Analysis
- max time kernel
104s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 22:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-03_444165981028f94fb7a3315dc0e26912_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-11-03_444165981028f94fb7a3315dc0e26912_elex_emotet_stop.exe
- Size 208KB
- Sample261104-18ssdsvxex
- SHA256 ec4555752239026b714a60d9c52967666c8a7d756f64d4c0ada43fb7f77fb604
- MD5 444165981028f94fb7a3315dc0e26912
- SHA1 61cb93f5275f5191c5452adbf36259db8f827b9b
- SHA512 137afb6de837f33222bdd121d0619b9bcfc766999257c3846689f81f4e401ac25218cbbac81fa1c3f2415670b67d2b0b8d5f73d63f5d4f6cd4210d0f0c75f68c
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFliKL+LOfz4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFliS+LObkEj1
- TLSH T17B247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2412 MWHPDWL.exe 2044 YZRC.exe 3992 WPDFHGW.exe 480 NABVGBR.exe 6124 KGZSNKT.exe 5692 BONX.exe 4684 FWUXMUK.exe 5236 GZYB.exe 1112 KHMBEC.exe 4112 QCEC.exe 4988 KQILLX.exe 3764 JNCO.exe 2988 DBGYIK.exe 2556 VJIDTHL.exe 4564 PWFM.exe 5400 ECLJLR.exe 1244 MHLYMW.exe 5324 MSUZAIL.exe 4292 RSCN.exe 3652 RGUBL.exe 1268 MTZLVP.exe 1300 XMC.exe 1908 NHLIO.exe 1464 VMLWQW.exe 4152 EZWO.exe 6060 PSR.exe 3932 CDVF.exe 5604 ZASD.exe 428 BYUF.exe 5368 KMEXOVS.exe 4352 BMGC.exe 4004 MEBVA.exe 3008 QUQVMAY.exe 2320 AVK.exe 4420 PQBMIK.exe 4476 LVZ.exe 4344 GJELA.exe 4692 IHF.exe 4644 MXM.exe 3568 XPPGTQL.exe 4296 IIK.exe 2452 FFPVI.exe 1672 YITRNXE.exe 2108 AWYB.exe 204 YWGOHR.exe 3140 BRK.exe 4852 PPQV.exe 5456 KKVEIA.exe 5564 QKVSRD.exe 1648 KYA.exe 996 SDAYDI.exe 5956 HJGNKR.exe 3480 FZEYW.exe 3116 HWGSCA.exe 2720 WCDPJKL.exe 2032 HVGIRRB.exe 3420 WQQM.exe 5920 TVWJKN.exe 4616 TBWYLAG.exe 6080 PGUV.exe 1528 MEZ.exe 2696 ZPI.exe 2896 QZG.exe 5748 CINGHJ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\KGZSNKT.exe NABVGBR.exe File opened for modification C:\windows\SysWOW64\YWGOHR.exe AWYB.exe File opened for modification C:\windows\SysWOW64\VJIDTHL.exe DBGYIK.exe File created C:\windows\SysWOW64\IHF.exe.bat GJELA.exe File opened for modification C:\windows\SysWOW64\YITRNXE.exe FFPVI.exe File created C:\windows\SysWOW64\KKVEIA.exe PPQV.exe File opened for modification C:\windows\SysWOW64\DMEM.exe OQVAID.exe File created C:\windows\SysWOW64\FJFGZ.exe DMEM.exe File opened for modification C:\windows\SysWOW64\FJFGZ.exe DMEM.exe File created C:\windows\SysWOW64\MSUZAIL.exe.bat MHLYMW.exe File created C:\windows\SysWOW64\BYUF.exe ZASD.exe File opened for modification C:\windows\SysWOW64\CINGHJ.exe QZG.exe File created C:\windows\SysWOW64\QXJDQ.exe.bat QSRP.exe File created C:\windows\SysWOW64\TPNTM.exe ZBI.exe File created C:\windows\SysWOW64\ITEOMK.exe.bat XBBVE.exe File created C:\windows\SysWOW64\KMEXOVS.exe BYUF.exe File created C:\windows\SysWOW64\GJELA.exe LVZ.exe File created C:\windows\SysWOW64\TBWYLAG.exe TVWJKN.exe File created C:\windows\SysWOW64\QZG.exe ZPI.exe File created C:\windows\SysWOW64\DMEM.exe OQVAID.exe File created C:\windows\SysWOW64\RZOG.exe.bat ITEOMK.exe File created C:\windows\SysWOW64\QOOSP.exe.bat OQVQJRM.exe File created C:\windows\SysWOW64\YWGOHR.exe.bat AWYB.exe File created C:\windows\SysWOW64\TBWYLAG.exe.bat TVWJKN.exe File created C:\windows\SysWOW64\TKEOVWO.exe YXHEL.exe File created C:\windows\SysWOW64\NABVGBR.exe WPDFHGW.exe File opened for modification C:\windows\SysWOW64\MTZLVP.exe RGUBL.exe File created C:\windows\SysWOW64\MEBVA.exe BMGC.exe File created C:\windows\SysWOW64\CINGHJ.exe QZG.exe File created C:\windows\SysWOW64\WATS.exe WPKR.exe File created C:\windows\SysWOW64\QKVSRD.exe KKVEIA.exe File created C:\windows\SysWOW64\TKEOVWO.exe.bat YXHEL.exe File created C:\windows\SysWOW64\XPAA.exe PXRH.exe File opened for modification C:\windows\SysWOW64\NABVGBR.exe WPDFHGW.exe File opened for modification C:\windows\SysWOW64\BYUF.exe ZASD.exe File created C:\windows\SysWOW64\BYUF.exe.bat ZASD.exe File opened for modification C:\windows\SysWOW64\YCTTMYQ.exe QSKRGMK.exe File created C:\windows\SysWOW64\TPNTM.exe.bat ZBI.exe File opened for modification C:\windows\SysWOW64\NKZA.exe CSWHJ.exe File created C:\windows\SysWOW64\VJIDTHL.exe DBGYIK.exe File created C:\windows\SysWOW64\VJIDTHL.exe.bat DBGYIK.exe File opened for modification C:\windows\SysWOW64\HVGIRRB.exe WCDPJKL.exe File opened for modification C:\windows\SysWOW64\TBWYLAG.exe TVWJKN.exe File created C:\windows\SysWOW64\QSRP.exe.bat KRJBFUG.exe File created C:\windows\SysWOW64\KGZSNKT.exe.bat NABVGBR.exe File created C:\windows\SysWOW64\MTZLVP.exe RGUBL.exe File created C:\windows\SysWOW64\LVZ.exe PQBMIK.exe File created C:\windows\SysWOW64\LVZ.exe.bat PQBMIK.exe File opened for modification C:\windows\SysWOW64\KKVEIA.exe PPQV.exe File created C:\windows\SysWOW64\QXJDQ.exe QSRP.exe File created C:\windows\SysWOW64\IHF.exe GJELA.exe File created C:\windows\SysWOW64\CINGHJ.exe.bat QZG.exe File created C:\windows\SysWOW64\CSWHJ.exe XPAA.exe File opened for modification C:\windows\SysWOW64\QZG.exe ZPI.exe File created C:\windows\SysWOW64\QSRP.exe KRJBFUG.exe File created C:\windows\SysWOW64\MTZLVP.exe.bat RGUBL.exe File created C:\windows\SysWOW64\GJELA.exe.bat LVZ.exe File created C:\windows\SysWOW64\WCDPJKL.exe.bat HWGSCA.exe File created C:\windows\SysWOW64\WQQM.exe HVGIRRB.exe File created C:\windows\SysWOW64\QZG.exe.bat ZPI.exe File created C:\windows\SysWOW64\DMEM.exe.bat OQVAID.exe File opened for modification C:\windows\SysWOW64\CSWHJ.exe XPAA.exe File opened for modification C:\windows\SysWOW64\QOOSP.exe OQVQJRM.exe File opened for modification C:\windows\SysWOW64\MSUZAIL.exe MHLYMW.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\BONX.exe KGZSNKT.exe File created C:\windows\MHLYMW.exe.bat ECLJLR.exe File opened for modification C:\windows\system\HGVK.exe IVVJ.exe File created C:\windows\system\KHMBEC.exe GZYB.exe File opened for modification C:\windows\system\NTD.exe HTWLU.exe File opened for modification C:\windows\UKZGOQT.exe XETIH.exe File created C:\windows\system\MILUWP.exe.bat QCNX.exe File created C:\windows\system\CDVF.exe PSR.exe File created C:\windows\LWC.exe.bat PRWTJE.exe File opened for modification C:\windows\system\AWYB.exe YITRNXE.exe File opened for modification C:\windows\system\CDVF.exe PSR.exe File opened for modification C:\windows\YSJPXLM.exe HHTRQQQ.exe File created C:\windows\YSJPXLM.exe.bat HHTRQQQ.exe File created C:\windows\system\HTWLU.exe WATS.exe File created C:\windows\UKZGOQT.exe XETIH.exe File created C:\windows\NLMI.exe.bat BTJPR.exe File created C:\windows\system\YMJJW.exe JRSE.exe File created C:\windows\system\YZRC.exe.bat MWHPDWL.exe File opened for modification C:\windows\PSR.exe EZWO.exe File created C:\windows\XOU.exe DAPBOP.exe File opened for modification C:\windows\CWC.exe WVVZMD.exe File opened for modification C:\windows\system\MILUWP.exe QCNX.exe File opened for modification C:\windows\system\PPIIJKQ.exe PXZHV.exe File opened for modification C:\windows\system\RGUBL.exe RSCN.exe File created C:\windows\KRJBFUG.exe.bat NMDMQKM.exe File created C:\windows\GHFGNDB.exe.bat JCZJGB.exe File created C:\windows\system\KKNUJ.exe FJFGZ.exe File created C:\windows\system\PXZHV.exe.bat YMJJW.exe File created C:\windows\WQVKK.exe.bat YSJPXLM.exe File opened for modification C:\windows\system\OCSCWG.exe TPNTM.exe File created C:\windows\system\PRWTJE.exe.bat NTD.exe File created C:\windows\GTDLH.exe VWSN.exe File created C:\windows\XBBVE.exe VDZTGGR.exe File opened for modification C:\windows\system\MEZ.exe PGUV.exe File created C:\windows\PWFM.exe.bat VJIDTHL.exe File created C:\windows\HJGNKR.exe SDAYDI.exe File created C:\windows\WTDWSX.exe.bat QTVJ.exe File created C:\windows\NETMZS.exe WTDWSX.exe File created C:\windows\DAPBOP.exe MNNJY.exe File created C:\windows\system\OQVAID.exe KAOA.exe File created C:\windows\system\NTD.exe HTWLU.exe File created C:\windows\OYMPD.exe MILUWP.exe File opened for modification C:\windows\system\NMDMQKM.exe TZYDO.exe File created C:\windows\system\GUIBO.exe.bat JXKEZ.exe File created C:\windows\BJN.exe PQKLCY.exe File created C:\windows\system\XETIH.exe GTDLH.exe File created C:\windows\system\PXZHV.exe YMJJW.exe File opened for modification C:\windows\BMGC.exe KMEXOVS.exe File created C:\windows\BRK.exe YWGOHR.exe File created C:\windows\system\PRR.exe JRJFGK.exe File created C:\windows\JNCO.exe.bat KQILLX.exe File created C:\windows\KTOVAB.exe.bat QXJDQ.exe File created C:\windows\system\HTWLU.exe.bat WATS.exe File opened for modification C:\windows\system\OEMV.exe RZOG.exe File created C:\windows\HWGSCA.exe.bat FZEYW.exe File created C:\windows\FWUXMUK.exe BONX.exe File created C:\windows\FZEYW.exe.bat HJGNKR.exe File opened for modification C:\windows\ZPI.exe MEZ.exe File created C:\windows\WQVKK.exe YSJPXLM.exe File created C:\windows\BJN.exe.bat PQKLCY.exe File created C:\windows\system\OEMV.exe RZOG.exe File created C:\windows\OQVQJRM.exe.bat OYMPD.exe File opened for modification C:\windows\XMC.exe MTZLVP.exe File created C:\windows\BMGC.exe KMEXOVS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6056 cmd.exe 5344 cmd.exe 2432 cmd.exe 708 cmd.exe 5992 cmd.exe 4312 cmd.exe 252 cmd.exe 4288 cmd.exe 5908 cmd.exe 3152 cmd.exe 1968 cmd.exe 5004 cmd.exe 1964 cmd.exe 1748 cmd.exe 1516 cmd.exe 944 cmd.exe 5744 cmd.exe 1368 cmd.exe 1352 cmd.exe 2464 cmd.exe 1260 cmd.exe 1224 cmd.exe 1324 cmd.exe 5640 cmd.exe 5932 cmd.exe 5484 cmd.exe 2144 cmd.exe 6052 cmd.exe 5124 cmd.exe 4520 cmd.exe 2500 cmd.exe 3500 cmd.exe 692 cmd.exe 108 cmd.exe 3000 cmd.exe 1296 cmd.exe 3964 cmd.exe 3860 cmd.exe 3756 cmd.exe 716 cmd.exe 1460 cmd.exe 5872 cmd.exe 2712 cmd.exe 5796 cmd.exe 5652 cmd.exe 5208 cmd.exe 4608 cmd.exe 1236 cmd.exe 4832 cmd.exe 2164 cmd.exe 4244 cmd.exe 4132 cmd.exe 5688 cmd.exe 4808 cmd.exe 6020 cmd.exe 4672 cmd.exe 4116 cmd.exe 2596 cmd.exe 3444 cmd.exe 5924 cmd.exe 5224 cmd.exe 6016 cmd.exe 4620 cmd.exe 1312 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1196 4976 WerFault.exe 88 2192 2412 WerFault.exe 92 5652 2044 WerFault.exe 99 3064 3992 WerFault.exe 104 4100 480 WerFault.exe 109 5928 6124 WerFault.exe 114 2748 5692 WerFault.exe 119 2220 4684 WerFault.exe 124 2052 5236 WerFault.exe 129 5688 1112 WerFault.exe 134 4808 4112 WerFault.exe 140 4556 4988 WerFault.exe 145 5756 3764 WerFault.exe 150 4968 2988 WerFault.exe 155 3480 2556 WerFault.exe 160 876 4564 WerFault.exe 165 4448 5400 WerFault.exe 170 6036 1244 WerFault.exe 175 4692 5324 WerFault.exe 180 2124 4292 WerFault.exe 185 1068 3652 WerFault.exe 190 3964 1268 WerFault.exe 195 2612 1300 WerFault.exe 200 2684 1908 WerFault.exe 205 5108 1464 WerFault.exe 210 2772 4152 WerFault.exe 215 2428 6060 WerFault.exe 220 5460 3932 WerFault.exe 225 5660 5604 WerFault.exe 230 2164 428 WerFault.exe 235 2636 5368 WerFault.exe 240 3864 4352 WerFault.exe 245 3732 4004 WerFault.exe 250 2940 3008 WerFault.exe 255 5696 2320 WerFault.exe 260 2848 4420 WerFault.exe 265 5744 4476 WerFault.exe 270 4836 4344 WerFault.exe 274 4460 4692 WerFault.exe 280 3044 4644 WerFault.exe 285 3448 3568 WerFault.exe 291 5176 4296 WerFault.exe 296 5300 2452 WerFault.exe 301 1320 1672 WerFault.exe 306 5676 2108 WerFault.exe 311 2408 204 WerFault.exe 316 5096 3140 WerFault.exe 321 4156 4852 WerFault.exe 326 2636 5456 WerFault.exe 331 4320 5564 WerFault.exe 336 2064 1648 WerFault.exe 341 1528 996 WerFault.exe 346 4704 5956 WerFault.exe 351 2348 3480 WerFault.exe 356 2936 3116 WerFault.exe 361 4660 2720 WerFault.exe 366 2844 2032 WerFault.exe 371 6004 3420 WerFault.exe 376 3464 5920 WerFault.exe 381 5012 4616 WerFault.exe 386 1612 6080 WerFault.exe 391 5392 1528 WerFault.exe 396 3904 2696 WerFault.exe 401 5656 2896 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MEBVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NMDMQKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CINGHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAPBOP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CSWHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HGVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NABVGBR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWUXMUK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSJPXLM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJGNKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MEZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTOVAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WTDWSX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RZOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QOOSP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PPQV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQVQJRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPPGTQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWHPDWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JRJFGK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEMV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCEC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QXJDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JCZJGB.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4976 2026-11-03_444165981028f94fb7a3315dc0e26912_elex_emotet_stop.exe 4976 2026-11-03_444165981028f94fb7a3315dc0e26912_elex_emotet_stop.exe 2412 MWHPDWL.exe 2412 MWHPDWL.exe 2044 YZRC.exe 2044 YZRC.exe 3992 WPDFHGW.exe 3992 WPDFHGW.exe 480 NABVGBR.exe 480 NABVGBR.exe 6124 KGZSNKT.exe 6124 KGZSNKT.exe 5692 BONX.exe 5692 BONX.exe 4684 FWUXMUK.exe 4684 FWUXMUK.exe 5236 GZYB.exe 5236 GZYB.exe 1112 KHMBEC.exe 1112 KHMBEC.exe 4112 QCEC.exe 4112 QCEC.exe 4988 KQILLX.exe 4988 KQILLX.exe 3764 JNCO.exe 3764 JNCO.exe 2988 DBGYIK.exe 2988 DBGYIK.exe 2556 VJIDTHL.exe 2556 VJIDTHL.exe 4564 PWFM.exe 4564 PWFM.exe 5400 ECLJLR.exe 5400 ECLJLR.exe 1244 MHLYMW.exe 1244 MHLYMW.exe 5324 MSUZAIL.exe 5324 MSUZAIL.exe 4292 RSCN.exe 4292 RSCN.exe 3652 RGUBL.exe 3652 RGUBL.exe 1268 MTZLVP.exe 1268 MTZLVP.exe 1300 XMC.exe 1300 XMC.exe 1908 NHLIO.exe 1908 NHLIO.exe 1464 VMLWQW.exe 1464 VMLWQW.exe 4152 EZWO.exe 4152 EZWO.exe 6060 PSR.exe 6060 PSR.exe 3932 CDVF.exe 3932 CDVF.exe 5604 ZASD.exe 5604 ZASD.exe 428 BYUF.exe 428 BYUF.exe 5368 KMEXOVS.exe 5368 KMEXOVS.exe 4352 BMGC.exe 4352 BMGC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4976 2026-11-03_444165981028f94fb7a3315dc0e26912_elex_emotet_stop.exe 4976 2026-11-03_444165981028f94fb7a3315dc0e26912_elex_emotet_stop.exe 2412 MWHPDWL.exe 2412 MWHPDWL.exe 2044 YZRC.exe 2044 YZRC.exe 3992 WPDFHGW.exe 3992 WPDFHGW.exe 480 NABVGBR.exe 480 NABVGBR.exe 6124 KGZSNKT.exe 6124 KGZSNKT.exe 5692 BONX.exe 5692 BONX.exe 4684 FWUXMUK.exe 4684 FWUXMUK.exe 5236 GZYB.exe 5236 GZYB.exe 1112 KHMBEC.exe 1112 KHMBEC.exe 4112 QCEC.exe 4112 QCEC.exe 4988 KQILLX.exe 4988 KQILLX.exe 3764 JNCO.exe 3764 JNCO.exe 2988 DBGYIK.exe 2988 DBGYIK.exe 2556 VJIDTHL.exe 2556 VJIDTHL.exe 4564 PWFM.exe 4564 PWFM.exe 5400 ECLJLR.exe 5400 ECLJLR.exe 1244 MHLYMW.exe 1244 MHLYMW.exe 5324 MSUZAIL.exe 5324 MSUZAIL.exe 4292 RSCN.exe 4292 RSCN.exe 3652 RGUBL.exe 3652 RGUBL.exe 1268 MTZLVP.exe 1268 MTZLVP.exe 1300 XMC.exe 1300 XMC.exe 1908 NHLIO.exe 1908 NHLIO.exe 1464 VMLWQW.exe 1464 VMLWQW.exe 4152 EZWO.exe 4152 EZWO.exe 6060 PSR.exe 6060 PSR.exe 3932 CDVF.exe 3932 CDVF.exe 5604 ZASD.exe 5604 ZASD.exe 428 BYUF.exe 428 BYUF.exe 5368 KMEXOVS.exe 5368 KMEXOVS.exe 4352 BMGC.exe 4352 BMGC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4976 wrote to memory of 6024 4976 2026-11-03_444165981028f94fb7a3315dc0e26912_elex_emotet_stop.exe 89 PID 6024 wrote to memory of 2412 6024 cmd.exe 92 PID 2412 wrote to memory of 1572 2412 MWHPDWL.exe 95 PID 1572 wrote to memory of 2044 1572 cmd.exe 99 PID 2044 wrote to memory of 5240 2044 YZRC.exe 100 PID 5240 wrote to memory of 3992 5240 cmd.exe 104 PID 3992 wrote to memory of 3944 3992 WPDFHGW.exe 105 PID 3944 wrote to memory of 480 3944 cmd.exe 109 PID 480 wrote to memory of 2464 480 NABVGBR.exe 110 PID 2464 wrote to memory of 6124 2464 cmd.exe 114 PID 6124 wrote to memory of 1544 6124 KGZSNKT.exe 115 PID 1544 wrote to memory of 5692 1544 cmd.exe 119 PID 5692 wrote to memory of 2500 5692 BONX.exe 120 PID 2500 wrote to memory of 4684 2500 cmd.exe 124 PID 4684 wrote to memory of 1104 4684 FWUXMUK.exe 125 PID 1104 wrote to memory of 5236 1104 cmd.exe 129 PID 5236 wrote to memory of 3988 5236 GZYB.exe 130 PID 3988 wrote to memory of 1112 3988 cmd.exe 134 PID 1112 wrote to memory of 2620 1112 KHMBEC.exe 136 PID 2620 wrote to memory of 4112 2620 cmd.exe 140 PID 4112 wrote to memory of 5640 4112 QCEC.exe 141 PID 5640 wrote to memory of 4988 5640 cmd.exe 145 PID 4988 wrote to memory of 4356 4988 KQILLX.exe 146 PID 4356 wrote to memory of 3764 4356 cmd.exe 150 PID 3764 wrote to memory of 5652 3764 JNCO.exe 151 PID 5652 wrote to memory of 2988 5652 cmd.exe 155 PID 2988 wrote to memory of 4404 2988 DBGYIK.exe 156 PID 4404 wrote to memory of 2556 4404 cmd.exe 160 PID 2556 wrote to memory of 4100 2556 VJIDTHL.exe 161 PID 4100 wrote to memory of 4564 4100 cmd.exe 165 PID 4564 wrote to memory of 2596 4564 PWFM.exe 166 PID 2596 wrote to memory of 5400 2596 cmd.exe 170 PID 5400 wrote to memory of 5208 5400 ECLJLR.exe 171 PID 5208 wrote to memory of 1244 5208 cmd.exe 175 PID 1244 wrote to memory of 1328 1244 MHLYMW.exe 176 PID 1328 wrote to memory of 5324 1328 cmd.exe 180 PID 5324 wrote to memory of 1260 5324 MSUZAIL.exe 181 PID 1260 wrote to memory of 4292 1260 cmd.exe 185 PID 4292 wrote to memory of 3500 4292 RSCN.exe 186 PID 3500 wrote to memory of 3652 3500 cmd.exe 190 PID 3652 wrote to memory of 4824 3652 RGUBL.exe 191 PID 4824 wrote to memory of 1268 4824 cmd.exe 195 PID 1268 wrote to memory of 2300 1268 MTZLVP.exe 196 PID 2300 wrote to memory of 1300 2300 cmd.exe 200 PID 1300 wrote to memory of 3496 1300 XMC.exe 201 PID 3496 wrote to memory of 1908 3496 cmd.exe 205 PID 1908 wrote to memory of 3756 1908 NHLIO.exe 206 PID 3756 wrote to memory of 1464 3756 cmd.exe 210 PID 1464 wrote to memory of 3444 1464 VMLWQW.exe 211 PID 3444 wrote to memory of 4152 3444 cmd.exe 215 PID 4152 wrote to memory of 1188 4152 EZWO.exe 216 PID 1188 wrote to memory of 6060 1188 cmd.exe 220 PID 6060 wrote to memory of 1200 6060 PSR.exe 221 PID 1200 wrote to memory of 3932 1200 cmd.exe 225 PID 3932 wrote to memory of 5612 3932 CDVF.exe 226 PID 5612 wrote to memory of 5604 5612 cmd.exe 230 PID 5604 wrote to memory of 2880 5604 ZASD.exe 231 PID 2880 wrote to memory of 428 2880 cmd.exe 235 PID 428 wrote to memory of 4848 428 BYUF.exe 236 PID 4848 wrote to memory of 5368 4848 cmd.exe 240 PID 5368 wrote to memory of 3952 5368 KMEXOVS.exe 241 PID 3952 wrote to memory of 4352 3952 cmd.exe 245 PID 4352 wrote to memory of 3396 4352 BMGC.exe 246 PID 3396 wrote to memory of 4004 3396 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_444165981028f94fb7a3315dc0e26912_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_444165981028f94fb7a3315dc0e26912_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MWHPDWL.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\windows\SysWOW64\MWHPDWL.exeC:\windows\system32\MWHPDWL.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZRC.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\windows\system\YZRC.exeC:\windows\system\YZRC.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPDFHGW.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\windows\WPDFHGW.exeC:\windows\WPDFHGW.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NABVGBR.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\windows\SysWOW64\NABVGBR.exeC:\windows\system32\NABVGBR.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGZSNKT.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\windows\SysWOW64\KGZSNKT.exeC:\windows\system32\KGZSNKT.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BONX.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\windows\system\BONX.exeC:\windows\system\BONX.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWUXMUK.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\windows\FWUXMUK.exeC:\windows\FWUXMUK.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZYB.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\windows\GZYB.exeC:\windows\GZYB.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KHMBEC.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\windows\system\KHMBEC.exeC:\windows\system\KHMBEC.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCEC.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\windows\QCEC.exeC:\windows\QCEC.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KQILLX.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\windows\system\KQILLX.exeC:\windows\system\KQILLX.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JNCO.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\windows\JNCO.exeC:\windows\JNCO.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBGYIK.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\windows\SysWOW64\DBGYIK.exeC:\windows\system32\DBGYIK.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VJIDTHL.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\windows\SysWOW64\VJIDTHL.exeC:\windows\system32\VJIDTHL.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWFM.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\windows\PWFM.exeC:\windows\PWFM.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECLJLR.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\windows\system\ECLJLR.exeC:\windows\system\ECLJLR.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MHLYMW.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\windows\MHLYMW.exeC:\windows\MHLYMW.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MSUZAIL.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\windows\SysWOW64\MSUZAIL.exeC:\windows\system32\MSUZAIL.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RSCN.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\windows\RSCN.exeC:\windows\RSCN.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGUBL.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\windows\system\RGUBL.exeC:\windows\system\RGUBL.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MTZLVP.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\SysWOW64\MTZLVP.exeC:\windows\system32\MTZLVP.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XMC.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\windows\XMC.exeC:\windows\XMC.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NHLIO.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\windows\NHLIO.exeC:\windows\NHLIO.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VMLWQW.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\windows\VMLWQW.exeC:\windows\VMLWQW.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EZWO.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\windows\system\EZWO.exeC:\windows\system\EZWO.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PSR.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\windows\PSR.exeC:\windows\PSR.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDVF.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\windows\system\CDVF.exeC:\windows\system\CDVF.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZASD.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\windows\ZASD.exeC:\windows\ZASD.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BYUF.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\windows\SysWOW64\BYUF.exeC:\windows\system32\BYUF.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMEXOVS.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\windows\SysWOW64\KMEXOVS.exeC:\windows\system32\KMEXOVS.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMGC.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\windows\BMGC.exeC:\windows\BMGC.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MEBVA.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\windows\SysWOW64\MEBVA.exeC:\windows\system32\MEBVA.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUQVMAY.exe.bat" "66⤵
- Executes a command shell one-liner
PID:1964 -
C:\windows\QUQVMAY.exeC:\windows\QUQVMAY.exe67⤵
- Executes dropped EXE
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AVK.exe.bat" "68⤵PID:2304
-
C:\windows\AVK.exeC:\windows\AVK.exe69⤵
- Executes dropped EXE
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQBMIK.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:716 -
C:\windows\system\PQBMIK.exeC:\windows\system\PQBMIK.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LVZ.exe.bat" "72⤵PID:1764
-
C:\windows\SysWOW64\LVZ.exeC:\windows\system32\LVZ.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GJELA.exe.bat" "74⤵PID:4164
-
C:\windows\SysWOW64\GJELA.exeC:\windows\system32\GJELA.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHF.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1460 -
C:\windows\SysWOW64\IHF.exeC:\windows\system32\IHF.exe77⤵
- Executes dropped EXE
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MXM.exe.bat" "78⤵
- Executes a command shell one-liner
PID:5688 -
C:\windows\SysWOW64\MXM.exeC:\windows\system32\MXM.exe79⤵
- Executes dropped EXE
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPPGTQL.exe.bat" "80⤵PID:3028
-
C:\windows\system\XPPGTQL.exeC:\windows\system\XPPGTQL.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIK.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5624 -
C:\windows\IIK.exeC:\windows\IIK.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FFPVI.exe.bat" "84⤵
- Executes a command shell one-liner
PID:5932 -
C:\windows\SysWOW64\FFPVI.exeC:\windows\system32\FFPVI.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YITRNXE.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1748 -
C:\windows\SysWOW64\YITRNXE.exeC:\windows\system32\YITRNXE.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AWYB.exe.bat" "88⤵PID:248
-
C:\windows\system\AWYB.exeC:\windows\system\AWYB.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YWGOHR.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:1004 -
C:\windows\SysWOW64\YWGOHR.exeC:\windows\system32\YWGOHR.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BRK.exe.bat" "92⤵PID:4424
-
C:\windows\BRK.exeC:\windows\BRK.exe93⤵
- Executes dropped EXE
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PPQV.exe.bat" "94⤵
- Executes a command shell one-liner
PID:1516 -
C:\windows\system\PPQV.exeC:\windows\system\PPQV.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKVEIA.exe.bat" "96⤵
- Executes a command shell one-liner
PID:5992 -
C:\windows\SysWOW64\KKVEIA.exeC:\windows\system32\KKVEIA.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKVSRD.exe.bat" "98⤵PID:1184
-
C:\windows\SysWOW64\QKVSRD.exeC:\windows\system32\QKVSRD.exe99⤵
- Executes dropped EXE
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYA.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1368 -
C:\windows\system\KYA.exeC:\windows\system\KYA.exe101⤵
- Executes dropped EXE
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SDAYDI.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4808 -
C:\windows\SDAYDI.exeC:\windows\SDAYDI.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HJGNKR.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5924 -
C:\windows\HJGNKR.exeC:\windows\HJGNKR.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZEYW.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3348 -
C:\windows\FZEYW.exeC:\windows\FZEYW.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HWGSCA.exe.bat" "108⤵
- Executes a command shell one-liner
PID:5872 -
C:\windows\HWGSCA.exeC:\windows\HWGSCA.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCDPJKL.exe.bat" "110⤵PID:2660
-
C:\windows\SysWOW64\WCDPJKL.exeC:\windows\system32\WCDPJKL.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVGIRRB.exe.bat" "112⤵
- Executes a command shell one-liner
PID:1352 -
C:\windows\SysWOW64\HVGIRRB.exeC:\windows\system32\HVGIRRB.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQQM.exe.bat" "114⤵PID:1308
-
C:\windows\SysWOW64\WQQM.exeC:\windows\system32\WQQM.exe115⤵
- Executes dropped EXE
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TVWJKN.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4312 -
C:\windows\TVWJKN.exeC:\windows\TVWJKN.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TBWYLAG.exe.bat" "118⤵
- Executes a command shell one-liner
PID:4608 -
C:\windows\SysWOW64\TBWYLAG.exeC:\windows\system32\TBWYLAG.exe119⤵
- Executes dropped EXE
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGUV.exe.bat" "120⤵PID:4032
-
C:\windows\system\PGUV.exeC:\windows\system\PGUV.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-