Analysis
- max time kernel
95s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 19:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-03_5e7cee6501c4583d06b8b0560545c8f6_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-11-03_5e7cee6501c4583d06b8b0560545c8f6_elex_emotet_stop.exe
- Size 208KB
- Sample261104-x2kawscy3v
- SHA256 162912c43794cce940afd50791edbd3498172e15ab72dde01138535eadf9274e
- MD5 5e7cee6501c4583d06b8b0560545c8f6
- SHA1 e149e45046ab0c8fcfcd47d727f034f6fb6ef6c2
- SHA512 d0d19cea3c33533d3b9e069c2560e6ac4bac5c661265aad3b0c1d895ea4074546a86ec57d97ac25228f6ea05454931384a96107db590326d0369237024339531
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfq4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOCkEj1
- TLSH T1B6247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3104 GUC.exe 4700 PSW.exe 5436 TXOXQVE.exe 604 DYQCT.exe 3148 OQLUCI.exe 5912 UQTILKX.exe 3740 OEY.exe 2756 AWBKD.exe 1280 FXIYMLD.exe 3132 JNPG.exe 2300 TNRLCJ.exe 4392 EGUEKRI.exe 4460 KGUS.exe 5704 EBYBDL.exe 2808 HOD.exe 5760 SHGD.exe 5648 CHIIZ.exe 4284 GXPIMQS.exe 5476 GATMRF.exe 592 VYYJYP.exe 5848 KTIO.exe 1368 JEYL.exe 2752 XJEAYG.exe 5432 DKM.exe 4152 JKT.exe 6024 AVK.exe 5812 WAQXE.exe 2836 CBXLNBD.exe 4312 LBZQ.exe 3724 MEDTWW.exe 2468 BZM.exe 2428 LHODT.exe 4908 ACY.exe 2252 GYXQJ.exe 1620 ALCZTEF.exe 4632 QGLEE.exe 1760 ZONJHW.exe 2888 FPVF.exe 4736 ZCAOB.exe 5132 LUDZJGN.exe 1332 QVKUSAO.exe 4148 HGBKZUS.exe 4728 RDOFHDA.exe 3648 GYYJ.exe 4972 BMDSCP.exe 1212 BZVHECS.exe 3932 QUMTX.exe 4904 QAEIY.exe 4856 HNP.exe 4568 TGSKOGZ.exe 5788 EYND.exe 2560 YMSNH.exe 3936 QUUA.exe 4724 QFCT.exe 2076 BXFMY.exe 5632 MQAFHU.exe 1336 DDLXWQF.exe 3908 PVO.exe 4288 SEUQJQ.exe 4820 EWXIRXX.exe 3856 NEZ.exe 1676 EKKFKZ.exe 4944 NSMLOXQ.exe 2092 FSOY.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\MJRG.exe BQW.exe File created C:\windows\SysWOW64\WNHO.exe NIW.exe File created C:\windows\SysWOW64\ZMGUD.exe ZJDRYW.exe File created C:\windows\SysWOW64\FXIYMLD.exe AWBKD.exe File created C:\windows\SysWOW64\CHIIZ.exe SHGD.exe File created C:\windows\SysWOW64\GYXQJ.exe ACY.exe File created C:\windows\SysWOW64\HNP.exe.bat QAEIY.exe File created C:\windows\SysWOW64\BQW.exe.bat VQOZAD.exe File created C:\windows\SysWOW64\WQFQ.exe.bat HVVETH.exe File created C:\windows\SysWOW64\EBYBDL.exe KGUS.exe File opened for modification C:\windows\SysWOW64\KUATVMC.exe LEO.exe File created C:\windows\SysWOW64\CHIIZ.exe.bat SHGD.exe File opened for modification C:\windows\SysWOW64\BZM.exe MEDTWW.exe File created C:\windows\SysWOW64\ALCZTEF.exe.bat GYXQJ.exe File created C:\windows\SysWOW64\YMSNH.exe.bat EYND.exe File created C:\windows\SysWOW64\ZMGUD.exe.bat ZJDRYW.exe File created C:\windows\SysWOW64\TNRLCJ.exe.bat JNPG.exe File opened for modification C:\windows\SysWOW64\ALCZTEF.exe GYXQJ.exe File created C:\windows\SysWOW64\MJRG.exe BQW.exe File created C:\windows\SysWOW64\MFRT.exe DXPOG.exe File opened for modification C:\windows\SysWOW64\WNHO.exe NIW.exe File created C:\windows\SysWOW64\WNHO.exe.bat NIW.exe File created C:\windows\SysWOW64\BZM.exe MEDTWW.exe File created C:\windows\SysWOW64\ACY.exe.bat LHODT.exe File created C:\windows\SysWOW64\ZCAOB.exe.bat FPVF.exe File opened for modification C:\windows\SysWOW64\OCFK.exe LPB.exe File created C:\windows\SysWOW64\NIW.exe VAURI.exe File created C:\windows\SysWOW64\WAQXE.exe AVK.exe File created C:\windows\SysWOW64\KKACQ.exe.bat IMMQIEJ.exe File opened for modification C:\windows\SysWOW64\NIW.exe VAURI.exe File opened for modification C:\windows\SysWOW64\ACY.exe LHODT.exe File created C:\windows\SysWOW64\YMSNH.exe EYND.exe File created C:\windows\SysWOW64\QUUA.exe.bat YMSNH.exe File opened for modification C:\windows\SysWOW64\UPCOFW.exe POUA.exe File created C:\windows\SysWOW64\LPB.exe LJAMJ.exe File created C:\windows\SysWOW64\FWHUI.exe QBQQXKE.exe File created C:\windows\SysWOW64\WQL.exe.bat WNHO.exe File created C:\windows\SysWOW64\AWBKD.exe OEY.exe File created C:\windows\SysWOW64\AWBKD.exe.bat OEY.exe File opened for modification C:\windows\SysWOW64\FXIYMLD.exe AWBKD.exe File opened for modification C:\windows\SysWOW64\JEYL.exe KTIO.exe File opened for modification C:\windows\SysWOW64\WAQXE.exe AVK.exe File created C:\windows\SysWOW64\KKACQ.exe IMMQIEJ.exe File created C:\windows\SysWOW64\SHGD.exe.bat HOD.exe File created C:\windows\SysWOW64\LWJ.exe.bat WQL.exe File created C:\windows\SysWOW64\OQLUCI.exe DYQCT.exe File opened for modification C:\windows\SysWOW64\EBYBDL.exe KGUS.exe File opened for modification C:\windows\SysWOW64\YMSNH.exe EYND.exe File opened for modification C:\windows\SysWOW64\ROHDL.exe HQUJD.exe File created C:\windows\SysWOW64\LBZQ.exe CBXLNBD.exe File created C:\windows\SysWOW64\OQLUCI.exe.bat DYQCT.exe File created C:\windows\SysWOW64\UPCOFW.exe.bat POUA.exe File created C:\windows\SysWOW64\VQOZAD.exe AUKQ.exe File created C:\windows\SysWOW64\QBQQXKE.exe.bat YYMMS.exe File created C:\windows\SysWOW64\NIW.exe.bat VAURI.exe File created C:\windows\SysWOW64\PSW.exe.bat GUC.exe File created C:\windows\SysWOW64\FXIYMLD.exe.bat AWBKD.exe File opened for modification C:\windows\SysWOW64\VYYJYP.exe GATMRF.exe File created C:\windows\SysWOW64\JEYL.exe.bat KTIO.exe File opened for modification C:\windows\SysWOW64\XJEAYG.exe JEYL.exe File created C:\windows\SysWOW64\NEZ.exe EWXIRXX.exe File opened for modification C:\windows\SysWOW64\KKACQ.exe IMMQIEJ.exe File created C:\windows\SysWOW64\ALLFZZN.exe AYTQYM.exe File opened for modification C:\windows\SysWOW64\TXOXQVE.exe PSW.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\UBPQMCV.exe DTNLIW.exe File created C:\windows\system\UBPQMCV.exe.bat DTNLIW.exe File opened for modification C:\windows\XPK.exe NBZJS.exe File opened for modification C:\windows\system\WCSLS.exe GMR.exe File created C:\windows\system\GOJ.exe.bat GJR.exe File opened for modification C:\windows\system\KGUS.exe EGUEKRI.exe File created C:\windows\system\KTIO.exe.bat VYYJYP.exe File created C:\windows\BMDSCP.exe.bat GYYJ.exe File created C:\windows\DDLXWQF.exe MQAFHU.exe File opened for modification C:\windows\DDLXWQF.exe MQAFHU.exe File created C:\windows\system\LUDZJGN.exe.bat ZCAOB.exe File created C:\windows\system\SEUQJQ.exe.bat PVO.exe File opened for modification C:\windows\system\EKKFKZ.exe NEZ.exe File created C:\windows\AUKQ.exe APJ.exe File created C:\windows\YISE.exe.bat PHQ.exe File created C:\windows\system\OEY.exe UQTILKX.exe File created C:\windows\system\LUDZJGN.exe ZCAOB.exe File opened for modification C:\windows\system\EFH.exe YNIJH.exe File created C:\windows\VTWR.exe.bat UYSNGOZ.exe File created C:\windows\UQTILKX.exe OQLUCI.exe File opened for modification C:\windows\system\LHODT.exe BZM.exe File created C:\windows\system\BXFMY.exe.bat QFCT.exe File created C:\windows\system\WYZZD.exe.bat QYZ.exe File opened for modification C:\windows\ZJDRYW.exe VTWR.exe File created C:\windows\JKT.exe.bat DKM.exe File created C:\windows\IMMQIEJ.exe.bat CMFCR.exe File created C:\windows\system\HVVETH.exe WCSLS.exe File opened for modification C:\windows\UQTILKX.exe OQLUCI.exe File opened for modification C:\windows\system\EGUEKRI.exe TNRLCJ.exe File opened for modification C:\windows\NRJFVU.exe KDEW.exe File opened for modification C:\windows\system\WZL.exe NRJFVU.exe File created C:\windows\VFNQJ.exe.bat YFFCSYF.exe File opened for modification C:\windows\NBZJS.exe FWHUI.exe File created C:\windows\ZJDRYW.exe VTWR.exe File opened for modification C:\windows\GATMRF.exe GXPIMQS.exe File created C:\windows\PVO.exe.bat DDLXWQF.exe File opened for modification C:\windows\FSOY.exe NSMLOXQ.exe File created C:\windows\system\NGPVNY.exe VFNQJ.exe File created C:\windows\system\DXPOG.exe.bat OCFK.exe File created C:\windows\DYQCT.exe TXOXQVE.exe File opened for modification C:\windows\system\DKM.exe XJEAYG.exe File opened for modification C:\windows\CBXLNBD.exe WAQXE.exe File created C:\windows\system\LHODT.exe.bat BZM.exe File created C:\windows\FSOY.exe NSMLOXQ.exe File created C:\windows\system\QYZ.exe KKACQ.exe File created C:\windows\system\RJIQBR.exe LWJ.exe File created C:\windows\system\WCSLS.exe GMR.exe File opened for modification C:\windows\BZVHECS.exe BMDSCP.exe File opened for modification C:\windows\system\DXPOG.exe OCFK.exe File created C:\windows\system\IFYQUGY.exe.bat KUATVMC.exe File created C:\windows\TGSKOGZ.exe HNP.exe File created C:\windows\system\EKKFKZ.exe.bat NEZ.exe File created C:\windows\YFFCSYF.exe WZL.exe File opened for modification C:\windows\system\QGLEE.exe ALCZTEF.exe File created C:\windows\NBZJS.exe FWHUI.exe File created C:\windows\XPK.exe.bat NBZJS.exe File created C:\windows\system\GXPIMQS.exe.bat CHIIZ.exe File created C:\windows\system\EFH.exe.bat YNIJH.exe File created C:\windows\CBXLNBD.exe.bat WAQXE.exe File created C:\windows\GATMRF.exe.bat GXPIMQS.exe File created C:\windows\system\HZA.exe.bat QRGGEFR.exe File created C:\windows\system\LEO.exe.bat ALLFZZN.exe File opened for modification C:\windows\YISE.exe PHQ.exe File opened for modification C:\windows\system\QVKUSAO.exe LUDZJGN.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1396 cmd.exe 1928 cmd.exe 3540 cmd.exe 4592 cmd.exe 4880 cmd.exe 2464 cmd.exe 3436 cmd.exe 1688 cmd.exe 4544 cmd.exe 4276 cmd.exe 4620 cmd.exe 1784 cmd.exe 4400 cmd.exe 1656 cmd.exe 3076 cmd.exe 4248 cmd.exe 4404 cmd.exe 2372 cmd.exe 5456 cmd.exe 5920 cmd.exe 2988 cmd.exe 2916 cmd.exe 5464 cmd.exe 4464 cmd.exe 5588 cmd.exe 816 cmd.exe 4144 cmd.exe 2044 cmd.exe 4840 cmd.exe 4264 cmd.exe 5448 cmd.exe 3424 cmd.exe 4640 cmd.exe 4524 cmd.exe 2412 cmd.exe 4680 cmd.exe 6128 cmd.exe 4900 cmd.exe 2248 cmd.exe 5364 cmd.exe 4708 cmd.exe 6132 cmd.exe 5712 cmd.exe 4380 cmd.exe 4236 cmd.exe 4308 cmd.exe 2444 cmd.exe 2332 cmd.exe 1964 cmd.exe 3668 cmd.exe 2628 cmd.exe 2140 cmd.exe 2748 cmd.exe 5420 cmd.exe 4256 cmd.exe 2948 cmd.exe 3568 cmd.exe 3060 cmd.exe 2956 cmd.exe 1916 cmd.exe 752 cmd.exe 3288 cmd.exe 2724 cmd.exe 3672 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2932 4364 WerFault.exe 87 860 3104 WerFault.exe 93 2984 4700 WerFault.exe 99 3036 5436 WerFault.exe 104 5656 604 WerFault.exe 109 4212 3148 WerFault.exe 114 3128 5912 WerFault.exe 119 4052 3740 WerFault.exe 124 4496 2756 WerFault.exe 129 4544 1280 WerFault.exe 134 4804 3132 WerFault.exe 139 4732 2300 WerFault.exe 144 200 4392 WerFault.exe 149 4792 4460 WerFault.exe 154 2796 5704 WerFault.exe 159 4276 2808 WerFault.exe 164 4540 5760 WerFault.exe 169 5188 5648 WerFault.exe 174 4312 4284 WerFault.exe 179 4680 5476 WerFault.exe 184 4804 592 WerFault.exe 189 5056 5848 WerFault.exe 194 920 1368 WerFault.exe 199 2252 2752 WerFault.exe 204 2796 5432 WerFault.exe 209 2876 4152 WerFault.exe 214 2956 6024 WerFault.exe 219 2888 5812 WerFault.exe 224 4496 2836 WerFault.exe 229 4472 4312 WerFault.exe 234 4160 3724 WerFault.exe 239 3392 2468 WerFault.exe 244 1712 2428 WerFault.exe 249 5352 4908 WerFault.exe 254 5920 2252 WerFault.exe 259 956 1620 WerFault.exe 264 5232 4632 WerFault.exe 269 5188 1760 WerFault.exe 274 916 2888 WerFault.exe 279 3472 4736 WerFault.exe 284 6036 5132 WerFault.exe 290 5060 1332 WerFault.exe 295 960 4148 WerFault.exe 300 1116 4728 WerFault.exe 305 1536 3648 WerFault.exe 310 3792 4972 WerFault.exe 315 5216 1212 WerFault.exe 320 4196 3932 WerFault.exe 325 4580 4904 WerFault.exe 330 248 4856 WerFault.exe 335 4964 4568 WerFault.exe 340 200 5788 WerFault.exe 345 5352 2560 WerFault.exe 350 2976 3936 WerFault.exe 355 3200 4724 WerFault.exe 360 3040 2076 WerFault.exe 365 3152 5632 WerFault.exe 370 5128 1336 WerFault.exe 375 5708 3908 WerFault.exe 380 4448 4288 WerFault.exe 385 2648 4820 WerFault.exe 390 4748 3856 WerFault.exe 395 5968 1676 WerFault.exe 400 3540 4944 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWBKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RJIQBR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKKFKZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROHDL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZCAOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVKUSAO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UBPQMCV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QRGGEFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJAMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CHIIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZONJHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFNQJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WNHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYND.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YMSNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMFCR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBZJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UYSNGOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YYMMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWXIRXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBXLNBD.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4364 2026-11-03_5e7cee6501c4583d06b8b0560545c8f6_elex_emotet_stop.exe 4364 2026-11-03_5e7cee6501c4583d06b8b0560545c8f6_elex_emotet_stop.exe 3104 GUC.exe 3104 GUC.exe 4700 PSW.exe 4700 PSW.exe 5436 TXOXQVE.exe 5436 TXOXQVE.exe 604 DYQCT.exe 604 DYQCT.exe 3148 OQLUCI.exe 3148 OQLUCI.exe 5912 UQTILKX.exe 5912 UQTILKX.exe 3740 OEY.exe 3740 OEY.exe 2756 AWBKD.exe 2756 AWBKD.exe 1280 FXIYMLD.exe 1280 FXIYMLD.exe 3132 JNPG.exe 3132 JNPG.exe 2300 TNRLCJ.exe 2300 TNRLCJ.exe 4392 EGUEKRI.exe 4392 EGUEKRI.exe 4460 KGUS.exe 4460 KGUS.exe 5704 EBYBDL.exe 5704 EBYBDL.exe 2808 HOD.exe 2808 HOD.exe 5760 SHGD.exe 5760 SHGD.exe 5648 CHIIZ.exe 5648 CHIIZ.exe 4284 GXPIMQS.exe 4284 GXPIMQS.exe 5476 GATMRF.exe 5476 GATMRF.exe 592 VYYJYP.exe 592 VYYJYP.exe 5848 KTIO.exe 5848 KTIO.exe 1368 JEYL.exe 1368 JEYL.exe 2752 XJEAYG.exe 2752 XJEAYG.exe 5432 DKM.exe 5432 DKM.exe 4152 JKT.exe 4152 JKT.exe 6024 AVK.exe 6024 AVK.exe 5812 WAQXE.exe 5812 WAQXE.exe 2836 CBXLNBD.exe 2836 CBXLNBD.exe 4312 LBZQ.exe 4312 LBZQ.exe 3724 MEDTWW.exe 3724 MEDTWW.exe 2468 BZM.exe 2468 BZM.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4364 2026-11-03_5e7cee6501c4583d06b8b0560545c8f6_elex_emotet_stop.exe 4364 2026-11-03_5e7cee6501c4583d06b8b0560545c8f6_elex_emotet_stop.exe 3104 GUC.exe 3104 GUC.exe 4700 PSW.exe 4700 PSW.exe 5436 TXOXQVE.exe 5436 TXOXQVE.exe 604 DYQCT.exe 604 DYQCT.exe 3148 OQLUCI.exe 3148 OQLUCI.exe 5912 UQTILKX.exe 5912 UQTILKX.exe 3740 OEY.exe 3740 OEY.exe 2756 AWBKD.exe 2756 AWBKD.exe 1280 FXIYMLD.exe 1280 FXIYMLD.exe 3132 JNPG.exe 3132 JNPG.exe 2300 TNRLCJ.exe 2300 TNRLCJ.exe 4392 EGUEKRI.exe 4392 EGUEKRI.exe 4460 KGUS.exe 4460 KGUS.exe 5704 EBYBDL.exe 5704 EBYBDL.exe 2808 HOD.exe 2808 HOD.exe 5760 SHGD.exe 5760 SHGD.exe 5648 CHIIZ.exe 5648 CHIIZ.exe 4284 GXPIMQS.exe 4284 GXPIMQS.exe 5476 GATMRF.exe 5476 GATMRF.exe 592 VYYJYP.exe 592 VYYJYP.exe 5848 KTIO.exe 5848 KTIO.exe 1368 JEYL.exe 1368 JEYL.exe 2752 XJEAYG.exe 2752 XJEAYG.exe 5432 DKM.exe 5432 DKM.exe 4152 JKT.exe 4152 JKT.exe 6024 AVK.exe 6024 AVK.exe 5812 WAQXE.exe 5812 WAQXE.exe 2836 CBXLNBD.exe 2836 CBXLNBD.exe 4312 LBZQ.exe 4312 LBZQ.exe 3724 MEDTWW.exe 3724 MEDTWW.exe 2468 BZM.exe 2468 BZM.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4364 wrote to memory of 2784 4364 2026-11-03_5e7cee6501c4583d06b8b0560545c8f6_elex_emotet_stop.exe 89 PID 2784 wrote to memory of 3104 2784 cmd.exe 93 PID 3104 wrote to memory of 2448 3104 GUC.exe 95 PID 2448 wrote to memory of 4700 2448 cmd.exe 99 PID 4700 wrote to memory of 2008 4700 PSW.exe 100 PID 2008 wrote to memory of 5436 2008 cmd.exe 104 PID 5436 wrote to memory of 4416 5436 TXOXQVE.exe 105 PID 4416 wrote to memory of 604 4416 cmd.exe 109 PID 604 wrote to memory of 3268 604 DYQCT.exe 110 PID 3268 wrote to memory of 3148 3268 cmd.exe 114 PID 3148 wrote to memory of 2332 3148 OQLUCI.exe 115 PID 2332 wrote to memory of 5912 2332 cmd.exe 119 PID 5912 wrote to memory of 4056 5912 UQTILKX.exe 120 PID 4056 wrote to memory of 3740 4056 cmd.exe 124 PID 3740 wrote to memory of 5588 3740 OEY.exe 125 PID 5588 wrote to memory of 2756 5588 cmd.exe 129 PID 2756 wrote to memory of 6096 2756 AWBKD.exe 130 PID 6096 wrote to memory of 1280 6096 cmd.exe 134 PID 1280 wrote to memory of 4768 1280 FXIYMLD.exe 135 PID 4768 wrote to memory of 3132 4768 cmd.exe 139 PID 3132 wrote to memory of 244 3132 JNPG.exe 140 PID 244 wrote to memory of 2300 244 cmd.exe 144 PID 2300 wrote to memory of 4832 2300 TNRLCJ.exe 145 PID 4832 wrote to memory of 4392 4832 cmd.exe 149 PID 4392 wrote to memory of 3288 4392 EGUEKRI.exe 150 PID 3288 wrote to memory of 4460 3288 cmd.exe 154 PID 4460 wrote to memory of 5832 4460 KGUS.exe 155 PID 5832 wrote to memory of 5704 5832 cmd.exe 159 PID 5704 wrote to memory of 2724 5704 EBYBDL.exe 160 PID 2724 wrote to memory of 2808 2724 cmd.exe 164 PID 2808 wrote to memory of 3020 2808 HOD.exe 165 PID 3020 wrote to memory of 5760 3020 cmd.exe 169 PID 5760 wrote to memory of 1868 5760 SHGD.exe 170 PID 1868 wrote to memory of 5648 1868 cmd.exe 174 PID 5648 wrote to memory of 4244 5648 CHIIZ.exe 175 PID 4244 wrote to memory of 4284 4244 cmd.exe 179 PID 4284 wrote to memory of 3784 4284 GXPIMQS.exe 180 PID 3784 wrote to memory of 5476 3784 cmd.exe 184 PID 5476 wrote to memory of 2372 5476 GATMRF.exe 185 PID 2372 wrote to memory of 592 2372 cmd.exe 189 PID 592 wrote to memory of 4708 592 VYYJYP.exe 190 PID 4708 wrote to memory of 5848 4708 cmd.exe 194 PID 5848 wrote to memory of 5840 5848 KTIO.exe 195 PID 5840 wrote to memory of 1368 5840 cmd.exe 199 PID 1368 wrote to memory of 4128 1368 JEYL.exe 200 PID 4128 wrote to memory of 2752 4128 cmd.exe 204 PID 2752 wrote to memory of 3036 2752 XJEAYG.exe 205 PID 3036 wrote to memory of 5432 3036 cmd.exe 209 PID 5432 wrote to memory of 5572 5432 DKM.exe 210 PID 5572 wrote to memory of 4152 5572 cmd.exe 214 PID 4152 wrote to memory of 2464 4152 JKT.exe 215 PID 2464 wrote to memory of 6024 2464 cmd.exe 219 PID 6024 wrote to memory of 1240 6024 AVK.exe 220 PID 1240 wrote to memory of 5812 1240 cmd.exe 224 PID 5812 wrote to memory of 5636 5812 WAQXE.exe 225 PID 5636 wrote to memory of 2836 5636 cmd.exe 229 PID 2836 wrote to memory of 5036 2836 CBXLNBD.exe 230 PID 5036 wrote to memory of 4312 5036 cmd.exe 234 PID 4312 wrote to memory of 1964 4312 LBZQ.exe 235 PID 1964 wrote to memory of 3724 1964 cmd.exe 239 PID 3724 wrote to memory of 816 3724 MEDTWW.exe 240 PID 816 wrote to memory of 2468 816 cmd.exe 244 PID 2468 wrote to memory of 2912 2468 BZM.exe 245 PID 2912 wrote to memory of 2428 2912 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_5e7cee6501c4583d06b8b0560545c8f6_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_5e7cee6501c4583d06b8b0560545c8f6_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GUC.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\windows\system\GUC.exeC:\windows\system\GUC.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PSW.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\windows\SysWOW64\PSW.exeC:\windows\system32\PSW.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXOXQVE.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\windows\SysWOW64\TXOXQVE.exeC:\windows\system32\TXOXQVE.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYQCT.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\windows\DYQCT.exeC:\windows\DYQCT.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OQLUCI.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\windows\SysWOW64\OQLUCI.exeC:\windows\system32\OQLUCI.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UQTILKX.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\windows\UQTILKX.exeC:\windows\UQTILKX.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OEY.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\windows\system\OEY.exeC:\windows\system\OEY.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AWBKD.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\windows\SysWOW64\AWBKD.exeC:\windows\system32\AWBKD.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FXIYMLD.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\windows\SysWOW64\FXIYMLD.exeC:\windows\system32\FXIYMLD.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JNPG.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\windows\JNPG.exeC:\windows\JNPG.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TNRLCJ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:244 -
C:\windows\SysWOW64\TNRLCJ.exeC:\windows\system32\TNRLCJ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EGUEKRI.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\windows\system\EGUEKRI.exeC:\windows\system\EGUEKRI.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KGUS.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\windows\system\KGUS.exeC:\windows\system\KGUS.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EBYBDL.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\windows\SysWOW64\EBYBDL.exeC:\windows\system32\EBYBDL.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HOD.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\windows\HOD.exeC:\windows\HOD.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SHGD.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\windows\SysWOW64\SHGD.exeC:\windows\system32\SHGD.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CHIIZ.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\windows\SysWOW64\CHIIZ.exeC:\windows\system32\CHIIZ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXPIMQS.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\windows\system\GXPIMQS.exeC:\windows\system\GXPIMQS.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GATMRF.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\windows\GATMRF.exeC:\windows\GATMRF.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VYYJYP.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\windows\SysWOW64\VYYJYP.exeC:\windows\system32\VYYJYP.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTIO.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\windows\system\KTIO.exeC:\windows\system\KTIO.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JEYL.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\windows\SysWOW64\JEYL.exeC:\windows\system32\JEYL.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XJEAYG.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\windows\SysWOW64\XJEAYG.exeC:\windows\system32\XJEAYG.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKM.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\windows\system\DKM.exeC:\windows\system\DKM.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JKT.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\windows\JKT.exeC:\windows\JKT.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AVK.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\windows\AVK.exeC:\windows\AVK.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WAQXE.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\windows\SysWOW64\WAQXE.exeC:\windows\system32\WAQXE.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CBXLNBD.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\windows\CBXLNBD.exeC:\windows\CBXLNBD.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LBZQ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\windows\SysWOW64\LBZQ.exeC:\windows\system32\LBZQ.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEDTWW.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\windows\system\MEDTWW.exeC:\windows\system\MEDTWW.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BZM.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:816 -
C:\windows\SysWOW64\BZM.exeC:\windows\system32\BZM.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LHODT.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\windows\system\LHODT.exeC:\windows\system\LHODT.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACY.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3436 -
C:\windows\SysWOW64\ACY.exeC:\windows\system32\ACY.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GYXQJ.exe.bat" "68⤵PID:4204
-
C:\windows\SysWOW64\GYXQJ.exeC:\windows\system32\GYXQJ.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ALCZTEF.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4144 -
C:\windows\SysWOW64\ALCZTEF.exeC:\windows\system32\ALCZTEF.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QGLEE.exe.bat" "72⤵PID:3632
-
C:\windows\system\QGLEE.exeC:\windows\system\QGLEE.exe73⤵
- Executes dropped EXE
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZONJHW.exe.bat" "74⤵
- Executes a command shell one-liner
PID:2044 -
C:\windows\ZONJHW.exeC:\windows\ZONJHW.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FPVF.exe.bat" "76⤵PID:4808
-
C:\windows\system\FPVF.exeC:\windows\system\FPVF.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZCAOB.exe.bat" "78⤵PID:4676
-
C:\windows\SysWOW64\ZCAOB.exeC:\windows\system32\ZCAOB.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LUDZJGN.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4796 -
C:\windows\system\LUDZJGN.exeC:\windows\system\LUDZJGN.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QVKUSAO.exe.bat" "82⤵PID:2704
-
C:\windows\system\QVKUSAO.exeC:\windows\system\QVKUSAO.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HGBKZUS.exe.bat" "84⤵PID:1056
-
C:\windows\HGBKZUS.exeC:\windows\HGBKZUS.exe85⤵
- Executes dropped EXE
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RDOFHDA.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:3900 -
C:\windows\system\RDOFHDA.exeC:\windows\system\RDOFHDA.exe87⤵
- Executes dropped EXE
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYYJ.exe.bat" "88⤵PID:2052
-
C:\windows\GYYJ.exeC:\windows\GYYJ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMDSCP.exe.bat" "90⤵
- Executes a command shell one-liner
PID:5920 -
C:\windows\BMDSCP.exeC:\windows\BMDSCP.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZVHECS.exe.bat" "92⤵
- Executes a command shell one-liner
PID:4256 -
C:\windows\BZVHECS.exeC:\windows\BZVHECS.exe93⤵
- Executes dropped EXE
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUMTX.exe.bat" "94⤵
- Executes a command shell one-liner
PID:6132 -
C:\windows\QUMTX.exeC:\windows\QUMTX.exe95⤵
- Executes dropped EXE
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QAEIY.exe.bat" "96⤵
- Executes a command shell one-liner
PID:1688 -
C:\windows\system\QAEIY.exeC:\windows\system\QAEIY.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HNP.exe.bat" "98⤵PID:1264
-
C:\windows\SysWOW64\HNP.exeC:\windows\system32\HNP.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TGSKOGZ.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5712 -
C:\windows\TGSKOGZ.exeC:\windows\TGSKOGZ.exe101⤵
- Executes dropped EXE
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EYND.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:4936 -
C:\windows\EYND.exeC:\windows\EYND.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YMSNH.exe.bat" "104⤵PID:4684
-
C:\windows\SysWOW64\YMSNH.exeC:\windows\system32\YMSNH.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUUA.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:1944 -
C:\windows\SysWOW64\QUUA.exeC:\windows\system32\QUUA.exe107⤵
- Executes dropped EXE
PID:3936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QFCT.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:2796 -
C:\windows\SysWOW64\QFCT.exeC:\windows\system32\QFCT.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BXFMY.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4404 -
C:\windows\system\BXFMY.exeC:\windows\system\BXFMY.exe111⤵
- Executes dropped EXE
PID:2076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MQAFHU.exe.bat" "112⤵PID:5900
-
C:\windows\MQAFHU.exeC:\windows\MQAFHU.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DDLXWQF.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:6052 -
C:\windows\DDLXWQF.exeC:\windows\DDLXWQF.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PVO.exe.bat" "116⤵PID:2232
-
C:\windows\PVO.exeC:\windows\PVO.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEUQJQ.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5616 -
C:\windows\system\SEUQJQ.exeC:\windows\system\SEUQJQ.exe119⤵
- Executes dropped EXE
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWXIRXX.exe.bat" "120⤵
- Executes a command shell one-liner
PID:2948 -
C:\windows\system\EWXIRXX.exeC:\windows\system\EWXIRXX.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-