Analysis
- max time kernel
94s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 18:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-02_f0497d6aba622ff76046fbe8acd953cb_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-11-02_f0497d6aba622ff76046fbe8acd953cb_elex_emotet_stop.exe
- Size 208KB
- Sample261102-xbhpdaex5k
- SHA256 327f14a5231445330114be2f1cfe5ab65aeae85fca826dc399d872d6d5cbcba9
- MD5 f0497d6aba622ff76046fbe8acd953cb
- SHA1 eece54f8d4376cdfffaa8d43d140eb96989f3463
- SHA512 c6b96d5a65bd76734b42ac667f3b8b70058805c3b69e90da5d3615ec96bcf9fb72ce8e081b1f88b9f6d2388c4dd0043bc0c5ed5f5362e0735d5f0e3c61c19be2
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfp4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOhkEj1
- TLSH T1D6247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3444 JBKXB.exe 1260 OBH.exe 5956 XRB.exe 972 PUFWM.exe 404 FPO.exe 612 OXQOBW.exe 1452 JLV.exe 3932 ATXC.exe 6000 POGHAGL.exe 1668 PUG.exe 3304 VUOJS.exe 3848 ZCV.exe 2820 OSWI.exe 4448 DVFVWNA.exe 3928 NVHAA.exe 2092 YOKS.exe 5652 NJUXTNS.exe 1848 FRWCWS.exe 1984 IZC.exe 5804 PVBL.exe 4676 DAZIU.exe 5952 PIO.exe 4428 TYUIT.exe 3028 OLZZDAZ.exe 3500 XMBEH.exe 3388 DMBSQZ.exe 4900 DPNO.exe 2860 BPUBMSN.exe 4116 HLL.exe 5908 BDB.exe 6024 VRGF.exe 2612 QMLONN.exe 4652 BEOHVVE.exe 1152 HFN.exe 6128 AAZQRNG.exe 5492 CNE.exe 5932 ANDNLP.exe 5140 DJIFNPT.exe 5968 MJKK.exe 2640 SJSYHO.exe 500 MXX.exe 3832 WFZM.exe 5392 QSDVFL.exe 2828 CIK.exe 804 VDOZXUZ.exe 1912 GWRSXB.exe 1812 BRW.exe 4908 VEBLS.exe 5940 BFIZBDU.exe 2224 JKA.exe 4888 NSHVP.exe 3596 IOMEZAZ.exe 4840 CBRO.exe 4752 XOV.exe 928 OXXC.exe 3876 SFEKJX.exe 2644 FPUB.exe 3312 GSY.exe 3472 VQE.exe 4800 PLBLU.exe 3152 QGNH.exe 4916 JJQLFO.exe 5996 FPOAUPT.exe 1872 WPQ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\PVBL.exe.bat IZC.exe File opened for modification C:\windows\SysWOW64\CNE.exe AAZQRNG.exe File created C:\windows\SysWOW64\JJQLFO.exe.bat QGNH.exe File created C:\windows\SysWOW64\RUBOIE.exe.bat XHWWG.exe File created C:\windows\SysWOW64\RTFLJ.exe.bat WYA.exe File opened for modification C:\windows\SysWOW64\PUFWM.exe XRB.exe File created C:\windows\SysWOW64\GSY.exe.bat FPUB.exe File created C:\windows\SysWOW64\OSWI.exe.bat ZCV.exe File opened for modification C:\windows\SysWOW64\XOV.exe CBRO.exe File created C:\windows\SysWOW64\IXUV.exe PUQRYRI.exe File created C:\windows\SysWOW64\QYL.exe.bat BVBUX.exe File created C:\windows\SysWOW64\RUBOIE.exe XHWWG.exe File opened for modification C:\windows\SysWOW64\LEESJDQ.exe AMBABW.exe File created C:\windows\SysWOW64\HLL.exe BPUBMSN.exe File opened for modification C:\windows\SysWOW64\AAZQRNG.exe HFN.exe File opened for modification C:\windows\SysWOW64\RTFLJ.exe WYA.exe File created C:\windows\SysWOW64\LIJHYZN.exe XDD.exe File opened for modification C:\windows\SysWOW64\RUBOIE.exe XHWWG.exe File opened for modification C:\windows\SysWOW64\GWRSXB.exe VDOZXUZ.exe File opened for modification C:\windows\SysWOW64\XMBEH.exe OLZZDAZ.exe File opened for modification C:\windows\SysWOW64\LIJHYZN.exe XDD.exe File created C:\windows\SysWOW64\LIJHYZN.exe.bat XDD.exe File created C:\windows\SysWOW64\LEESJDQ.exe.bat AMBABW.exe File created C:\windows\SysWOW64\OXQOBW.exe FPO.exe File created C:\windows\SysWOW64\DVFVWNA.exe.bat OSWI.exe File created C:\windows\SysWOW64\GWRSXB.exe.bat VDOZXUZ.exe File created C:\windows\SysWOW64\XOV.exe CBRO.exe File opened for modification C:\windows\SysWOW64\JJQLFO.exe QGNH.exe File opened for modification C:\windows\SysWOW64\WUHJYF.exe BZCZO.exe File created C:\windows\SysWOW64\XADPX.exe ORJC.exe File opened for modification C:\windows\SysWOW64\XADPX.exe ORJC.exe File created C:\windows\SysWOW64\RQQ.exe.bat VLKFIY.exe File created C:\windows\SysWOW64\MVSUM.exe HVLHC.exe File opened for modification C:\windows\SysWOW64\OXQOBW.exe FPO.exe File created C:\windows\SysWOW64\JKA.exe BFIZBDU.exe File created C:\windows\SysWOW64\SFEKJX.exe.bat OXXC.exe File created C:\windows\SysWOW64\MLMDDO.exe LIJHYZN.exe File created C:\windows\SysWOW64\MVSUM.exe.bat HVLHC.exe File created C:\windows\SysWOW64\PUFWM.exe.bat XRB.exe File created C:\windows\SysWOW64\PIO.exe.bat DAZIU.exe File created C:\windows\SysWOW64\XOV.exe.bat CBRO.exe File created C:\windows\SysWOW64\FPUB.exe.bat SFEKJX.exe File created C:\windows\SysWOW64\IXUV.exe.bat PUQRYRI.exe File created C:\windows\SysWOW64\PUFWM.exe XRB.exe File created C:\windows\SysWOW64\VDOZXUZ.exe CIK.exe File created C:\windows\SysWOW64\CBRO.exe.bat IOMEZAZ.exe File created C:\windows\SysWOW64\KKVEIA.exe.bat YRSTA.exe File created C:\windows\SysWOW64\DVFVWNA.exe OSWI.exe File created C:\windows\SysWOW64\AAZQRNG.exe HFN.exe File opened for modification C:\windows\SysWOW64\VDOZXUZ.exe CIK.exe File created C:\windows\SysWOW64\CBRO.exe IOMEZAZ.exe File created C:\windows\SysWOW64\YRSTA.exe.bat VBLLOBW.exe File created C:\windows\SysWOW64\PIO.exe DAZIU.exe File created C:\windows\SysWOW64\GLHORJS.exe.bat APHN.exe File created C:\windows\SysWOW64\RQQ.exe VLKFIY.exe File opened for modification C:\windows\SysWOW64\RQQ.exe VLKFIY.exe File created C:\windows\SysWOW64\JLV.exe OXQOBW.exe File created C:\windows\SysWOW64\QMLONN.exe VRGF.exe File created C:\windows\SysWOW64\CNE.exe AAZQRNG.exe File created C:\windows\SysWOW64\RTFLJ.exe WYA.exe File created C:\windows\SysWOW64\WYUB.exe MXS.exe File created C:\windows\SysWOW64\JLV.exe.bat OXQOBW.exe File opened for modification C:\windows\SysWOW64\PVBL.exe IZC.exe File opened for modification C:\windows\SysWOW64\VEBLS.exe BRW.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\BPUBMSN.exe.bat DPNO.exe File created C:\windows\system\AMBABW.exe.bat WEUA.exe File opened for modification C:\windows\ATXC.exe JLV.exe File created C:\windows\system\HFN.exe BEOHVVE.exe File created C:\windows\system\IOMEZAZ.exe.bat NSHVP.exe File created C:\windows\system\METNDTN.exe BMYUVL.exe File opened for modification C:\windows\XHWWG.exe FZURUH.exe File opened for modification C:\windows\system\SQLU.exe KKT.exe File created C:\windows\DXKQYDT.exe MWILV.exe File opened for modification C:\windows\DXKQYDT.exe MWILV.exe File opened for modification C:\windows\NJUXTNS.exe YOKS.exe File created C:\windows\DAZIU.exe PVBL.exe File created C:\windows\FPOAUPT.exe JJQLFO.exe File opened for modification C:\windows\PUQRYRI.exe NHLIO.exe File created C:\windows\system\OPF.exe DXKQYDT.exe File opened for modification C:\windows\APHN.exe NFROGD.exe File created C:\windows\BMYUVL.exe.bat XDJ.exe File opened for modification C:\windows\system\FZURUH.exe LLPIS.exe File created C:\windows\LBLFHSZ.exe.bat WYUB.exe File created C:\windows\system\OLZZDAZ.exe TYUIT.exe File opened for modification C:\windows\system\BPUBMSN.exe DPNO.exe File created C:\windows\VQE.exe GSY.exe File opened for modification C:\windows\system\IAX.exe IXUV.exe File opened for modification C:\windows\system\OPF.exe DXKQYDT.exe File opened for modification C:\windows\VRGF.exe BDB.exe File created C:\windows\system\FPO.exe.bat PUFWM.exe File opened for modification C:\windows\YOKS.exe NVHAA.exe File created C:\windows\TYUIT.exe.bat PIO.exe File opened for modification C:\windows\system\IOMEZAZ.exe NSHVP.exe File opened for modification C:\windows\PMW.exe EWPJ.exe File created C:\windows\PUQRYRI.exe NHLIO.exe File opened for modification C:\windows\system\AMBABW.exe WEUA.exe File opened for modification C:\windows\VBLLOBW.exe RTFLJ.exe File created C:\windows\PMW.exe EWPJ.exe File created C:\windows\system\XDJ.exe.bat AYLX.exe File opened for modification C:\windows\BMYUVL.exe XDJ.exe File created C:\windows\system\WFZM.exe MXX.exe File opened for modification C:\windows\BVBUX.exe IAX.exe File created C:\windows\HVLHC.exe BVD.exe File created C:\windows\system\MXS.exe KKVEIA.exe File created C:\windows\system\XCXIF.exe.bat PMW.exe File opened for modification C:\windows\POGHAGL.exe ATXC.exe File created C:\windows\system\JBKXB.exe.bat 2026-11-02_f0497d6aba622ff76046fbe8acd953cb_elex_emotet_stop.exe File created C:\windows\system\XRB.exe.bat OBH.exe File created C:\windows\APHN.exe NFROGD.exe File created C:\windows\system\FZURUH.exe.bat LLPIS.exe File created C:\windows\system\IZC.exe.bat FRWCWS.exe File opened for modification C:\windows\system\OLZZDAZ.exe TYUIT.exe File opened for modification C:\windows\VQE.exe GSY.exe File created C:\windows\MRNRNBS.exe.bat MLMDDO.exe File created C:\windows\NHLIO.exe.bat VYXKC.exe File created C:\windows\system\SQLU.exe.bat KKT.exe File created C:\windows\FRWCWS.exe NJUXTNS.exe File opened for modification C:\windows\WPQ.exe FPOAUPT.exe File created C:\windows\BVBUX.exe IAX.exe File created C:\windows\system\RJDC.exe NTXU.exe File opened for modification C:\windows\system\IZC.exe FRWCWS.exe File created C:\windows\CIK.exe.bat QSDVFL.exe File created C:\windows\XHWWG.exe.bat FZURUH.exe File created C:\windows\HVLHC.exe.bat BVD.exe File created C:\windows\system\DJIFNPT.exe.bat ANDNLP.exe File created C:\windows\APHN.exe.bat NFROGD.exe File created C:\windows\NHLIO.exe VYXKC.exe File created C:\windows\system\BVD.exe RUBOIE.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4340 cmd.exe 4596 cmd.exe 956 cmd.exe 4192 cmd.exe 4464 cmd.exe 4512 cmd.exe 4128 cmd.exe 4912 cmd.exe 4328 cmd.exe 5836 cmd.exe 3268 cmd.exe 544 cmd.exe 5476 cmd.exe 1040 cmd.exe 3032 cmd.exe 588 cmd.exe 4144 cmd.exe 4748 cmd.exe 3676 cmd.exe 616 cmd.exe 4856 cmd.exe 3880 cmd.exe 3356 cmd.exe 2948 cmd.exe 1148 cmd.exe 920 cmd.exe 5696 cmd.exe 5760 cmd.exe 3540 cmd.exe 3204 cmd.exe 692 cmd.exe 4560 cmd.exe 4188 cmd.exe 5772 cmd.exe 4780 cmd.exe 5552 cmd.exe 4472 cmd.exe 592 cmd.exe 4160 cmd.exe 2452 cmd.exe 5360 cmd.exe 1172 cmd.exe 3572 cmd.exe 3236 cmd.exe 3636 cmd.exe 2136 cmd.exe 5272 cmd.exe 5868 cmd.exe 5964 cmd.exe 1076 cmd.exe 4292 cmd.exe 1188 cmd.exe 248 cmd.exe 4504 cmd.exe 1416 cmd.exe 2956 cmd.exe 1404 cmd.exe 4880 cmd.exe 4820 cmd.exe 3128 cmd.exe 5304 cmd.exe 6012 cmd.exe 4068 cmd.exe 3624 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4852 3608 WerFault.exe 88 2372 3444 WerFault.exe 94 5108 1260 WerFault.exe 100 1104 5956 WerFault.exe 105 5212 972 WerFault.exe 110 5420 404 WerFault.exe 115 2860 612 WerFault.exe 120 3192 1452 WerFault.exe 125 3660 3932 WerFault.exe 130 2848 6000 WerFault.exe 135 2060 1668 WerFault.exe 140 4496 3304 WerFault.exe 145 3384 3848 WerFault.exe 150 4296 2820 WerFault.exe 155 1576 4448 WerFault.exe 160 5784 3928 WerFault.exe 165 5168 2092 WerFault.exe 170 900 5652 WerFault.exe 175 3488 1848 WerFault.exe 180 1976 1984 WerFault.exe 185 5332 5804 WerFault.exe 189 3568 4676 WerFault.exe 195 5296 5952 WerFault.exe 200 1060 4428 WerFault.exe 205 2232 3028 WerFault.exe 210 2272 3500 WerFault.exe 215 5836 3388 WerFault.exe 220 2572 4900 WerFault.exe 225 5352 2860 WerFault.exe 230 4480 4116 WerFault.exe 235 3732 5908 WerFault.exe 240 5044 6024 WerFault.exe 245 2688 2612 WerFault.exe 250 3212 4652 WerFault.exe 255 928 1152 WerFault.exe 260 3208 6128 WerFault.exe 265 5936 5492 WerFault.exe 270 4192 5932 WerFault.exe 275 3812 5140 WerFault.exe 280 2328 5968 WerFault.exe 286 1976 2640 WerFault.exe 291 788 500 WerFault.exe 296 4576 3832 WerFault.exe 301 8 5392 WerFault.exe 306 5132 2828 WerFault.exe 311 4756 804 WerFault.exe 316 4912 1912 WerFault.exe 321 2004 1812 WerFault.exe 326 3976 4908 WerFault.exe 331 1692 5940 WerFault.exe 336 540 2224 WerFault.exe 341 3400 4888 WerFault.exe 346 2036 3596 WerFault.exe 351 3544 4840 WerFault.exe 356 4732 4752 WerFault.exe 361 260 928 WerFault.exe 366 4512 3876 WerFault.exe 371 4572 2644 WerFault.exe 376 2308 3312 WerFault.exe 381 4776 3472 WerFault.exe 386 1712 4800 WerFault.exe 391 3732 3152 WerFault.exe 396 3600 4916 WerFault.exe 401 1176 5996 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SJSYHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLHORJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAUJQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPUB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XHWWG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYLX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZURUH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUBOIE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAZIU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJKK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language METNDTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMYUVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMBSQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWILV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BRW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUQRYRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMLONN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUOJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PVBL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VYXKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MRNRNBS.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3608 2026-11-02_f0497d6aba622ff76046fbe8acd953cb_elex_emotet_stop.exe 3608 2026-11-02_f0497d6aba622ff76046fbe8acd953cb_elex_emotet_stop.exe 3444 JBKXB.exe 3444 JBKXB.exe 1260 OBH.exe 1260 OBH.exe 5956 XRB.exe 5956 XRB.exe 972 PUFWM.exe 972 PUFWM.exe 404 FPO.exe 404 FPO.exe 612 OXQOBW.exe 612 OXQOBW.exe 1452 JLV.exe 1452 JLV.exe 3932 ATXC.exe 3932 ATXC.exe 6000 POGHAGL.exe 6000 POGHAGL.exe 1668 PUG.exe 1668 PUG.exe 3304 VUOJS.exe 3304 VUOJS.exe 3848 ZCV.exe 3848 ZCV.exe 2820 OSWI.exe 2820 OSWI.exe 4448 DVFVWNA.exe 4448 DVFVWNA.exe 3928 NVHAA.exe 3928 NVHAA.exe 2092 YOKS.exe 2092 YOKS.exe 5652 NJUXTNS.exe 5652 NJUXTNS.exe 1848 FRWCWS.exe 1848 FRWCWS.exe 1984 IZC.exe 1984 IZC.exe 5804 PVBL.exe 5804 PVBL.exe 4676 DAZIU.exe 4676 DAZIU.exe 5952 PIO.exe 5952 PIO.exe 4428 TYUIT.exe 4428 TYUIT.exe 3028 OLZZDAZ.exe 3028 OLZZDAZ.exe 3500 XMBEH.exe 3500 XMBEH.exe 3388 DMBSQZ.exe 3388 DMBSQZ.exe 4900 DPNO.exe 4900 DPNO.exe 2860 BPUBMSN.exe 2860 BPUBMSN.exe 4116 HLL.exe 4116 HLL.exe 5908 BDB.exe 5908 BDB.exe 6024 VRGF.exe 6024 VRGF.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3608 2026-11-02_f0497d6aba622ff76046fbe8acd953cb_elex_emotet_stop.exe 3608 2026-11-02_f0497d6aba622ff76046fbe8acd953cb_elex_emotet_stop.exe 3444 JBKXB.exe 3444 JBKXB.exe 1260 OBH.exe 1260 OBH.exe 5956 XRB.exe 5956 XRB.exe 972 PUFWM.exe 972 PUFWM.exe 404 FPO.exe 404 FPO.exe 612 OXQOBW.exe 612 OXQOBW.exe 1452 JLV.exe 1452 JLV.exe 3932 ATXC.exe 3932 ATXC.exe 6000 POGHAGL.exe 6000 POGHAGL.exe 1668 PUG.exe 1668 PUG.exe 3304 VUOJS.exe 3304 VUOJS.exe 3848 ZCV.exe 3848 ZCV.exe 2820 OSWI.exe 2820 OSWI.exe 4448 DVFVWNA.exe 4448 DVFVWNA.exe 3928 NVHAA.exe 3928 NVHAA.exe 2092 YOKS.exe 2092 YOKS.exe 5652 NJUXTNS.exe 5652 NJUXTNS.exe 1848 FRWCWS.exe 1848 FRWCWS.exe 1984 IZC.exe 1984 IZC.exe 5804 PVBL.exe 5804 PVBL.exe 4676 DAZIU.exe 4676 DAZIU.exe 5952 PIO.exe 5952 PIO.exe 4428 TYUIT.exe 4428 TYUIT.exe 3028 OLZZDAZ.exe 3028 OLZZDAZ.exe 3500 XMBEH.exe 3500 XMBEH.exe 3388 DMBSQZ.exe 3388 DMBSQZ.exe 4900 DPNO.exe 4900 DPNO.exe 2860 BPUBMSN.exe 2860 BPUBMSN.exe 4116 HLL.exe 4116 HLL.exe 5908 BDB.exe 5908 BDB.exe 6024 VRGF.exe 6024 VRGF.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3608 wrote to memory of 3624 3608 2026-11-02_f0497d6aba622ff76046fbe8acd953cb_elex_emotet_stop.exe 90 PID 3624 wrote to memory of 3444 3624 cmd.exe 94 PID 3444 wrote to memory of 3204 3444 JBKXB.exe 96 PID 3204 wrote to memory of 1260 3204 cmd.exe 100 PID 1260 wrote to memory of 1148 1260 OBH.exe 101 PID 1148 wrote to memory of 5956 1148 cmd.exe 105 PID 5956 wrote to memory of 4340 5956 XRB.exe 106 PID 4340 wrote to memory of 972 4340 cmd.exe 110 PID 972 wrote to memory of 4472 972 PUFWM.exe 111 PID 4472 wrote to memory of 404 4472 cmd.exe 115 PID 404 wrote to memory of 5328 404 FPO.exe 116 PID 5328 wrote to memory of 612 5328 cmd.exe 120 PID 612 wrote to memory of 3636 612 OXQOBW.exe 121 PID 3636 wrote to memory of 1452 3636 cmd.exe 125 PID 1452 wrote to memory of 4844 1452 JLV.exe 126 PID 4844 wrote to memory of 3932 4844 cmd.exe 130 PID 3932 wrote to memory of 5700 3932 ATXC.exe 131 PID 5700 wrote to memory of 6000 5700 cmd.exe 135 PID 6000 wrote to memory of 3088 6000 POGHAGL.exe 136 PID 3088 wrote to memory of 1668 3088 cmd.exe 140 PID 1668 wrote to memory of 692 1668 PUG.exe 141 PID 692 wrote to memory of 3304 692 cmd.exe 145 PID 3304 wrote to memory of 592 3304 VUOJS.exe 146 PID 592 wrote to memory of 3848 592 cmd.exe 150 PID 3848 wrote to memory of 2904 3848 ZCV.exe 151 PID 2904 wrote to memory of 2820 2904 cmd.exe 155 PID 2820 wrote to memory of 248 2820 OSWI.exe 156 PID 248 wrote to memory of 4448 248 cmd.exe 160 PID 4448 wrote to memory of 752 4448 DVFVWNA.exe 161 PID 752 wrote to memory of 3928 752 cmd.exe 165 PID 3928 wrote to memory of 2880 3928 NVHAA.exe 166 PID 2880 wrote to memory of 2092 2880 cmd.exe 170 PID 2092 wrote to memory of 1392 2092 YOKS.exe 171 PID 1392 wrote to memory of 5652 1392 cmd.exe 175 PID 5652 wrote to memory of 5476 5652 NJUXTNS.exe 176 PID 5476 wrote to memory of 1848 5476 cmd.exe 180 PID 1848 wrote to memory of 4260 1848 FRWCWS.exe 181 PID 4260 wrote to memory of 1984 4260 cmd.exe 185 PID 1984 wrote to memory of 4596 1984 IZC.exe 186 PID 4596 wrote to memory of 5804 4596 cmd.exe 189 PID 5804 wrote to memory of 956 5804 PVBL.exe 191 PID 956 wrote to memory of 4676 956 cmd.exe 195 PID 4676 wrote to memory of 5312 4676 DAZIU.exe 196 PID 5312 wrote to memory of 5952 5312 cmd.exe 200 PID 5952 wrote to memory of 1276 5952 PIO.exe 201 PID 1276 wrote to memory of 4428 1276 cmd.exe 205 PID 4428 wrote to memory of 2484 4428 TYUIT.exe 206 PID 2484 wrote to memory of 3028 2484 cmd.exe 210 PID 3028 wrote to memory of 4712 3028 OLZZDAZ.exe 211 PID 4712 wrote to memory of 3500 4712 cmd.exe 215 PID 3500 wrote to memory of 1220 3500 XMBEH.exe 216 PID 1220 wrote to memory of 3388 1220 cmd.exe 220 PID 3388 wrote to memory of 3516 3388 DMBSQZ.exe 221 PID 3516 wrote to memory of 4900 3516 cmd.exe 225 PID 4900 wrote to memory of 6040 4900 DPNO.exe 226 PID 6040 wrote to memory of 2860 6040 cmd.exe 230 PID 2860 wrote to memory of 5912 2860 BPUBMSN.exe 231 PID 5912 wrote to memory of 4116 5912 cmd.exe 235 PID 4116 wrote to memory of 3356 4116 HLL.exe 236 PID 3356 wrote to memory of 5908 3356 cmd.exe 240 PID 5908 wrote to memory of 2080 5908 BDB.exe 241 PID 2080 wrote to memory of 6024 2080 cmd.exe 245 PID 6024 wrote to memory of 5056 6024 VRGF.exe 246 PID 5056 wrote to memory of 2612 5056 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_f0497d6aba622ff76046fbe8acd953cb_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_f0497d6aba622ff76046fbe8acd953cb_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBKXB.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\windows\system\JBKXB.exeC:\windows\system\JBKXB.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OBH.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\windows\SysWOW64\OBH.exeC:\windows\system32\OBH.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XRB.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\windows\system\XRB.exeC:\windows\system\XRB.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PUFWM.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\windows\SysWOW64\PUFWM.exeC:\windows\system32\PUFWM.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FPO.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\windows\system\FPO.exeC:\windows\system\FPO.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OXQOBW.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\windows\SysWOW64\OXQOBW.exeC:\windows\system32\OXQOBW.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JLV.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\windows\SysWOW64\JLV.exeC:\windows\system32\JLV.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ATXC.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\windows\ATXC.exeC:\windows\ATXC.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\POGHAGL.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\windows\POGHAGL.exeC:\windows\POGHAGL.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUG.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\windows\PUG.exeC:\windows\PUG.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VUOJS.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:692 -
C:\windows\system\VUOJS.exeC:\windows\system\VUOJS.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZCV.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:592 -
C:\windows\ZCV.exeC:\windows\ZCV.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OSWI.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\windows\SysWOW64\OSWI.exeC:\windows\system32\OSWI.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DVFVWNA.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:248 -
C:\windows\SysWOW64\DVFVWNA.exeC:\windows\system32\DVFVWNA.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NVHAA.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:752 -
C:\windows\NVHAA.exeC:\windows\NVHAA.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOKS.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\windows\YOKS.exeC:\windows\YOKS.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NJUXTNS.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\windows\NJUXTNS.exeC:\windows\NJUXTNS.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FRWCWS.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\windows\FRWCWS.exeC:\windows\FRWCWS.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IZC.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\windows\system\IZC.exeC:\windows\system\IZC.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVBL.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\windows\SysWOW64\PVBL.exeC:\windows\system32\PVBL.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DAZIU.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:956 -
C:\windows\DAZIU.exeC:\windows\DAZIU.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PIO.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\windows\SysWOW64\PIO.exeC:\windows\system32\PIO.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TYUIT.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\windows\TYUIT.exeC:\windows\TYUIT.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OLZZDAZ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\windows\system\OLZZDAZ.exeC:\windows\system\OLZZDAZ.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XMBEH.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\windows\SysWOW64\XMBEH.exeC:\windows\system32\XMBEH.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DMBSQZ.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\windows\system\DMBSQZ.exeC:\windows\system\DMBSQZ.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DPNO.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\windows\DPNO.exeC:\windows\DPNO.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BPUBMSN.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\windows\system\BPUBMSN.exeC:\windows\system\BPUBMSN.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HLL.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\windows\SysWOW64\HLL.exeC:\windows\system32\HLL.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDB.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\windows\SysWOW64\BDB.exeC:\windows\system32\BDB.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRGF.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\windows\VRGF.exeC:\windows\VRGF.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QMLONN.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\windows\SysWOW64\QMLONN.exeC:\windows\system32\QMLONN.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BEOHVVE.exe.bat" "66⤵PID:1880
-
C:\windows\BEOHVVE.exeC:\windows\BEOHVVE.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HFN.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4160 -
C:\windows\system\HFN.exeC:\windows\system\HFN.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAZQRNG.exe.bat" "70⤵PID:4432
-
C:\windows\SysWOW64\AAZQRNG.exeC:\windows\system32\AAZQRNG.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CNE.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2452 -
C:\windows\SysWOW64\CNE.exeC:\windows\system32\CNE.exe73⤵
- Executes dropped EXE
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANDNLP.exe.bat" "74⤵PID:5848
-
C:\windows\SysWOW64\ANDNLP.exeC:\windows\system32\ANDNLP.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DJIFNPT.exe.bat" "76⤵PID:1932
-
C:\windows\system\DJIFNPT.exeC:\windows\system\DJIFNPT.exe77⤵
- Executes dropped EXE
PID:5140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MJKK.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:2576 -
C:\windows\MJKK.exeC:\windows\MJKK.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SJSYHO.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4864 -
C:\windows\SJSYHO.exeC:\windows\SJSYHO.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXX.exe.bat" "82⤵
- Executes a command shell one-liner
PID:2136 -
C:\windows\MXX.exeC:\windows\MXX.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WFZM.exe.bat" "84⤵PID:5832
-
C:\windows\system\WFZM.exeC:\windows\system\WFZM.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QSDVFL.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:6096 -
C:\windows\SysWOW64\QSDVFL.exeC:\windows\system32\QSDVFL.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CIK.exe.bat" "88⤵PID:3556
-
C:\windows\CIK.exeC:\windows\CIK.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDOZXUZ.exe.bat" "90⤵PID:4240
-
C:\windows\SysWOW64\VDOZXUZ.exeC:\windows\system32\VDOZXUZ.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GWRSXB.exe.bat" "92⤵PID:4380
-
C:\windows\SysWOW64\GWRSXB.exeC:\windows\system32\GWRSXB.exe93⤵
- Executes dropped EXE
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRW.exe.bat" "94⤵PID:1360
-
C:\windows\SysWOW64\BRW.exeC:\windows\system32\BRW.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEBLS.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:3344 -
C:\windows\SysWOW64\VEBLS.exeC:\windows\system32\VEBLS.exe97⤵
- Executes dropped EXE
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BFIZBDU.exe.bat" "98⤵
- Executes a command shell one-liner
PID:4128 -
C:\windows\system\BFIZBDU.exeC:\windows\system\BFIZBDU.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JKA.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4560 -
C:\windows\SysWOW64\JKA.exeC:\windows\system32\JKA.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NSHVP.exe.bat" "102⤵PID:5352
-
C:\windows\NSHVP.exeC:\windows\NSHVP.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOMEZAZ.exe.bat" "104⤵PID:2712
-
C:\windows\system\IOMEZAZ.exeC:\windows\system\IOMEZAZ.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CBRO.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4504 -
C:\windows\SysWOW64\CBRO.exeC:\windows\system32\CBRO.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOV.exe.bat" "108⤵PID:3532
-
C:\windows\SysWOW64\XOV.exeC:\windows\system32\XOV.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXXC.exe.bat" "110⤵PID:5796
-
C:\windows\system\OXXC.exeC:\windows\system\OXXC.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SFEKJX.exe.bat" "112⤵PID:5324
-
C:\windows\SysWOW64\SFEKJX.exeC:\windows\system32\SFEKJX.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPUB.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4912 -
C:\windows\SysWOW64\FPUB.exeC:\windows\system32\FPUB.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSY.exe.bat" "116⤵
- Executes a command shell one-liner
PID:5360 -
C:\windows\SysWOW64\GSY.exeC:\windows\system32\GSY.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQE.exe.bat" "118⤵PID:5496
-
C:\windows\VQE.exeC:\windows\VQE.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PLBLU.exe.bat" "120⤵
- Executes a command shell one-liner
PID:1040 -
C:\windows\system\PLBLU.exeC:\windows\system\PLBLU.exe121⤵
- Executes dropped EXE
PID:4800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-