Analysis
- max time kernel
83s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 18:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_cacc04a8e8ff822e4ad4ba0cc4c10baa_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-28_cacc04a8e8ff822e4ad4ba0cc4c10baa_elex_emotet_stop.exe
- Size 208KB
- Sample261029-w626tsd14x
- SHA256 6641ac8321279aab9adb0ed67f99df81f8df991e41f86776350a7af82f1e56aa
- MD5 cacc04a8e8ff822e4ad4ba0cc4c10baa
- SHA1 cd117537bc43c14b158394bd53ad2423ba953d38
- SHA512 34175e0ef4651e552407a2e48b341856119a7c17f72cb1ee7cc11084ff59fe4fe6b36630c3b9aaf2fa4b22e62bdd22be2423534e71437d6e14cd0eaf7d581a46
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlydL+LOfy4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFly5+LO6kEj1
- TLSH T1B9247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3488 RHEL.exe 5860 JVEQ.exe 3756 INH.exe 4472 IILCX.exe 4144 WTBBL.exe 1188 QGGKVOA.exe 3180 GXHK.exe 1716 KNO.exe 4968 VFRCOKA.exe 4812 FDWXESB.exe 2828 ZQB.exe 4452 PLLKZE.exe 2240 PRLZBRB.exe 1832 CCTYP.exe 4552 EPYHZUD.exe 5732 OXAMD.exe 3468 DSJ.exe 5684 YGOAY.exe 2900 QJSEDCE.exe 6080 GZTDK.exe 5592 LZBRT.exe 3028 GMGADAR.exe 4620 XVIFH.exe 5904 BDO.exe 6120 HDWTC.exe 364 CQBKMJF.exe 6072 AMA.exe 1856 MUGLD.exe 5712 EXKP.exe 4576 KXSDSX.exe 4772 ONYD.exe 4796 ZFBVM.exe 3428 ABFRSMZ.exe 5972 VWK.exe 5076 ZERIOF.exe 2792 ZHVMU.exe 1504 SKYIZKU.exe 2704 NXD.exe 2680 EYFWN.exe 5600 YLKGXQA.exe 3356 CBRO.exe 2488 VEU.exe 4760 KZMWAK.exe 1268 LCQ.exe 1148 KNSIWOW.exe 4656 CQWLB.exe 2996 XDBVLEU.exe 4860 JLIVQ.exe 824 UELOYE.exe 4508 AESBHY.exe 2564 YZRC.exe 1868 NUBOFOP.exe 2244 OXFK.exe 4960 QVK.exe 3312 QYWAX.exe 5308 AZQ.exe 124 ACCJO.exe 4212 VPHSYXJ.exe 6084 TFSVLK.exe 1572 HKSH.exe 1580 NLAVEQ.exe 2432 RTGV.exe 5336 LOLET.exe 5752 DONJEGG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\XVIFH.exe GMGADAR.exe File opened for modification C:\windows\SysWOW64\XVIFH.exe GMGADAR.exe File opened for modification C:\windows\SysWOW64\ZZZM.exe EMVCIDM.exe File created C:\windows\SysWOW64\NHZJOJ.exe.bat YMI.exe File created C:\windows\SysWOW64\WRODE.exe XGLNVV.exe File created C:\windows\SysWOW64\ABFRSMZ.exe.bat ZFBVM.exe File created C:\windows\SysWOW64\VEU.exe.bat CBRO.exe File created C:\windows\SysWOW64\ZZZM.exe EMVCIDM.exe File created C:\windows\SysWOW64\XNRLN.exe.bat IXQLHEF.exe File created C:\windows\SysWOW64\KNSIWOW.exe.bat LCQ.exe File created C:\windows\SysWOW64\AESBHY.exe.bat UELOYE.exe File created C:\windows\SysWOW64\HKSH.exe.bat TFSVLK.exe File created C:\windows\SysWOW64\JVEQ.exe RHEL.exe File created C:\windows\SysWOW64\YGOAY.exe DSJ.exe File created C:\windows\SysWOW64\GZTDK.exe QJSEDCE.exe File created C:\windows\SysWOW64\EYFWN.exe NXD.exe File created C:\windows\SysWOW64\ACCJO.exe AZQ.exe File opened for modification C:\windows\SysWOW64\ABFRSMZ.exe ZFBVM.exe File created C:\windows\SysWOW64\WRODE.exe.bat XGLNVV.exe File opened for modification C:\windows\SysWOW64\GZTDK.exe QJSEDCE.exe File opened for modification C:\windows\SysWOW64\WRODE.exe XGLNVV.exe File created C:\windows\SysWOW64\VPSHMSR.exe RHLHZ.exe File opened for modification C:\windows\SysWOW64\KXSDSX.exe EXKP.exe File opened for modification C:\windows\SysWOW64\IILCX.exe INH.exe File created C:\windows\SysWOW64\YGOAY.exe.bat DSJ.exe File created C:\windows\SysWOW64\KZMWAK.exe VEU.exe File opened for modification C:\windows\SysWOW64\IXQLHEF.exe EPJL.exe File created C:\windows\SysWOW64\PLLKZE.exe.bat ZQB.exe File opened for modification C:\windows\SysWOW64\YGOAY.exe DSJ.exe File opened for modification C:\windows\SysWOW64\AESBHY.exe UELOYE.exe File created C:\windows\SysWOW64\IXQLHEF.exe EPJL.exe File opened for modification C:\windows\SysWOW64\XNRLN.exe IXQLHEF.exe File opened for modification C:\windows\SysWOW64\QGGKVOA.exe WTBBL.exe File created C:\windows\SysWOW64\JVEQ.exe.bat RHEL.exe File created C:\windows\SysWOW64\PRLZBRB.exe PLLKZE.exe File created C:\windows\SysWOW64\WYUB.exe XNRLN.exe File created C:\windows\SysWOW64\CBRO.exe.bat YLKGXQA.exe File opened for modification C:\windows\SysWOW64\OXFK.exe NUBOFOP.exe File opened for modification C:\windows\SysWOW64\VWK.exe ABFRSMZ.exe File created C:\windows\SysWOW64\VWK.exe.bat ABFRSMZ.exe File created C:\windows\SysWOW64\ZERIOF.exe VWK.exe File opened for modification C:\windows\SysWOW64\CBRO.exe YLKGXQA.exe File created C:\windows\SysWOW64\ZWL.exe RRL.exe File created C:\windows\SysWOW64\WTBBL.exe IILCX.exe File created C:\windows\SysWOW64\QGGKVOA.exe.bat WTBBL.exe File created C:\windows\SysWOW64\KNSIWOW.exe LCQ.exe File created C:\windows\SysWOW64\CQWLB.exe KNSIWOW.exe File opened for modification C:\windows\SysWOW64\DONJEGG.exe LOLET.exe File created C:\windows\SysWOW64\ZZZM.exe.bat EMVCIDM.exe File opened for modification C:\windows\SysWOW64\PRLZBRB.exe PLLKZE.exe File created C:\windows\SysWOW64\XVIFH.exe.bat GMGADAR.exe File created C:\windows\SysWOW64\KXSDSX.exe.bat EXKP.exe File created C:\windows\SysWOW64\VWK.exe ABFRSMZ.exe File opened for modification C:\windows\SysWOW64\ZERIOF.exe VWK.exe File opened for modification C:\windows\SysWOW64\HKSH.exe TFSVLK.exe File created C:\windows\SysWOW64\DONJEGG.exe.bat LOLET.exe File created C:\windows\SysWOW64\WTBBL.exe.bat IILCX.exe File opened for modification C:\windows\SysWOW64\CQWLB.exe KNSIWOW.exe File created C:\windows\SysWOW64\QGGKVOA.exe WTBBL.exe File created C:\windows\SysWOW64\ABFRSMZ.exe ZFBVM.exe File opened for modification C:\windows\SysWOW64\KZMWAK.exe VEU.exe File opened for modification C:\windows\SysWOW64\VPHSYXJ.exe ACCJO.exe File created C:\windows\SysWOW64\IILCX.exe INH.exe File created C:\windows\SysWOW64\PRLZBRB.exe.bat PLLKZE.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\HUYZV.exe USQAH.exe File created C:\windows\system\MUGLD.exe.bat AMA.exe File created C:\windows\system\DSJ.exe.bat OXAMD.exe File opened for modification C:\windows\system\HDWTC.exe BDO.exe File created C:\windows\ZHVMU.exe ZERIOF.exe File created C:\windows\JLIVQ.exe XDBVLEU.exe File created C:\windows\system\QHBZWJD.exe.bat ZZZM.exe File opened for modification C:\windows\IJUIDHZ.exe CNDH.exe File opened for modification C:\windows\system\VFRCOKA.exe KNO.exe File created C:\windows\system\QJSEDCE.exe.bat YGOAY.exe File opened for modification C:\windows\system\BDO.exe XVIFH.exe File created C:\windows\system\HDWTC.exe.bat BDO.exe File opened for modification C:\windows\RRL.exe GYQJVB.exe File created C:\windows\system\HUYZV.exe.bat USQAH.exe File created C:\windows\XGLNVV.exe.bat DLHE.exe File created C:\windows\system\DVJIRXF.exe ZNCZ.exe File created C:\windows\system\RHEL.exe 2026-10-28_cacc04a8e8ff822e4ad4ba0cc4c10baa_elex_emotet_stop.exe File opened for modification C:\windows\BXZP.exe HKUGSLX.exe File opened for modification C:\windows\system\RBMM.exe CLLMNF.exe File created C:\windows\FSY.exe VSWL.exe File created C:\windows\NUBOFOP.exe.bat YZRC.exe File opened for modification C:\windows\system\TFSVLK.exe VPHSYXJ.exe File created C:\windows\system\RTGV.exe NLAVEQ.exe File created C:\windows\system\VFRCOKA.exe.bat KNO.exe File created C:\windows\CCTYP.exe PRLZBRB.exe File created C:\windows\XDBVLEU.exe.bat CQWLB.exe File opened for modification C:\windows\system\YZRC.exe AESBHY.exe File created C:\windows\system\CLLMNF.exe.bat WLEZE.exe File created C:\windows\LCQ.exe.bat KZMWAK.exe File created C:\windows\system\YZRC.exe.bat AESBHY.exe File opened for modification C:\windows\NUBOFOP.exe YZRC.exe File opened for modification C:\windows\system\NLAVEQ.exe HKSH.exe File created C:\windows\system\QHBZWJD.exe ZZZM.exe File opened for modification C:\windows\system\USQAH.exe ZWL.exe File created C:\windows\system\EPJL.exe.bat QETNOB.exe File opened for modification C:\windows\ROD.exe JIKRKJL.exe File opened for modification C:\windows\system\GXHK.exe QGGKVOA.exe File created C:\windows\ZHVMU.exe.bat ZERIOF.exe File opened for modification C:\windows\QVK.exe OXFK.exe File created C:\windows\LOLET.exe.bat RTGV.exe File created C:\windows\ROD.exe JIKRKJL.exe File created C:\windows\ROD.exe.bat JIKRKJL.exe File created C:\windows\system\VSWL.exe.bat VPSHMSR.exe File created C:\windows\EYND.exe DVJIRXF.exe File opened for modification C:\windows\system\INH.exe JVEQ.exe File opened for modification C:\windows\KNO.exe GXHK.exe File created C:\windows\NXD.exe SKYIZKU.exe File opened for modification C:\windows\system\RTGV.exe NLAVEQ.exe File opened for modification C:\windows\LOLET.exe RTGV.exe File opened for modification C:\windows\system\QHBZWJD.exe ZZZM.exe File created C:\windows\CNDH.exe.bat NSMDOR.exe File created C:\windows\EYND.exe.bat DVJIRXF.exe File created C:\windows\system\VFRCOKA.exe KNO.exe File created C:\windows\QYWAX.exe.bat QVK.exe File created C:\windows\system\NLAVEQ.exe HKSH.exe File created C:\windows\system\XCSB.exe.bat DONJEGG.exe File created C:\windows\BXZP.exe HKUGSLX.exe File created C:\windows\system\WLEZE.exe BXZP.exe File created C:\windows\system\NSMDOR.exe.bat LVGI.exe File created C:\windows\CNDH.exe NSMDOR.exe File created C:\windows\system\ONYD.exe KXSDSX.exe File created C:\windows\FDWXESB.exe VFRCOKA.exe File created C:\windows\system\MRJQQ.exe IJUIDHZ.exe File opened for modification C:\windows\GYQJVB.exe MLLAL.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4176 cmd.exe 5884 cmd.exe 4804 cmd.exe 5560 cmd.exe 4216 cmd.exe 252 cmd.exe 3344 cmd.exe 2136 cmd.exe 1784 cmd.exe 3744 cmd.exe 724 cmd.exe 3264 cmd.exe 3176 cmd.exe 5444 cmd.exe 5568 cmd.exe 4448 cmd.exe 1136 cmd.exe 5092 cmd.exe 2660 cmd.exe 6064 cmd.exe 4892 cmd.exe 2044 cmd.exe 5808 cmd.exe 3460 cmd.exe 3068 cmd.exe 5396 cmd.exe 1436 cmd.exe 2164 cmd.exe 2936 cmd.exe 2088 cmd.exe 2684 cmd.exe 876 cmd.exe 2664 cmd.exe 3208 cmd.exe 5968 cmd.exe 1496 cmd.exe 5460 cmd.exe 3400 cmd.exe 4512 cmd.exe 3804 cmd.exe 4256 cmd.exe 3824 cmd.exe 4008 cmd.exe 5844 cmd.exe 4356 cmd.exe 3016 cmd.exe 1372 cmd.exe 4004 cmd.exe 5604 cmd.exe 3184 cmd.exe 5532 cmd.exe 3864 cmd.exe 2896 cmd.exe 5700 cmd.exe 5512 cmd.exe 5220 cmd.exe 4612 cmd.exe 4868 cmd.exe 5260 cmd.exe 3592 cmd.exe 712 cmd.exe 5868 cmd.exe 3268 cmd.exe 4580 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4908 4416 WerFault.exe 88 4132 3488 WerFault.exe 94 52 5860 WerFault.exe 100 5788 3756 WerFault.exe 105 776 4472 WerFault.exe 110 1256 4144 WerFault.exe 115 5292 1188 WerFault.exe 120 2752 3180 WerFault.exe 125 2136 1716 WerFault.exe 129 6116 4968 WerFault.exe 135 3272 4812 WerFault.exe 140 1992 2828 WerFault.exe 145 4928 4452 WerFault.exe 150 240 2240 WerFault.exe 155 5608 1832 WerFault.exe 160 5692 4552 WerFault.exe 165 4312 5732 WerFault.exe 170 2288 3468 WerFault.exe 175 2036 5684 WerFault.exe 180 4604 2900 WerFault.exe 185 4476 6080 WerFault.exe 190 5320 5592 WerFault.exe 195 5452 3028 WerFault.exe 200 1272 4620 WerFault.exe 205 264 5904 WerFault.exe 210 5400 6120 WerFault.exe 215 4600 364 WerFault.exe 220 1336 6072 WerFault.exe 225 4172 1856 WerFault.exe 230 3824 5712 WerFault.exe 234 5444 4576 WerFault.exe 240 2780 4772 WerFault.exe 245 4528 4796 WerFault.exe 250 2044 3428 WerFault.exe 255 5448 5972 WerFault.exe 260 1360 5076 WerFault.exe 265 4920 2792 WerFault.exe 270 4292 1504 WerFault.exe 275 1256 2704 WerFault.exe 280 5440 2680 WerFault.exe 285 3964 5600 WerFault.exe 290 2776 3356 WerFault.exe 295 1332 2488 WerFault.exe 300 4484 4760 WerFault.exe 305 5312 1268 WerFault.exe 310 5308 1148 WerFault.exe 315 4592 4656 WerFault.exe 320 3664 2996 WerFault.exe 325 4816 4860 WerFault.exe 329 3936 824 WerFault.exe 335 2200 4508 WerFault.exe 340 2156 2564 WerFault.exe 345 4476 1868 WerFault.exe 350 5320 2244 WerFault.exe 355 4180 4960 WerFault.exe 360 5032 3312 WerFault.exe 365 4664 5308 WerFault.exe 370 5880 124 WerFault.exe 375 5036 4212 WerFault.exe 380 5132 6084 WerFault.exe 385 2384 1572 WerFault.exe 389 2344 1580 WerFault.exe 395 200 2432 WerFault.exe 400 1876 5336 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BXZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQBKMJF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NLAVEQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZZZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGLNVV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZHVMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYWAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MRJQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNRLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUGLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKSH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-28_cacc04a8e8ff822e4ad4ba0cc4c10baa_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDWXESB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFSVLK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDWTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSMDOR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EPYHZUD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LOLET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHLHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DVJIRXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPHSYXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLLMNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLEZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4416 2026-10-28_cacc04a8e8ff822e4ad4ba0cc4c10baa_elex_emotet_stop.exe 4416 2026-10-28_cacc04a8e8ff822e4ad4ba0cc4c10baa_elex_emotet_stop.exe 3488 RHEL.exe 3488 RHEL.exe 5860 JVEQ.exe 5860 JVEQ.exe 3756 INH.exe 3756 INH.exe 4472 IILCX.exe 4472 IILCX.exe 4144 WTBBL.exe 4144 WTBBL.exe 1188 QGGKVOA.exe 1188 QGGKVOA.exe 3180 GXHK.exe 3180 GXHK.exe 1716 KNO.exe 1716 KNO.exe 4968 VFRCOKA.exe 4968 VFRCOKA.exe 4812 FDWXESB.exe 4812 FDWXESB.exe 2828 ZQB.exe 2828 ZQB.exe 4452 PLLKZE.exe 4452 PLLKZE.exe 2240 PRLZBRB.exe 2240 PRLZBRB.exe 1832 CCTYP.exe 1832 CCTYP.exe 4552 EPYHZUD.exe 4552 EPYHZUD.exe 5732 OXAMD.exe 5732 OXAMD.exe 3468 DSJ.exe 3468 DSJ.exe 5684 YGOAY.exe 5684 YGOAY.exe 2900 QJSEDCE.exe 2900 QJSEDCE.exe 6080 GZTDK.exe 6080 GZTDK.exe 5592 LZBRT.exe 5592 LZBRT.exe 3028 GMGADAR.exe 3028 GMGADAR.exe 4620 XVIFH.exe 4620 XVIFH.exe 5904 BDO.exe 5904 BDO.exe 6120 HDWTC.exe 6120 HDWTC.exe 364 CQBKMJF.exe 364 CQBKMJF.exe 6072 AMA.exe 6072 AMA.exe 1856 MUGLD.exe 1856 MUGLD.exe 5712 EXKP.exe 5712 EXKP.exe 4576 KXSDSX.exe 4576 KXSDSX.exe 4772 ONYD.exe 4772 ONYD.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4416 2026-10-28_cacc04a8e8ff822e4ad4ba0cc4c10baa_elex_emotet_stop.exe 4416 2026-10-28_cacc04a8e8ff822e4ad4ba0cc4c10baa_elex_emotet_stop.exe 3488 RHEL.exe 3488 RHEL.exe 5860 JVEQ.exe 5860 JVEQ.exe 3756 INH.exe 3756 INH.exe 4472 IILCX.exe 4472 IILCX.exe 4144 WTBBL.exe 4144 WTBBL.exe 1188 QGGKVOA.exe 1188 QGGKVOA.exe 3180 GXHK.exe 3180 GXHK.exe 1716 KNO.exe 1716 KNO.exe 4968 VFRCOKA.exe 4968 VFRCOKA.exe 4812 FDWXESB.exe 4812 FDWXESB.exe 2828 ZQB.exe 2828 ZQB.exe 4452 PLLKZE.exe 4452 PLLKZE.exe 2240 PRLZBRB.exe 2240 PRLZBRB.exe 1832 CCTYP.exe 1832 CCTYP.exe 4552 EPYHZUD.exe 4552 EPYHZUD.exe 5732 OXAMD.exe 5732 OXAMD.exe 3468 DSJ.exe 3468 DSJ.exe 5684 YGOAY.exe 5684 YGOAY.exe 2900 QJSEDCE.exe 2900 QJSEDCE.exe 6080 GZTDK.exe 6080 GZTDK.exe 5592 LZBRT.exe 5592 LZBRT.exe 3028 GMGADAR.exe 3028 GMGADAR.exe 4620 XVIFH.exe 4620 XVIFH.exe 5904 BDO.exe 5904 BDO.exe 6120 HDWTC.exe 6120 HDWTC.exe 364 CQBKMJF.exe 364 CQBKMJF.exe 6072 AMA.exe 6072 AMA.exe 1856 MUGLD.exe 1856 MUGLD.exe 5712 EXKP.exe 5712 EXKP.exe 4576 KXSDSX.exe 4576 KXSDSX.exe 4772 ONYD.exe 4772 ONYD.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4416 wrote to memory of 1956 4416 2026-10-28_cacc04a8e8ff822e4ad4ba0cc4c10baa_elex_emotet_stop.exe 90 PID 1956 wrote to memory of 3488 1956 cmd.exe 94 PID 3488 wrote to memory of 5148 3488 RHEL.exe 96 PID 5148 wrote to memory of 5860 5148 cmd.exe 100 PID 5860 wrote to memory of 3868 5860 JVEQ.exe 101 PID 3868 wrote to memory of 3756 3868 cmd.exe 105 PID 3756 wrote to memory of 4176 3756 INH.exe 106 PID 4176 wrote to memory of 4472 4176 cmd.exe 110 PID 4472 wrote to memory of 5968 4472 IILCX.exe 111 PID 5968 wrote to memory of 4144 5968 cmd.exe 115 PID 4144 wrote to memory of 3544 4144 WTBBL.exe 116 PID 3544 wrote to memory of 1188 3544 cmd.exe 120 PID 1188 wrote to memory of 1460 1188 QGGKVOA.exe 121 PID 1460 wrote to memory of 3180 1460 cmd.exe 125 PID 3180 wrote to memory of 5984 3180 GXHK.exe 126 PID 5984 wrote to memory of 1716 5984 cmd.exe 129 PID 1716 wrote to memory of 5604 1716 KNO.exe 131 PID 5604 wrote to memory of 4968 5604 cmd.exe 135 PID 4968 wrote to memory of 3732 4968 VFRCOKA.exe 136 PID 3732 wrote to memory of 4812 3732 cmd.exe 140 PID 4812 wrote to memory of 4540 4812 FDWXESB.exe 141 PID 4540 wrote to memory of 2828 4540 cmd.exe 145 PID 2828 wrote to memory of 4216 2828 ZQB.exe 146 PID 4216 wrote to memory of 4452 4216 cmd.exe 150 PID 4452 wrote to memory of 3184 4452 PLLKZE.exe 151 PID 3184 wrote to memory of 2240 3184 cmd.exe 155 PID 2240 wrote to memory of 832 2240 PRLZBRB.exe 156 PID 832 wrote to memory of 1832 832 cmd.exe 160 PID 1832 wrote to memory of 5808 1832 CCTYP.exe 161 PID 5808 wrote to memory of 4552 5808 cmd.exe 165 PID 4552 wrote to memory of 5532 4552 EPYHZUD.exe 166 PID 5532 wrote to memory of 5732 5532 cmd.exe 170 PID 5732 wrote to memory of 4824 5732 OXAMD.exe 171 PID 4824 wrote to memory of 3468 4824 cmd.exe 175 PID 3468 wrote to memory of 1496 3468 DSJ.exe 176 PID 1496 wrote to memory of 5684 1496 cmd.exe 180 PID 5684 wrote to memory of 5220 5684 YGOAY.exe 181 PID 5220 wrote to memory of 2900 5220 cmd.exe 185 PID 2900 wrote to memory of 3188 2900 QJSEDCE.exe 186 PID 3188 wrote to memory of 6080 3188 cmd.exe 190 PID 6080 wrote to memory of 796 6080 GZTDK.exe 191 PID 796 wrote to memory of 5592 796 cmd.exe 195 PID 5592 wrote to memory of 3144 5592 LZBRT.exe 196 PID 3144 wrote to memory of 3028 3144 cmd.exe 200 PID 3028 wrote to memory of 3176 3028 GMGADAR.exe 201 PID 3176 wrote to memory of 4620 3176 cmd.exe 205 PID 4620 wrote to memory of 5260 4620 XVIFH.exe 206 PID 5260 wrote to memory of 5904 5260 cmd.exe 210 PID 5904 wrote to memory of 252 5904 BDO.exe 211 PID 252 wrote to memory of 6120 252 cmd.exe 215 PID 6120 wrote to memory of 6036 6120 HDWTC.exe 216 PID 6036 wrote to memory of 364 6036 cmd.exe 220 PID 364 wrote to memory of 2324 364 CQBKMJF.exe 221 PID 2324 wrote to memory of 6072 2324 cmd.exe 225 PID 6072 wrote to memory of 5012 6072 AMA.exe 226 PID 5012 wrote to memory of 1856 5012 cmd.exe 230 PID 1856 wrote to memory of 5520 1856 MUGLD.exe 231 PID 5520 wrote to memory of 5712 5520 cmd.exe 234 PID 5712 wrote to memory of 3460 5712 EXKP.exe 236 PID 3460 wrote to memory of 4576 3460 cmd.exe 240 PID 4576 wrote to memory of 4008 4576 KXSDSX.exe 241 PID 4008 wrote to memory of 4772 4008 cmd.exe 245 PID 4772 wrote to memory of 2936 4772 ONYD.exe 246 PID 2936 wrote to memory of 4796 2936 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_cacc04a8e8ff822e4ad4ba0cc4c10baa_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_cacc04a8e8ff822e4ad4ba0cc4c10baa_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHEL.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\windows\system\RHEL.exeC:\windows\system\RHEL.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JVEQ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\windows\SysWOW64\JVEQ.exeC:\windows\system32\JVEQ.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\INH.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\windows\system\INH.exeC:\windows\system\INH.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IILCX.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\windows\SysWOW64\IILCX.exeC:\windows\system32\IILCX.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WTBBL.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\windows\SysWOW64\WTBBL.exeC:\windows\system32\WTBBL.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QGGKVOA.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\windows\SysWOW64\QGGKVOA.exeC:\windows\system32\QGGKVOA.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXHK.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\windows\system\GXHK.exeC:\windows\system\GXHK.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KNO.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\windows\KNO.exeC:\windows\KNO.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VFRCOKA.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\windows\system\VFRCOKA.exeC:\windows\system\VFRCOKA.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FDWXESB.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\windows\FDWXESB.exeC:\windows\FDWXESB.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZQB.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\windows\system\ZQB.exeC:\windows\system\ZQB.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PLLKZE.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\SysWOW64\PLLKZE.exeC:\windows\system32\PLLKZE.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRLZBRB.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\windows\SysWOW64\PRLZBRB.exeC:\windows\system32\PRLZBRB.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCTYP.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\windows\CCTYP.exeC:\windows\CCTYP.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EPYHZUD.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\windows\system\EPYHZUD.exeC:\windows\system\EPYHZUD.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OXAMD.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\windows\OXAMD.exeC:\windows\OXAMD.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DSJ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\system\DSJ.exeC:\windows\system\DSJ.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YGOAY.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\windows\SysWOW64\YGOAY.exeC:\windows\system32\YGOAY.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJSEDCE.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\windows\system\QJSEDCE.exeC:\windows\system\QJSEDCE.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GZTDK.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\windows\SysWOW64\GZTDK.exeC:\windows\system32\GZTDK.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LZBRT.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:796 -
C:\windows\LZBRT.exeC:\windows\LZBRT.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GMGADAR.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\windows\SysWOW64\GMGADAR.exeC:\windows\system32\GMGADAR.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XVIFH.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\windows\SysWOW64\XVIFH.exeC:\windows\system32\XVIFH.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BDO.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\windows\system\BDO.exeC:\windows\system\BDO.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HDWTC.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:252 -
C:\windows\system\HDWTC.exeC:\windows\system\HDWTC.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQBKMJF.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\windows\SysWOW64\CQBKMJF.exeC:\windows\system32\CQBKMJF.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AMA.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\windows\AMA.exeC:\windows\AMA.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MUGLD.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\windows\system\MUGLD.exeC:\windows\system\MUGLD.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EXKP.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\windows\EXKP.exeC:\windows\EXKP.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXSDSX.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\windows\SysWOW64\KXSDSX.exeC:\windows\system32\KXSDSX.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ONYD.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\windows\system\ONYD.exeC:\windows\system\ONYD.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZFBVM.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\windows\ZFBVM.exeC:\windows\ZFBVM.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABFRSMZ.exe.bat" "66⤵PID:568
-
C:\windows\SysWOW64\ABFRSMZ.exeC:\windows\system32\ABFRSMZ.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWK.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5884 -
C:\windows\SysWOW64\VWK.exeC:\windows\system32\VWK.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZERIOF.exe.bat" "70⤵PID:2076
-
C:\windows\SysWOW64\ZERIOF.exeC:\windows\system32\ZERIOF.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZHVMU.exe.bat" "72⤵PID:5104
-
C:\windows\ZHVMU.exeC:\windows\ZHVMU.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SKYIZKU.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:1672 -
C:\windows\system\SKYIZKU.exeC:\windows\system\SKYIZKU.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXD.exe.bat" "76⤵PID:4912
-
C:\windows\NXD.exeC:\windows\NXD.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYFWN.exe.bat" "78⤵
- Executes a command shell one-liner
PID:5460 -
C:\windows\SysWOW64\EYFWN.exeC:\windows\system32\EYFWN.exe79⤵
- Executes dropped EXE
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YLKGXQA.exe.bat" "80⤵
- Executes a command shell one-liner
PID:2088 -
C:\windows\system\YLKGXQA.exeC:\windows\system\YLKGXQA.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CBRO.exe.bat" "82⤵PID:5048
-
C:\windows\SysWOW64\CBRO.exeC:\windows\system32\CBRO.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEU.exe.bat" "84⤵
- Executes a command shell one-liner
PID:3344 -
C:\windows\SysWOW64\VEU.exeC:\windows\system32\VEU.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZMWAK.exe.bat" "86⤵PID:5872
-
C:\windows\SysWOW64\KZMWAK.exeC:\windows\system32\KZMWAK.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCQ.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4804 -
C:\windows\LCQ.exeC:\windows\LCQ.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNSIWOW.exe.bat" "90⤵PID:5612
-
C:\windows\SysWOW64\KNSIWOW.exeC:\windows\system32\KNSIWOW.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQWLB.exe.bat" "92⤵PID:5160
-
C:\windows\SysWOW64\CQWLB.exeC:\windows\system32\CQWLB.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XDBVLEU.exe.bat" "94⤵
- Executes a command shell one-liner
PID:3068 -
C:\windows\XDBVLEU.exeC:\windows\XDBVLEU.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLIVQ.exe.bat" "96⤵
- Executes a command shell one-liner
PID:3400 -
C:\windows\JLIVQ.exeC:\windows\JLIVQ.exe97⤵
- Executes dropped EXE
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UELOYE.exe.bat" "98⤵PID:1500
-
C:\windows\SysWOW64\UELOYE.exeC:\windows\system32\UELOYE.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AESBHY.exe.bat" "100⤵PID:3688
-
C:\windows\SysWOW64\AESBHY.exeC:\windows\system32\AESBHY.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZRC.exe.bat" "102⤵PID:1540
-
C:\windows\system\YZRC.exeC:\windows\system\YZRC.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NUBOFOP.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1136 -
C:\windows\NUBOFOP.exeC:\windows\NUBOFOP.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OXFK.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:5424 -
C:\windows\SysWOW64\OXFK.exeC:\windows\system32\OXFK.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVK.exe.bat" "108⤵PID:5776
-
C:\windows\QVK.exeC:\windows\QVK.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYWAX.exe.bat" "110⤵
- Executes a command shell one-liner
PID:3592 -
C:\windows\QYWAX.exeC:\windows\QYWAX.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZQ.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:5448 -
C:\windows\system\AZQ.exeC:\windows\system\AZQ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACCJO.exe.bat" "114⤵
- Executes a command shell one-liner
PID:5396 -
C:\windows\SysWOW64\ACCJO.exeC:\windows\system32\ACCJO.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPHSYXJ.exe.bat" "116⤵
- Executes a command shell one-liner
PID:2684 -
C:\windows\SysWOW64\VPHSYXJ.exeC:\windows\system32\VPHSYXJ.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFSVLK.exe.bat" "118⤵PID:960
-
C:\windows\system\TFSVLK.exeC:\windows\system\TFSVLK.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKSH.exe.bat" "120⤵PID:5652
-
C:\windows\SysWOW64\HKSH.exeC:\windows\system32\HKSH.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-