exe File created C:\windows\LGQMNA.exe.bat IYIQ.exe File created C:\windows\RSZN.exe.bat YZRC.exe File created C:\windows\DNSCST.exe EDPMJFR.exe File created C:\windows\system\RLSN.exe.bat DNSCST.exe File created C:\windows\IDSD.exe.bat JSPVA.exe File opened for modification C:\windows\JCFV.exe TMEDDD.exe File created C:\windows\system\RGR.exe JTEB.exe File created C:\windows\system\LPZXAUH.exe BSUDLMZ.exe File created C:\windows\ENLU.exe.bat HMJSB.exe File created C:\windows\EDPMJFR.exe.bat RSZN.exe File created C:\windows\DCBN.exe.bat JJMC.exe File opened for modification C:\windows\system\JTWUNXF.exe OGFTCE.exe File opened for modification C:\windows\QOFMV.exe TVWJKN.exe File opened for modification C:\windows\PWMRI.exe QOFMV.exe File created C:\windows\system\KJFFYVW.exe.bat AMA.exe File created C:\windows\system\CLZPXM.exe.bat SOH.exe File opened for modification C:\windows\system\YZRC.exe MMK.exe File created C:\windows\system\RLNXV.exe NIPKVFK.exe File created C:\windows\system\EJCQX.exe.bat ULXVPW.exe File opened for modification C:\windows\system\RXAPXQ.exe ZPTKLH.exe File opened for modification C:\windows\system\MXUU.exe CZOAAH.exe File created C:\windows\QOFMV.exe TVWJKN.exe File created C:\windows\system\CVQH.exe.bat AXCNWF.exe File opened for modification C:\windows\HAAX.exe CVQH.exe File opened for modification C:\windows\SOH.exe HAAX.exe File created C:\windows\ENLU.exe HMJSB.exe File opened for modification C:\windows\system\KZT.exe LGQMNA.exe File created C:\windows\RSZN.exe YZRC.exe File opened for modification C:\windows\system\EJCQX.exe ULXVPW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5516 cmd.exe 5560 cmd.exe 1068 cmd.exe 4408 cmd.exe 5556 cmd.exe 4984 cmd.exe 1204 cmd.exe 5408 cmd.exe 2880 cmd.exe 2260 cmd.exe 2096 cmd.exe 792 cmd.exe 5808 cmd.exe 5196 cmd.exe 1188 cmd.exe 3376 cmd.exe 1344 cmd.exe 4936 cmd.exe 2072 cmd.exe 6136 cmd.exe 4540 cmd.exe 5020 cmd.exe 5740 cmd.exe 616 cmd.exe 3708 cmd.exe 1672 cmd.exe 256 cmd.exe 2812 cmd.exe 5868 cmd.exe 1604 cmd.exe 3120 cmd.exe 4368 cmd.exe 460 cmd.exe 808 cmd.exe 3424 cmd.exe 3116 cmd.exe 4660 cmd.exe 472 cmd.exe 5172 cmd.exe 4844 cmd.exe 716 cmd.exe 672 cmd.exe 4412 cmd.exe 3436 cmd.exe 2432 cmd.exe 6132 cmd.exe 6100 cmd.exe 2032 cmd.exe 5088 cmd.exe 4668 cmd.exe 252 cmd.exe 2940 cmd.exe 3428 cmd.exe 2716 cmd.exe 5892 cmd.exe 5672 cmd.exe 5092 cmd.exe 4428 cmd.exe 1560 cmd.exe 5628 cmd.exe 3996 cmd.exe 3700 cmd.exe 2852 cmd.exe 3740 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3088 4104 WerFault.exe 87 2412 3972 WerFault.exe 93 4984 2612 WerFault.exe 99 3584 3764 WerFault.exe 104 3464 1380 WerFault.exe 109 1188 4492 WerFault.exe 114 4336 4504 WerFault.exe 119 2172 1264 WerFault.exe 124 4816 6020 WerFault.exe 129 6124 2976 WerFault.exe 134 5968 2564 WerFault.exe 139 2568 4944 WerFault.exe 144 5468 6016 WerFault.exe 149 3520 1784 WerFault.exe 154 3152 5656 WerFault.exe 159 2704 1128 WerFault.exe 164 4896 2328 WerFault.exe 169 4948 4260 WerFault.exe 174 4820 2908 WerFault.exe 179 3848 1532 WerFault.exe 184 3076 3616 WerFault.exe 189 4768 5924 WerFault.exe 194 2716 4240 WerFault.exe 199 1612 5116 WerFault.exe 204 5676 4148 WerFault.exe 209 1388 6060 WerFault.exe 214 2236 2040 WerFault.exe 219 1300 5360 WerFault.exe 224 6108 1848 WerFault.exe 229 6100 1312 WerFault.exe 234 1636 1208 WerFault.exe 239 5988 2008 WerFault.exe 244 4612 2988 WerFault.exe 249 5784 5540 WerFault.exe 254 2084 2652 WerFault.exe 260 2704 4280 WerFault.exe 265 2232 5176 WerFault.exe 270 5320 3548 WerFault.exe 275 2356 2960 WerFault.exe 280 2800 2028 WerFault.exe 285 1200 4908 WerFault.exe 290 3276 1076 WerFault.exe 295 3932 3292 WerFault.exe 300 4780 5156 WerFault.exe 305 4360 1240 WerFault.exe 310 2828 2476 WerFault.exe 315 5016 3684 WerFault.exe 320 5804 4948 WerFault.exe 325 5304 1372 WerFault.exe 330 4200 4696 WerFault.exe 335 5376 4572 WerFault.exe 340 5232 5600 WerFault.exe 345 5144 5488 WerFault.exe 350 3392 2300 WerFault.exe 355 1976 2740 WerFault.exe 360 5348 2496 WerFault.exe 365 6076 2232 WerFault.exe 370 4748 3516 WerFault.exe 375 1424 2900 WerFault.exe 380 692 5848 WerFault.exe 385 5844 3624 WerFault.exe 390 756 2104 WerFault.exe 395 3392 3272 WerFault.exe 400 5452 3520 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NIPKVFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JCFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFJEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYIQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLZVTAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENLU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZRC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFFDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEMQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLZPXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KEOJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCCDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RLLQGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PWMRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AXCNWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RLSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDROKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJCQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IDSD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRUF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GHXZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDPMJFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSPVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4104 2026-10-28_cb92bdc17b465f35fbe00ed97867c429_elex_emotet_stop.exe 4104 2026-10-28_cb92bdc17b465f35fbe00ed97867c429_elex_emotet_stop.exe 3972 NEMQZ.exe 3972 NEMQZ.exe 2612 SXQN.exe 2612 SXQN.exe 3764 INEXUL.exe 3764 INEXUL.exe 1380 FDROKS.exe 1380 FDROKS.exe 4492 AMA.exe 4492 AMA.exe 4504 KJFFYVW.exe 4504 KJFFYVW.exe 1264 BSUDLMZ.exe 1264 BSUDLMZ.exe 6020 LPZXAUH.exe 6020 LPZXAUH.exe 2976 RLLQGR.exe 2976 RLLQGR.exe 2564 JLZVTAS.exe 2564 JLZVTAS.exe 4944 XGL.exe 4944 XGL.exe 6016 FUQ.exe 6016 FUQ.exe 1784 FZC.exe 1784 FZC.exe 5656 AXCNWF.exe 5656 AXCNWF.exe 1128 CVQH.exe 1128 CVQH.exe 2328 HAAX.exe 2328 HAAX.exe 4260 SOH.exe 4260 SOH.exe 2908 CLZPXM.exe 2908 CLZPXM.exe 1532 HMJSB.exe 1532 HMJSB.exe 3616 ENLU.exe 3616 ENLU.exe 5924 XFAF.exe 5924 XFAF.exe 4240 IYIQ.exe 4240 IYIQ.exe 5116 LGQMNA.exe 5116 LGQMNA.exe 4148 KZT.exe 4148 KZT.exe 6060 MMK.exe 6060 MMK.exe 2040 YZRC.exe 2040 YZRC.exe 5360 RSZN.exe 5360 RSZN.exe 1848 EDPMJFR.exe 1848 EDPMJFR.exe 1312 DNSCST.exe 1312 DNSCST.exe 1208 RLSN.exe 1208 RLSN.exe 2008 KMIYL.exe 2008 KMIYL.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4104 2026-10-28_cb92bdc17b465f35fbe00ed97867c429_elex_emotet_stop.exe 4104 2026-10-28_cb92bdc17b465f35fbe00ed97867c429_elex_emotet_stop.exe 3972 NEMQZ.exe 3972 NEMQZ.exe 2612 SXQN.exe 2612 SXQN.exe 3764 INEXUL.exe 3764 INEXUL.exe 1380 FDROKS.exe 1380 FDROKS.exe 4492 AMA.exe 4492 AMA.exe 4504 KJFFYVW.exe 4504 KJFFYVW.exe 1264 BSUDLMZ.exe 1264 BSUDLMZ.exe 6020 LPZXAUH.exe 6020 LPZXAUH.exe 2976 RLLQGR.exe 2976 RLLQGR.exe 2564 JLZVTAS.exe 2564 JLZVTAS.exe 4944 XGL.exe 4944 XGL.exe 6016 FUQ.exe 6016 FUQ.exe 1784 FZC.exe 1784 FZC.exe 5656 AXCNWF.exe 5656 AXCNWF.exe 1128 CVQH.exe 1128 CVQH.exe 2328 HAAX.exe 2328 HAAX.exe 4260 SOH.exe 4260 SOH.exe 2908 CLZPXM.exe 2908 CLZPXM.exe 1532 HMJSB.exe 1532 HMJSB.exe 3616 ENLU.exe 3616 ENLU.exe 5924 XFAF.exe 5924 XFAF.exe 4240 IYIQ.exe 4240 IYIQ.exe 5116 LGQMNA.exe 5116 LGQMNA.exe 4148 KZT.exe 4148 KZT.exe 6060 MMK.exe 6060 MMK.exe 2040 YZRC.exe 2040 YZRC.exe 5360 RSZN.exe 5360 RSZN.exe 1848 EDPMJFR.exe 1848 EDPMJFR.exe 1312 DNSCST.exe 1312 DNSCST.exe 1208 RLSN.exe 1208 RLSN.exe 2008 KMIYL.exe 2008 KMIYL.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4104 wrote to memory of 5020 4104 2026-10-28_cb92bdc17b465f35fbe00ed97867c429_elex_emotet_stop.exe 89 PID 5020 wrote to memory of 3972 5020 cmd.exe 93 PID 3972 wrote to memory of 5560 3972 NEMQZ.exe 95 PID 5560 wrote to memory of 2612 5560 cmd.exe 99 PID 2612 wrote to memory of 1952 2612 SXQN.exe 100 PID 1952 wrote to memory of 3764 1952 cmd.exe 104 PID 3764 wrote to memory of 1436 3764 INEXUL.exe 105 PID 1436 wrote to memory of 1380 1436 cmd.exe 109 PID 1380 wrote to memory of 5672 1380 FDROKS.exe 110 PID 5672 wrote to memory of 4492 5672 cmd.exe 114 PID 4492 wrote to memory of 716 4492 AMA.exe 115 PID 716 wrote to memory of 4504 716 cmd.exe 119 PID 4504 wrote to memory of 2144 4504 KJFFYVW.exe 120 PID 2144 wrote to memory of 1264 2144 cmd.exe 124 PID 1264 wrote to memory of 3148 1264 BSUDLMZ.exe 125 PID 3148 wrote to memory of 6020 3148 cmd.exe 129 PID 6020 wrote to memory of 5456 6020 LPZXAUH.exe 130 PID 5456 wrote to memory of 2976 5456 cmd.exe 134 PID 2976 wrote to memory of 672 2976 RLLQGR.exe 135 PID 672 wrote to memory of 2564 672 cmd.exe 139 PID 2564 wrote to memory of 3700 2564 JLZVTAS.exe 140 PID 3700 wrote to memory of 4944 3700 cmd.exe 144 PID 4944 wrote to memory of 5092 4944 XGL.exe 145 PID 5092 wrote to memory of 6016 5092 cmd.exe 149 PID 6016 wrote to memory of 4844 6016 FUQ.exe 150 PID 4844 wrote to memory of 1784 4844 cmd.exe 154 PID 1784 wrote to memory of 3420 1784 FZC.exe 155 PID 3420 wrote to memory of 5656 3420 cmd.exe 159 PID 5656 wrote to memory of 2472 5656 AXCNWF.exe 160 PID 2472 wrote to memory of 1128 2472 cmd.exe 164 PID 1128 wrote to memory of 1152 1128 CVQH.exe 165 PID 1152 wrote to memory of 2328 1152 cmd.exe 169 PID 2328 wrote to memory of 2520 2328 HAAX.exe 170 PID 2520 wrote to memory of 4260 2520 cmd.exe 174 PID 4260 wrote to memory of 5872 4260 SOH.exe 175 PID 5872 wrote to memory of 2908 5872 cmd.exe 179 PID 2908 wrote to memory of 4840 2908 CLZPXM.exe 180 PID 4840 wrote to memory of 1532 4840 cmd.exe 184 PID 1532 wrote to memory of 4284 1532 HMJSB.exe 185 PID 4284 wrote to memory of 3616 4284 cmd.exe 189 PID 3616 wrote to memory of 5664 3616 ENLU.exe 190 PID 5664 wrote to memory of 5924 5664 cmd.exe 194 PID 5924 wrote to memory of 4584 5924 XFAF.exe 195 PID 4584 wrote to memory of 4240 4584 cmd.exe 199 PID 4240 wrote to memory of 3580 4240 IYIQ.exe 200 PID 3580 wrote to memory of 5116 3580 cmd.exe 204 PID 5116 wrote to memory of 1452 5116 LGQMNA.exe 205 PID 1452 wrote to memory of 4148 1452 cmd.exe 209 PID 4148 wrote to memory of 5440 4148 KZT.exe 210 PID 5440 wrote to memory of 6060 5440 cmd.exe 214 PID 6060 wrote to memory of 4776 6060 MMK.exe 215 PID 4776 wrote to memory of 2040 4776 cmd.exe 219 PID 2040 wrote to memory of 4340 2040 YZRC.exe 220 PID 4340 wrote to memory of 5360 4340 cmd.exe 224 PID 5360 wrote to memory of 2284 5360 RSZN.exe 225 PID 2284 wrote to memory of 1848 2284 cmd.exe 229 PID 1848 wrote to memory of 4720 1848 EDPMJFR.exe 230 PID 4720 wrote to memory of 1312 4720 cmd.exe 234 PID 1312 wrote to memory of 4368 1312 DNSCST.exe 235 PID 4368 wrote to memory of 1208 4368 cmd.exe 239 PID 1208 wrote to memory of 5104 1208 RLSN.exe 240 PID 5104 wrote to memory of 2008 5104 cmd.exe 244 PID 2008 wrote to memory of 2804 2008 KMIYL.exe 245 PID 2804 wrote to memory of 2988 2804 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_cb92bdc17b465f35fbe00ed97867c429_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_cb92bdc17b465f35fbe00ed97867c429_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NEMQZ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\windows\system\NEMQZ.exeC:\windows\system\NEMQZ.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SXQN.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\windows\SXQN.exeC:\windows\SXQN.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INEXUL.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\windows\SysWOW64\INEXUL.exeC:\windows\system32\INEXUL.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FDROKS.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\windows\SysWOW64\FDROKS.exeC:\windows\system32\FDROKS.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AMA.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\windows\AMA.exeC:\windows\AMA.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KJFFYVW.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:716 -
C:\windows\system\KJFFYVW.exeC:\windows\system\KJFFYVW.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BSUDLMZ.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\windows\system\BSUDLMZ.exeC:\windows\system\BSUDLMZ.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LPZXAUH.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\windows\system\LPZXAUH.exeC:\windows\system\LPZXAUH.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RLLQGR.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\windows\SysWOW64\RLLQGR.exeC:\windows\system32\RLLQGR.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLZVTAS.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:672 -
C:\windows\JLZVTAS.exeC:\windows\JLZVTAS.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XGL.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\windows\XGL.exeC:\windows\XGL.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FUQ.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\windows\SysWOW64\FUQ.exeC:\windows\system32\FUQ.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZC.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\windows\FZC.exeC:\windows\FZC.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AXCNWF.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\windows\SysWOW64\AXCNWF.exeC:\windows\system32\AXCNWF.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CVQH.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\windows\system\CVQH.exeC:\windows\system\CVQH.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAAX.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\windows\HAAX.exeC:\windows\HAAX.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SOH.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\windows\SOH.exeC:\windows\SOH.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLZPXM.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\windows\system\CLZPXM.exeC:\windows\system\CLZPXM.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HMJSB.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\windows\SysWOW64\HMJSB.exeC:\windows\system32\HMJSB.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENLU.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\windows\ENLU.exeC:\windows\ENLU.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFAF.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\windows\SysWOW64\XFAF.exeC:\windows\system32\XFAF.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IYIQ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\windows\SysWOW64\IYIQ.exeC:\windows\system32\IYIQ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGQMNA.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\windows\LGQMNA.exeC:\windows\LGQMNA.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KZT.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\windows\system\KZT.exeC:\windows\system\KZT.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMK.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\windows\SysWOW64\MMK.exeC:\windows\system32\MMK.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZRC.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\windows\system\YZRC.exeC:\windows\system\YZRC.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RSZN.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\windows\RSZN.exeC:\windows\RSZN.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDPMJFR.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\windows\EDPMJFR.exeC:\windows\EDPMJFR.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNSCST.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\windows\DNSCST.exeC:\windows\DNSCST.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLSN.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\windows\system\RLSN.exeC:\windows\system\RLSN.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMIYL.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\windows\KMIYL.exeC:\windows\KMIYL.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRUF.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\windows\SysWOW64\SRUF.exeC:\windows\system32\SRUF.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFZM.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1068 -
C:\windows\AFZM.exeC:\windows\AFZM.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NIPKVFK.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:460 -
C:\windows\NIPKVFK.exeC:\windows\NIPKVFK.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLNXV.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2752 -
C:\windows\system\RLNXV.exeC:\windows\system\RLNXV.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVW.exe.bat" "72⤵PID:856
-
C:\windows\SysWOW64\NVW.exeC:\windows\system32\NVW.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ULXVPW.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:808 -
C:\windows\SysWOW64\ULXVPW.exeC:\windows\system32\ULXVPW.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EJCQX.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5868 -
C:\windows\system\EJCQX.exeC:\windows\system\EJCQX.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KEOJD.exe.bat" "78⤵
- Executes a command shell one-liner
PID:5740 -
C:\windows\system\KEOJD.exeC:\windows\system\KEOJD.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCCDS.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:616 -
C:\windows\SysWOW64\UCCDS.exeC:\windows\system32\UCCDS.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSPVA.exe.bat" "82⤵PID:4320
-
C:\windows\SysWOW64\JSPVA.exeC:\windows\system32\JSPVA.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IDSD.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2032 -
C:\windows\IDSD.exeC:\windows\IDSD.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BEHW.exe.bat" "86⤵PID:1320
-
C:\windows\system\BEHW.exeC:\windows\system\BEHW.exe87⤵
- Executes dropped EXE
PID:5156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJMC.exe.bat" "88⤵PID:1396
-
C:\windows\system\JJMC.exeC:\windows\system\JJMC.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DCBN.exe.bat" "90⤵PID:5784
-
C:\windows\DCBN.exeC:\windows\DCBN.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TMEDDD.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4176 -
C:\windows\SysWOW64\TMEDDD.exeC:\windows\system32\TMEDDD.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JCFV.exe.bat" "94⤵
- Executes a command shell one-liner
PID:2852 -
C:\windows\JCFV.exeC:\windows\JCFV.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ALUA.exe.bat" "96⤵
- Executes a command shell one-liner
PID:1604 -
C:\windows\ALUA.exeC:\windows\ALUA.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OGFTCE.exe.bat" "98⤵PID:2188
-
C:\windows\SysWOW64\OGFTCE.exeC:\windows\system32\OGFTCE.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JTWUNXF.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4408 -
C:\windows\system\JTWUNXF.exeC:\windows\system\JTWUNXF.exe101⤵
- Executes dropped EXE
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMZKWD.exe.bat" "102⤵PID:3060
-
C:\windows\IMZKWD.exeC:\windows\IMZKWD.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXC.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:6080 -
C:\windows\system\GXC.exeC:\windows\system\GXC.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HASWT.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:5876 -
C:\windows\SysWOW64\HASWT.exeC:\windows\system32\HASWT.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PFFDE.exe.bat" "108⤵PID:5468
-
C:\windows\system\PFFDE.exeC:\windows\system\PFFDE.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JTEB.exe.bat" "110⤵PID:1776
-
C:\windows\system\JTEB.exeC:\windows\system\JTEB.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGR.exe.bat" "112⤵
- Executes a command shell one-liner
PID:5172 -
C:\windows\system\RGR.exeC:\windows\system\RGR.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHF.exe.bat" "114⤵PID:4132
-
C:\windows\SysWOW64\IHF.exeC:\windows\system32\IHF.exe115⤵
- Executes dropped EXE
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPTKLH.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:1840 -
C:\windows\ZPTKLH.exeC:\windows\ZPTKLH.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RXAPXQ.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5032 -
C:\windows\system\RXAPXQ.exeC:\windows\system\RXAPXQ.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TFJEE.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5556 -
C:\windows\TFJEE.exeC:\windows\TFJEE.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-