Analysis
- max time kernel
83s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 11:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_0c0567583261164c0f244061aa96e3cc_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-23_0c0567583261164c0f244061aa96e3cc_elex_emotet_stop.exe
- Size 208KB
- Sample260723-ncvkwscc73
- SHA256 73dcdafb41ed4c848ecd1a77ad9e2457d3cb728e0e40995d27cce7a25a6a08bc
- MD5 0c0567583261164c0f244061aa96e3cc
- SHA1 e35ce5f4a1e56b8e22767ee439ba490b32e56b8d
- SHA512 754bc726f7bba006b45b5190b827e6b22afdaf08f67ad8758bf261557cd176743a9f149363bc73bcd3ead44c8e94f50b8765124ca185c6dec03611e560c5e0b1
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlydL+LOfh4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFly5+LOpkEj1
- TLSH T1D8247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6000 QJG.exe 2680 BRNSTQB.exe 5660 QHO.exe 988 UXVSE.exe 612 KNWJ.exe 5380 CIA.exe 3708 SLRR.exe 2400 SGV.exe 6116 LJZR.exe 4372 PZFZ.exe 5364 XFGFI.exe 4580 ZCLZYNV.exe 884 DID.exe 3308 BVV.exe 5896 RYMCDG.exe 1000 LMR.exe 4000 DMLQ.exe 1716 OMAB.exe 2388 YCGW.exe 4716 NSHVP.exe 5324 GVTR.exe 5716 AJYAEY.exe 5976 KGDUU.exe 3144 UPFAXEM.exe 4864 LCQ.exe 5924 WVLK.exe 5008 FVNPZ.exe 4868 PTAKG.exe 1292 KGFTRV.exe 5868 FTK.exe 6044 KUJQK.exe 3048 LXVUPNO.exe 1876 GKAD.exe 896 PSUJD.exe 2052 ENM.exe 5044 KJDWTA.exe 1204 MGQQIJ.exe 1224 BBAUTV.exe 5092 CEEQZ.exe 1952 GMK.exe 4924 PVMD.exe 1432 BDTDBB.exe 3160 UGXHG.exe 1608 PTBQQRQ.exe 4536 SJQQ.exe 5628 VWNINJ.exe 4488 TSMJ.exe 2456 XATJWX.exe 2512 JQHR.exe 3912 SQBWL.exe 5368 PWHTAWF.exe 2592 JJMC.exe 1808 PJUQUY.exe 428 IMX.exe 3804 TFAE.exe 1060 UAEINL.exe 2484 FTHTVBC.exe 1384 AOMK.exe 1984 YEXFSGZ.exe 3400 MJXRUR.exe 4352 GXC.exe 4380 VSMNQE.exe 2500 NSOS.exe 3852 LSVG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\AAEN.exe.bat MUY.exe File created C:\windows\SysWOW64\UXVSE.exe.bat QHO.exe File created C:\windows\SysWOW64\KGFTRV.exe.bat PTAKG.exe File opened for modification C:\windows\SysWOW64\KUJQK.exe FTK.exe File opened for modification C:\windows\SysWOW64\KJDWTA.exe ENM.exe File created C:\windows\SysWOW64\IQKWPAW.exe.bat JSZT.exe File created C:\windows\SysWOW64\MBXYDX.exe VNMG.exe File opened for modification C:\windows\SysWOW64\OFWQ.exe IFOCSWO.exe File created C:\windows\SysWOW64\MUY.exe UUWLDR.exe File created C:\windows\SysWOW64\MUY.exe.bat UUWLDR.exe File created C:\windows\SysWOW64\LJZR.exe SGV.exe File opened for modification C:\windows\SysWOW64\BDTDBB.exe PVMD.exe File created C:\windows\SysWOW64\BDTDBB.exe.bat PVMD.exe File created C:\windows\SysWOW64\TGVUL.exe LSVG.exe File created C:\windows\SysWOW64\BUSK.exe IZOGDDA.exe File created C:\windows\SysWOW64\KKXBOT.exe YCIT.exe File created C:\windows\SysWOW64\BVV.exe.bat DID.exe File opened for modification C:\windows\SysWOW64\FVNPZ.exe WVLK.exe File created C:\windows\SysWOW64\PVMD.exe.bat GMK.exe File opened for modification C:\windows\SysWOW64\IQKWPAW.exe JSZT.exe File created C:\windows\SysWOW64\MBXYDX.exe.bat VNMG.exe File opened for modification C:\windows\SysWOW64\CUUCKU.exe WGV.exe File opened for modification C:\windows\SysWOW64\LSHGWF.exe AAEN.exe File opened for modification C:\windows\SysWOW64\UXVSE.exe QHO.exe File created C:\windows\SysWOW64\KJDWTA.exe ENM.exe File created C:\windows\SysWOW64\BDTDBB.exe PVMD.exe File created C:\windows\SysWOW64\AAHXLBO.exe.bat UFIO.exe File created C:\windows\SysWOW64\LLA.exe MBXYDX.exe File opened for modification C:\windows\SysWOW64\KGFTRV.exe PTAKG.exe File opened for modification C:\windows\SysWOW64\SJQQ.exe PTBQQRQ.exe File opened for modification C:\windows\SysWOW64\AAHXLBO.exe UFIO.exe File opened for modification C:\windows\SysWOW64\YCGW.exe OMAB.exe File created C:\windows\SysWOW64\FVNPZ.exe WVLK.exe File created C:\windows\SysWOW64\KGFTRV.exe PTAKG.exe File opened for modification C:\windows\SysWOW64\PVMD.exe GMK.exe File created C:\windows\SysWOW64\BUSK.exe.bat IZOGDDA.exe File opened for modification C:\windows\SysWOW64\LLA.exe MBXYDX.exe File created C:\windows\SysWOW64\CUUCKU.exe WGV.exe File opened for modification C:\windows\SysWOW64\MUY.exe UUWLDR.exe File created C:\windows\SysWOW64\PVMD.exe GMK.exe File created C:\windows\SysWOW64\SJQQ.exe.bat PTBQQRQ.exe File created C:\windows\SysWOW64\YEXFSGZ.exe.bat AOMK.exe File created C:\windows\SysWOW64\IQKWPAW.exe JSZT.exe File created C:\windows\SysWOW64\CUUCKU.exe.bat WGV.exe File created C:\windows\SysWOW64\IXYTL.exe.bat GUXEB.exe File created C:\windows\SysWOW64\LSHGWF.exe AAEN.exe File created C:\windows\SysWOW64\SGV.exe SLRR.exe File created C:\windows\SysWOW64\SGV.exe.bat SLRR.exe File created C:\windows\SysWOW64\LJZR.exe.bat SGV.exe File created C:\windows\SysWOW64\KUJQK.exe FTK.exe File opened for modification C:\windows\SysWOW64\YEXFSGZ.exe AOMK.exe File opened for modification C:\windows\SysWOW64\BUSK.exe IZOGDDA.exe File created C:\windows\SysWOW64\AAHXLBO.exe UFIO.exe File created C:\windows\SysWOW64\OFWQ.exe IFOCSWO.exe File opened for modification C:\windows\SysWOW64\SGV.exe SLRR.exe File created C:\windows\SysWOW64\KJDWTA.exe.bat ENM.exe File created C:\windows\SysWOW64\MGQQIJ.exe KJDWTA.exe File opened for modification C:\windows\SysWOW64\TGVUL.exe LSVG.exe File created C:\windows\SysWOW64\TGVUL.exe.bat LSVG.exe File created C:\windows\SysWOW64\UXVSE.exe QHO.exe File opened for modification C:\windows\SysWOW64\LJZR.exe SGV.exe File created C:\windows\SysWOW64\LXVUPNO.exe KUJQK.exe File created C:\windows\SysWOW64\SJQQ.exe PTBQQRQ.exe File created C:\windows\SysWOW64\AAEN.exe MUY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\LMR.exe RYMCDG.exe File created C:\windows\ENM.exe PSUJD.exe File created C:\windows\system\MQG.exe OFWQ.exe File created C:\windows\PZFZ.exe.bat LJZR.exe File opened for modification C:\windows\XFGFI.exe PZFZ.exe File opened for modification C:\windows\VWNINJ.exe SJQQ.exe File opened for modification C:\windows\system\SQBWL.exe JQHR.exe File created C:\windows\SBBGSZJ.exe.bat LLA.exe File created C:\windows\system\EIJXDB.exe.bat GTX.exe File created C:\windows\VWNINJ.exe SJQQ.exe File created C:\windows\system\LSVG.exe.bat NSOS.exe File created C:\windows\DMLQ.exe LMR.exe File opened for modification C:\windows\JQHR.exe XATJWX.exe File created C:\windows\FTHTVBC.exe UAEINL.exe File opened for modification C:\windows\QJG.exe 2026-07-23_0c0567583261164c0f244061aa96e3cc_elex_emotet_stop.exe File created C:\windows\UGXHG.exe.bat BDTDBB.exe File created C:\windows\system\YVF.exe JFEM.exe File opened for modification C:\windows\PTAKG.exe FVNPZ.exe File created C:\windows\JQHR.exe.bat XATJWX.exe File opened for modification C:\windows\PJUQUY.exe JJMC.exe File opened for modification C:\windows\system\MJXRUR.exe YEXFSGZ.exe File created C:\windows\CLQKVR.exe MQG.exe File created C:\windows\NSHVP.exe.bat YCGW.exe File created C:\windows\LCQ.exe UPFAXEM.exe File created C:\windows\BBAUTV.exe.bat MGQQIJ.exe File opened for modification C:\windows\system\CRSPY.exe YBMHLJP.exe File opened for modification C:\windows\JFEM.exe ORZDPYU.exe File created C:\windows\system\BRNSTQB.exe.bat QJG.exe File opened for modification C:\windows\system\GXC.exe MJXRUR.exe File created C:\windows\system\MQG.exe.bat OFWQ.exe File created C:\windows\system\SLRR.exe CIA.exe File created C:\windows\system\GMK.exe CEEQZ.exe File opened for modification C:\windows\system\LSVG.exe NSOS.exe File created C:\windows\XOCU.exe.bat TGVUL.exe File created C:\windows\system\RBHDAB.exe.bat XOCU.exe File opened for modification C:\windows\system\LMR.exe RYMCDG.exe File opened for modification C:\windows\UPFAXEM.exe KGDUU.exe File created C:\windows\XATJWX.exe.bat TSMJ.exe File created C:\windows\UUWLDR.exe CRSPY.exe File opened for modification C:\windows\AJYAEY.exe GVTR.exe File created C:\windows\system\JJMC.exe.bat PWHTAWF.exe File opened for modification C:\windows\system\SEL.exe RBHDAB.exe File opened for modification C:\windows\SBBGSZJ.exe LLA.exe File opened for modification C:\windows\GVTR.exe NSHVP.exe File opened for modification C:\windows\ENM.exe PSUJD.exe File created C:\windows\system\VSMNQE.exe.bat GXC.exe File created C:\windows\system\IFOCSWO.exe KKXBOT.exe File created C:\windows\system\UEUTEZ.exe.bat IMRA.exe File opened for modification C:\windows\system\BRNSTQB.exe QJG.exe File opened for modification C:\windows\system\SLRR.exe CIA.exe File created C:\windows\system\GMK.exe.bat CEEQZ.exe File created C:\windows\system\RBHDAB.exe XOCU.exe File created C:\windows\system\YBMHLJP.exe EIJXDB.exe File created C:\windows\KNWJ.exe UXVSE.exe File created C:\windows\XFGFI.exe.bat PZFZ.exe File opened for modification C:\windows\DID.exe ZCLZYNV.exe File created C:\windows\OMAB.exe DMLQ.exe File created C:\windows\UAEINL.exe TFAE.exe File created C:\windows\system\LSVG.exe NSOS.exe File created C:\windows\JFEM.exe ORZDPYU.exe File opened for modification C:\windows\NSHVP.exe YCGW.exe File created C:\windows\WGV.exe.bat CLQKVR.exe File created C:\windows\PZFZ.exe LJZR.exe File opened for modification C:\windows\BBAUTV.exe MGQQIJ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4752 cmd.exe 5688 cmd.exe 948 cmd.exe 6028 cmd.exe 2028 cmd.exe 4596 cmd.exe 2412 cmd.exe 5404 cmd.exe 4272 cmd.exe 4624 cmd.exe 4468 cmd.exe 5356 cmd.exe 4520 cmd.exe 2208 cmd.exe 244 cmd.exe 1480 cmd.exe 1360 cmd.exe 4792 cmd.exe 2132 cmd.exe 3336 cmd.exe 4532 cmd.exe 4560 cmd.exe 3876 cmd.exe 4652 cmd.exe 3868 cmd.exe 3828 cmd.exe 5560 cmd.exe 5212 cmd.exe 6036 cmd.exe 2876 cmd.exe 5568 cmd.exe 2900 cmd.exe 1612 cmd.exe 2096 cmd.exe 1044 cmd.exe 4928 cmd.exe 5244 cmd.exe 5928 cmd.exe 3436 cmd.exe 5296 cmd.exe 4268 cmd.exe 2732 cmd.exe 4276 cmd.exe 1684 cmd.exe 2612 cmd.exe 5312 cmd.exe 3004 cmd.exe 4492 cmd.exe 3704 cmd.exe 8 cmd.exe 1956 cmd.exe 928 cmd.exe 4336 cmd.exe 2720 cmd.exe 4484 cmd.exe 4180 cmd.exe 5472 cmd.exe 892 cmd.exe 2000 cmd.exe 3432 cmd.exe 1768 cmd.exe 1712 cmd.exe 5000 cmd.exe 4552 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4168 5832 WerFault.exe 88 6060 6000 WerFault.exe 93 1808 2680 WerFault.exe 99 3036 5660 WerFault.exe 104 4484 988 WerFault.exe 109 1392 612 WerFault.exe 114 5560 5380 WerFault.exe 119 2292 3708 WerFault.exe 124 3996 2400 WerFault.exe 129 1572 6116 WerFault.exe 134 3944 4372 WerFault.exe 139 2592 5364 WerFault.exe 144 2476 4580 WerFault.exe 149 5392 884 WerFault.exe 154 2960 3308 WerFault.exe 159 4484 5896 WerFault.exe 164 4444 1000 WerFault.exe 169 1228 4000 WerFault.exe 174 6068 1716 WerFault.exe 179 3996 2388 WerFault.exe 184 3868 4716 WerFault.exe 189 5356 5324 WerFault.exe 194 256 5716 WerFault.exe 199 4148 5976 WerFault.exe 204 2252 3144 WerFault.exe 209 1840 4864 WerFault.exe 214 4996 5924 WerFault.exe 219 3492 5008 WerFault.exe 224 3292 4868 WerFault.exe 229 5184 1292 WerFault.exe 234 2488 5868 WerFault.exe 239 352 6044 WerFault.exe 244 4792 3048 WerFault.exe 249 6096 1876 WerFault.exe 254 2252 896 WerFault.exe 259 1104 2052 WerFault.exe 264 5104 5044 WerFault.exe 269 5956 1204 WerFault.exe 274 5244 1224 WerFault.exe 280 3996 5092 WerFault.exe 285 3732 1952 WerFault.exe 290 2776 4924 WerFault.exe 295 1768 1432 WerFault.exe 300 1420 3160 WerFault.exe 305 5876 1608 WerFault.exe 310 2152 4536 WerFault.exe 315 3280 5628 WerFault.exe 320 1392 4488 WerFault.exe 325 1676 2456 WerFault.exe 330 1156 2512 WerFault.exe 335 4560 3912 WerFault.exe 340 4492 5368 WerFault.exe 345 5640 2592 WerFault.exe 350 4208 1808 WerFault.exe 355 5980 428 WerFault.exe 360 2144 3804 WerFault.exe 365 1412 1060 WerFault.exe 370 5824 2484 WerFault.exe 375 5276 1384 WerFault.exe 380 3732 1984 WerFault.exe 385 1548 3400 WerFault.exe 390 2740 4352 WerFault.exe 395 4548 4380 WerFault.exe 400 3120 2500 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RYMCDG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGFTRV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQBWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BRNSTQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJUQUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAEN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KNWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRSPY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBAUTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PVMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JQHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WVLK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VWNINJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBHDAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXVUPNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGXHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSMNQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZCLZYNV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OMAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPFAXEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUSK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MQG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFAE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UAEINL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5832 2026-07-23_0c0567583261164c0f244061aa96e3cc_elex_emotet_stop.exe 5832 2026-07-23_0c0567583261164c0f244061aa96e3cc_elex_emotet_stop.exe 6000 QJG.exe 6000 QJG.exe 2680 BRNSTQB.exe 2680 BRNSTQB.exe 5660 QHO.exe 5660 QHO.exe 988 UXVSE.exe 988 UXVSE.exe 612 KNWJ.exe 612 KNWJ.exe 5380 CIA.exe 5380 CIA.exe 3708 SLRR.exe 3708 SLRR.exe 2400 SGV.exe 2400 SGV.exe 6116 LJZR.exe 6116 LJZR.exe 4372 PZFZ.exe 4372 PZFZ.exe 5364 XFGFI.exe 5364 XFGFI.exe 4580 ZCLZYNV.exe 4580 ZCLZYNV.exe 884 DID.exe 884 DID.exe 3308 BVV.exe 3308 BVV.exe 5896 RYMCDG.exe 5896 RYMCDG.exe 1000 LMR.exe 1000 LMR.exe 4000 DMLQ.exe 4000 DMLQ.exe 1716 OMAB.exe 1716 OMAB.exe 2388 YCGW.exe 2388 YCGW.exe 4716 NSHVP.exe 4716 NSHVP.exe 5324 GVTR.exe 5324 GVTR.exe 5716 AJYAEY.exe 5716 AJYAEY.exe 5976 KGDUU.exe 5976 KGDUU.exe 3144 UPFAXEM.exe 3144 UPFAXEM.exe 4864 LCQ.exe 4864 LCQ.exe 5924 WVLK.exe 5924 WVLK.exe 5008 FVNPZ.exe 5008 FVNPZ.exe 4868 PTAKG.exe 4868 PTAKG.exe 1292 KGFTRV.exe 1292 KGFTRV.exe 5868 FTK.exe 5868 FTK.exe 6044 KUJQK.exe 6044 KUJQK.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5832 2026-07-23_0c0567583261164c0f244061aa96e3cc_elex_emotet_stop.exe 5832 2026-07-23_0c0567583261164c0f244061aa96e3cc_elex_emotet_stop.exe 6000 QJG.exe 6000 QJG.exe 2680 BRNSTQB.exe 2680 BRNSTQB.exe 5660 QHO.exe 5660 QHO.exe 988 UXVSE.exe 988 UXVSE.exe 612 KNWJ.exe 612 KNWJ.exe 5380 CIA.exe 5380 CIA.exe 3708 SLRR.exe 3708 SLRR.exe 2400 SGV.exe 2400 SGV.exe 6116 LJZR.exe 6116 LJZR.exe 4372 PZFZ.exe 4372 PZFZ.exe 5364 XFGFI.exe 5364 XFGFI.exe 4580 ZCLZYNV.exe 4580 ZCLZYNV.exe 884 DID.exe 884 DID.exe 3308 BVV.exe 3308 BVV.exe 5896 RYMCDG.exe 5896 RYMCDG.exe 1000 LMR.exe 1000 LMR.exe 4000 DMLQ.exe 4000 DMLQ.exe 1716 OMAB.exe 1716 OMAB.exe 2388 YCGW.exe 2388 YCGW.exe 4716 NSHVP.exe 4716 NSHVP.exe 5324 GVTR.exe 5324 GVTR.exe 5716 AJYAEY.exe 5716 AJYAEY.exe 5976 KGDUU.exe 5976 KGDUU.exe 3144 UPFAXEM.exe 3144 UPFAXEM.exe 4864 LCQ.exe 4864 LCQ.exe 5924 WVLK.exe 5924 WVLK.exe 5008 FVNPZ.exe 5008 FVNPZ.exe 4868 PTAKG.exe 4868 PTAKG.exe 1292 KGFTRV.exe 1292 KGFTRV.exe 5868 FTK.exe 5868 FTK.exe 6044 KUJQK.exe 6044 KUJQK.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5832 wrote to memory of 5152 5832 2026-07-23_0c0567583261164c0f244061aa96e3cc_elex_emotet_stop.exe 89 PID 5152 wrote to memory of 6000 5152 cmd.exe 93 PID 6000 wrote to memory of 4816 6000 QJG.exe 95 PID 4816 wrote to memory of 2680 4816 cmd.exe 99 PID 2680 wrote to memory of 1376 2680 BRNSTQB.exe 100 PID 1376 wrote to memory of 5660 1376 cmd.exe 104 PID 5660 wrote to memory of 5928 5660 QHO.exe 105 PID 5928 wrote to memory of 988 5928 cmd.exe 109 PID 988 wrote to memory of 4400 988 UXVSE.exe 110 PID 4400 wrote to memory of 612 4400 cmd.exe 114 PID 612 wrote to memory of 2876 612 KNWJ.exe 115 PID 2876 wrote to memory of 5380 2876 cmd.exe 119 PID 5380 wrote to memory of 2304 5380 CIA.exe 120 PID 2304 wrote to memory of 3708 2304 cmd.exe 124 PID 3708 wrote to memory of 1588 3708 SLRR.exe 125 PID 1588 wrote to memory of 2400 1588 cmd.exe 129 PID 2400 wrote to memory of 6056 2400 SGV.exe 130 PID 6056 wrote to memory of 6116 6056 cmd.exe 134 PID 6116 wrote to memory of 5736 6116 LJZR.exe 135 PID 5736 wrote to memory of 4372 5736 cmd.exe 139 PID 4372 wrote to memory of 3296 4372 PZFZ.exe 140 PID 3296 wrote to memory of 5364 3296 cmd.exe 144 PID 5364 wrote to memory of 1712 5364 XFGFI.exe 145 PID 1712 wrote to memory of 4580 1712 cmd.exe 149 PID 4580 wrote to memory of 3876 4580 ZCLZYNV.exe 150 PID 3876 wrote to memory of 884 3876 cmd.exe 154 PID 884 wrote to memory of 2328 884 DID.exe 155 PID 2328 wrote to memory of 3308 2328 cmd.exe 159 PID 3308 wrote to memory of 1116 3308 BVV.exe 160 PID 1116 wrote to memory of 5896 1116 cmd.exe 164 PID 5896 wrote to memory of 4640 5896 RYMCDG.exe 165 PID 4640 wrote to memory of 1000 4640 cmd.exe 169 PID 1000 wrote to memory of 4616 1000 LMR.exe 170 PID 4616 wrote to memory of 4000 4616 cmd.exe 174 PID 4000 wrote to memory of 2720 4000 DMLQ.exe 175 PID 2720 wrote to memory of 1716 2720 cmd.exe 179 PID 1716 wrote to memory of 4468 1716 OMAB.exe 180 PID 4468 wrote to memory of 2388 4468 cmd.exe 184 PID 2388 wrote to memory of 5568 2388 YCGW.exe 185 PID 5568 wrote to memory of 4716 5568 cmd.exe 189 PID 4716 wrote to memory of 3436 4716 NSHVP.exe 190 PID 3436 wrote to memory of 5324 3436 cmd.exe 194 PID 5324 wrote to memory of 4624 5324 GVTR.exe 195 PID 4624 wrote to memory of 5716 4624 cmd.exe 199 PID 5716 wrote to memory of 4684 5716 AJYAEY.exe 200 PID 4684 wrote to memory of 5976 4684 cmd.exe 204 PID 5976 wrote to memory of 260 5976 KGDUU.exe 205 PID 260 wrote to memory of 3144 260 cmd.exe 209 PID 3144 wrote to memory of 948 3144 UPFAXEM.exe 210 PID 948 wrote to memory of 4864 948 cmd.exe 214 PID 4864 wrote to memory of 3828 4864 LCQ.exe 215 PID 3828 wrote to memory of 5924 3828 cmd.exe 219 PID 5924 wrote to memory of 4484 5924 WVLK.exe 220 PID 4484 wrote to memory of 5008 4484 cmd.exe 224 PID 5008 wrote to memory of 5620 5008 FVNPZ.exe 225 PID 5620 wrote to memory of 4868 5620 cmd.exe 229 PID 4868 wrote to memory of 4752 4868 PTAKG.exe 230 PID 4752 wrote to memory of 1292 4752 cmd.exe 234 PID 1292 wrote to memory of 2900 1292 KGFTRV.exe 235 PID 2900 wrote to memory of 5868 2900 cmd.exe 239 PID 5868 wrote to memory of 2944 5868 FTK.exe 240 PID 2944 wrote to memory of 6044 2944 cmd.exe 244 PID 6044 wrote to memory of 4652 6044 KUJQK.exe 245 PID 4652 wrote to memory of 3048 4652 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_0c0567583261164c0f244061aa96e3cc_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_0c0567583261164c0f244061aa96e3cc_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QJG.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\windows\QJG.exeC:\windows\QJG.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BRNSTQB.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\windows\system\BRNSTQB.exeC:\windows\system\BRNSTQB.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHO.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\windows\system\QHO.exeC:\windows\system\QHO.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UXVSE.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\windows\SysWOW64\UXVSE.exeC:\windows\system32\UXVSE.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KNWJ.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\windows\KNWJ.exeC:\windows\KNWJ.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CIA.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\windows\system\CIA.exeC:\windows\system\CIA.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SLRR.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\windows\system\SLRR.exeC:\windows\system\SLRR.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SGV.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\windows\SysWOW64\SGV.exeC:\windows\system32\SGV.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJZR.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\windows\SysWOW64\LJZR.exeC:\windows\system32\LJZR.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PZFZ.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\windows\PZFZ.exeC:\windows\PZFZ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFGFI.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\windows\XFGFI.exeC:\windows\XFGFI.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZCLZYNV.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\windows\ZCLZYNV.exeC:\windows\ZCLZYNV.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DID.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\windows\DID.exeC:\windows\DID.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BVV.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\windows\SysWOW64\BVV.exeC:\windows\system32\BVV.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RYMCDG.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\windows\RYMCDG.exeC:\windows\RYMCDG.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMR.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\windows\system\LMR.exeC:\windows\system\LMR.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMLQ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\windows\DMLQ.exeC:\windows\DMLQ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OMAB.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\windows\OMAB.exeC:\windows\OMAB.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YCGW.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\SysWOW64\YCGW.exeC:\windows\system32\YCGW.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NSHVP.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\windows\NSHVP.exeC:\windows\NSHVP.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GVTR.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\windows\GVTR.exeC:\windows\GVTR.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AJYAEY.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\windows\AJYAEY.exeC:\windows\AJYAEY.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGDUU.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\windows\KGDUU.exeC:\windows\KGDUU.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPFAXEM.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:260 -
C:\windows\UPFAXEM.exeC:\windows\UPFAXEM.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCQ.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:948 -
C:\windows\LCQ.exeC:\windows\LCQ.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WVLK.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\windows\system\WVLK.exeC:\windows\system\WVLK.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FVNPZ.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\windows\SysWOW64\FVNPZ.exeC:\windows\system32\FVNPZ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PTAKG.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\windows\PTAKG.exeC:\windows\PTAKG.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGFTRV.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\windows\SysWOW64\KGFTRV.exeC:\windows\system32\KGFTRV.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTK.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\windows\FTK.exeC:\windows\FTK.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUJQK.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\windows\SysWOW64\KUJQK.exeC:\windows\system32\KUJQK.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LXVUPNO.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\windows\SysWOW64\LXVUPNO.exeC:\windows\system32\LXVUPNO.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKAD.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:4964 -
C:\windows\system\GKAD.exeC:\windows\system\GKAD.exe67⤵
- Executes dropped EXE
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PSUJD.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1512 -
C:\windows\system\PSUJD.exeC:\windows\system\PSUJD.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENM.exe.bat" "70⤵PID:2796
-
C:\windows\ENM.exeC:\windows\ENM.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJDWTA.exe.bat" "72⤵
- Executes a command shell one-liner
PID:5000 -
C:\windows\SysWOW64\KJDWTA.exeC:\windows\system32\KJDWTA.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MGQQIJ.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:5644 -
C:\windows\SysWOW64\MGQQIJ.exeC:\windows\system32\MGQQIJ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BBAUTV.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:4384 -
C:\windows\BBAUTV.exeC:\windows\BBAUTV.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CEEQZ.exe.bat" "78⤵PID:4980
-
C:\windows\system\CEEQZ.exeC:\windows\system\CEEQZ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GMK.exe.bat" "80⤵PID:788
-
C:\windows\system\GMK.exeC:\windows\system\GMK.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVMD.exe.bat" "82⤵PID:3092
-
C:\windows\SysWOW64\PVMD.exeC:\windows\system32\PVMD.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDTDBB.exe.bat" "84⤵PID:3392
-
C:\windows\SysWOW64\BDTDBB.exeC:\windows\system32\BDTDBB.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UGXHG.exe.bat" "86⤵PID:5456
-
C:\windows\UGXHG.exeC:\windows\UGXHG.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PTBQQRQ.exe.bat" "88⤵PID:236
-
C:\windows\PTBQQRQ.exeC:\windows\PTBQQRQ.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SJQQ.exe.bat" "90⤵PID:1316
-
C:\windows\SysWOW64\SJQQ.exeC:\windows\system32\SJQQ.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VWNINJ.exe.bat" "92⤵
- Executes a command shell one-liner
PID:2612 -
C:\windows\VWNINJ.exeC:\windows\VWNINJ.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSMJ.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5296 -
C:\windows\TSMJ.exeC:\windows\TSMJ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XATJWX.exe.bat" "96⤵PID:3360
-
C:\windows\XATJWX.exeC:\windows\XATJWX.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JQHR.exe.bat" "98⤵
- Executes a command shell one-liner
PID:5312 -
C:\windows\JQHR.exeC:\windows\JQHR.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQBWL.exe.bat" "100⤵PID:616
-
C:\windows\system\SQBWL.exeC:\windows\system\SQBWL.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWHTAWF.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4336 -
C:\windows\system\PWHTAWF.exeC:\windows\system\PWHTAWF.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJMC.exe.bat" "104⤵PID:4936
-
C:\windows\system\JJMC.exeC:\windows\system\JJMC.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJUQUY.exe.bat" "106⤵
- Executes a command shell one-liner
PID:1768 -
C:\windows\PJUQUY.exeC:\windows\PJUQUY.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMX.exe.bat" "108⤵
- Executes a command shell one-liner
PID:1480 -
C:\windows\IMX.exeC:\windows\IMX.exe109⤵
- Executes dropped EXE
PID:428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFAE.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:2884 -
C:\windows\system\TFAE.exeC:\windows\system\TFAE.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UAEINL.exe.bat" "112⤵PID:4524
-
C:\windows\UAEINL.exeC:\windows\UAEINL.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTHTVBC.exe.bat" "114⤵PID:1836
-
C:\windows\FTHTVBC.exeC:\windows\FTHTVBC.exe115⤵
- Executes dropped EXE
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOMK.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1360 -
C:\windows\system\AOMK.exeC:\windows\system\AOMK.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YEXFSGZ.exe.bat" "118⤵PID:2800
-
C:\windows\SysWOW64\YEXFSGZ.exeC:\windows\system32\YEXFSGZ.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MJXRUR.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:3312 -
C:\windows\system\MJXRUR.exeC:\windows\system\MJXRUR.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-