Analysis
- max time kernel
93s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 21:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-03_4833279f26ccb409853151967b5cb386_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-11-03_4833279f26ccb409853151967b5cb386_elex_emotet_stop.exe
- Size 208KB
- Sample261104-1ry8vaeg77
- SHA256 2d5ed991e8325f1ab4e7b148cac6eeffb27c67fef813f213abf6da72353c98c3
- MD5 4833279f26ccb409853151967b5cb386
- SHA1 629cc292586809388eddeb899108144a097c367f
- SHA512 8b40a263ced73decd47874550e1d1af80666593993a5a116bed21cdaee88af74a98b5e936fbc60331b90c6fd630f468d1bba22f9198bef61591e33d9be7cb25f
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlFdL+LOfd4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlF5+LO1kEj1
- TLSH T18B247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5944 ZSKQZD.exe 1556 BBHTKKT.exe 1344 HBHHT.exe 5940 BOLYDMR.exe 2532 WCQ.exe 704 VMBYOSU.exe 4736 PIGH.exe 3956 EDPMJFR.exe 2404 MII.exe 108 QYWAX.exe 3388 WZEOOEK.exe 3712 IRZH.exe 3900 IXZV.exe 1548 LFGDCRQ.exe 4768 PVMD.exe 1236 HVOIAHG.exe 5856 ZYSM.exe 4644 PTBQQRQ.exe 2972 EJCQX.exe 3644 XMOLCDO.exe 4904 CNWZT.exe 2548 INWNCZR.exe 4548 YDF.exe 5992 CLLMNF.exe 1752 COPQB.exe 2544 VRTMGTN.exe 5924 QEY.exe 4456 MKDSY.exe 5256 HXICIUS.exe 2040 BKFL.exe 2044 NDIES.exe 4312 SDQSBEY.exe 1216 PJVPQNA.exe 5040 IMZKWD.exe 6020 ZMBXZJD.exe 1304 BKHK.exe 1820 CNL.exe 2736 WAQXE.exe 1564 ROUGHHR.exe 3464 IBF.exe 3364 COKI.exe 5048 OHNBPL.exe 5896 OMFPRX.exe 6008 IIK.exe 4428 ZNUQJU.exe 908 YITRNXE.exe 3928 AWYB.exe 2276 JJITNT.exe 1480 EWN.exe 2228 MKNQ.exe 3024 VPYJH.exe 3596 VDQXQIP.exe 5816 YQVG.exe 2320 JJY.exe 3432 HJGNKR.exe 4120 JWKWURJ.exe 4580 EJPO.exe 4116 PCKYN.exe 3680 VCS.exe 3252 PATOCP.exe 3540 GNDG.exe 5328 RGYZS.exe 2712 MTDJCBO.exe 956 SULW.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\SDQSBEY.exe.bat NDIES.exe File created C:\windows\SysWOW64\XZZV.exe.bat XEVAV.exe File created C:\windows\SysWOW64\PCKYN.exe.bat EJPO.exe File created C:\windows\SysWOW64\PATOCP.exe VCS.exe File opened for modification C:\windows\SysWOW64\PATOCP.exe VCS.exe File created C:\windows\SysWOW64\BLC.exe FFWSMI.exe File created C:\windows\SysWOW64\EGMJ.exe UYK.exe File created C:\windows\SysWOW64\WCQ.exe BOLYDMR.exe File created C:\windows\SysWOW64\VPYJH.exe MKNQ.exe File created C:\windows\SysWOW64\SULW.exe.bat MTDJCBO.exe File created C:\windows\SysWOW64\XSANM.exe LAFU.exe File created C:\windows\SysWOW64\XZZV.exe XEVAV.exe File opened for modification C:\windows\SysWOW64\ROUGHHR.exe WAQXE.exe File opened for modification C:\windows\SysWOW64\VEGEB.exe VLF.exe File opened for modification C:\windows\SysWOW64\BLC.exe FFWSMI.exe File created C:\windows\SysWOW64\TSD.exe HCPXUK.exe File created C:\windows\SysWOW64\HXICIUS.exe.bat MKDSY.exe File created C:\windows\SysWOW64\COKI.exe.bat IBF.exe File created C:\windows\SysWOW64\DHX.exe JUSJOJQ.exe File created C:\windows\SysWOW64\CYI.exe.bat GTCSYA.exe File created C:\windows\SysWOW64\IXZV.exe.bat IRZH.exe File created C:\windows\SysWOW64\XMOLCDO.exe EJCQX.exe File opened for modification C:\windows\SysWOW64\SDQSBEY.exe NDIES.exe File created C:\windows\SysWOW64\YQVG.exe VDQXQIP.exe File opened for modification C:\windows\SysWOW64\PXLKMQP.exe RJLBI.exe File created C:\windows\SysWOW64\JUSJOJQ.exe MOMMH.exe File opened for modification C:\windows\SysWOW64\DHX.exe JUSJOJQ.exe File opened for modification C:\windows\SysWOW64\CYI.exe GTCSYA.exe File created C:\windows\SysWOW64\MII.exe.bat EDPMJFR.exe File created C:\windows\SysWOW64\QEY.exe VRTMGTN.exe File opened for modification C:\windows\SysWOW64\HXICIUS.exe MKDSY.exe File created C:\windows\SysWOW64\YITRNXE.exe ZNUQJU.exe File opened for modification C:\windows\SysWOW64\MROOX.exe XWWBMQW.exe File created C:\windows\SysWOW64\HTZ.exe HNZYIDM.exe File created C:\windows\SysWOW64\HTZ.exe.bat HNZYIDM.exe File created C:\windows\SysWOW64\DHX.exe.bat JUSJOJQ.exe File created C:\windows\SysWOW64\PJVPQNA.exe.bat SDQSBEY.exe File created C:\windows\SysWOW64\COKI.exe IBF.exe File opened for modification C:\windows\SysWOW64\VPYJH.exe MKNQ.exe File created C:\windows\SysWOW64\IXZV.exe IRZH.exe File created C:\windows\SysWOW64\CZTYH.exe HPKZBQH.exe File created C:\windows\SysWOW64\PIGH.exe VMBYOSU.exe File opened for modification C:\windows\SysWOW64\PIGH.exe VMBYOSU.exe File created C:\windows\SysWOW64\PVMD.exe.bat LFGDCRQ.exe File created C:\windows\SysWOW64\PCKYN.exe EJPO.exe File opened for modification C:\windows\SysWOW64\SZLLN.exe SULW.exe File created C:\windows\SysWOW64\WCQ.exe.bat BOLYDMR.exe File opened for modification C:\windows\SysWOW64\SULW.exe MTDJCBO.exe File opened for modification C:\windows\SysWOW64\IXMDE.exe MROOX.exe File created C:\windows\SysWOW64\IXMDE.exe.bat MROOX.exe File created C:\windows\SysWOW64\VEGEB.exe VLF.exe File created C:\windows\SysWOW64\RJLBI.exe VEGEB.exe File created C:\windows\SysWOW64\JUSJOJQ.exe.bat MOMMH.exe File created C:\windows\SysWOW64\GTCSYA.exe.bat XSANM.exe File opened for modification C:\windows\SysWOW64\WCQ.exe BOLYDMR.exe File opened for modification C:\windows\SysWOW64\COPQB.exe CLLMNF.exe File created C:\windows\SysWOW64\COPQB.exe.bat CLLMNF.exe File created C:\windows\SysWOW64\QEY.exe.bat VRTMGTN.exe File created C:\windows\SysWOW64\OFRIC.exe SZLLN.exe File created C:\windows\SysWOW64\XEVAV.exe.bat ZEO.exe File opened for modification C:\windows\SysWOW64\WZEOOEK.exe QYWAX.exe File opened for modification C:\windows\SysWOW64\QEY.exe VRTMGTN.exe File opened for modification C:\windows\SysWOW64\GTCSYA.exe XSANM.exe File opened for modification C:\windows\SysWOW64\EGMJ.exe UYK.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\IIK.exe OMFPRX.exe File created C:\windows\RGYZS.exe.bat GNDG.exe File created C:\windows\DWGRN.exe NEHCG.exe File created C:\windows\system\SYHYPBK.exe SSHKNOP.exe File opened for modification C:\windows\NDIES.exe BKFL.exe File opened for modification C:\windows\ZNUQJU.exe IIK.exe File created C:\windows\system\MKNQ.exe.bat EWN.exe File created C:\windows\HJGNKR.exe.bat JJY.exe File opened for modification C:\windows\WDS.exe UFQWLMW.exe File opened for modification C:\windows\system\XWWBMQW.exe XQENDDU.exe File created C:\windows\system\MOMMH.exe DOKH.exe File created C:\windows\SSHKNOP.exe.bat VNBNYEN.exe File opened for modification C:\windows\BKFL.exe HXICIUS.exe File created C:\windows\system\JWKWURJ.exe HJGNKR.exe File created C:\windows\system\BBHTKKT.exe ZSKQZD.exe File opened for modification C:\windows\system\HBHHT.exe BBHTKKT.exe File created C:\windows\PTBQQRQ.exe.bat ZYSM.exe File created C:\windows\system\EJCQX.exe PTBQQRQ.exe File created C:\windows\system\CLLMNF.exe YDF.exe File created C:\windows\ZNUQJU.exe IIK.exe File opened for modification C:\windows\XQENDDU.exe ALYYW.exe File opened for modification C:\windows\SSHKNOP.exe VNBNYEN.exe File opened for modification C:\windows\system\SYHYPBK.exe SSHKNOP.exe File created C:\windows\system\UJMYORQ.exe AWIGE.exe File created C:\windows\system\YDF.exe INWNCZR.exe File created C:\windows\VRTMGTN.exe COPQB.exe File created C:\windows\VRTMGTN.exe.bat COPQB.exe File created C:\windows\system\JJY.exe.bat YQVG.exe File created C:\windows\system\HNZYIDM.exe.bat SSPU.exe File created C:\windows\UFX.exe.bat XZZV.exe File created C:\windows\system\NIBOVMU.exe UFX.exe File created C:\windows\system\UJMYORQ.exe.bat AWIGE.exe File created C:\windows\system\BOLYDMR.exe HBHHT.exe File created C:\windows\CNL.exe.bat BKHK.exe File created C:\windows\OMFPRX.exe.bat OHNBPL.exe File opened for modification C:\windows\system\EJPO.exe JWKWURJ.exe File created C:\windows\UFQWLMW.exe.bat OFRIC.exe File created C:\windows\system\HQCS.exe.bat WYZZD.exe File opened for modification C:\windows\system\LAFU.exe DHX.exe File created C:\windows\system\VNB.exe.bat NIBOVMU.exe File opened for modification C:\windows\system\HVOIAHG.exe PVMD.exe File created C:\windows\system\WYZZD.exe.bat BLC.exe File created C:\windows\system\NIBOVMU.exe.bat UFX.exe File created C:\windows\KHTXFCH.exe.bat EGMJ.exe File created C:\windows\system\HBHHT.exe BBHTKKT.exe File created C:\windows\QYWAX.exe MII.exe File created C:\windows\ZMBXZJD.exe IMZKWD.exe File created C:\windows\OHNBPL.exe COKI.exe File opened for modification C:\windows\system\JJITNT.exe AWYB.exe File created C:\windows\FFWSMI.exe DPVQGL.exe File created C:\windows\system\OLACKQ.exe DTXKK.exe File created C:\windows\ODFV.exe.bat SYHYPBK.exe File created C:\windows\system\VMBYOSU.exe.bat WCQ.exe File created C:\windows\system\IRZH.exe.bat WZEOOEK.exe File created C:\windows\INWNCZR.exe.bat CNWZT.exe File opened for modification C:\windows\IIK.exe OMFPRX.exe File created C:\windows\KHTXFCH.exe EGMJ.exe File created C:\windows\ZMBXZJD.exe.bat IMZKWD.exe File created C:\windows\BKHK.exe.bat ZMBXZJD.exe File created C:\windows\RGYZS.exe GNDG.exe File opened for modification C:\windows\UYK.exe VNB.exe File created C:\windows\LFGDCRQ.exe.bat IXZV.exe File opened for modification C:\windows\system\YDF.exe INWNCZR.exe File created C:\windows\system\MKNQ.exe EWN.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1816 cmd.exe 1472 cmd.exe 4556 cmd.exe 5628 cmd.exe 4384 cmd.exe 4812 cmd.exe 1432 cmd.exe 4880 cmd.exe 4692 cmd.exe 8 cmd.exe 2248 cmd.exe 2932 cmd.exe 2124 cmd.exe 4416 cmd.exe 3088 cmd.exe 3812 cmd.exe 4908 cmd.exe 5204 cmd.exe 3452 cmd.exe 4528 cmd.exe 4992 cmd.exe 3244 cmd.exe 4244 cmd.exe 616 cmd.exe 5780 cmd.exe 1672 cmd.exe 5208 cmd.exe 2728 cmd.exe 5176 cmd.exe 1740 cmd.exe 1780 cmd.exe 5716 cmd.exe 4240 cmd.exe 712 cmd.exe 5848 cmd.exe 4568 cmd.exe 4276 cmd.exe 5104 cmd.exe 4288 cmd.exe 2628 cmd.exe 3832 cmd.exe 2884 cmd.exe 5468 cmd.exe 5200 cmd.exe 5920 cmd.exe 4128 cmd.exe 2612 cmd.exe 3168 cmd.exe 4232 cmd.exe 4676 cmd.exe 3136 cmd.exe 5980 cmd.exe 4252 cmd.exe 5600 cmd.exe 4916 cmd.exe 5556 cmd.exe 3496 cmd.exe 1708 cmd.exe 3080 cmd.exe 1308 cmd.exe 5396 cmd.exe 4124 cmd.exe 2672 cmd.exe 4156 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5676 2860 WerFault.exe 87 1568 5944 WerFault.exe 93 5384 1556 WerFault.exe 99 3540 1344 WerFault.exe 104 2212 5940 WerFault.exe 109 5988 2532 WerFault.exe 114 5924 704 WerFault.exe 119 4332 4736 WerFault.exe 124 5296 3956 WerFault.exe 129 748 2404 WerFault.exe 134 4904 108 WerFault.exe 139 2548 3388 WerFault.exe 144 4548 3712 WerFault.exe 149 5992 3900 WerFault.exe 154 3576 1548 WerFault.exe 159 5988 4768 WerFault.exe 164 1820 1236 WerFault.exe 169 4648 5856 WerFault.exe 174 4236 4644 WerFault.exe 179 5676 2972 WerFault.exe 184 3744 3644 WerFault.exe 189 3168 4904 WerFault.exe 194 5976 2548 WerFault.exe 199 5540 4548 WerFault.exe 204 4952 5992 WerFault.exe 209 5724 1752 WerFault.exe 214 5720 2544 WerFault.exe 219 1560 5924 WerFault.exe 224 3120 4456 WerFault.exe 229 3864 5256 WerFault.exe 234 1812 2040 WerFault.exe 239 1824 2044 WerFault.exe 244 1336 4312 WerFault.exe 249 5364 1216 WerFault.exe 254 4404 5040 WerFault.exe 259 2772 6020 WerFault.exe 264 1724 1304 WerFault.exe 269 5284 1820 WerFault.exe 274 3120 2736 WerFault.exe 279 4132 1564 WerFault.exe 285 1360 3464 WerFault.exe 290 1276 3364 WerFault.exe 295 3416 5048 WerFault.exe 300 3968 5896 WerFault.exe 305 2728 6008 WerFault.exe 310 4772 4428 WerFault.exe 315 2492 908 WerFault.exe 320 3108 3928 WerFault.exe 325 1580 2276 WerFault.exe 330 3500 1480 WerFault.exe 335 4296 2228 WerFault.exe 340 1568 3024 WerFault.exe 345 2872 3596 WerFault.exe 350 1132 5816 WerFault.exe 355 4148 2320 WerFault.exe 360 572 3432 WerFault.exe 365 3240 4120 WerFault.exe 370 4720 4580 WerFault.exe 375 1980 4116 WerFault.exe 380 4704 3680 WerFault.exe 385 5472 3252 WerFault.exe 390 1744 3540 WerFault.exe 395 4952 5328 WerFault.exe 400 4692 2712 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SULW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DPVQGL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MOMMH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VMBYOSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XWWBMQW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HCPXUK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLACKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VLF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYZZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XZZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAQXE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OMFPRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDQSBEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALYYW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFWSMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INWNCZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EGMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDPMJFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVOIAHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDIES.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTDJCBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LAFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDQXQIP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHNBPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRTMGTN.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2860 2026-11-03_4833279f26ccb409853151967b5cb386_elex_emotet_stop.exe 2860 2026-11-03_4833279f26ccb409853151967b5cb386_elex_emotet_stop.exe 5944 ZSKQZD.exe 5944 ZSKQZD.exe 1556 BBHTKKT.exe 1556 BBHTKKT.exe 1344 HBHHT.exe 1344 HBHHT.exe 5940 BOLYDMR.exe 5940 BOLYDMR.exe 2532 WCQ.exe 2532 WCQ.exe 704 VMBYOSU.exe 704 VMBYOSU.exe 4736 PIGH.exe 4736 PIGH.exe 3956 EDPMJFR.exe 3956 EDPMJFR.exe 2404 MII.exe 2404 MII.exe 108 QYWAX.exe 108 QYWAX.exe 3388 WZEOOEK.exe 3388 WZEOOEK.exe 3712 IRZH.exe 3712 IRZH.exe 3900 IXZV.exe 3900 IXZV.exe 1548 LFGDCRQ.exe 1548 LFGDCRQ.exe 4768 PVMD.exe 4768 PVMD.exe 1236 HVOIAHG.exe 1236 HVOIAHG.exe 5856 ZYSM.exe 5856 ZYSM.exe 4644 PTBQQRQ.exe 4644 PTBQQRQ.exe 2972 EJCQX.exe 2972 EJCQX.exe 3644 XMOLCDO.exe 3644 XMOLCDO.exe 4904 CNWZT.exe 4904 CNWZT.exe 2548 INWNCZR.exe 2548 INWNCZR.exe 4548 YDF.exe 4548 YDF.exe 5992 CLLMNF.exe 5992 CLLMNF.exe 1752 COPQB.exe 1752 COPQB.exe 2544 VRTMGTN.exe 2544 VRTMGTN.exe 5924 QEY.exe 5924 QEY.exe 4456 MKDSY.exe 4456 MKDSY.exe 5256 HXICIUS.exe 5256 HXICIUS.exe 2040 BKFL.exe 2040 BKFL.exe 2044 NDIES.exe 2044 NDIES.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2860 2026-11-03_4833279f26ccb409853151967b5cb386_elex_emotet_stop.exe 2860 2026-11-03_4833279f26ccb409853151967b5cb386_elex_emotet_stop.exe 5944 ZSKQZD.exe 5944 ZSKQZD.exe 1556 BBHTKKT.exe 1556 BBHTKKT.exe 1344 HBHHT.exe 1344 HBHHT.exe 5940 BOLYDMR.exe 5940 BOLYDMR.exe 2532 WCQ.exe 2532 WCQ.exe 704 VMBYOSU.exe 704 VMBYOSU.exe 4736 PIGH.exe 4736 PIGH.exe 3956 EDPMJFR.exe 3956 EDPMJFR.exe 2404 MII.exe 2404 MII.exe 108 QYWAX.exe 108 QYWAX.exe 3388 WZEOOEK.exe 3388 WZEOOEK.exe 3712 IRZH.exe 3712 IRZH.exe 3900 IXZV.exe 3900 IXZV.exe 1548 LFGDCRQ.exe 1548 LFGDCRQ.exe 4768 PVMD.exe 4768 PVMD.exe 1236 HVOIAHG.exe 1236 HVOIAHG.exe 5856 ZYSM.exe 5856 ZYSM.exe 4644 PTBQQRQ.exe 4644 PTBQQRQ.exe 2972 EJCQX.exe 2972 EJCQX.exe 3644 XMOLCDO.exe 3644 XMOLCDO.exe 4904 CNWZT.exe 4904 CNWZT.exe 2548 INWNCZR.exe 2548 INWNCZR.exe 4548 YDF.exe 4548 YDF.exe 5992 CLLMNF.exe 5992 CLLMNF.exe 1752 COPQB.exe 1752 COPQB.exe 2544 VRTMGTN.exe 2544 VRTMGTN.exe 5924 QEY.exe 5924 QEY.exe 4456 MKDSY.exe 4456 MKDSY.exe 5256 HXICIUS.exe 5256 HXICIUS.exe 2040 BKFL.exe 2040 BKFL.exe 2044 NDIES.exe 2044 NDIES.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2860 wrote to memory of 5504 2860 2026-11-03_4833279f26ccb409853151967b5cb386_elex_emotet_stop.exe 89 PID 5504 wrote to memory of 5944 5504 cmd.exe 93 PID 5944 wrote to memory of 2508 5944 ZSKQZD.exe 95 PID 2508 wrote to memory of 1556 2508 cmd.exe 99 PID 1556 wrote to memory of 4984 1556 BBHTKKT.exe 100 PID 4984 wrote to memory of 1344 4984 cmd.exe 104 PID 1344 wrote to memory of 2436 1344 HBHHT.exe 105 PID 2436 wrote to memory of 5940 2436 cmd.exe 109 PID 5940 wrote to memory of 3244 5940 BOLYDMR.exe 110 PID 3244 wrote to memory of 2532 3244 cmd.exe 114 PID 2532 wrote to memory of 5732 2532 WCQ.exe 115 PID 5732 wrote to memory of 704 5732 cmd.exe 119 PID 704 wrote to memory of 3832 704 VMBYOSU.exe 120 PID 3832 wrote to memory of 4736 3832 cmd.exe 124 PID 4736 wrote to memory of 5784 4736 PIGH.exe 125 PID 5784 wrote to memory of 3956 5784 cmd.exe 129 PID 3956 wrote to memory of 5688 3956 EDPMJFR.exe 130 PID 5688 wrote to memory of 2404 5688 cmd.exe 134 PID 2404 wrote to memory of 3812 2404 MII.exe 135 PID 3812 wrote to memory of 108 3812 cmd.exe 139 PID 108 wrote to memory of 712 108 QYWAX.exe 140 PID 712 wrote to memory of 3388 712 cmd.exe 144 PID 3388 wrote to memory of 3548 3388 WZEOOEK.exe 145 PID 3548 wrote to memory of 3712 3548 cmd.exe 149 PID 3712 wrote to memory of 4848 3712 IRZH.exe 150 PID 4848 wrote to memory of 3900 4848 cmd.exe 154 PID 3900 wrote to memory of 1816 3900 IXZV.exe 155 PID 1816 wrote to memory of 1548 1816 cmd.exe 159 PID 1548 wrote to memory of 4232 1548 LFGDCRQ.exe 160 PID 4232 wrote to memory of 4768 4232 cmd.exe 164 PID 4768 wrote to memory of 5928 4768 PVMD.exe 165 PID 5928 wrote to memory of 1236 5928 cmd.exe 169 PID 1236 wrote to memory of 5848 1236 HVOIAHG.exe 170 PID 5848 wrote to memory of 5856 5848 cmd.exe 174 PID 5856 wrote to memory of 4244 5856 ZYSM.exe 175 PID 4244 wrote to memory of 4644 4244 cmd.exe 179 PID 4644 wrote to memory of 4268 4644 PTBQQRQ.exe 180 PID 4268 wrote to memory of 2972 4268 cmd.exe 184 PID 2972 wrote to memory of 5556 2972 EJCQX.exe 185 PID 5556 wrote to memory of 3644 5556 cmd.exe 189 PID 3644 wrote to memory of 5916 3644 XMOLCDO.exe 190 PID 5916 wrote to memory of 4904 5916 cmd.exe 194 PID 4904 wrote to memory of 1428 4904 CNWZT.exe 195 PID 1428 wrote to memory of 2548 1428 cmd.exe 199 PID 2548 wrote to memory of 4708 2548 INWNCZR.exe 200 PID 4708 wrote to memory of 4548 4708 cmd.exe 204 PID 4548 wrote to memory of 900 4548 YDF.exe 205 PID 900 wrote to memory of 5992 900 cmd.exe 209 PID 5992 wrote to memory of 2624 5992 CLLMNF.exe 210 PID 2624 wrote to memory of 1752 2624 cmd.exe 214 PID 1752 wrote to memory of 1956 1752 COPQB.exe 215 PID 1956 wrote to memory of 2544 1956 cmd.exe 219 PID 2544 wrote to memory of 4124 2544 VRTMGTN.exe 220 PID 4124 wrote to memory of 5924 4124 cmd.exe 224 PID 5924 wrote to memory of 5964 5924 QEY.exe 225 PID 5964 wrote to memory of 4456 5964 cmd.exe 229 PID 4456 wrote to memory of 1472 4456 MKDSY.exe 230 PID 1472 wrote to memory of 5256 1472 cmd.exe 234 PID 5256 wrote to memory of 820 5256 HXICIUS.exe 235 PID 820 wrote to memory of 2040 820 cmd.exe 239 PID 2040 wrote to memory of 4616 2040 BKFL.exe 240 PID 4616 wrote to memory of 2044 4616 cmd.exe 244 PID 2044 wrote to memory of 5008 2044 NDIES.exe 245 PID 5008 wrote to memory of 4312 5008 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_4833279f26ccb409853151967b5cb386_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_4833279f26ccb409853151967b5cb386_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZSKQZD.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\windows\SysWOW64\ZSKQZD.exeC:\windows\system32\ZSKQZD.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBHTKKT.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\windows\system\BBHTKKT.exeC:\windows\system\BBHTKKT.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBHHT.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\windows\system\HBHHT.exeC:\windows\system\HBHHT.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BOLYDMR.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\windows\system\BOLYDMR.exeC:\windows\system\BOLYDMR.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCQ.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\windows\SysWOW64\WCQ.exeC:\windows\system32\WCQ.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMBYOSU.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\windows\system\VMBYOSU.exeC:\windows\system\VMBYOSU.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PIGH.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\windows\SysWOW64\PIGH.exeC:\windows\system32\PIGH.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDPMJFR.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\windows\EDPMJFR.exeC:\windows\EDPMJFR.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MII.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\windows\SysWOW64\MII.exeC:\windows\system32\MII.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYWAX.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\windows\QYWAX.exeC:\windows\QYWAX.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WZEOOEK.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:712 -
C:\windows\SysWOW64\WZEOOEK.exeC:\windows\system32\WZEOOEK.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IRZH.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\windows\system\IRZH.exeC:\windows\system\IRZH.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXZV.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\windows\SysWOW64\IXZV.exeC:\windows\system32\IXZV.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFGDCRQ.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\windows\LFGDCRQ.exeC:\windows\LFGDCRQ.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVMD.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\windows\SysWOW64\PVMD.exeC:\windows\system32\PVMD.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HVOIAHG.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\windows\system\HVOIAHG.exeC:\windows\system\HVOIAHG.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZYSM.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\windows\system\ZYSM.exeC:\windows\system\ZYSM.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PTBQQRQ.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\windows\PTBQQRQ.exeC:\windows\PTBQQRQ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EJCQX.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\windows\system\EJCQX.exeC:\windows\system\EJCQX.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XMOLCDO.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\windows\SysWOW64\XMOLCDO.exeC:\windows\system32\XMOLCDO.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNWZT.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\windows\CNWZT.exeC:\windows\CNWZT.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\INWNCZR.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\windows\INWNCZR.exeC:\windows\INWNCZR.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDF.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\windows\system\YDF.exeC:\windows\system\YDF.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLLMNF.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:900 -
C:\windows\system\CLLMNF.exeC:\windows\system\CLLMNF.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COPQB.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\windows\SysWOW64\COPQB.exeC:\windows\system32\COPQB.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRTMGTN.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\windows\VRTMGTN.exeC:\windows\VRTMGTN.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEY.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\windows\SysWOW64\QEY.exeC:\windows\system32\QEY.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKDSY.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\windows\MKDSY.exeC:\windows\MKDSY.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXICIUS.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\windows\SysWOW64\HXICIUS.exeC:\windows\system32\HXICIUS.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKFL.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\windows\BKFL.exeC:\windows\BKFL.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDIES.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\windows\NDIES.exeC:\windows\NDIES.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDQSBEY.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\windows\SysWOW64\SDQSBEY.exeC:\windows\system32\SDQSBEY.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJVPQNA.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:616 -
C:\windows\SysWOW64\PJVPQNA.exeC:\windows\system32\PJVPQNA.exe67⤵
- Executes dropped EXE
PID:1216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMZKWD.exe.bat" "68⤵PID:3908
-
C:\windows\IMZKWD.exeC:\windows\IMZKWD.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZMBXZJD.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4568 -
C:\windows\ZMBXZJD.exeC:\windows\ZMBXZJD.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKHK.exe.bat" "72⤵PID:5548
-
C:\windows\BKHK.exeC:\windows\BKHK.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNL.exe.bat" "74⤵PID:5576
-
C:\windows\CNL.exeC:\windows\CNL.exe75⤵
- Executes dropped EXE
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WAQXE.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:1544 -
C:\windows\SysWOW64\WAQXE.exeC:\windows\system32\WAQXE.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ROUGHHR.exe.bat" "78⤵PID:5292
-
C:\windows\SysWOW64\ROUGHHR.exeC:\windows\system32\ROUGHHR.exe79⤵
- Executes dropped EXE
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IBF.exe.bat" "80⤵
- Executes a command shell one-liner
PID:2884 -
C:\windows\IBF.exeC:\windows\IBF.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COKI.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4556 -
C:\windows\SysWOW64\COKI.exeC:\windows\system32\COKI.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHNBPL.exe.bat" "84⤵PID:5384
-
C:\windows\OHNBPL.exeC:\windows\OHNBPL.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OMFPRX.exe.bat" "86⤵PID:4228
-
C:\windows\OMFPRX.exeC:\windows\OMFPRX.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIK.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:5364 -
C:\windows\IIK.exeC:\windows\IIK.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNUQJU.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4676 -
C:\windows\ZNUQJU.exeC:\windows\ZNUQJU.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YITRNXE.exe.bat" "92⤵PID:4764
-
C:\windows\SysWOW64\YITRNXE.exeC:\windows\system32\YITRNXE.exe93⤵
- Executes dropped EXE
PID:908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AWYB.exe.bat" "94⤵PID:4180
-
C:\windows\system\AWYB.exeC:\windows\system\AWYB.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJITNT.exe.bat" "96⤵
- Executes a command shell one-liner
PID:5628 -
C:\windows\system\JJITNT.exeC:\windows\system\JJITNT.exe97⤵
- Executes dropped EXE
PID:2276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EWN.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:1240 -
C:\windows\EWN.exeC:\windows\EWN.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKNQ.exe.bat" "100⤵PID:2944
-
C:\windows\system\MKNQ.exeC:\windows\system\MKNQ.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPYJH.exe.bat" "102⤵PID:124
-
C:\windows\SysWOW64\VPYJH.exeC:\windows\system32\VPYJH.exe103⤵
- Executes dropped EXE
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDQXQIP.exe.bat" "104⤵
- Executes a command shell one-liner
PID:3088 -
C:\windows\SysWOW64\VDQXQIP.exeC:\windows\system32\VDQXQIP.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YQVG.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4384 -
C:\windows\SysWOW64\YQVG.exeC:\windows\system32\YQVG.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJY.exe.bat" "108⤵PID:6012
-
C:\windows\system\JJY.exeC:\windows\system\JJY.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HJGNKR.exe.bat" "110⤵PID:1368
-
C:\windows\HJGNKR.exeC:\windows\HJGNKR.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWKWURJ.exe.bat" "112⤵PID:5724
-
C:\windows\system\JWKWURJ.exeC:\windows\system\JWKWURJ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EJPO.exe.bat" "114⤵PID:5568
-
C:\windows\system\EJPO.exeC:\windows\system\EJPO.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCKYN.exe.bat" "116⤵PID:792
-
C:\windows\SysWOW64\PCKYN.exeC:\windows\system32\PCKYN.exe117⤵
- Executes dropped EXE
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VCS.exe.bat" "118⤵
- Executes a command shell one-liner
PID:2672 -
C:\windows\VCS.exeC:\windows\VCS.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PATOCP.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4812 -
C:\windows\SysWOW64\PATOCP.exeC:\windows\system32\PATOCP.exe121⤵
- Executes dropped EXE
PID:3252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-