Analysis
- max time kernel
107s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 21:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-30_95a33fec2ceba7e05cb79cbaa06632d9_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-30_95a33fec2ceba7e05cb79cbaa06632d9_elex_emotet_stop.exe
- Size 208KB
- Sample261030-1n65aaft3x
- SHA256 2a6c907703457ae1b0331d4098ebd5e683d81c83d1576b22227faa4ca52f6799
- MD5 95a33fec2ceba7e05cb79cbaa06632d9
- SHA1 d6ea276d3e194ab823b2f7d7b9485e9ccd15020d
- SHA512 e04fcf4e2a5204ab0b0e65131998f6043e1ac6e190471e5be67522d04ff97fe6cd1e5cd3a689175714c41492631b01cfb585326409999162ebb17f84b3f6c01c
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfV4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOdkEj1
- TLSH T14F247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4800 WLXC.exe 4904 CJX.exe 5640 COXA.exe 4472 HPXOJR.exe 4308 RPZTNPA.exe 4444 NVEQ.exe 4864 RLLQGR.exe 2844 MYQ.exe 3600 SYXNZL.exe 3052 BYZADQI.exe 3000 NOGA.exe 2536 WPIFTG.exe 3984 GXKK.exe 4696 VSUXPQJ.exe 5452 XFYG.exe 5620 JYB.exe 2364 BBFVNVW.exe 876 WOK.exe 1088 XROID.exe 2172 AZUIH.exe 3884 USK.exe 1572 UGC.exe 4208 DLMZQG.exe 5300 LYNORTC.exe 4548 RZUB.exe 3388 CRXUJ.exe 5624 LSRZMAV.exe 1084 CFCRCWJ.exe 5852 MFEWFC.exe 892 VNGJRZN.exe 3404 MBQ.exe 2568 YTTM.exe 5748 JMWFP.exe 5416 UERYXA.exe 2476 LKCQFXJ.exe 3476 NID.exe 3804 LIKGV.exe 3812 WAFRDD.exe 1948 ZOK.exe 3996 ZGT.exe 2980 KZWU.exe 3032 HEURIY.exe 5524 BSZ.exe 4340 BXZP.exe 5804 SLJH.exe 1248 JVAFJ.exe 1332 AJKPZZR.exe 4376 VWPG.exe 1048 PJUQUY.exe 4232 PPUEVDP.exe 2744 TFAE.exe 576 OIJDOGH.exe 1580 NDIES.exe 704 SDQSBEY.exe 4456 EWTKKL.exe 1124 LOB.exe 2208 VPVRB.exe 4664 PCAALUK.exe 2072 KXF.exe 5488 VQICW.exe 1936 DAREK.exe 4936 WEUA.exe 4992 CECN.exe 2516 SPSL.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\RLLQGR.exe NVEQ.exe File created C:\windows\SysWOW64\AJKPZZR.exe JVAFJ.exe File created C:\windows\SysWOW64\SDQSBEY.exe NDIES.exe File created C:\windows\SysWOW64\LTCWAA.exe LOCHYO.exe File created C:\windows\SysWOW64\EIDT.exe NIBOVMU.exe File opened for modification C:\windows\SysWOW64\NID.exe LKCQFXJ.exe File opened for modification C:\windows\SysWOW64\PCAALUK.exe VPVRB.exe File created C:\windows\SysWOW64\SPSL.exe.bat CECN.exe File opened for modification C:\windows\SysWOW64\SJWD.exe SDWO.exe File created C:\windows\SysWOW64\AWWJ.exe.bat CWOVXW.exe File created C:\windows\SysWOW64\MDLZ.exe OCDLQGG.exe File created C:\windows\SysWOW64\MDLZ.exe.bat OCDLQGG.exe File opened for modification C:\windows\SysWOW64\FQHVP.exe LDC.exe File created C:\windows\SysWOW64\EWTKKL.exe SDQSBEY.exe File created C:\windows\SysWOW64\MVTQN.exe.bat RHW.exe File opened for modification C:\windows\SysWOW64\BRFX.exe VRXKOXX.exe File created C:\windows\SysWOW64\ROFGS.exe.bat GWC.exe File opened for modification C:\windows\SysWOW64\WPIFTG.exe NOGA.exe File created C:\windows\SysWOW64\WPIFTG.exe.bat NOGA.exe File created C:\windows\SysWOW64\CECN.exe WEUA.exe File opened for modification C:\windows\SysWOW64\CECN.exe WEUA.exe File created C:\windows\SysWOW64\UARPJ.exe.bat DQBRJ.exe File opened for modification C:\windows\SysWOW64\LOCHYO.exe UARPJ.exe File opened for modification C:\windows\SysWOW64\COXA.exe CJX.exe File created C:\windows\SysWOW64\DLMZQG.exe.bat UGC.exe File opened for modification C:\windows\SysWOW64\WEUA.exe DAREK.exe File created C:\windows\SysWOW64\GYJI.exe IXCUJWH.exe File opened for modification C:\windows\SysWOW64\AIGDKD.exe SDOPJQ.exe File created C:\windows\SysWOW64\SKKD.exe XPFTJYF.exe File opened for modification C:\windows\SysWOW64\CFCRCWJ.exe LSRZMAV.exe File created C:\windows\SysWOW64\EWTKKL.exe.bat SDQSBEY.exe File opened for modification C:\windows\SysWOW64\ROFGS.exe GWC.exe File opened for modification C:\windows\SysWOW64\UARPJ.exe DQBRJ.exe File opened for modification C:\windows\SysWOW64\AWWJ.exe CWOVXW.exe File opened for modification C:\windows\SysWOW64\VDLD.exe BQGTLJI.exe File created C:\windows\SysWOW64\KENVPIA.exe FEFIY.exe File opened for modification C:\windows\SysWOW64\OXEP.exe DFB.exe File opened for modification C:\windows\SysWOW64\LYNORTC.exe DLMZQG.exe File created C:\windows\SysWOW64\VNGJRZN.exe.bat MFEWFC.exe File opened for modification C:\windows\SysWOW64\SDQSBEY.exe NDIES.exe File created C:\windows\SysWOW64\AIGDKD.exe SDOPJQ.exe File opened for modification C:\windows\SysWOW64\ZMI.exe HMGHAFQ.exe File created C:\windows\SysWOW64\FQHVP.exe LDC.exe File created C:\windows\SysWOW64\VNGJRZN.exe MFEWFC.exe File created C:\windows\SysWOW64\HEURIY.exe.bat KZWU.exe File created C:\windows\SysWOW64\AJKPZZR.exe.bat JVAFJ.exe File created C:\windows\SysWOW64\GYJI.exe.bat IXCUJWH.exe File opened for modification C:\windows\SysWOW64\MDLZ.exe OCDLQGG.exe File created C:\windows\SysWOW64\FEFIY.exe.bat VDLD.exe File opened for modification C:\windows\SysWOW64\KXF.exe PCAALUK.exe File opened for modification C:\windows\SysWOW64\DYT.exe ODKXT.exe File opened for modification C:\windows\SysWOW64\SKKD.exe XPFTJYF.exe File opened for modification C:\windows\SysWOW64\LTCWAA.exe LOCHYO.exe File created C:\windows\SysWOW64\EIDT.exe.bat NIBOVMU.exe File created C:\windows\SysWOW64\VDLD.exe BQGTLJI.exe File created C:\windows\SysWOW64\FQHVP.exe.bat LDC.exe File opened for modification C:\windows\SysWOW64\RPZTNPA.exe HPXOJR.exe File created C:\windows\SysWOW64\NID.exe LKCQFXJ.exe File created C:\windows\SysWOW64\KZWU.exe ZGT.exe File opened for modification C:\windows\SysWOW64\VPVRB.exe LOB.exe File created C:\windows\SysWOW64\CECN.exe.bat WEUA.exe File created C:\windows\SysWOW64\AIGDKD.exe.bat SDOPJQ.exe File created C:\windows\SysWOW64\AOLA.exe.bat LTCWAA.exe File created C:\windows\SysWOW64\LYNORTC.exe.bat DLMZQG.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\OIJDOGH.exe TFAE.exe File opened for modification C:\windows\LTMODM.exe ZARD.exe File created C:\windows\system\ZSFRMU.exe CMHUF.exe File created C:\windows\system\BBFVNVW.exe JYB.exe File created C:\windows\system\OPXKC.exe.bat AJRMV.exe File created C:\windows\ZARD.exe.bat FNM.exe File opened for modification C:\windows\system\ZGT.exe ZOK.exe File created C:\windows\system\GHBXQ.exe AHU.exe File created C:\windows\HJSSWSC.exe.bat KENVPIA.exe File opened for modification C:\windows\system\WPYI.exe HJSSWSC.exe File created C:\windows\XFYG.exe VSUXPQJ.exe File opened for modification C:\windows\system\BYZADQI.exe SYXNZL.exe File created C:\windows\DMEJS.exe.bat SPSL.exe File opened for modification C:\windows\TZNEO.exe ZMI.exe File opened for modification C:\windows\JYB.exe XFYG.exe File created C:\windows\system\MFEWFC.exe CFCRCWJ.exe File created C:\windows\RHW.exe.bat LHOTTV.exe File opened for modification C:\windows\NOGA.exe BYZADQI.exe File opened for modification C:\windows\system\XROID.exe WOK.exe File opened for modification C:\windows\system\VSUXPQJ.exe GXKK.exe File created C:\windows\system\RZUB.exe.bat LYNORTC.exe File created C:\windows\GJOR.exe AIGDKD.exe File opened for modification C:\windows\HMGHAFQ.exe SJWD.exe File opened for modification C:\windows\LHOTTV.exe AOLA.exe File opened for modification C:\windows\system\ZRUI.exe EWP.exe File opened for modification C:\windows\system\GVU.exe RADBB.exe File created C:\windows\NOGA.exe BYZADQI.exe File opened for modification C:\windows\DCNVT.exe SKKD.exe File created C:\windows\AHU.exe OORYZRF.exe File created C:\windows\RHW.exe LHOTTV.exe File created C:\windows\DCNVT.exe SKKD.exe File created C:\windows\system\VSUXPQJ.exe.bat GXKK.exe File created C:\windows\system\XROID.exe.bat WOK.exe File created C:\windows\AZUIH.exe XROID.exe File created C:\windows\system\WAFRDD.exe LIKGV.exe File created C:\windows\DAREK.exe VQICW.exe File created C:\windows\system\SDWO.exe XQRFDFY.exe File created C:\windows\system\MPZCO.exe AWWJ.exe File created C:\windows\system\GHBXQ.exe.bat AHU.exe File created C:\windows\system\TFAE.exe.bat PPUEVDP.exe File opened for modification C:\windows\system\NVEQ.exe RPZTNPA.exe File created C:\windows\BSZ.exe HEURIY.exe File created C:\windows\VRXKOXX.exe AETAE.exe File opened for modification C:\windows\RADBB.exe WNG.exe File opened for modification C:\windows\system\AETAE.exe GJOR.exe File opened for modification C:\windows\RHW.exe LHOTTV.exe File created C:\windows\system\ZXUWD.exe ZRUI.exe File opened for modification C:\windows\ODKXT.exe GYJI.exe File opened for modification C:\windows\AHU.exe OORYZRF.exe File opened for modification C:\windows\system\NQFGK.exe EIDT.exe File created C:\windows\system\NVEQ.exe RPZTNPA.exe File created C:\windows\PJUQUY.exe.bat VWPG.exe File opened for modification C:\windows\system\LUDZJGN.exe OPXKC.exe File created C:\windows\system\ZNEYC.exe.bat BRFX.exe File created C:\windows\system\OORYZRF.exe JOJLQX.exe File created C:\windows\system\LDC.exe.bat OXEP.exe File opened for modification C:\windows\system\UERYXA.exe JMWFP.exe File opened for modification C:\windows\system\TFAE.exe PPUEVDP.exe File opened for modification C:\windows\XPFTJYF.exe ROFGS.exe File created C:\windows\system\JIRW.exe.bat MDLZ.exe File opened for modification C:\windows\CJX.exe WLXC.exe File opened for modification C:\windows\BSZ.exe HEURIY.exe File created C:\windows\system\ICW.exe TZNEO.exe File created C:\windows\JOJLQX.exe JIRW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 632 cmd.exe 2704 cmd.exe 1344 cmd.exe 5408 cmd.exe 1308 cmd.exe 5628 cmd.exe 1596 cmd.exe 3420 cmd.exe 4844 cmd.exe 4112 cmd.exe 2776 cmd.exe 2396 cmd.exe 1160 cmd.exe 4796 cmd.exe 4148 cmd.exe 5800 cmd.exe 1980 cmd.exe 3408 cmd.exe 3684 cmd.exe 5012 cmd.exe 4940 cmd.exe 3288 cmd.exe 5024 cmd.exe 4324 cmd.exe 2560 cmd.exe 5004 cmd.exe 5644 cmd.exe 4424 cmd.exe 3260 cmd.exe 256 cmd.exe 3344 cmd.exe 4328 cmd.exe 2828 cmd.exe 1480 cmd.exe 1028 cmd.exe 2136 cmd.exe 5108 cmd.exe 3004 cmd.exe 2148 cmd.exe 3448 cmd.exe 764 cmd.exe 5836 cmd.exe 5932 cmd.exe 992 cmd.exe 4584 cmd.exe 4168 cmd.exe 2144 cmd.exe 5236 cmd.exe 2992 cmd.exe 2960 cmd.exe 5448 cmd.exe 1432 cmd.exe 5912 cmd.exe 5956 cmd.exe 4264 cmd.exe 3440 cmd.exe 2104 cmd.exe 1840 cmd.exe 4604 cmd.exe 2576 cmd.exe 1232 cmd.exe 712 cmd.exe 4400 cmd.exe 2812 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3432 5788 WerFault.exe 87 4376 4800 WerFault.exe 93 256 4904 WerFault.exe 99 5624 5640 WerFault.exe 104 1084 4472 WerFault.exe 109 1204 4308 WerFault.exe 114 480 4444 WerFault.exe 119 3032 4864 WerFault.exe 124 4960 2844 WerFault.exe 129 3684 3600 WerFault.exe 134 632 3052 WerFault.exe 139 6024 3000 WerFault.exe 144 2648 2536 WerFault.exe 149 5100 3984 WerFault.exe 154 2508 4696 WerFault.exe 159 5028 5452 WerFault.exe 164 600 5620 WerFault.exe 169 5428 2364 WerFault.exe 174 2604 876 WerFault.exe 179 2328 1088 WerFault.exe 184 4516 2172 WerFault.exe 189 5456 3884 WerFault.exe 194 5904 1572 WerFault.exe 199 4660 4208 WerFault.exe 204 1332 5300 WerFault.exe 209 360 4548 WerFault.exe 214 5776 3388 WerFault.exe 219 5336 5624 WerFault.exe 224 4256 1084 WerFault.exe 229 1796 5852 WerFault.exe 234 3192 892 WerFault.exe 239 2964 3404 WerFault.exe 244 704 2568 WerFault.exe 249 4340 5748 WerFault.exe 254 2880 5416 WerFault.exe 259 4524 2476 WerFault.exe 264 4100 3476 WerFault.exe 269 676 3804 WerFault.exe 274 5644 3812 WerFault.exe 279 2008 1948 WerFault.exe 284 832 3996 WerFault.exe 289 576 2980 WerFault.exe 294 5064 3032 WerFault.exe 299 4488 5524 WerFault.exe 304 2880 4340 WerFault.exe 309 3432 5804 WerFault.exe 314 996 1248 WerFault.exe 319 5628 1332 WerFault.exe 324 2988 4376 WerFault.exe 329 764 1048 WerFault.exe 334 5096 4232 WerFault.exe 339 5516 2744 WerFault.exe 344 5576 576 WerFault.exe 349 5456 1580 WerFault.exe 354 2880 704 WerFault.exe 359 1960 4456 WerFault.exe 364 2984 1124 WerFault.exe 369 5604 2208 WerFault.exe 374 908 4664 WerFault.exe 379 5324 2072 WerFault.exe 384 1208 5488 WerFault.exe 389 3472 1936 WerFault.exe 394 1980 4936 WerFault.exe 399 5104 4992 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OXEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPZTNPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPVRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPSL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMEFLM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BQGTLJI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIRW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RZUB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KZWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SLJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JPE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XQRFDFY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOGA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFAE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDIES.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRTCAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJSSWSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZARD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UERYXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BXZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BRFX.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5788 2026-10-30_95a33fec2ceba7e05cb79cbaa06632d9_elex_emotet_stop.exe 5788 2026-10-30_95a33fec2ceba7e05cb79cbaa06632d9_elex_emotet_stop.exe 4800 WLXC.exe 4800 WLXC.exe 4904 CJX.exe 4904 CJX.exe 5640 COXA.exe 5640 COXA.exe 4472 HPXOJR.exe 4472 HPXOJR.exe 4308 RPZTNPA.exe 4308 RPZTNPA.exe 4444 NVEQ.exe 4444 NVEQ.exe 4864 RLLQGR.exe 4864 RLLQGR.exe 2844 MYQ.exe 2844 MYQ.exe 3600 SYXNZL.exe 3600 SYXNZL.exe 3052 BYZADQI.exe 3052 BYZADQI.exe 3000 NOGA.exe 3000 NOGA.exe 2536 WPIFTG.exe 2536 WPIFTG.exe 3984 GXKK.exe 3984 GXKK.exe 4696 VSUXPQJ.exe 4696 VSUXPQJ.exe 5452 XFYG.exe 5452 XFYG.exe 5620 JYB.exe 5620 JYB.exe 2364 BBFVNVW.exe 2364 BBFVNVW.exe 876 WOK.exe 876 WOK.exe 1088 XROID.exe 1088 XROID.exe 2172 AZUIH.exe 2172 AZUIH.exe 3884 USK.exe 3884 USK.exe 1572 UGC.exe 1572 UGC.exe 4208 DLMZQG.exe 4208 DLMZQG.exe 5300 LYNORTC.exe 5300 LYNORTC.exe 4548 RZUB.exe 4548 RZUB.exe 3388 CRXUJ.exe 3388 CRXUJ.exe 5624 LSRZMAV.exe 5624 LSRZMAV.exe 1084 CFCRCWJ.exe 1084 CFCRCWJ.exe 5852 MFEWFC.exe 5852 MFEWFC.exe 892 VNGJRZN.exe 892 VNGJRZN.exe 3404 MBQ.exe 3404 MBQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5788 2026-10-30_95a33fec2ceba7e05cb79cbaa06632d9_elex_emotet_stop.exe 5788 2026-10-30_95a33fec2ceba7e05cb79cbaa06632d9_elex_emotet_stop.exe 4800 WLXC.exe 4800 WLXC.exe 4904 CJX.exe 4904 CJX.exe 5640 COXA.exe 5640 COXA.exe 4472 HPXOJR.exe 4472 HPXOJR.exe 4308 RPZTNPA.exe 4308 RPZTNPA.exe 4444 NVEQ.exe 4444 NVEQ.exe 4864 RLLQGR.exe 4864 RLLQGR.exe 2844 MYQ.exe 2844 MYQ.exe 3600 SYXNZL.exe 3600 SYXNZL.exe 3052 BYZADQI.exe 3052 BYZADQI.exe 3000 NOGA.exe 3000 NOGA.exe 2536 WPIFTG.exe 2536 WPIFTG.exe 3984 GXKK.exe 3984 GXKK.exe 4696 VSUXPQJ.exe 4696 VSUXPQJ.exe 5452 XFYG.exe 5452 XFYG.exe 5620 JYB.exe 5620 JYB.exe 2364 BBFVNVW.exe 2364 BBFVNVW.exe 876 WOK.exe 876 WOK.exe 1088 XROID.exe 1088 XROID.exe 2172 AZUIH.exe 2172 AZUIH.exe 3884 USK.exe 3884 USK.exe 1572 UGC.exe 1572 UGC.exe 4208 DLMZQG.exe 4208 DLMZQG.exe 5300 LYNORTC.exe 5300 LYNORTC.exe 4548 RZUB.exe 4548 RZUB.exe 3388 CRXUJ.exe 3388 CRXUJ.exe 5624 LSRZMAV.exe 5624 LSRZMAV.exe 1084 CFCRCWJ.exe 1084 CFCRCWJ.exe 5852 MFEWFC.exe 5852 MFEWFC.exe 892 VNGJRZN.exe 892 VNGJRZN.exe 3404 MBQ.exe 3404 MBQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5788 wrote to memory of 2908 5788 2026-10-30_95a33fec2ceba7e05cb79cbaa06632d9_elex_emotet_stop.exe 89 PID 2908 wrote to memory of 4800 2908 cmd.exe 93 PID 4800 wrote to memory of 4348 4800 WLXC.exe 95 PID 4348 wrote to memory of 4904 4348 cmd.exe 99 PID 4904 wrote to memory of 3260 4904 CJX.exe 100 PID 3260 wrote to memory of 5640 3260 cmd.exe 104 PID 5640 wrote to memory of 5928 5640 COXA.exe 105 PID 5928 wrote to memory of 4472 5928 cmd.exe 109 PID 4472 wrote to memory of 4252 4472 HPXOJR.exe 110 PID 4252 wrote to memory of 4308 4252 cmd.exe 114 PID 4308 wrote to memory of 5024 4308 RPZTNPA.exe 115 PID 5024 wrote to memory of 4444 5024 cmd.exe 119 PID 4444 wrote to memory of 692 4444 NVEQ.exe 120 PID 692 wrote to memory of 4864 692 cmd.exe 124 PID 4864 wrote to memory of 1432 4864 RLLQGR.exe 125 PID 1432 wrote to memory of 2844 1432 cmd.exe 129 PID 2844 wrote to memory of 4324 2844 MYQ.exe 130 PID 4324 wrote to memory of 3600 4324 cmd.exe 134 PID 3600 wrote to memory of 2576 3600 SYXNZL.exe 135 PID 2576 wrote to memory of 3052 2576 cmd.exe 139 PID 3052 wrote to memory of 2704 3052 BYZADQI.exe 140 PID 2704 wrote to memory of 3000 2704 cmd.exe 144 PID 3000 wrote to memory of 3144 3000 NOGA.exe 145 PID 3144 wrote to memory of 2536 3144 cmd.exe 149 PID 2536 wrote to memory of 4268 2536 WPIFTG.exe 150 PID 4268 wrote to memory of 3984 4268 cmd.exe 154 PID 3984 wrote to memory of 2064 3984 GXKK.exe 155 PID 2064 wrote to memory of 4696 2064 cmd.exe 159 PID 4696 wrote to memory of 256 4696 VSUXPQJ.exe 160 PID 256 wrote to memory of 5452 256 cmd.exe 164 PID 5452 wrote to memory of 5268 5452 XFYG.exe 165 PID 5268 wrote to memory of 5620 5268 cmd.exe 169 PID 5620 wrote to memory of 3456 5620 JYB.exe 170 PID 3456 wrote to memory of 2364 3456 cmd.exe 174 PID 2364 wrote to memory of 1232 2364 BBFVNVW.exe 175 PID 1232 wrote to memory of 876 1232 cmd.exe 179 PID 876 wrote to memory of 4520 876 WOK.exe 180 PID 4520 wrote to memory of 1088 4520 cmd.exe 184 PID 1088 wrote to memory of 5000 1088 XROID.exe 185 PID 5000 wrote to memory of 2172 5000 cmd.exe 189 PID 2172 wrote to memory of 712 2172 AZUIH.exe 190 PID 712 wrote to memory of 3884 712 cmd.exe 194 PID 3884 wrote to memory of 3344 3884 USK.exe 195 PID 3344 wrote to memory of 1572 3344 cmd.exe 199 PID 1572 wrote to memory of 3420 1572 UGC.exe 200 PID 3420 wrote to memory of 4208 3420 cmd.exe 204 PID 4208 wrote to memory of 4400 4208 DLMZQG.exe 205 PID 4400 wrote to memory of 5300 4400 cmd.exe 209 PID 5300 wrote to memory of 2648 5300 LYNORTC.exe 210 PID 2648 wrote to memory of 4548 2648 cmd.exe 214 PID 4548 wrote to memory of 1160 4548 RZUB.exe 215 PID 1160 wrote to memory of 3388 1160 cmd.exe 219 PID 3388 wrote to memory of 5912 3388 CRXUJ.exe 220 PID 5912 wrote to memory of 5624 5912 cmd.exe 224 PID 5624 wrote to memory of 3136 5624 LSRZMAV.exe 225 PID 3136 wrote to memory of 1084 3136 cmd.exe 229 PID 1084 wrote to memory of 4584 1084 CFCRCWJ.exe 230 PID 4584 wrote to memory of 5852 4584 cmd.exe 234 PID 5852 wrote to memory of 2812 5852 MFEWFC.exe 235 PID 2812 wrote to memory of 892 2812 cmd.exe 239 PID 892 wrote to memory of 4796 892 VNGJRZN.exe 240 PID 4796 wrote to memory of 3404 4796 cmd.exe 244 PID 3404 wrote to memory of 1280 3404 MBQ.exe 245 PID 1280 wrote to memory of 2568 1280 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_95a33fec2ceba7e05cb79cbaa06632d9_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_95a33fec2ceba7e05cb79cbaa06632d9_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLXC.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\windows\SysWOW64\WLXC.exeC:\windows\system32\WLXC.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CJX.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\windows\CJX.exeC:\windows\CJX.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COXA.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\windows\SysWOW64\COXA.exeC:\windows\system32\COXA.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HPXOJR.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\windows\SysWOW64\HPXOJR.exeC:\windows\system32\HPXOJR.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RPZTNPA.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\windows\SysWOW64\RPZTNPA.exeC:\windows\system32\RPZTNPA.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NVEQ.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\windows\system\NVEQ.exeC:\windows\system\NVEQ.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RLLQGR.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:692 -
C:\windows\SysWOW64\RLLQGR.exeC:\windows\system32\RLLQGR.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYQ.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\windows\MYQ.exeC:\windows\MYQ.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SYXNZL.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\windows\SYXNZL.exeC:\windows\SYXNZL.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BYZADQI.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\windows\system\BYZADQI.exeC:\windows\system\BYZADQI.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NOGA.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\windows\NOGA.exeC:\windows\NOGA.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WPIFTG.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\windows\SysWOW64\WPIFTG.exeC:\windows\system32\WPIFTG.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GXKK.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\windows\SysWOW64\GXKK.exeC:\windows\system32\GXKK.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSUXPQJ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\windows\system\VSUXPQJ.exeC:\windows\system\VSUXPQJ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFYG.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:256 -
C:\windows\XFYG.exeC:\windows\XFYG.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JYB.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\windows\JYB.exeC:\windows\JYB.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBFVNVW.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\windows\system\BBFVNVW.exeC:\windows\system\BBFVNVW.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WOK.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\windows\system\WOK.exeC:\windows\system\WOK.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XROID.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\windows\system\XROID.exeC:\windows\system\XROID.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AZUIH.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\windows\AZUIH.exeC:\windows\AZUIH.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USK.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:712 -
C:\windows\system\USK.exeC:\windows\system\USK.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGC.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\windows\system\UGC.exeC:\windows\system\UGC.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLMZQG.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\windows\SysWOW64\DLMZQG.exeC:\windows\system32\DLMZQG.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LYNORTC.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\windows\SysWOW64\LYNORTC.exeC:\windows\system32\LYNORTC.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RZUB.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\windows\system\RZUB.exeC:\windows\system\RZUB.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CRXUJ.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\windows\system\CRXUJ.exeC:\windows\system\CRXUJ.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LSRZMAV.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\windows\system\LSRZMAV.exeC:\windows\system\LSRZMAV.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CFCRCWJ.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\windows\SysWOW64\CFCRCWJ.exeC:\windows\system32\CFCRCWJ.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MFEWFC.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\windows\system\MFEWFC.exeC:\windows\system\MFEWFC.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNGJRZN.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\windows\SysWOW64\VNGJRZN.exeC:\windows\system32\VNGJRZN.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MBQ.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\windows\MBQ.exeC:\windows\MBQ.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YTTM.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\windows\YTTM.exeC:\windows\YTTM.exe65⤵
- Executes dropped EXE
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMWFP.exe.bat" "66⤵PID:6124
-
C:\windows\JMWFP.exeC:\windows\JMWFP.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UERYXA.exe.bat" "68⤵PID:2244
-
C:\windows\system\UERYXA.exeC:\windows\system\UERYXA.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LKCQFXJ.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2700 -
C:\windows\system\LKCQFXJ.exeC:\windows\system\LKCQFXJ.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NID.exe.bat" "72⤵PID:4872
-
C:\windows\SysWOW64\NID.exeC:\windows\system32\NID.exe73⤵
- Executes dropped EXE
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LIKGV.exe.bat" "74⤵PID:52
-
C:\windows\LIKGV.exeC:\windows\LIKGV.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WAFRDD.exe.bat" "76⤵PID:2508
-
C:\windows\system\WAFRDD.exeC:\windows\system\WAFRDD.exe77⤵
- Executes dropped EXE
PID:3812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOK.exe.bat" "78⤵PID:4588
-
C:\windows\ZOK.exeC:\windows\ZOK.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGT.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:1744 -
C:\windows\system\ZGT.exeC:\windows\system\ZGT.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZWU.exe.bat" "82⤵PID:4708
-
C:\windows\SysWOW64\KZWU.exeC:\windows\system32\KZWU.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HEURIY.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:2588 -
C:\windows\SysWOW64\HEURIY.exeC:\windows\system32\HEURIY.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BSZ.exe.bat" "86⤵
- Executes a command shell one-liner
PID:4328 -
C:\windows\BSZ.exeC:\windows\BSZ.exe87⤵
- Executes dropped EXE
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BXZP.exe.bat" "88⤵PID:1128
-
C:\windows\BXZP.exeC:\windows\BXZP.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SLJH.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4148 -
C:\windows\SLJH.exeC:\windows\SLJH.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVAFJ.exe.bat" "92⤵
- Executes a command shell one-liner
PID:2560 -
C:\windows\JVAFJ.exeC:\windows\JVAFJ.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJKPZZR.exe.bat" "94⤵PID:3668
-
C:\windows\SysWOW64\AJKPZZR.exeC:\windows\system32\AJKPZZR.exe95⤵
- Executes dropped EXE
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VWPG.exe.bat" "96⤵PID:3528
-
C:\windows\VWPG.exeC:\windows\VWPG.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJUQUY.exe.bat" "98⤵PID:4824
-
C:\windows\PJUQUY.exeC:\windows\PJUQUY.exe99⤵
- Executes dropped EXE
PID:1048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PPUEVDP.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5492 -
C:\windows\SysWOW64\PPUEVDP.exeC:\windows\system32\PPUEVDP.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFAE.exe.bat" "102⤵
- Executes a command shell one-liner
PID:5108 -
C:\windows\system\TFAE.exeC:\windows\system\TFAE.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OIJDOGH.exe.bat" "104⤵PID:4468
-
C:\windows\system\OIJDOGH.exeC:\windows\system\OIJDOGH.exe105⤵
- Executes dropped EXE
PID:576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDIES.exe.bat" "106⤵PID:5288
-
C:\windows\NDIES.exeC:\windows\NDIES.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDQSBEY.exe.bat" "108⤵PID:4560
-
C:\windows\SysWOW64\SDQSBEY.exeC:\windows\system32\SDQSBEY.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EWTKKL.exe.bat" "110⤵PID:3060
-
C:\windows\SysWOW64\EWTKKL.exeC:\windows\system32\EWTKKL.exe111⤵
- Executes dropped EXE
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LOB.exe.bat" "112⤵PID:4300
-
C:\windows\system\LOB.exeC:\windows\system\LOB.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPVRB.exe.bat" "114⤵PID:236
-
C:\windows\SysWOW64\VPVRB.exeC:\windows\system32\VPVRB.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCAALUK.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:1100 -
C:\windows\SysWOW64\PCAALUK.exeC:\windows\system32\PCAALUK.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXF.exe.bat" "118⤵PID:2956
-
C:\windows\SysWOW64\KXF.exeC:\windows\system32\KXF.exe119⤵
- Executes dropped EXE
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VQICW.exe.bat" "120⤵PID:4396
-
C:\windows\system\VQICW.exeC:\windows\system\VQICW.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-