Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/11/2026, 19:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-31_e63a55d1a170a05b27fb0c8f0940207f_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-31_e63a55d1a170a05b27fb0c8f0940207f_elex_emotet_stop.exe
- Size 208KB
- Sample261101-xp6claev6m
- SHA256 5922257333117ad59681abf48e3869ff6ceb40df78e5b7e0875cd7015da2ad37
- MD5 e63a55d1a170a05b27fb0c8f0940207f
- SHA1 81d0d14b223a503f58cf03e5baeab16182e9ddea
- SHA512 04ae8d0c7164534ebf91fb08c8c6e6def1a611b361bd096a50497aa8fa16c0b8ba68f50435f80c2aeea44d5f9e5c75c9c3873f6539463500f35e8c46d1257b4f
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlEdL+LOfT4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlE5+LObkEj1
- TLSH T1DA247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3620 YQELVDT.exe 768 AEKCK.exe 1812 PULTRFY.exe 4136 TKSBVX.exe 3232 OXX.exe 4576 ODP.exe 244 QQUIR.exe 4276 FTL.exe 5548 AGQWM.exe 2436 JHKBYU.exe 3092 VZNUYBZ.exe 3416 TXGXTG.exe 3120 USK.exe 1508 ONPCJ.exe 4904 JBLULE.exe 4884 EOQ.exe 3452 ETQR.exe 2696 PJX.exe 2004 ZKZWM.exe 1200 TFEGXY.exe 4356 ZFMU.exe 1552 UTQLQ.exe 2812 FLTWY.exe 3780 GOX.exe 6028 ACCJO.exe 3872 KHMBEC.exe 944 GMK.exe 1396 BAPHV.exe 2864 BNPWX.exe 3324 HOXKGTV.exe 3292 PTP.exe 4784 YGZQXU.exe 4800 JZCJF.exe 1416 KUGF.exe 5772 YAMC.exe 3176 JSPVA.exe 2652 VLKFIY.exe 4052 MYVX.exe 5924 MEVMA.exe 1872 DRFEP.exe 4532 DXFSRR.exe 3068 LPG.exe 2332 UPIZI.exe 1980 AQQNRVA.exe 264 LITFZC.exe 5656 VRVK.exe 4596 KMEXOVS.exe 4868 KRE.exe 2820 BEPV.exe 4244 BKHK.exe 4720 CNL.exe 3252 BYT.exe 2672 DVNJ.exe 3856 JWUXXC.exe 5928 UOXQYK.exe 6060 YWEQK.exe 896 EXLDT.exe 1368 ZSQVDEN.exe 5316 QDPLDZI.exe 1948 HIZDS.exe 6128 SBUVBD.exe 5816 DTXOBKB.exe 4348 HJEON.exe 2464 NKLCE.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\MYVX.exe.bat VLKFIY.exe File opened for modification C:\windows\SysWOW64\LITFZC.exe AQQNRVA.exe File created C:\windows\SysWOW64\JWUXXC.exe DVNJ.exe File created C:\windows\SysWOW64\HJEON.exe.bat DTXOBKB.exe File created C:\windows\SysWOW64\JPLYI.exe.bat SBBGSZJ.exe File created C:\windows\SysWOW64\JULMK.exe JPLYI.exe File created C:\windows\SysWOW64\AEKCK.exe YQELVDT.exe File created C:\windows\SysWOW64\TKSBVX.exe.bat PULTRFY.exe File created C:\windows\SysWOW64\FTL.exe QQUIR.exe File opened for modification C:\windows\SysWOW64\JSPVA.exe YAMC.exe File created C:\windows\SysWOW64\VRVK.exe LITFZC.exe File created C:\windows\SysWOW64\DVNJ.exe.bat BYT.exe File opened for modification C:\windows\SysWOW64\QDPLDZI.exe ZSQVDEN.exe File opened for modification C:\windows\SysWOW64\OTIN.exe WQERPDE.exe File created C:\windows\SysWOW64\ACCJO.exe GOX.exe File created C:\windows\SysWOW64\KUGF.exe.bat JZCJF.exe File created C:\windows\SysWOW64\JSPVA.exe YAMC.exe File created C:\windows\SysWOW64\MYVX.exe VLKFIY.exe File opened for modification C:\windows\SysWOW64\JWUXXC.exe DVNJ.exe File opened for modification C:\windows\SysWOW64\JULMK.exe JPLYI.exe File created C:\windows\SysWOW64\OTIN.exe.bat WQERPDE.exe File created C:\windows\SysWOW64\VRVK.exe.bat LITFZC.exe File opened for modification C:\windows\SysWOW64\KMEXOVS.exe VRVK.exe File created C:\windows\SysWOW64\DVNJ.exe BYT.exe File opened for modification C:\windows\SysWOW64\YWEQK.exe UOXQYK.exe File created C:\windows\SysWOW64\YWEQK.exe.bat UOXQYK.exe File created C:\windows\SysWOW64\FTL.exe.bat QQUIR.exe File created C:\windows\SysWOW64\VZNUYBZ.exe.bat JHKBYU.exe File created C:\windows\SysWOW64\ETQR.exe EOQ.exe File created C:\windows\SysWOW64\JWUXXC.exe.bat DVNJ.exe File created C:\windows\SysWOW64\XNRLN.exe.bat ONPG.exe File created C:\windows\SysWOW64\GARJR.exe.bat JULMK.exe File created C:\windows\SysWOW64\BEPV.exe KRE.exe File opened for modification C:\windows\SysWOW64\DVNJ.exe BYT.exe File created C:\windows\SysWOW64\JPLYI.exe SBBGSZJ.exe File opened for modification C:\windows\SysWOW64\VZNUYBZ.exe JHKBYU.exe File opened for modification C:\windows\SysWOW64\ETQR.exe EOQ.exe File opened for modification C:\windows\SysWOW64\TFEGXY.exe ZKZWM.exe File created C:\windows\SysWOW64\TFEGXY.exe.bat ZKZWM.exe File created C:\windows\SysWOW64\YWEQK.exe UOXQYK.exe File created C:\windows\SysWOW64\HJEON.exe DTXOBKB.exe File opened for modification C:\windows\SysWOW64\HJEON.exe DTXOBKB.exe File created C:\windows\SysWOW64\TFEGXY.exe ZKZWM.exe File created C:\windows\SysWOW64\XNRLN.exe ONPG.exe File opened for modification C:\windows\SysWOW64\GARJR.exe JULMK.exe File opened for modification C:\windows\SysWOW64\AEKCK.exe YQELVDT.exe File created C:\windows\SysWOW64\TKSBVX.exe PULTRFY.exe File opened for modification C:\windows\SysWOW64\ZFMU.exe TFEGXY.exe File opened for modification C:\windows\SysWOW64\BNPWX.exe BAPHV.exe File created C:\windows\SysWOW64\UPIZI.exe.bat LPG.exe File created C:\windows\SysWOW64\KMEXOVS.exe.bat VRVK.exe File opened for modification C:\windows\SysWOW64\XNRLN.exe ONPG.exe File created C:\windows\SysWOW64\JULMK.exe.bat JPLYI.exe File opened for modification C:\windows\SysWOW64\BEPV.exe KRE.exe File created C:\windows\SysWOW64\QDPLDZI.exe.bat ZSQVDEN.exe File created C:\windows\SysWOW64\OTIN.exe WQERPDE.exe File opened for modification C:\windows\SysWOW64\ACCJO.exe GOX.exe File opened for modification C:\windows\SysWOW64\VRVK.exe LITFZC.exe File created C:\windows\SysWOW64\BEPV.exe.bat KRE.exe File created C:\windows\SysWOW64\QDPLDZI.exe ZSQVDEN.exe File opened for modification C:\windows\SysWOW64\TKSBVX.exe PULTRFY.exe File opened for modification C:\windows\SysWOW64\FTL.exe QQUIR.exe File created C:\windows\SysWOW64\JSPVA.exe.bat YAMC.exe File created C:\windows\SysWOW64\UPIZI.exe LPG.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\FLTWY.exe UTQLQ.exe File created C:\windows\JTHBP.exe.bat ZTFW.exe File opened for modification C:\windows\system\GOX.exe FLTWY.exe File created C:\windows\HOXKGTV.exe BNPWX.exe File created C:\windows\system\DRFEP.exe MEVMA.exe File opened for modification C:\windows\DXFSRR.exe DRFEP.exe File opened for modification C:\windows\ZSQVDEN.exe EXLDT.exe File created C:\windows\system\NKLCE.exe HJEON.exe File created C:\windows\system\JBLULE.exe.bat ONPCJ.exe File created C:\windows\system\ZKZWM.exe.bat PJX.exe File created C:\windows\JZCJF.exe YGZQXU.exe File created C:\windows\DXFSRR.exe.bat DRFEP.exe File created C:\windows\system\PULTRFY.exe.bat AEKCK.exe File created C:\windows\system\FLTWY.exe.bat UTQLQ.exe File created C:\windows\system\AQQNRVA.exe.bat UPIZI.exe File created C:\windows\HIZDS.exe QDPLDZI.exe File created C:\windows\DTXOBKB.exe.bat SBUVBD.exe File opened for modification C:\windows\system\ONPG.exe NKLCE.exe File created C:\windows\UOXQYK.exe.bat JWUXXC.exe File opened for modification C:\windows\system\ZKZWM.exe PJX.exe File created C:\windows\system\USK.exe TXGXTG.exe File created C:\windows\system\USK.exe.bat TXGXTG.exe File created C:\windows\system\YQELVDT.exe 2026-10-31_e63a55d1a170a05b27fb0c8f0940207f_elex_emotet_stop.exe File opened for modification C:\windows\OXX.exe TKSBVX.exe File created C:\windows\system\GMK.exe.bat KHMBEC.exe File created C:\windows\system\YAMC.exe.bat KUGF.exe File opened for modification C:\windows\JHKBYU.exe AGQWM.exe File created C:\windows\system\KHMBEC.exe ACCJO.exe File created C:\windows\system\MEVMA.exe MYVX.exe File created C:\windows\GVVF.exe.bat GARJR.exe File opened for modification C:\windows\ODP.exe OXX.exe File opened for modification C:\windows\system\FLTWY.exe UTQLQ.exe File created C:\windows\VLKFIY.exe JSPVA.exe File opened for modification C:\windows\system\USK.exe TXGXTG.exe File opened for modification C:\windows\QQUIR.exe ODP.exe File created C:\windows\HOXKGTV.exe.bat BNPWX.exe File created C:\windows\SBUVBD.exe.bat HIZDS.exe File created C:\windows\SBBGSZJ.exe.bat JTHBP.exe File opened for modification C:\windows\WQERPDE.exe GVVF.exe File created C:\windows\system\PULTRFY.exe AEKCK.exe File created C:\windows\system\JBLULE.exe ONPCJ.exe File opened for modification C:\windows\system\EOQ.exe JBLULE.exe File created C:\windows\system\GMK.exe KHMBEC.exe File opened for modification C:\windows\system\LPG.exe DXFSRR.exe File opened for modification C:\windows\SBUVBD.exe HIZDS.exe File created C:\windows\GVVF.exe GARJR.exe File created C:\windows\ODP.exe.bat OXX.exe File created C:\windows\system\EOQ.exe.bat JBLULE.exe File created C:\windows\YGZQXU.exe.bat PTP.exe File created C:\windows\DXFSRR.exe DRFEP.exe File created C:\windows\KRE.exe KMEXOVS.exe File created C:\windows\WQERPDE.exe.bat GVVF.exe File created C:\windows\system\TXGXTG.exe.bat VZNUYBZ.exe File created C:\windows\JHKBYU.exe.bat AGQWM.exe File created C:\windows\system\BAPHV.exe.bat GMK.exe File opened for modification C:\windows\JZCJF.exe YGZQXU.exe File created C:\windows\BYT.exe CNL.exe File opened for modification C:\windows\system\GMK.exe KHMBEC.exe File created C:\windows\JZCJF.exe.bat YGZQXU.exe File opened for modification C:\windows\system\YAMC.exe KUGF.exe File opened for modification C:\windows\system\MEVMA.exe MYVX.exe File opened for modification C:\windows\HOXKGTV.exe BNPWX.exe File opened for modification C:\windows\UOXQYK.exe JWUXXC.exe File created C:\windows\ZSQVDEN.exe EXLDT.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3720 cmd.exe 2908 cmd.exe 5336 cmd.exe 2744 cmd.exe 2140 cmd.exe 1776 cmd.exe 5648 cmd.exe 1548 cmd.exe 4284 cmd.exe 1936 cmd.exe 3224 cmd.exe 3172 cmd.exe 3756 cmd.exe 4788 cmd.exe 3196 cmd.exe 2484 cmd.exe 1164 cmd.exe 3012 cmd.exe 4636 cmd.exe 1740 cmd.exe 5344 cmd.exe 4820 cmd.exe 2736 cmd.exe 3360 cmd.exe 5320 cmd.exe 1336 cmd.exe 5952 cmd.exe 1880 cmd.exe 1984 cmd.exe 428 cmd.exe 1652 cmd.exe 1912 cmd.exe 5964 cmd.exe 864 cmd.exe 2500 cmd.exe 3492 cmd.exe 3296 cmd.exe 4940 cmd.exe 1556 cmd.exe 2200 cmd.exe 1752 cmd.exe 6076 cmd.exe 3796 cmd.exe 1084 cmd.exe 4548 cmd.exe 6008 cmd.exe 5052 cmd.exe 1468 cmd.exe 6032 cmd.exe 2728 cmd.exe 4180 cmd.exe 4528 cmd.exe 2816 cmd.exe 2868 cmd.exe 2424 cmd.exe 4872 cmd.exe 4848 cmd.exe 5340 cmd.exe 4968 cmd.exe 5824 cmd.exe 1568 cmd.exe 2712 cmd.exe 6000 cmd.exe 2028 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1500 1436 WerFault.exe 87 2744 3620 WerFault.exe 93 3920 768 WerFault.exe 99 348 1812 WerFault.exe 104 4248 4136 WerFault.exe 109 3676 3232 WerFault.exe 114 4364 4576 WerFault.exe 119 4912 244 WerFault.exe 124 2008 4276 WerFault.exe 129 1548 5548 WerFault.exe 134 260 2436 WerFault.exe 139 1364 3092 WerFault.exe 144 4860 3416 WerFault.exe 149 4800 3120 WerFault.exe 154 4924 1508 WerFault.exe 159 6096 4904 WerFault.exe 164 4292 4884 WerFault.exe 169 1868 3452 WerFault.exe 174 5584 2696 WerFault.exe 179 3508 2004 WerFault.exe 184 4468 1200 WerFault.exe 189 3132 4356 WerFault.exe 194 4784 1552 WerFault.exe 199 3832 2812 WerFault.exe 204 2712 3780 WerFault.exe 209 4640 6028 WerFault.exe 214 5928 3872 WerFault.exe 219 4928 944 WerFault.exe 224 1632 1396 WerFault.exe 229 5608 2864 WerFault.exe 234 2404 3324 WerFault.exe 239 4532 3292 WerFault.exe 244 200 4784 WerFault.exe 249 5016 4800 WerFault.exe 254 2076 1416 WerFault.exe 259 1116 5772 WerFault.exe 264 3552 3176 WerFault.exe 269 5332 2652 WerFault.exe 274 6112 4052 WerFault.exe 279 1968 5924 WerFault.exe 284 2828 1872 WerFault.exe 290 596 4532 WerFault.exe 295 6096 3068 WerFault.exe 300 4512 2332 WerFault.exe 305 2172 1980 WerFault.exe 310 6092 264 WerFault.exe 315 3812 5656 WerFault.exe 320 5308 4596 WerFault.exe 325 984 4868 WerFault.exe 330 5936 2820 WerFault.exe 335 2760 4244 WerFault.exe 340 4908 4720 WerFault.exe 345 3576 3252 WerFault.exe 350 5916 2672 WerFault.exe 355 5860 3856 WerFault.exe 360 1868 5928 WerFault.exe 365 1204 6060 WerFault.exe 370 252 896 WerFault.exe 375 5404 1368 WerFault.exe 380 3060 5316 WerFault.exe 385 3312 1948 WerFault.exe 390 4912 6128 WerFault.exe 394 4292 5816 WerFault.exe 400 3148 4348 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKHK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZKZWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNRLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YGZQXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VLKFIY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLTWY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ONPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ONPCJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMEXOVS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QDPLDZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-31_e63a55d1a170a05b27fb0c8f0940207f_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEKCK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JPLYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXGXTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KHMBEC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DTXOBKB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JBLULE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KRE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTHBP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EOQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIZDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZCJF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YAMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BYT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DVNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNZYWUD.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1436 2026-10-31_e63a55d1a170a05b27fb0c8f0940207f_elex_emotet_stop.exe 1436 2026-10-31_e63a55d1a170a05b27fb0c8f0940207f_elex_emotet_stop.exe 3620 YQELVDT.exe 3620 YQELVDT.exe 768 AEKCK.exe 768 AEKCK.exe 1812 PULTRFY.exe 1812 PULTRFY.exe 4136 TKSBVX.exe 4136 TKSBVX.exe 3232 OXX.exe 3232 OXX.exe 4576 ODP.exe 4576 ODP.exe 244 QQUIR.exe 244 QQUIR.exe 4276 FTL.exe 4276 FTL.exe 5548 AGQWM.exe 5548 AGQWM.exe 2436 JHKBYU.exe 2436 JHKBYU.exe 3092 VZNUYBZ.exe 3092 VZNUYBZ.exe 3416 TXGXTG.exe 3416 TXGXTG.exe 3120 USK.exe 3120 USK.exe 1508 ONPCJ.exe 1508 ONPCJ.exe 4904 JBLULE.exe 4904 JBLULE.exe 4884 EOQ.exe 4884 EOQ.exe 3452 ETQR.exe 3452 ETQR.exe 2696 PJX.exe 2696 PJX.exe 2004 ZKZWM.exe 2004 ZKZWM.exe 1200 TFEGXY.exe 1200 TFEGXY.exe 4356 ZFMU.exe 4356 ZFMU.exe 1552 UTQLQ.exe 1552 UTQLQ.exe 2812 FLTWY.exe 2812 FLTWY.exe 3780 GOX.exe 3780 GOX.exe 6028 ACCJO.exe 6028 ACCJO.exe 3872 KHMBEC.exe 3872 KHMBEC.exe 944 GMK.exe 944 GMK.exe 1396 BAPHV.exe 1396 BAPHV.exe 2864 BNPWX.exe 2864 BNPWX.exe 3324 HOXKGTV.exe 3324 HOXKGTV.exe 3292 PTP.exe 3292 PTP.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1436 2026-10-31_e63a55d1a170a05b27fb0c8f0940207f_elex_emotet_stop.exe 1436 2026-10-31_e63a55d1a170a05b27fb0c8f0940207f_elex_emotet_stop.exe 3620 YQELVDT.exe 3620 YQELVDT.exe 768 AEKCK.exe 768 AEKCK.exe 1812 PULTRFY.exe 1812 PULTRFY.exe 4136 TKSBVX.exe 4136 TKSBVX.exe 3232 OXX.exe 3232 OXX.exe 4576 ODP.exe 4576 ODP.exe 244 QQUIR.exe 244 QQUIR.exe 4276 FTL.exe 4276 FTL.exe 5548 AGQWM.exe 5548 AGQWM.exe 2436 JHKBYU.exe 2436 JHKBYU.exe 3092 VZNUYBZ.exe 3092 VZNUYBZ.exe 3416 TXGXTG.exe 3416 TXGXTG.exe 3120 USK.exe 3120 USK.exe 1508 ONPCJ.exe 1508 ONPCJ.exe 4904 JBLULE.exe 4904 JBLULE.exe 4884 EOQ.exe 4884 EOQ.exe 3452 ETQR.exe 3452 ETQR.exe 2696 PJX.exe 2696 PJX.exe 2004 ZKZWM.exe 2004 ZKZWM.exe 1200 TFEGXY.exe 1200 TFEGXY.exe 4356 ZFMU.exe 4356 ZFMU.exe 1552 UTQLQ.exe 1552 UTQLQ.exe 2812 FLTWY.exe 2812 FLTWY.exe 3780 GOX.exe 3780 GOX.exe 6028 ACCJO.exe 6028 ACCJO.exe 3872 KHMBEC.exe 3872 KHMBEC.exe 944 GMK.exe 944 GMK.exe 1396 BAPHV.exe 1396 BAPHV.exe 2864 BNPWX.exe 2864 BNPWX.exe 3324 HOXKGTV.exe 3324 HOXKGTV.exe 3292 PTP.exe 3292 PTP.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1436 wrote to memory of 1652 1436 2026-10-31_e63a55d1a170a05b27fb0c8f0940207f_elex_emotet_stop.exe 89 PID 1652 wrote to memory of 3620 1652 cmd.exe 93 PID 3620 wrote to memory of 1556 3620 YQELVDT.exe 95 PID 1556 wrote to memory of 768 1556 cmd.exe 99 PID 768 wrote to memory of 1568 768 AEKCK.exe 100 PID 1568 wrote to memory of 1812 1568 cmd.exe 104 PID 1812 wrote to memory of 4408 1812 PULTRFY.exe 105 PID 4408 wrote to memory of 4136 4408 cmd.exe 109 PID 4136 wrote to memory of 4788 4136 TKSBVX.exe 110 PID 4788 wrote to memory of 3232 4788 cmd.exe 114 PID 3232 wrote to memory of 3720 3232 OXX.exe 115 PID 3720 wrote to memory of 4576 3720 cmd.exe 119 PID 4576 wrote to memory of 2200 4576 ODP.exe 120 PID 2200 wrote to memory of 244 2200 cmd.exe 124 PID 244 wrote to memory of 2804 244 QQUIR.exe 125 PID 2804 wrote to memory of 4276 2804 cmd.exe 129 PID 4276 wrote to memory of 1912 4276 FTL.exe 130 PID 1912 wrote to memory of 5548 1912 cmd.exe 134 PID 5548 wrote to memory of 1752 5548 AGQWM.exe 135 PID 1752 wrote to memory of 2436 1752 cmd.exe 139 PID 2436 wrote to memory of 4940 2436 JHKBYU.exe 140 PID 4940 wrote to memory of 3092 4940 cmd.exe 144 PID 3092 wrote to memory of 3796 3092 VZNUYBZ.exe 145 PID 3796 wrote to memory of 3416 3796 cmd.exe 149 PID 3416 wrote to memory of 1844 3416 TXGXTG.exe 150 PID 1844 wrote to memory of 3120 1844 cmd.exe 154 PID 3120 wrote to memory of 3224 3120 USK.exe 155 PID 3224 wrote to memory of 1508 3224 cmd.exe 159 PID 1508 wrote to memory of 2728 1508 ONPCJ.exe 160 PID 2728 wrote to memory of 4904 2728 cmd.exe 164 PID 4904 wrote to memory of 5344 4904 JBLULE.exe 165 PID 5344 wrote to memory of 4884 5344 cmd.exe 169 PID 4884 wrote to memory of 2872 4884 EOQ.exe 170 PID 2872 wrote to memory of 3452 2872 cmd.exe 174 PID 3452 wrote to memory of 4180 3452 ETQR.exe 175 PID 4180 wrote to memory of 2696 4180 cmd.exe 179 PID 2696 wrote to memory of 4820 2696 PJX.exe 180 PID 4820 wrote to memory of 2004 4820 cmd.exe 184 PID 2004 wrote to memory of 2484 2004 ZKZWM.exe 185 PID 2484 wrote to memory of 1200 2484 cmd.exe 189 PID 1200 wrote to memory of 3188 1200 TFEGXY.exe 190 PID 3188 wrote to memory of 4356 3188 cmd.exe 194 PID 4356 wrote to memory of 2736 4356 ZFMU.exe 195 PID 2736 wrote to memory of 1552 2736 cmd.exe 199 PID 1552 wrote to memory of 1164 1552 UTQLQ.exe 200 PID 1164 wrote to memory of 2812 1164 cmd.exe 204 PID 2812 wrote to memory of 2908 2812 FLTWY.exe 205 PID 2908 wrote to memory of 3780 2908 cmd.exe 209 PID 3780 wrote to memory of 3172 3780 GOX.exe 210 PID 3172 wrote to memory of 6028 3172 cmd.exe 214 PID 6028 wrote to memory of 4528 6028 ACCJO.exe 215 PID 4528 wrote to memory of 3872 4528 cmd.exe 219 PID 3872 wrote to memory of 5336 3872 KHMBEC.exe 220 PID 5336 wrote to memory of 944 5336 cmd.exe 224 PID 944 wrote to memory of 5824 944 GMK.exe 225 PID 5824 wrote to memory of 1396 5824 cmd.exe 229 PID 1396 wrote to memory of 1548 1396 BAPHV.exe 230 PID 1548 wrote to memory of 2864 1548 cmd.exe 234 PID 2864 wrote to memory of 864 2864 BNPWX.exe 235 PID 864 wrote to memory of 3324 864 cmd.exe 239 PID 3324 wrote to memory of 2744 3324 HOXKGTV.exe 240 PID 2744 wrote to memory of 3292 2744 cmd.exe 244 PID 3292 wrote to memory of 1084 3292 PTP.exe 245 PID 1084 wrote to memory of 4784 1084 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-31_e63a55d1a170a05b27fb0c8f0940207f_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-31_e63a55d1a170a05b27fb0c8f0940207f_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQELVDT.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\windows\system\YQELVDT.exeC:\windows\system\YQELVDT.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AEKCK.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\windows\SysWOW64\AEKCK.exeC:\windows\system32\AEKCK.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PULTRFY.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\windows\system\PULTRFY.exeC:\windows\system\PULTRFY.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKSBVX.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\windows\SysWOW64\TKSBVX.exeC:\windows\system32\TKSBVX.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OXX.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\windows\OXX.exeC:\windows\OXX.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODP.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\windows\ODP.exeC:\windows\ODP.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QQUIR.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\windows\QQUIR.exeC:\windows\QQUIR.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FTL.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\windows\SysWOW64\FTL.exeC:\windows\system32\FTL.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AGQWM.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\windows\system\AGQWM.exeC:\windows\system\AGQWM.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JHKBYU.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\windows\JHKBYU.exeC:\windows\JHKBYU.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZNUYBZ.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\windows\SysWOW64\VZNUYBZ.exeC:\windows\system32\VZNUYBZ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TXGXTG.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\windows\system\TXGXTG.exeC:\windows\system\TXGXTG.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USK.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\windows\system\USK.exeC:\windows\system\USK.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ONPCJ.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\windows\ONPCJ.exeC:\windows\ONPCJ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBLULE.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\windows\system\JBLULE.exeC:\windows\system\JBLULE.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EOQ.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\windows\system\EOQ.exeC:\windows\system\EOQ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ETQR.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\windows\SysWOW64\ETQR.exeC:\windows\system32\ETQR.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJX.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\windows\system\PJX.exeC:\windows\system\PJX.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZKZWM.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\windows\system\ZKZWM.exeC:\windows\system\ZKZWM.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TFEGXY.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\windows\SysWOW64\TFEGXY.exeC:\windows\system32\TFEGXY.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZFMU.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\windows\SysWOW64\ZFMU.exeC:\windows\system32\ZFMU.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UTQLQ.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\windows\UTQLQ.exeC:\windows\UTQLQ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FLTWY.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\windows\system\FLTWY.exeC:\windows\system\FLTWY.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GOX.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\windows\system\GOX.exeC:\windows\system\GOX.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACCJO.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\windows\SysWOW64\ACCJO.exeC:\windows\system32\ACCJO.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KHMBEC.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\windows\system\KHMBEC.exeC:\windows\system\KHMBEC.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GMK.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\windows\system\GMK.exeC:\windows\system\GMK.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BAPHV.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\windows\system\BAPHV.exeC:\windows\system\BAPHV.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNPWX.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\windows\SysWOW64\BNPWX.exeC:\windows\system32\BNPWX.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HOXKGTV.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:864 -
C:\windows\HOXKGTV.exeC:\windows\HOXKGTV.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PTP.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\windows\system\PTP.exeC:\windows\system\PTP.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGZQXU.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\windows\YGZQXU.exeC:\windows\YGZQXU.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZCJF.exe.bat" "66⤵PID:6136
-
C:\windows\JZCJF.exeC:\windows\JZCJF.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUGF.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1336 -
C:\windows\SysWOW64\KUGF.exeC:\windows\system32\KUGF.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YAMC.exe.bat" "70⤵
- Executes a command shell one-liner
PID:2140 -
C:\windows\system\YAMC.exeC:\windows\system\YAMC.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSPVA.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4548 -
C:\windows\SysWOW64\JSPVA.exeC:\windows\system32\JSPVA.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VLKFIY.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4848 -
C:\windows\VLKFIY.exeC:\windows\VLKFIY.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MYVX.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4284 -
C:\windows\SysWOW64\MYVX.exeC:\windows\system32\MYVX.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEVMA.exe.bat" "78⤵PID:1284
-
C:\windows\system\MEVMA.exeC:\windows\system\MEVMA.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DRFEP.exe.bat" "80⤵PID:2740
-
C:\windows\system\DRFEP.exeC:\windows\system\DRFEP.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DXFSRR.exe.bat" "82⤵
- Executes a command shell one-liner
PID:5340 -
C:\windows\DXFSRR.exeC:\windows\DXFSRR.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LPG.exe.bat" "84⤵
- Executes a command shell one-liner
PID:6008 -
C:\windows\system\LPG.exeC:\windows\system\LPG.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UPIZI.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2712 -
C:\windows\SysWOW64\UPIZI.exeC:\windows\system32\UPIZI.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQQNRVA.exe.bat" "88⤵
- Executes a command shell one-liner
PID:6000 -
C:\windows\system\AQQNRVA.exeC:\windows\system\AQQNRVA.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LITFZC.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2448 -
C:\windows\SysWOW64\LITFZC.exeC:\windows\system32\LITFZC.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRVK.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5052 -
C:\windows\SysWOW64\VRVK.exeC:\windows\system32\VRVK.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMEXOVS.exe.bat" "94⤵
- Executes a command shell one-liner
PID:1776 -
C:\windows\SysWOW64\KMEXOVS.exeC:\windows\system32\KMEXOVS.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KRE.exe.bat" "96⤵
- Executes a command shell one-liner
PID:5648 -
C:\windows\KRE.exeC:\windows\KRE.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEPV.exe.bat" "98⤵
- Executes a command shell one-liner
PID:6076 -
C:\windows\SysWOW64\BEPV.exeC:\windows\system32\BEPV.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKHK.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2500 -
C:\windows\BKHK.exeC:\windows\BKHK.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNL.exe.bat" "102⤵
- Executes a command shell one-liner
PID:2816 -
C:\windows\CNL.exeC:\windows\CNL.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BYT.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3756 -
C:\windows\BYT.exeC:\windows\BYT.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DVNJ.exe.bat" "106⤵
- Executes a command shell one-liner
PID:1936 -
C:\windows\SysWOW64\DVNJ.exeC:\windows\system32\DVNJ.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JWUXXC.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5952 -
C:\windows\SysWOW64\JWUXXC.exeC:\windows\system32\JWUXXC.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UOXQYK.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5964 -
C:\windows\UOXQYK.exeC:\windows\UOXQYK.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YWEQK.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3492 -
C:\windows\SysWOW64\YWEQK.exeC:\windows\system32\YWEQK.exe113⤵
- Executes dropped EXE
PID:6060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXLDT.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2868 -
C:\windows\system\EXLDT.exeC:\windows\system\EXLDT.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSQVDEN.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1880 -
C:\windows\ZSQVDEN.exeC:\windows\ZSQVDEN.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QDPLDZI.exe.bat" "118⤵
- Executes a command shell one-liner
PID:4968 -
C:\windows\SysWOW64\QDPLDZI.exeC:\windows\system32\QDPLDZI.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIZDS.exe.bat" "120⤵
- Executes a command shell one-liner
PID:3296 -
C:\windows\HIZDS.exeC:\windows\HIZDS.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-