Analysis
- max time kernel
86s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 06:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_72981b1c959f63ffbf2e8438aede8a54_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-27_72981b1c959f63ffbf2e8438aede8a54_elex_emotet_stop.exe
- Size 208KB
- Sample260727-hfcllaan4y
- SHA256 2d4b76afe30da4877e4beb2f77250d35b06e83db1b643db12378e0b65f87a9d3
- MD5 72981b1c959f63ffbf2e8438aede8a54
- SHA1 ecb45fca998ca4e3fd3624ad003da22bf713324a
- SHA512 f61069379d0057df961f00b550053f38973c3acb7d29a3750c8896e43a982972883742b5896547f4f403e051144807158cd8bf6f545298120319ce0f252b6457
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUtL+LOfz4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUp+LObkEj1
- TLSH T166247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4876 QTCN.exe 5988 OEGKV.exe 6000 HFN.exe 1548 HKNJF.exe 5604 FAHE.exe 1984 KDFZAIS.exe 4120 ZGO.exe 2788 TTTNWV.exe 4724 JJU.exe 5640 YEDRND.exe 5308 ZIHUB.exe 5944 CQOUFLC.exe 2184 JLN.exe 4548 QGWHDB.exe 5736 STBRFBP.exe 5932 NOGA.exe 5884 WPIFTG.exe 2320 GXKK.exe 6036 SFRSIW.exe 2816 VVXS.exe 5140 QICCF.exe 2764 ZJEPILJ.exe 5340 CEJ.exe 5868 GMQ.exe 5348 AZUIH.exe 1120 KXACWMJ.exe 4596 SNBBDZ.exe 3788 MBGLFZV.exe 3240 YRULS.exe 2252 TERUCRX.exe 4472 XUGC.exe 3176 BCNCAC.exe 5312 JIFRCHK.exe 4124 DDKA.exe 3772 TYBNXBA.exe 3236 EQW.exe 1680 CRELO.exe 3532 KWEAQQ.exe 2704 QXL.exe 4532 ECJ.exe 4844 VCLPRZ.exe 2900 HVOIAHG.exe 5296 VBUFHQI.exe 920 BBCT.exe 4788 MTXMY.exe 6112 EUZRCXB.exe 2856 IKFR.exe 4744 MSUZAIL.exe 2132 GNZ.exe 2604 BAWSN.exe 5748 DOABXID.exe 204 NWCGA.exe 5304 FRGKGVP.exe 2940 LROY.exe 2988 MUSTCN.exe 1948 GIW.exe 2684 WDOPXI.exe 4344 WQGEZNJ.exe 2572 SOM.exe 4296 FZURUH.exe 2864 XHWWG.exe 3084 ZAOVTD.exe 1600 JIQAEIV.exe 2528 WLYYK.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\MSUZAIL.exe IKFR.exe File opened for modification C:\windows\SysWOW64\BAWSN.exe GNZ.exe File created C:\windows\SysWOW64\DSJVBY.exe NHYFTKC.exe File created C:\windows\SysWOW64\NQOQR.exe DSJVBY.exe File created C:\windows\SysWOW64\MJRG.exe NQOQR.exe File created C:\windows\SysWOW64\MJRG.exe.bat NQOQR.exe File created C:\windows\SysWOW64\FAHE.exe.bat HKNJF.exe File opened for modification C:\windows\SysWOW64\WPIFTG.exe NOGA.exe File created C:\windows\SysWOW64\GXKK.exe.bat WPIFTG.exe File created C:\windows\SysWOW64\MUSTCN.exe LROY.exe File created C:\windows\SysWOW64\JIQAEIV.exe.bat ZAOVTD.exe File created C:\windows\SysWOW64\VBUFHQI.exe HVOIAHG.exe File opened for modification C:\windows\SysWOW64\VDQXQIP.exe VPYJH.exe File opened for modification C:\windows\SysWOW64\VCLPRZ.exe ECJ.exe File created C:\windows\SysWOW64\VPYJH.exe PPQV.exe File created C:\windows\SysWOW64\NQOQR.exe.bat DSJVBY.exe File created C:\windows\SysWOW64\UHMO.exe.bat VJTLDS.exe File opened for modification C:\windows\SysWOW64\YEDRND.exe JJU.exe File opened for modification C:\windows\SysWOW64\GXKK.exe WPIFTG.exe File opened for modification C:\windows\SysWOW64\VBUFHQI.exe HVOIAHG.exe File created C:\windows\SysWOW64\VBUFHQI.exe.bat HVOIAHG.exe File opened for modification C:\windows\SysWOW64\PYGKQWT.exe CNPLCTG.exe File created C:\windows\SysWOW64\PYGKQWT.exe.bat CNPLCTG.exe File created C:\windows\SysWOW64\VCLPRZ.exe ECJ.exe File opened for modification C:\windows\SysWOW64\IKFR.exe EUZRCXB.exe File created C:\windows\SysWOW64\WFNQ.exe EXLDT.exe File created C:\windows\SysWOW64\VPYJH.exe.bat PPQV.exe File opened for modification C:\windows\SysWOW64\IZWORJT.exe CZOAAH.exe File created C:\windows\SysWOW64\IZWORJT.exe.bat CZOAAH.exe File opened for modification C:\windows\SysWOW64\MMUKN.exe OOJHAPS.exe File opened for modification C:\windows\SysWOW64\NQOQR.exe DSJVBY.exe File created C:\windows\SysWOW64\YEDRND.exe.bat JJU.exe File created C:\windows\SysWOW64\PYGKQWT.exe CNPLCTG.exe File created C:\windows\SysWOW64\UHMO.exe VJTLDS.exe File opened for modification C:\windows\SysWOW64\ECJ.exe QXL.exe File created C:\windows\SysWOW64\VCLPRZ.exe.bat ECJ.exe File created C:\windows\SysWOW64\LBJG.exe.bat PWEJD.exe File created C:\windows\SysWOW64\JOJHPGJ.exe LBJG.exe File opened for modification C:\windows\SysWOW64\EWDJL.exe SDAYDI.exe File opened for modification C:\windows\SysWOW64\CMFCR.exe UHMO.exe File created C:\windows\SysWOW64\FAHE.exe HKNJF.exe File created C:\windows\SysWOW64\YEDRND.exe JJU.exe File created C:\windows\SysWOW64\ECJ.exe QXL.exe File opened for modification C:\windows\SysWOW64\WFNQ.exe EXLDT.exe File created C:\windows\SysWOW64\EWDJL.exe.bat SDAYDI.exe File created C:\windows\SysWOW64\MIJGUYF.exe.bat OIBS.exe File created C:\windows\SysWOW64\QICCF.exe VVXS.exe File created C:\windows\SysWOW64\LBJG.exe PWEJD.exe File opened for modification C:\windows\SysWOW64\JOJHPGJ.exe LBJG.exe File opened for modification C:\windows\SysWOW64\DSJVBY.exe NHYFTKC.exe File opened for modification C:\windows\SysWOW64\FAHE.exe HKNJF.exe File created C:\windows\SysWOW64\GXKK.exe WPIFTG.exe File opened for modification C:\windows\SysWOW64\DDKA.exe JIFRCHK.exe File created C:\windows\SysWOW64\CMFCR.exe UHMO.exe File created C:\windows\SysWOW64\CMFCR.exe.bat UHMO.exe File opened for modification C:\windows\SysWOW64\QICCF.exe VVXS.exe File opened for modification C:\windows\SysWOW64\YRULS.exe MBGLFZV.exe File created C:\windows\SysWOW64\IKFR.exe EUZRCXB.exe File created C:\windows\SysWOW64\MSUZAIL.exe.bat IKFR.exe File created C:\windows\SysWOW64\BAWSN.exe GNZ.exe File created C:\windows\SysWOW64\TWW.exe TQENZVT.exe File opened for modification C:\windows\SysWOW64\LBJG.exe PWEJD.exe File created C:\windows\SysWOW64\JOJHPGJ.exe.bat LBJG.exe File created C:\windows\SysWOW64\WPIFTG.exe NOGA.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\EQW.exe TYBNXBA.exe File opened for modification C:\windows\system\TFVE.exe WFNQ.exe File created C:\windows\system\DQEBGZK.exe.bat CNB.exe File opened for modification C:\windows\WMNI.exe YRW.exe File created C:\windows\system\VVXS.exe.bat SFRSIW.exe File opened for modification C:\windows\AZUIH.exe GMQ.exe File created C:\windows\system\FRGKGVP.exe NWCGA.exe File created C:\windows\system\ZAOVTD.exe VSHNGKF.exe File created C:\windows\OIBS.exe.bat TNWBBEH.exe File created C:\windows\system\EOH.exe.bat PYGKQWT.exe File opened for modification C:\windows\system\TTTNWV.exe ZGO.exe File created C:\windows\AZUIH.exe GMQ.exe File opened for modification C:\windows\EUZRCXB.exe MTXMY.exe File created C:\windows\system\DOABXID.exe BAWSN.exe File opened for modification C:\windows\NHYFTKC.exe MMUKN.exe File created C:\windows\system\BCNCAC.exe XUGC.exe File opened for modification C:\windows\system\FRGKGVP.exe NWCGA.exe File created C:\windows\GIW.exe.bat MUSTCN.exe File created C:\windows\system\STBRFBP.exe QGWHDB.exe File created C:\windows\system\FRGKGVP.exe.bat NWCGA.exe File created C:\windows\SDAYDI.exe BDY.exe File created C:\windows\system\OOJHAPS.exe.bat EOH.exe File opened for modification C:\windows\CEJ.exe ZJEPILJ.exe File opened for modification C:\windows\system\DQEBGZK.exe CNB.exe File opened for modification C:\windows\system\QTCN.exe 2026-07-27_72981b1c959f63ffbf2e8438aede8a54_elex_emotet_stop.exe File created C:\windows\system\HFN.exe.bat OEGKV.exe File created C:\windows\system\MBGLFZV.exe SNBBDZ.exe File created C:\windows\system\DOABXID.exe.bat BAWSN.exe File opened for modification C:\windows\system\HYLBT.exe DQEBGZK.exe File created C:\windows\system\HFN.exe OEGKV.exe File created C:\windows\system\JJU.exe.bat TTTNWV.exe File created C:\windows\WTAOYE.exe TFVE.exe File created C:\windows\SDAYDI.exe.bat BDY.exe File created C:\windows\system\HYLBT.exe.bat DQEBGZK.exe File created C:\windows\WLYYK.exe.bat JIQAEIV.exe File created C:\windows\system\VRBL.exe TWW.exe File opened for modification C:\windows\PVO.exe MIJGUYF.exe File created C:\windows\system\KDFZAIS.exe.bat FAHE.exe File created C:\windows\system\QXL.exe.bat KWEAQQ.exe File opened for modification C:\windows\system\BDY.exe VDQXQIP.exe File opened for modification C:\windows\QGWHDB.exe JLN.exe File opened for modification C:\windows\system\PPQV.exe JOJHPGJ.exe File created C:\windows\system\ZZU.exe.bat SEUQJQ.exe File created C:\windows\system\HKNJF.exe HFN.exe File created C:\windows\WDOPXI.exe.bat GIW.exe File opened for modification C:\windows\system\VRBL.exe TWW.exe File created C:\windows\system\ZIHUB.exe YEDRND.exe File created C:\windows\system\VRBL.exe.bat TWW.exe File created C:\windows\system\CZOAAH.exe YJIAVXW.exe File opened for modification C:\windows\system\RZSSRE.exe WMNI.exe File created C:\windows\VJTLDS.exe MJRG.exe File opened for modification C:\windows\TYBNXBA.exe DDKA.exe File opened for modification C:\windows\system\BBCT.exe VBUFHQI.exe File opened for modification C:\windows\system\EOH.exe PYGKQWT.exe File created C:\windows\SFRSIW.exe.bat GXKK.exe File created C:\windows\system\WQGEZNJ.exe.bat WDOPXI.exe File created C:\windows\XHWWG.exe.bat FZURUH.exe File opened for modification C:\windows\system\ZIHUB.exe YEDRND.exe File opened for modification C:\windows\SNBBDZ.exe KXACWMJ.exe File created C:\windows\TERUCRX.exe YRULS.exe File created C:\windows\system\GNZ.exe MSUZAIL.exe File created C:\windows\GMQ.exe.bat CEJ.exe File opened for modification C:\windows\GIW.exe MUSTCN.exe File created C:\windows\system\CZOAAH.exe.bat YJIAVXW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1308 cmd.exe 5000 cmd.exe 1464 cmd.exe 6004 cmd.exe 5616 cmd.exe 2840 cmd.exe 1992 cmd.exe 1712 cmd.exe 2568 cmd.exe 1844 cmd.exe 4540 cmd.exe 4712 cmd.exe 5044 cmd.exe 3960 cmd.exe 5280 cmd.exe 4768 cmd.exe 2672 cmd.exe 880 cmd.exe 3376 cmd.exe 3292 cmd.exe 3800 cmd.exe 4700 cmd.exe 2496 cmd.exe 236 cmd.exe 1952 cmd.exe 3544 cmd.exe 1532 cmd.exe 4740 cmd.exe 2660 cmd.exe 3808 cmd.exe 5796 cmd.exe 5424 cmd.exe 3592 cmd.exe 5524 cmd.exe 952 cmd.exe 1360 cmd.exe 2716 cmd.exe 1520 cmd.exe 3364 cmd.exe 5436 cmd.exe 4612 cmd.exe 4544 cmd.exe 940 cmd.exe 4720 cmd.exe 444 cmd.exe 1720 cmd.exe 1084 cmd.exe 5700 cmd.exe 6092 cmd.exe 4728 cmd.exe 4316 cmd.exe 3324 cmd.exe 1104 cmd.exe 4660 cmd.exe 2484 cmd.exe 2912 cmd.exe 5964 cmd.exe 3460 cmd.exe 1444 cmd.exe 2536 cmd.exe 1500 cmd.exe 2280 cmd.exe 5872 cmd.exe 5644 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2512 2196 WerFault.exe 87 3712 4876 WerFault.exe 93 2648 5988 WerFault.exe 99 5456 6000 WerFault.exe 104 3112 1548 WerFault.exe 109 2416 5604 WerFault.exe 114 3680 1984 WerFault.exe 119 2452 4120 WerFault.exe 124 4532 2788 WerFault.exe 129 3944 4724 WerFault.exe 134 564 5640 WerFault.exe 139 3900 5308 WerFault.exe 144 4488 5944 WerFault.exe 149 2072 2184 WerFault.exe 154 1492 4548 WerFault.exe 159 3432 5736 WerFault.exe 164 5672 5932 WerFault.exe 169 3496 5884 WerFault.exe 174 4760 2320 WerFault.exe 179 2696 6036 WerFault.exe 184 6028 2816 WerFault.exe 189 5344 5140 WerFault.exe 194 120 2764 WerFault.exe 199 5356 5340 WerFault.exe 204 3772 5868 WerFault.exe 209 768 5348 WerFault.exe 214 2724 1120 WerFault.exe 219 4136 4596 WerFault.exe 224 3960 3788 WerFault.exe 229 2232 3240 WerFault.exe 234 2772 2252 WerFault.exe 239 1624 4472 WerFault.exe 244 264 3176 WerFault.exe 249 4488 5312 WerFault.exe 254 4812 4124 WerFault.exe 259 3708 3772 WerFault.exe 264 2724 3236 WerFault.exe 269 1884 1680 WerFault.exe 274 2552 3532 WerFault.exe 280 3808 2704 WerFault.exe 285 2780 4532 WerFault.exe 290 3428 4844 WerFault.exe 295 4196 2900 WerFault.exe 300 5708 5296 WerFault.exe 305 3524 920 WerFault.exe 310 5496 4788 WerFault.exe 315 4288 6112 WerFault.exe 320 5764 2856 WerFault.exe 325 5976 4744 WerFault.exe 330 1088 2132 WerFault.exe 335 1196 2604 WerFault.exe 340 1012 5748 WerFault.exe 345 3388 204 WerFault.exe 350 2072 5304 WerFault.exe 355 5840 2940 WerFault.exe 360 940 2988 WerFault.exe 365 2288 1948 WerFault.exe 370 4948 2684 WerFault.exe 375 3032 4344 WerFault.exe 380 2984 2572 WerFault.exe 385 3420 4296 WerFault.exe 390 264 2864 WerFault.exe 395 5336 4688 WerFault.exe 400 768 3084 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIBS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBUFHQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HYLBT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VJTLDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNPLCTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUSTCN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIQAEIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PWEJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIFRCHK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRELO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFRSIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBGLFZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPYJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MIJGUYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEGKV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQOUFLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSUZAIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLQKVR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEUQJQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LROY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDQXQIP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2196 2026-07-27_72981b1c959f63ffbf2e8438aede8a54_elex_emotet_stop.exe 2196 2026-07-27_72981b1c959f63ffbf2e8438aede8a54_elex_emotet_stop.exe 4876 QTCN.exe 4876 QTCN.exe 5988 OEGKV.exe 5988 OEGKV.exe 6000 HFN.exe 6000 HFN.exe 1548 HKNJF.exe 1548 HKNJF.exe 5604 FAHE.exe 5604 FAHE.exe 1984 KDFZAIS.exe 1984 KDFZAIS.exe 4120 ZGO.exe 4120 ZGO.exe 2788 TTTNWV.exe 2788 TTTNWV.exe 4724 JJU.exe 4724 JJU.exe 5640 YEDRND.exe 5640 YEDRND.exe 5308 ZIHUB.exe 5308 ZIHUB.exe 5944 CQOUFLC.exe 5944 CQOUFLC.exe 2184 JLN.exe 2184 JLN.exe 4548 QGWHDB.exe 4548 QGWHDB.exe 5736 STBRFBP.exe 5736 STBRFBP.exe 5932 NOGA.exe 5932 NOGA.exe 5884 WPIFTG.exe 5884 WPIFTG.exe 2320 GXKK.exe 2320 GXKK.exe 6036 SFRSIW.exe 6036 SFRSIW.exe 2816 VVXS.exe 2816 VVXS.exe 5140 QICCF.exe 5140 QICCF.exe 2764 ZJEPILJ.exe 2764 ZJEPILJ.exe 5340 CEJ.exe 5340 CEJ.exe 5868 GMQ.exe 5868 GMQ.exe 5348 AZUIH.exe 5348 AZUIH.exe 1120 KXACWMJ.exe 1120 KXACWMJ.exe 4596 SNBBDZ.exe 4596 SNBBDZ.exe 3788 MBGLFZV.exe 3788 MBGLFZV.exe 3240 YRULS.exe 3240 YRULS.exe 2252 TERUCRX.exe 2252 TERUCRX.exe 4472 XUGC.exe 4472 XUGC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2196 2026-07-27_72981b1c959f63ffbf2e8438aede8a54_elex_emotet_stop.exe 2196 2026-07-27_72981b1c959f63ffbf2e8438aede8a54_elex_emotet_stop.exe 4876 QTCN.exe 4876 QTCN.exe 5988 OEGKV.exe 5988 OEGKV.exe 6000 HFN.exe 6000 HFN.exe 1548 HKNJF.exe 1548 HKNJF.exe 5604 FAHE.exe 5604 FAHE.exe 1984 KDFZAIS.exe 1984 KDFZAIS.exe 4120 ZGO.exe 4120 ZGO.exe 2788 TTTNWV.exe 2788 TTTNWV.exe 4724 JJU.exe 4724 JJU.exe 5640 YEDRND.exe 5640 YEDRND.exe 5308 ZIHUB.exe 5308 ZIHUB.exe 5944 CQOUFLC.exe 5944 CQOUFLC.exe 2184 JLN.exe 2184 JLN.exe 4548 QGWHDB.exe 4548 QGWHDB.exe 5736 STBRFBP.exe 5736 STBRFBP.exe 5932 NOGA.exe 5932 NOGA.exe 5884 WPIFTG.exe 5884 WPIFTG.exe 2320 GXKK.exe 2320 GXKK.exe 6036 SFRSIW.exe 6036 SFRSIW.exe 2816 VVXS.exe 2816 VVXS.exe 5140 QICCF.exe 5140 QICCF.exe 2764 ZJEPILJ.exe 2764 ZJEPILJ.exe 5340 CEJ.exe 5340 CEJ.exe 5868 GMQ.exe 5868 GMQ.exe 5348 AZUIH.exe 5348 AZUIH.exe 1120 KXACWMJ.exe 1120 KXACWMJ.exe 4596 SNBBDZ.exe 4596 SNBBDZ.exe 3788 MBGLFZV.exe 3788 MBGLFZV.exe 3240 YRULS.exe 3240 YRULS.exe 2252 TERUCRX.exe 2252 TERUCRX.exe 4472 XUGC.exe 4472 XUGC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 4768 2196 2026-07-27_72981b1c959f63ffbf2e8438aede8a54_elex_emotet_stop.exe 89 PID 4768 wrote to memory of 4876 4768 cmd.exe 93 PID 4876 wrote to memory of 2672 4876 QTCN.exe 95 PID 2672 wrote to memory of 5988 2672 cmd.exe 99 PID 5988 wrote to memory of 1720 5988 OEGKV.exe 100 PID 1720 wrote to memory of 6000 1720 cmd.exe 104 PID 6000 wrote to memory of 5816 6000 HFN.exe 105 PID 5816 wrote to memory of 1548 5816 cmd.exe 109 PID 1548 wrote to memory of 1464 1548 HKNJF.exe 110 PID 1464 wrote to memory of 5604 1464 cmd.exe 114 PID 5604 wrote to memory of 4372 5604 FAHE.exe 115 PID 4372 wrote to memory of 1984 4372 cmd.exe 119 PID 1984 wrote to memory of 3000 1984 KDFZAIS.exe 120 PID 3000 wrote to memory of 4120 3000 cmd.exe 124 PID 4120 wrote to memory of 3544 4120 ZGO.exe 125 PID 3544 wrote to memory of 2788 3544 cmd.exe 129 PID 2788 wrote to memory of 1104 2788 TTTNWV.exe 130 PID 1104 wrote to memory of 4724 1104 cmd.exe 134 PID 4724 wrote to memory of 4700 4724 JJU.exe 135 PID 4700 wrote to memory of 5640 4700 cmd.exe 139 PID 5640 wrote to memory of 4772 5640 YEDRND.exe 140 PID 4772 wrote to memory of 5308 4772 cmd.exe 144 PID 5308 wrote to memory of 1724 5308 ZIHUB.exe 145 PID 1724 wrote to memory of 5944 1724 cmd.exe 149 PID 5944 wrote to memory of 2944 5944 CQOUFLC.exe 150 PID 2944 wrote to memory of 2184 2944 cmd.exe 154 PID 2184 wrote to memory of 2896 2184 JLN.exe 155 PID 2896 wrote to memory of 4548 2896 cmd.exe 159 PID 4548 wrote to memory of 1712 4548 QGWHDB.exe 160 PID 1712 wrote to memory of 5736 1712 cmd.exe 164 PID 5736 wrote to memory of 5184 5736 STBRFBP.exe 165 PID 5184 wrote to memory of 5932 5184 cmd.exe 169 PID 5932 wrote to memory of 1480 5932 NOGA.exe 170 PID 1480 wrote to memory of 5884 1480 cmd.exe 174 PID 5884 wrote to memory of 6004 5884 WPIFTG.exe 175 PID 6004 wrote to memory of 2320 6004 cmd.exe 179 PID 2320 wrote to memory of 4752 2320 GXKK.exe 180 PID 4752 wrote to memory of 6036 4752 cmd.exe 184 PID 6036 wrote to memory of 2556 6036 SFRSIW.exe 185 PID 2556 wrote to memory of 2816 2556 cmd.exe 189 PID 2816 wrote to memory of 2568 2816 VVXS.exe 190 PID 2568 wrote to memory of 5140 2568 cmd.exe 194 PID 5140 wrote to memory of 2388 5140 QICCF.exe 195 PID 2388 wrote to memory of 2764 2388 cmd.exe 199 PID 2764 wrote to memory of 4660 2764 ZJEPILJ.exe 200 PID 4660 wrote to memory of 5340 4660 cmd.exe 204 PID 5340 wrote to memory of 5796 5340 CEJ.exe 205 PID 5796 wrote to memory of 5868 5796 cmd.exe 209 PID 5868 wrote to memory of 1084 5868 GMQ.exe 210 PID 1084 wrote to memory of 5348 1084 cmd.exe 214 PID 5348 wrote to memory of 572 5348 AZUIH.exe 215 PID 572 wrote to memory of 1120 572 cmd.exe 219 PID 1120 wrote to memory of 5996 1120 KXACWMJ.exe 220 PID 5996 wrote to memory of 4596 5996 cmd.exe 224 PID 4596 wrote to memory of 2484 4596 SNBBDZ.exe 225 PID 2484 wrote to memory of 3788 2484 cmd.exe 229 PID 3788 wrote to memory of 5656 3788 MBGLFZV.exe 230 PID 5656 wrote to memory of 3240 5656 cmd.exe 234 PID 3240 wrote to memory of 3680 3240 YRULS.exe 235 PID 3680 wrote to memory of 2252 3680 cmd.exe 239 PID 2252 wrote to memory of 2472 2252 TERUCRX.exe 240 PID 2472 wrote to memory of 4472 2472 cmd.exe 244 PID 4472 wrote to memory of 3364 4472 XUGC.exe 245 PID 3364 wrote to memory of 3176 3364 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_72981b1c959f63ffbf2e8438aede8a54_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_72981b1c959f63ffbf2e8438aede8a54_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTCN.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\windows\system\QTCN.exeC:\windows\system\QTCN.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OEGKV.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\windows\OEGKV.exeC:\windows\OEGKV.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HFN.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\windows\system\HFN.exeC:\windows\system\HFN.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKNJF.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\windows\system\HKNJF.exeC:\windows\system\HKNJF.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FAHE.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\windows\SysWOW64\FAHE.exeC:\windows\system32\FAHE.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDFZAIS.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\windows\system\KDFZAIS.exeC:\windows\system\KDFZAIS.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGO.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\windows\ZGO.exeC:\windows\ZGO.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TTTNWV.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\windows\system\TTTNWV.exeC:\windows\system\TTTNWV.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJU.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\windows\system\JJU.exeC:\windows\system\JJU.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YEDRND.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\windows\SysWOW64\YEDRND.exeC:\windows\system32\YEDRND.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZIHUB.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\windows\system\ZIHUB.exeC:\windows\system\ZIHUB.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CQOUFLC.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\windows\system\CQOUFLC.exeC:\windows\system\CQOUFLC.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLN.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\windows\JLN.exeC:\windows\JLN.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGWHDB.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\windows\QGWHDB.exeC:\windows\QGWHDB.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STBRFBP.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\windows\system\STBRFBP.exeC:\windows\system\STBRFBP.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NOGA.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\windows\NOGA.exeC:\windows\NOGA.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WPIFTG.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\windows\SysWOW64\WPIFTG.exeC:\windows\system32\WPIFTG.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GXKK.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\windows\SysWOW64\GXKK.exeC:\windows\system32\GXKK.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFRSIW.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\windows\SFRSIW.exeC:\windows\SFRSIW.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVXS.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\windows\system\VVXS.exeC:\windows\system\VVXS.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QICCF.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\windows\SysWOW64\QICCF.exeC:\windows\system32\QICCF.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZJEPILJ.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\windows\system\ZJEPILJ.exeC:\windows\system\ZJEPILJ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEJ.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\windows\CEJ.exeC:\windows\CEJ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMQ.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\windows\GMQ.exeC:\windows\GMQ.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AZUIH.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\windows\AZUIH.exeC:\windows\AZUIH.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KXACWMJ.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:572 -
C:\windows\system\KXACWMJ.exeC:\windows\system\KXACWMJ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNBBDZ.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\windows\SNBBDZ.exeC:\windows\SNBBDZ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MBGLFZV.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\windows\system\MBGLFZV.exeC:\windows\system\MBGLFZV.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YRULS.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\SysWOW64\YRULS.exeC:\windows\system32\YRULS.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TERUCRX.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\windows\TERUCRX.exeC:\windows\TERUCRX.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUGC.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\windows\system\XUGC.exeC:\windows\system\XUGC.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BCNCAC.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\windows\system\BCNCAC.exeC:\windows\system\BCNCAC.exe65⤵
- Executes dropped EXE
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JIFRCHK.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5616 -
C:\windows\JIFRCHK.exeC:\windows\JIFRCHK.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDKA.exe.bat" "68⤵PID:864
-
C:\windows\SysWOW64\DDKA.exeC:\windows\system32\DDKA.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TYBNXBA.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5424 -
C:\windows\TYBNXBA.exeC:\windows\TYBNXBA.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQW.exe.bat" "72⤵PID:3672
-
C:\windows\EQW.exeC:\windows\EQW.exe73⤵
- Executes dropped EXE
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CRELO.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:4620 -
C:\windows\CRELO.exeC:\windows\CRELO.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KWEAQQ.exe.bat" "76⤵PID:1580
-
C:\windows\KWEAQQ.exeC:\windows\KWEAQQ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QXL.exe.bat" "78⤵PID:5324
-
C:\windows\system\QXL.exeC:\windows\system\QXL.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ECJ.exe.bat" "80⤵PID:4520
-
C:\windows\SysWOW64\ECJ.exeC:\windows\system32\ECJ.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VCLPRZ.exe.bat" "82⤵PID:5980
-
C:\windows\SysWOW64\VCLPRZ.exeC:\windows\system32\VCLPRZ.exe83⤵
- Executes dropped EXE
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HVOIAHG.exe.bat" "84⤵
- Executes a command shell one-liner
PID:1500 -
C:\windows\system\HVOIAHG.exeC:\windows\system\HVOIAHG.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VBUFHQI.exe.bat" "86⤵
- Executes a command shell one-liner
PID:5700 -
C:\windows\SysWOW64\VBUFHQI.exeC:\windows\system32\VBUFHQI.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBCT.exe.bat" "88⤵
- Executes a command shell one-liner
PID:6092 -
C:\windows\system\BBCT.exeC:\windows\system\BBCT.exe89⤵
- Executes dropped EXE
PID:920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTXMY.exe.bat" "90⤵PID:4960
-
C:\windows\MTXMY.exeC:\windows\MTXMY.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUZRCXB.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:3708 -
C:\windows\EUZRCXB.exeC:\windows\EUZRCXB.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IKFR.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:1732 -
C:\windows\SysWOW64\IKFR.exeC:\windows\system32\IKFR.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MSUZAIL.exe.bat" "96⤵PID:4600
-
C:\windows\SysWOW64\MSUZAIL.exeC:\windows\system32\MSUZAIL.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GNZ.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:5828 -
C:\windows\system\GNZ.exeC:\windows\system\GNZ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BAWSN.exe.bat" "100⤵PID:3528
-
C:\windows\SysWOW64\BAWSN.exeC:\windows\system32\BAWSN.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOABXID.exe.bat" "102⤵
- Executes a command shell one-liner
PID:1308 -
C:\windows\system\DOABXID.exeC:\windows\system\DOABXID.exe103⤵
- Executes dropped EXE
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NWCGA.exe.bat" "104⤵PID:4556
-
C:\windows\system\NWCGA.exeC:\windows\system\NWCGA.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FRGKGVP.exe.bat" "106⤵
- Executes a command shell one-liner
PID:5000 -
C:\windows\system\FRGKGVP.exeC:\windows\system\FRGKGVP.exe107⤵
- Executes dropped EXE
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LROY.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2840 -
C:\windows\LROY.exeC:\windows\LROY.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUSTCN.exe.bat" "110⤵PID:3524
-
C:\windows\SysWOW64\MUSTCN.exeC:\windows\system32\MUSTCN.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIW.exe.bat" "112⤵
- Executes a command shell one-liner
PID:5436 -
C:\windows\GIW.exeC:\windows\GIW.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDOPXI.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1844 -
C:\windows\WDOPXI.exeC:\windows\WDOPXI.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQGEZNJ.exe.bat" "116⤵PID:4208
-
C:\windows\system\WQGEZNJ.exeC:\windows\system\WQGEZNJ.exe117⤵
- Executes dropped EXE
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SOM.exe.bat" "118⤵PID:5484
-
C:\windows\system\SOM.exeC:\windows\system\SOM.exe119⤵
- Executes dropped EXE
PID:2572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZURUH.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:824 -
C:\windows\system\FZURUH.exeC:\windows\system\FZURUH.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-