Analysis
- max time kernel
95s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 01:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_fccd1980a1cf8ec32c947983a9350325_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-11-01_fccd1980a1cf8ec32c947983a9350325_elex_emotet_stop.exe
- Size 208KB
- Sample261102-b7r22aztht
- SHA256 ae552bbc6e890e999fa4b7901e5d806c1ca2929d0a27360fc8362a2beecb4004
- MD5 fccd1980a1cf8ec32c947983a9350325
- SHA1 40518e216b639f13b0a95e586b28bfff4a118eac
- SHA512 65c6ead4b47d1300ef28ade7768b506b10af1425a13188947a500aacc2f1a6311ebb26ef56ddfff464f1f0c7c6fa469167786abb2ec5be366d60bc1d2939e395
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfL4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOTkEj1
- TLSH T1A8247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5896 KNMLJ.exe 1536 ZDZCZUW.exe 2612 RDBI.exe 6052 NJH.exe 3044 CERJDO.exe 5056 VHUFI.exe 6096 VNVTKR.exe 1976 KQEF.exe 4516 CQGLG.exe 3448 UTKG.exe 1776 ATRU.exe 5852 JUTHGZU.exe 4700 VMWAGGK.exe 5948 KHGEZ.exe 5180 SVYTB.exe 4276 MIDCLFC.exe 1040 SIKQ.exe 1100 EBNJCP.exe 4212 JBV.exe 4324 EOAGW.exe 824 ZCFPYR.exe 5360 FCMD.exe 4708 FQFR.exe 3352 QIIKZG.exe 5624 KWMTBFF.exe 4128 FJRD.exe 2992 JZYLYXI.exe 5936 ECGCM.exe 2352 ZPLLWA.exe 3776 TKQ.exe 4216 DLSH.exe 5408 UTU.exe 3880 JODRYY.exe 1388 JTDFAC.exe 5604 GZJCPM.exe 5364 AMG.exe 5996 JAREHJ.exe 3724 ZQADOEQ.exe 5764 KIV.exe 5648 BVFGEI.exe 1428 BBFVNVW.exe 1524 WOK.exe 4444 HHFXY.exe 3496 CUKGIC.exe 252 YAQDPM.exe 2124 NVZI.exe 4904 IIEZKZ.exe 1548 TBHKSOO.exe 2604 LJJ.exe 1528 JJQLFO.exe 564 LHKFLC.exe 2156 QHR.exe 2616 LVWCF.exe 3320 WNZV.exe 6132 RBEEXM.exe 108 DRLMBE.exe 5052 JRSASY.exe 5580 DHLURV.exe 3188 ZMR.exe 5752 KFUK.exe 3916 OVBKSXM.exe 5264 WFBLGJB.exe 5400 FOD.exe 960 ABIAU.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\YAQDPM.exe.bat CUKGIC.exe File created C:\windows\SysWOW64\INGTWD.exe.bat DMEJS.exe File created C:\windows\SysWOW64\KNMLJ.exe.bat 2026-11-01_fccd1980a1cf8ec32c947983a9350325_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\ZDZCZUW.exe KNMLJ.exe File created C:\windows\SysWOW64\KSHDAX.exe QFCT.exe File opened for modification C:\windows\SysWOW64\IXMDE.exe OJH.exe File created C:\windows\SysWOW64\BVFGEI.exe.bat KIV.exe File created C:\windows\SysWOW64\LJJ.exe TBHKSOO.exe File created C:\windows\SysWOW64\LVWCF.exe QHR.exe File created C:\windows\SysWOW64\WFBLGJB.exe OVBKSXM.exe File created C:\windows\SysWOW64\IXMDE.exe OJH.exe File created C:\windows\SysWOW64\JUTHGZU.exe.bat ATRU.exe File opened for modification C:\windows\SysWOW64\JUTHGZU.exe ATRU.exe File created C:\windows\SysWOW64\ZQADOEQ.exe JAREHJ.exe File created C:\windows\SysWOW64\WNZV.exe LVWCF.exe File opened for modification C:\windows\SysWOW64\JRSASY.exe DRLMBE.exe File created C:\windows\SysWOW64\YBHJEWX.exe.bat MIEZW.exe File created C:\windows\SysWOW64\OMUQGZ.exe ZJL.exe File opened for modification C:\windows\SysWOW64\QIIKZG.exe FQFR.exe File opened for modification C:\windows\SysWOW64\JAN.exe OPXKC.exe File created C:\windows\SysWOW64\HOC.exe.bat TDT.exe File created C:\windows\SysWOW64\KNMLJ.exe 2026-11-01_fccd1980a1cf8ec32c947983a9350325_elex_emotet_stop.exe File created C:\windows\SysWOW64\OFWQ.exe PVTAT.exe File created C:\windows\SysWOW64\OFWQ.exe.bat PVTAT.exe File opened for modification C:\windows\SysWOW64\KNMLJ.exe 2026-11-01_fccd1980a1cf8ec32c947983a9350325_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\JZYLYXI.exe FJRD.exe File created C:\windows\SysWOW64\XMOLCDO.exe.bat GBQODIT.exe File opened for modification C:\windows\SysWOW64\CTATQD.exe JYWQ.exe File created C:\windows\SysWOW64\NJH.exe RDBI.exe File created C:\windows\SysWOW64\QIIKZG.exe.bat FQFR.exe File created C:\windows\SysWOW64\TKQ.exe ZPLLWA.exe File created C:\windows\SysWOW64\INGTWD.exe DMEJS.exe File opened for modification C:\windows\SysWOW64\KIGRI.exe LXDBZL.exe File opened for modification C:\windows\SysWOW64\CLKNNPP.exe KIGRI.exe File created C:\windows\SysWOW64\CUKGIC.exe HHFXY.exe File created C:\windows\SysWOW64\DRLMBE.exe RBEEXM.exe File created C:\windows\SysWOW64\PPUEVDP.exe PJUQUY.exe File opened for modification C:\windows\SysWOW64\OMUQGZ.exe ZJL.exe File opened for modification C:\windows\SysWOW64\EOAGW.exe JBV.exe File created C:\windows\SysWOW64\JJQLFO.exe LJJ.exe File created C:\windows\SysWOW64\WNZV.exe.bat LVWCF.exe File opened for modification C:\windows\SysWOW64\MIEZW.exe SVZH.exe File created C:\windows\SysWOW64\JAN.exe OPXKC.exe File created C:\windows\SysWOW64\LXDBZL.exe.bat BAPH.exe File created C:\windows\SysWOW64\KIGRI.exe.bat LXDBZL.exe File created C:\windows\SysWOW64\CERJDO.exe.bat NJH.exe File created C:\windows\SysWOW64\YAQDPM.exe CUKGIC.exe File created C:\windows\SysWOW64\XMOLCDO.exe GBQODIT.exe File opened for modification C:\windows\SysWOW64\XMOLCDO.exe GBQODIT.exe File opened for modification C:\windows\SysWOW64\PPUEVDP.exe PJUQUY.exe File opened for modification C:\windows\SysWOW64\SQOUTZ.exe YDJK.exe File created C:\windows\SysWOW64\CLKNNPP.exe.bat KIGRI.exe File created C:\windows\SysWOW64\CUKGIC.exe.bat HHFXY.exe File created C:\windows\SysWOW64\WFBLGJB.exe.bat OVBKSXM.exe File created C:\windows\SysWOW64\SQOUTZ.exe.bat YDJK.exe File created C:\windows\SysWOW64\LXDBZL.exe BAPH.exe File created C:\windows\SysWOW64\ZDZCZUW.exe KNMLJ.exe File opened for modification C:\windows\SysWOW64\LJJ.exe TBHKSOO.exe File created C:\windows\SysWOW64\LJJ.exe.bat TBHKSOO.exe File opened for modification C:\windows\SysWOW64\WNZV.exe LVWCF.exe File opened for modification C:\windows\SysWOW64\INGTWD.exe DMEJS.exe File created C:\windows\SysWOW64\KHGEZ.exe.bat VMWAGGK.exe File opened for modification C:\windows\SysWOW64\QFCT.exe MWWTMMY.exe File created C:\windows\SysWOW64\CERJDO.exe NJH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\KWMTBFF.exe QIIKZG.exe File opened for modification C:\windows\system\JAREHJ.exe AMG.exe File opened for modification C:\windows\system\BBFVNVW.exe BVFGEI.exe File created C:\windows\system\QHR.exe.bat LHKFLC.exe File created C:\windows\system\FOD.exe WFBLGJB.exe File created C:\windows\system\UICBQ.exe OIV.exe File created C:\windows\WGV.exe SQOUTZ.exe File created C:\windows\ZARD.exe.bat FNM.exe File created C:\windows\system\OJH.exe.bat CTATQD.exe File created C:\windows\CQGLG.exe.bat KQEF.exe File created C:\windows\ATRU.exe UTKG.exe File opened for modification C:\windows\system\FOD.exe WFBLGJB.exe File created C:\windows\OVBKSXM.exe KFUK.exe File created C:\windows\TSCIO.exe.bat NXDH.exe File created C:\windows\XBQQ.exe UOZ.exe File created C:\windows\system\VMWAGGK.exe.bat JUTHGZU.exe File opened for modification C:\windows\system\JTDFAC.exe JODRYY.exe File opened for modification C:\windows\system\ONNHNF.exe INGTWD.exe File created C:\windows\MWWTMMY.exe WGV.exe File created C:\windows\system\TBHKSOO.exe IIEZKZ.exe File created C:\windows\PJUQUY.exe JJMC.exe File opened for modification C:\windows\system\CDREWPQ.exe JAN.exe File opened for modification C:\windows\TDT.exe CDREWPQ.exe File created C:\windows\system\JHV.exe DGNQTF.exe File created C:\windows\system\HXVUBWP.exe NJRKQ.exe File created C:\windows\MWWTMMY.exe.bat WGV.exe File created C:\windows\LHKFLC.exe JJQLFO.exe File created C:\windows\system\VNVTKR.exe VHUFI.exe File created C:\windows\JBV.exe EBNJCP.exe File created C:\windows\JBV.exe.bat EBNJCP.exe File created C:\windows\system\JODRYY.exe.bat UTU.exe File created C:\windows\system\JYWQ.exe ZARD.exe File created C:\windows\KWMTBFF.exe QIIKZG.exe File created C:\windows\system\DLSH.exe TKQ.exe File created C:\windows\GZJCPM.exe JTDFAC.exe File created C:\windows\system\AAJ.exe.bat CEKNDVD.exe File created C:\windows\system\NXKEOZ.exe JHV.exe File created C:\windows\system\OIV.exe.bat INWNCZR.exe File created C:\windows\NXDH.exe.bat HXVUBWP.exe File opened for modification C:\windows\system\FQFR.exe FCMD.exe File created C:\windows\system\BBFVNVW.exe.bat BVFGEI.exe File created C:\windows\system\OPXKC.exe VUT.exe File created C:\windows\MIDCLFC.exe SVYTB.exe File created C:\windows\system\AMG.exe GZJCPM.exe File created C:\windows\system\IIEZKZ.exe.bat NVZI.exe File created C:\windows\system\JJMC.exe.bat PWHTAWF.exe File created C:\windows\system\UOZ.exe SQLU.exe File opened for modification C:\windows\system\JHV.exe DGNQTF.exe File created C:\windows\system\VMWAGGK.exe JUTHGZU.exe File created C:\windows\system\QHR.exe LHKFLC.exe File created C:\windows\FNM.exe KSHDAX.exe File created C:\windows\system\ECGCM.exe.bat JZYLYXI.exe File created C:\windows\system\JJMC.exe PWHTAWF.exe File opened for modification C:\windows\XBQQ.exe UOZ.exe File created C:\windows\YDJK.exe OFWQ.exe File opened for modification C:\windows\RDBI.exe ZDZCZUW.exe File created C:\windows\HHFXY.exe.bat WOK.exe File created C:\windows\DMEJS.exe.bat WRUEHMC.exe File created C:\windows\system\CDREWPQ.exe.bat JAN.exe File created C:\windows\system\AMG.exe.bat GZJCPM.exe File created C:\windows\NXDH.exe HXVUBWP.exe File created C:\windows\system\VBEEAU.exe.bat TDDJCFU.exe File created C:\windows\system\DLSH.exe.bat TKQ.exe File created C:\windows\system\CNLDVND.exe NXKEOZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2864 cmd.exe 1400 cmd.exe 2364 cmd.exe 420 cmd.exe 552 cmd.exe 3860 cmd.exe 1676 cmd.exe 2256 cmd.exe 812 cmd.exe 5436 cmd.exe 712 cmd.exe 6128 cmd.exe 5308 cmd.exe 6140 cmd.exe 3280 cmd.exe 1772 cmd.exe 2308 cmd.exe 2488 cmd.exe 1968 cmd.exe 3536 cmd.exe 1556 cmd.exe 4684 cmd.exe 6024 cmd.exe 4704 cmd.exe 2144 cmd.exe 4280 cmd.exe 4652 cmd.exe 1540 cmd.exe 6028 cmd.exe 1248 cmd.exe 5808 cmd.exe 2172 cmd.exe 1640 cmd.exe 4316 cmd.exe 4772 cmd.exe 2412 cmd.exe 5676 cmd.exe 3932 cmd.exe 1724 cmd.exe 5696 cmd.exe 5156 cmd.exe 5836 cmd.exe 3156 cmd.exe 1476 cmd.exe 4680 cmd.exe 5968 cmd.exe 2668 cmd.exe 4264 cmd.exe 4088 cmd.exe 4856 cmd.exe 4980 cmd.exe 4564 cmd.exe 4208 cmd.exe 2032 cmd.exe 4896 cmd.exe 5128 cmd.exe 3216 cmd.exe 4696 cmd.exe 2652 cmd.exe 4228 cmd.exe 1004 cmd.exe 4148 cmd.exe 1712 cmd.exe 3568 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5324 480 WerFault.exe 87 4676 5896 WerFault.exe 93 5928 1536 WerFault.exe 99 2964 2612 WerFault.exe 104 4276 6052 WerFault.exe 109 5640 3044 WerFault.exe 114 3404 5056 WerFault.exe 119 2312 6096 WerFault.exe 124 1240 1976 WerFault.exe 129 4552 4516 WerFault.exe 134 1772 3448 WerFault.exe 139 3816 1776 WerFault.exe 144 3860 5852 WerFault.exe 149 1884 4700 WerFault.exe 154 3488 5948 WerFault.exe 159 4304 5180 WerFault.exe 164 2916 4276 WerFault.exe 169 4644 1040 WerFault.exe 174 3668 1100 WerFault.exe 179 4844 4212 WerFault.exe 184 4256 4324 WerFault.exe 189 1028 824 WerFault.exe 194 5380 5360 WerFault.exe 199 4948 4708 WerFault.exe 204 2124 3352 WerFault.exe 209 3812 5624 WerFault.exe 214 4220 4128 WerFault.exe 219 1232 2992 WerFault.exe 224 2148 5936 WerFault.exe 229 4868 2352 WerFault.exe 234 1880 3776 WerFault.exe 239 5264 4216 WerFault.exe 244 4812 5408 WerFault.exe 249 3432 3880 WerFault.exe 254 2320 1388 WerFault.exe 259 2728 5604 WerFault.exe 264 1284 5364 WerFault.exe 269 832 5996 WerFault.exe 274 5884 3724 WerFault.exe 279 2988 5764 WerFault.exe 284 4580 5648 WerFault.exe 290 4468 1428 WerFault.exe 295 4076 1524 WerFault.exe 300 2472 4444 WerFault.exe 305 716 3496 WerFault.exe 310 52 252 WerFault.exe 315 3812 2124 WerFault.exe 320 4220 4904 WerFault.exe 325 2644 1548 WerFault.exe 330 4312 2604 WerFault.exe 335 2928 1528 WerFault.exe 340 5972 564 WerFault.exe 345 2876 2156 WerFault.exe 350 904 2616 WerFault.exe 355 960 3320 WerFault.exe 360 4972 6132 WerFault.exe 365 404 108 WerFault.exe 370 2020 5052 WerFault.exe 375 1320 5580 WerFault.exe 380 4460 3188 WerFault.exe 385 3388 5752 WerFault.exe 390 5012 3916 WerFault.exe 395 2804 5264 WerFault.exe 400 3888 5400 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VHUFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQADOEQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JRSASY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FQFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DHLURV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXMDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JODRYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OAZDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJUQUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIGRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUKGIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSCIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVWCF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INGTWD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXDBZL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJRKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZRFDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLSH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDREWPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PVTAT.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 480 2026-11-01_fccd1980a1cf8ec32c947983a9350325_elex_emotet_stop.exe 480 2026-11-01_fccd1980a1cf8ec32c947983a9350325_elex_emotet_stop.exe 5896 KNMLJ.exe 5896 KNMLJ.exe 1536 ZDZCZUW.exe 1536 ZDZCZUW.exe 2612 RDBI.exe 2612 RDBI.exe 6052 NJH.exe 6052 NJH.exe 3044 CERJDO.exe 3044 CERJDO.exe 5056 VHUFI.exe 5056 VHUFI.exe 6096 VNVTKR.exe 6096 VNVTKR.exe 1976 KQEF.exe 1976 KQEF.exe 4516 CQGLG.exe 4516 CQGLG.exe 3448 UTKG.exe 3448 UTKG.exe 1776 ATRU.exe 1776 ATRU.exe 5852 JUTHGZU.exe 5852 JUTHGZU.exe 4700 VMWAGGK.exe 4700 VMWAGGK.exe 5948 KHGEZ.exe 5948 KHGEZ.exe 5180 SVYTB.exe 5180 SVYTB.exe 4276 MIDCLFC.exe 4276 MIDCLFC.exe 1040 SIKQ.exe 1040 SIKQ.exe 1100 EBNJCP.exe 1100 EBNJCP.exe 4212 JBV.exe 4212 JBV.exe 4324 EOAGW.exe 4324 EOAGW.exe 824 ZCFPYR.exe 824 ZCFPYR.exe 5360 FCMD.exe 5360 FCMD.exe 4708 FQFR.exe 4708 FQFR.exe 3352 QIIKZG.exe 3352 QIIKZG.exe 5624 KWMTBFF.exe 5624 KWMTBFF.exe 4128 FJRD.exe 4128 FJRD.exe 2992 JZYLYXI.exe 2992 JZYLYXI.exe 5936 ECGCM.exe 5936 ECGCM.exe 2352 ZPLLWA.exe 2352 ZPLLWA.exe 3776 TKQ.exe 3776 TKQ.exe 4216 DLSH.exe 4216 DLSH.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 480 2026-11-01_fccd1980a1cf8ec32c947983a9350325_elex_emotet_stop.exe 480 2026-11-01_fccd1980a1cf8ec32c947983a9350325_elex_emotet_stop.exe 5896 KNMLJ.exe 5896 KNMLJ.exe 1536 ZDZCZUW.exe 1536 ZDZCZUW.exe 2612 RDBI.exe 2612 RDBI.exe 6052 NJH.exe 6052 NJH.exe 3044 CERJDO.exe 3044 CERJDO.exe 5056 VHUFI.exe 5056 VHUFI.exe 6096 VNVTKR.exe 6096 VNVTKR.exe 1976 KQEF.exe 1976 KQEF.exe 4516 CQGLG.exe 4516 CQGLG.exe 3448 UTKG.exe 3448 UTKG.exe 1776 ATRU.exe 1776 ATRU.exe 5852 JUTHGZU.exe 5852 JUTHGZU.exe 4700 VMWAGGK.exe 4700 VMWAGGK.exe 5948 KHGEZ.exe 5948 KHGEZ.exe 5180 SVYTB.exe 5180 SVYTB.exe 4276 MIDCLFC.exe 4276 MIDCLFC.exe 1040 SIKQ.exe 1040 SIKQ.exe 1100 EBNJCP.exe 1100 EBNJCP.exe 4212 JBV.exe 4212 JBV.exe 4324 EOAGW.exe 4324 EOAGW.exe 824 ZCFPYR.exe 824 ZCFPYR.exe 5360 FCMD.exe 5360 FCMD.exe 4708 FQFR.exe 4708 FQFR.exe 3352 QIIKZG.exe 3352 QIIKZG.exe 5624 KWMTBFF.exe 5624 KWMTBFF.exe 4128 FJRD.exe 4128 FJRD.exe 2992 JZYLYXI.exe 2992 JZYLYXI.exe 5936 ECGCM.exe 5936 ECGCM.exe 2352 ZPLLWA.exe 2352 ZPLLWA.exe 3776 TKQ.exe 3776 TKQ.exe 4216 DLSH.exe 4216 DLSH.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 480 wrote to memory of 4652 480 2026-11-01_fccd1980a1cf8ec32c947983a9350325_elex_emotet_stop.exe 89 PID 4652 wrote to memory of 5896 4652 cmd.exe 93 PID 5896 wrote to memory of 5208 5896 KNMLJ.exe 95 PID 5208 wrote to memory of 1536 5208 cmd.exe 99 PID 1536 wrote to memory of 2516 1536 ZDZCZUW.exe 100 PID 2516 wrote to memory of 2612 2516 cmd.exe 104 PID 2612 wrote to memory of 4288 2612 RDBI.exe 105 PID 4288 wrote to memory of 6052 4288 cmd.exe 109 PID 6052 wrote to memory of 6140 6052 NJH.exe 110 PID 6140 wrote to memory of 3044 6140 cmd.exe 114 PID 3044 wrote to memory of 5536 3044 CERJDO.exe 115 PID 5536 wrote to memory of 5056 5536 cmd.exe 119 PID 5056 wrote to memory of 4684 5056 VHUFI.exe 120 PID 4684 wrote to memory of 6096 4684 cmd.exe 124 PID 6096 wrote to memory of 4980 6096 VNVTKR.exe 125 PID 4980 wrote to memory of 1976 4980 cmd.exe 129 PID 1976 wrote to memory of 2256 1976 KQEF.exe 130 PID 2256 wrote to memory of 4516 2256 cmd.exe 134 PID 4516 wrote to memory of 4204 4516 CQGLG.exe 135 PID 4204 wrote to memory of 3448 4204 cmd.exe 139 PID 3448 wrote to memory of 4896 3448 UTKG.exe 140 PID 4896 wrote to memory of 1776 4896 cmd.exe 144 PID 1776 wrote to memory of 5968 1776 ATRU.exe 145 PID 5968 wrote to memory of 5852 5968 cmd.exe 149 PID 5852 wrote to memory of 2668 5852 JUTHGZU.exe 150 PID 2668 wrote to memory of 4700 2668 cmd.exe 154 PID 4700 wrote to memory of 3696 4700 VMWAGGK.exe 155 PID 3696 wrote to memory of 5948 3696 cmd.exe 159 PID 5948 wrote to memory of 2896 5948 KHGEZ.exe 160 PID 2896 wrote to memory of 5180 2896 cmd.exe 164 PID 5180 wrote to memory of 4772 5180 SVYTB.exe 165 PID 4772 wrote to memory of 4276 4772 cmd.exe 169 PID 4276 wrote to memory of 1540 4276 MIDCLFC.exe 170 PID 1540 wrote to memory of 1040 1540 cmd.exe 174 PID 1040 wrote to memory of 4940 1040 SIKQ.exe 175 PID 4940 wrote to memory of 1100 4940 cmd.exe 179 PID 1100 wrote to memory of 5112 1100 EBNJCP.exe 180 PID 5112 wrote to memory of 4212 5112 cmd.exe 184 PID 4212 wrote to memory of 4732 4212 JBV.exe 185 PID 4732 wrote to memory of 4324 4732 cmd.exe 189 PID 4324 wrote to memory of 6028 4324 EOAGW.exe 190 PID 6028 wrote to memory of 824 6028 cmd.exe 194 PID 824 wrote to memory of 5696 824 ZCFPYR.exe 195 PID 5360 wrote to memory of 2300 5360 FCMD.exe 200 PID 2300 wrote to memory of 4708 2300 cmd.exe 204 PID 4708 wrote to memory of 3212 4708 FQFR.exe 205 PID 3212 wrote to memory of 3352 3212 cmd.exe 209 PID 3352 wrote to memory of 2412 3352 QIIKZG.exe 210 PID 2412 wrote to memory of 5624 2412 cmd.exe 214 PID 5624 wrote to memory of 1004 5624 KWMTBFF.exe 215 PID 1004 wrote to memory of 4128 1004 cmd.exe 219 PID 4128 wrote to memory of 5872 4128 FJRD.exe 220 PID 5872 wrote to memory of 2992 5872 cmd.exe 224 PID 2992 wrote to memory of 1660 2992 JZYLYXI.exe 225 PID 1660 wrote to memory of 5936 1660 cmd.exe 229 PID 5936 wrote to memory of 4264 5936 ECGCM.exe 230 PID 4264 wrote to memory of 2352 4264 cmd.exe 234 PID 2352 wrote to memory of 812 2352 ZPLLWA.exe 235 PID 812 wrote to memory of 3776 812 cmd.exe 239 PID 3776 wrote to memory of 4152 3776 TKQ.exe 240 PID 4152 wrote to memory of 4216 4152 cmd.exe 244 PID 4216 wrote to memory of 5824 4216 DLSH.exe 245 PID 5824 wrote to memory of 5408 5824 cmd.exe 249 PID 5408 wrote to memory of 5124 5408 UTU.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_fccd1980a1cf8ec32c947983a9350325_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_fccd1980a1cf8ec32c947983a9350325_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNMLJ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\windows\SysWOW64\KNMLJ.exeC:\windows\system32\KNMLJ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDZCZUW.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\windows\SysWOW64\ZDZCZUW.exeC:\windows\system32\ZDZCZUW.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDBI.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\windows\RDBI.exeC:\windows\RDBI.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJH.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\windows\SysWOW64\NJH.exeC:\windows\system32\NJH.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CERJDO.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\windows\SysWOW64\CERJDO.exeC:\windows\system32\CERJDO.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VHUFI.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\windows\VHUFI.exeC:\windows\VHUFI.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VNVTKR.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\windows\system\VNVTKR.exeC:\windows\system\VNVTKR.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KQEF.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\windows\KQEF.exeC:\windows\KQEF.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CQGLG.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\windows\CQGLG.exeC:\windows\CQGLG.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTKG.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\windows\system\UTKG.exeC:\windows\system\UTKG.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ATRU.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\windows\ATRU.exeC:\windows\ATRU.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUTHGZU.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\windows\SysWOW64\JUTHGZU.exeC:\windows\system32\JUTHGZU.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMWAGGK.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\windows\system\VMWAGGK.exeC:\windows\system\VMWAGGK.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KHGEZ.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\windows\SysWOW64\KHGEZ.exeC:\windows\system32\KHGEZ.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVYTB.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\windows\SysWOW64\SVYTB.exeC:\windows\system32\SVYTB.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MIDCLFC.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\windows\MIDCLFC.exeC:\windows\MIDCLFC.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SIKQ.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\windows\system\SIKQ.exeC:\windows\system\SIKQ.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EBNJCP.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\windows\SysWOW64\EBNJCP.exeC:\windows\system32\EBNJCP.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JBV.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\windows\JBV.exeC:\windows\JBV.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EOAGW.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\windows\SysWOW64\EOAGW.exeC:\windows\system32\EOAGW.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZCFPYR.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\windows\system\ZCFPYR.exeC:\windows\system\ZCFPYR.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FCMD.exe.bat" "44⤵
- Executes a command shell one-liner
PID:5696 -
C:\windows\system\FCMD.exeC:\windows\system\FCMD.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQFR.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\windows\system\FQFR.exeC:\windows\system\FQFR.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QIIKZG.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\windows\SysWOW64\QIIKZG.exeC:\windows\system32\QIIKZG.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KWMTBFF.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\windows\KWMTBFF.exeC:\windows\KWMTBFF.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJRD.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\windows\FJRD.exeC:\windows\FJRD.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JZYLYXI.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\windows\SysWOW64\JZYLYXI.exeC:\windows\system32\JZYLYXI.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECGCM.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\windows\system\ECGCM.exeC:\windows\system\ECGCM.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPLLWA.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\windows\ZPLLWA.exeC:\windows\ZPLLWA.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKQ.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:812 -
C:\windows\SysWOW64\TKQ.exeC:\windows\system32\TKQ.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLSH.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\windows\system\DLSH.exeC:\windows\system\DLSH.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTU.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\windows\system\UTU.exeC:\windows\system\UTU.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JODRYY.exe.bat" "66⤵PID:5124
-
C:\windows\system\JODRYY.exeC:\windows\system\JODRYY.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JTDFAC.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:692 -
C:\windows\system\JTDFAC.exeC:\windows\system\JTDFAC.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZJCPM.exe.bat" "70⤵PID:3032
-
C:\windows\GZJCPM.exeC:\windows\GZJCPM.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMG.exe.bat" "72⤵PID:4224
-
C:\windows\system\AMG.exeC:\windows\system\AMG.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JAREHJ.exe.bat" "74⤵PID:4528
-
C:\windows\system\JAREHJ.exeC:\windows\system\JAREHJ.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQADOEQ.exe.bat" "76⤵PID:3736
-
C:\windows\SysWOW64\ZQADOEQ.exeC:\windows\system32\ZQADOEQ.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIV.exe.bat" "78⤵PID:3096
-
C:\windows\KIV.exeC:\windows\KIV.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BVFGEI.exe.bat" "80⤵PID:4464
-
C:\windows\SysWOW64\BVFGEI.exeC:\windows\system32\BVFGEI.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBFVNVW.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5564 -
C:\windows\system\BBFVNVW.exeC:\windows\system\BBFVNVW.exe83⤵
- Executes dropped EXE
PID:1428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WOK.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:1312 -
C:\windows\system\WOK.exeC:\windows\system\WOK.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HHFXY.exe.bat" "86⤵PID:1944
-
C:\windows\HHFXY.exeC:\windows\HHFXY.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CUKGIC.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:2052 -
C:\windows\SysWOW64\CUKGIC.exeC:\windows\system32\CUKGIC.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAQDPM.exe.bat" "90⤵PID:4192
-
C:\windows\SysWOW64\YAQDPM.exeC:\windows\system32\YAQDPM.exe91⤵
- Executes dropped EXE
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NVZI.exe.bat" "92⤵
- Executes a command shell one-liner
PID:4088 -
C:\windows\system\NVZI.exeC:\windows\system\NVZI.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IIEZKZ.exe.bat" "94⤵PID:4688
-
C:\windows\system\IIEZKZ.exeC:\windows\system\IIEZKZ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TBHKSOO.exe.bat" "96⤵PID:3796
-
C:\windows\system\TBHKSOO.exeC:\windows\system\TBHKSOO.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJJ.exe.bat" "98⤵PID:5804
-
C:\windows\SysWOW64\LJJ.exeC:\windows\system32\LJJ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JJQLFO.exe.bat" "100⤵PID:1436
-
C:\windows\SysWOW64\JJQLFO.exeC:\windows\system32\JJQLFO.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LHKFLC.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5676 -
C:\windows\LHKFLC.exeC:\windows\LHKFLC.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHR.exe.bat" "104⤵PID:3900
-
C:\windows\system\QHR.exeC:\windows\system\QHR.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LVWCF.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3504 -
C:\windows\SysWOW64\LVWCF.exeC:\windows\system32\LVWCF.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WNZV.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:2304 -
C:\windows\SysWOW64\WNZV.exeC:\windows\system32\WNZV.exe109⤵
- Executes dropped EXE
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBEEXM.exe.bat" "110⤵PID:4944
-
C:\windows\system\RBEEXM.exeC:\windows\system\RBEEXM.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DRLMBE.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:3824 -
C:\windows\SysWOW64\DRLMBE.exeC:\windows\system32\DRLMBE.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JRSASY.exe.bat" "114⤵PID:4380
-
C:\windows\SysWOW64\JRSASY.exeC:\windows\system32\JRSASY.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DHLURV.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:1328 -
C:\windows\DHLURV.exeC:\windows\DHLURV.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMR.exe.bat" "118⤵PID:2288
-
C:\windows\system\ZMR.exeC:\windows\system\ZMR.exe119⤵
- Executes dropped EXE
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KFUK.exe.bat" "120⤵PID:3520
-
C:\windows\KFUK.exeC:\windows\KFUK.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-