Analysis
- max time kernel
87s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 15:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_5d40dff5fccfc7296e72bf1b54bfc0f9_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-27_5d40dff5fccfc7296e72bf1b54bfc0f9_elex_emotet_stop.exe
- Size 208KB
- Sample260727-s8b6msbg78
- SHA256 ccf2639c53bdc8cbf840c22fea592866c88d9897ea85a8f369f1ead300c53318
- MD5 5d40dff5fccfc7296e72bf1b54bfc0f9
- SHA1 28f543471248925ea8bcff9dc2396aad253eb297
- SHA512 e024b4ddd8b355eadac8164dc25908a85f64ed2a7f8a95964085c4e8d7a904495275d061db86c4b39cdf389d14635859abbed10e474e17a21e133b03d2c7a76c
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfr4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOjQEj1
- TLSH T140247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1556 MVYVG.exe 204 XYP.exe 4264 LJFNHJ.exe 4676 OZMVL.exe 4588 LWKLA.exe 5388 WPNDAK.exe 564 AFTL.exe 1132 ZQE.exe 1452 ZVW.exe 5708 PTSQV.exe 1692 NEUGEMK.exe 2696 IAZP.exe 4288 XVJCZHZ.exe 3964 HVLHC.exe 3868 QDNMGB.exe 6040 WEUA.exe 2992 GBAUEM.exe 6048 GHAIGZQ.exe 3104 MHIW.exe 1256 QPOWBM.exe 1000 QSSAH.exe 4568 ABUFSHR.exe 2488 PWEJD.exe 3420 JJITNT.exe 5544 JOJHPGJ.exe 1768 MKNQ.exe 4652 QSUZDR.exe 4764 WSC.exe 5848 FAERY.exe 4944 LBLFHSZ.exe 4740 UBF.exe 4532 VEROYOC.exe 4564 PROX.exe 2664 IUATOE.exe 2620 OVH.exe 2092 UVHCG.exe 3720 OIMMQAS.exe 4216 GJOR.exe 3408 YMSNH.exe 3196 GZETR.exe 1412 HUIX.exe 4536 YFL.exe 5160 TQBMUA.exe 2700 VOHYB.exe 5436 HEO.exe 1320 QEQL.exe 3860 WEXZAB.exe 5600 VPIPJ.exe 4672 XNO.exe 4664 RASTA.exe 3472 QTVJ.exe 2088 LGAST.exe 1564 AWBJ.exe 2768 EEIREJ.exe 3288 OCVE.exe 2384 XKXRXOK.exe 5548 DLXF.exe 3640 VLZKRO.exe 924 XJN.exe 4512 FWR.exe 5432 NCERUTO.exe 5076 RCSMHRX.exe 3044 BAGGP.exe 4184 NSNRG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\PDQHV.exe EKAWE.exe File created C:\windows\SysWOW64\YCXYKR.exe OERD.exe File created C:\windows\SysWOW64\PROX.exe VEROYOC.exe File created C:\windows\SysWOW64\WEXZAB.exe QEQL.exe File created C:\windows\SysWOW64\WEXZAB.exe.bat QEQL.exe File opened for modification C:\windows\SysWOW64\XNO.exe VPIPJ.exe File created C:\windows\SysWOW64\RPGQXAS.exe JKU.exe File created C:\windows\SysWOW64\PYCQBA.exe LQVI.exe File opened for modification C:\windows\SysWOW64\AFDZBMB.exe CKMYXJ.exe File created C:\windows\SysWOW64\QDY.exe MVRH.exe File created C:\windows\SysWOW64\MVYVG.exe 2026-07-27_5d40dff5fccfc7296e72bf1b54bfc0f9_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\LWKLA.exe OZMVL.exe File created C:\windows\SysWOW64\NEUGEMK.exe PTSQV.exe File opened for modification C:\windows\SysWOW64\QDNMGB.exe HVLHC.exe File created C:\windows\SysWOW64\IUATOE.exe PROX.exe File created C:\windows\SysWOW64\VOHYB.exe.bat TQBMUA.exe File created C:\windows\SysWOW64\XNO.exe.bat VPIPJ.exe File created C:\windows\SysWOW64\OCVE.exe EEIREJ.exe File opened for modification C:\windows\SysWOW64\UVHCG.exe OVH.exe File created C:\windows\SysWOW64\UVHCG.exe.bat OVH.exe File opened for modification C:\windows\SysWOW64\YMSNH.exe GJOR.exe File created C:\windows\SysWOW64\EKAWE.exe DHX.exe File opened for modification C:\windows\SysWOW64\YCXYKR.exe OERD.exe File created C:\windows\SysWOW64\WBH.exe BGCTYR.exe File opened for modification C:\windows\SysWOW64\WBH.exe BGCTYR.exe File created C:\windows\SysWOW64\WBH.exe.bat BGCTYR.exe File opened for modification C:\windows\SysWOW64\MVYVG.exe 2026-07-27_5d40dff5fccfc7296e72bf1b54bfc0f9_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\OZMVL.exe LJFNHJ.exe File created C:\windows\SysWOW64\ZQE.exe AFTL.exe File opened for modification C:\windows\SysWOW64\HEO.exe VOHYB.exe File created C:\windows\SysWOW64\AWBJ.exe LGAST.exe File created C:\windows\SysWOW64\EEIREJ.exe.bat AWBJ.exe File created C:\windows\SysWOW64\XKXRXOK.exe OCVE.exe File created C:\windows\SysWOW64\RCSMHRX.exe NCERUTO.exe File opened for modification C:\windows\SysWOW64\IUATOE.exe PROX.exe File opened for modification C:\windows\SysWOW64\BAGGP.exe RCSMHRX.exe File created C:\windows\SysWOW64\BAGGP.exe.bat RCSMHRX.exe File opened for modification C:\windows\SysWOW64\RPGQXAS.exe JKU.exe File created C:\windows\SysWOW64\DHX.exe.bat JZOERPB.exe File created C:\windows\SysWOW64\OOTX.exe.bat PDQHV.exe File created C:\windows\SysWOW64\AFDZBMB.exe CKMYXJ.exe File created C:\windows\SysWOW64\OZMVL.exe.bat LJFNHJ.exe File created C:\windows\SysWOW64\JOJHPGJ.exe JJITNT.exe File created C:\windows\SysWOW64\EEIREJ.exe AWBJ.exe File created C:\windows\SysWOW64\BAGGP.exe RCSMHRX.exe File created C:\windows\SysWOW64\RPGQXAS.exe.bat JKU.exe File opened for modification C:\windows\SysWOW64\DHX.exe JZOERPB.exe File created C:\windows\SysWOW64\YCXYKR.exe.bat OERD.exe File created C:\windows\SysWOW64\GJE.exe ROMLS.exe File created C:\windows\SysWOW64\OZMVL.exe LJFNHJ.exe File created C:\windows\SysWOW64\ZQE.exe.bat AFTL.exe File created C:\windows\SysWOW64\WEUA.exe QDNMGB.exe File created C:\windows\SysWOW64\PROX.exe.bat VEROYOC.exe File opened for modification C:\windows\SysWOW64\VOHYB.exe TQBMUA.exe File created C:\windows\SysWOW64\AWBJ.exe.bat LGAST.exe File created C:\windows\SysWOW64\AFDZBMB.exe.bat CKMYXJ.exe File created C:\windows\SysWOW64\GJE.exe.bat ROMLS.exe File created C:\windows\SysWOW64\WEUA.exe.bat QDNMGB.exe File opened for modification C:\windows\SysWOW64\PROX.exe VEROYOC.exe File created C:\windows\SysWOW64\YMSNH.exe GJOR.exe File created C:\windows\SysWOW64\HEO.exe VOHYB.exe File created C:\windows\SysWOW64\HEO.exe.bat VOHYB.exe File created C:\windows\SysWOW64\XKXRXOK.exe.bat OCVE.exe File created C:\windows\SysWOW64\DHX.exe JZOERPB.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\FAERY.exe WSC.exe File created C:\windows\system\TQBMUA.exe.bat YFL.exe File created C:\windows\system\XJN.exe VLZKRO.exe File created C:\windows\FWR.exe XJN.exe File opened for modification C:\windows\system\NSNRG.exe BAGGP.exe File created C:\windows\JKU.exe.bat WZL.exe File created C:\windows\QSSAH.exe QPOWBM.exe File opened for modification C:\windows\system\UBF.exe LBLFHSZ.exe File created C:\windows\system\LQVI.exe BPTDLLE.exe File created C:\windows\FTZGZ.exe QDY.exe File opened for modification C:\windows\LUHUIFB.exe FTZGZ.exe File created C:\windows\system\PSE.exe ESO.exe File opened for modification C:\windows\system\PSE.exe ESO.exe File created C:\windows\system\PSE.exe.bat ESO.exe File created C:\windows\ZVW.exe ZQE.exe File created C:\windows\system\LDYH.exe.bat NSNRG.exe File created C:\windows\NOFF.exe.bat GYEGWR.exe File created C:\windows\CKMYXJ.exe YCXYKR.exe File created C:\windows\WSC.exe.bat QSUZDR.exe File opened for modification C:\windows\system\LDYH.exe NSNRG.exe File created C:\windows\system\IILLJMI.exe SSKL.exe File created C:\windows\system\IILLJMI.exe.bat SSKL.exe File created C:\windows\system\BGCTYR.exe.bat HSGJ.exe File opened for modification C:\windows\system\ROMLS.exe WBH.exe File created C:\windows\system\ROMLS.exe.bat WBH.exe File created C:\windows\system\PWEJD.exe.bat ABUFSHR.exe File opened for modification C:\windows\system\JJITNT.exe PWEJD.exe File opened for modification C:\windows\system\QEQL.exe HEO.exe File created C:\windows\system\NCERUTO.exe FWR.exe File created C:\windows\QSSAH.exe.bat QPOWBM.exe File opened for modification C:\windows\GZETR.exe YMSNH.exe File created C:\windows\system\YFL.exe.bat HUIX.exe File created C:\windows\LGAST.exe QTVJ.exe File created C:\windows\system\GYEGWR.exe IILLJMI.exe File opened for modification C:\windows\BPTDLLE.exe BMQ.exe File opened for modification C:\windows\system\CEJKQT.exe LUHUIFB.exe File created C:\windows\system\HSGJ.exe.bat PSE.exe File created C:\windows\LJFNHJ.exe XYP.exe File created C:\windows\LJFNHJ.exe.bat XYP.exe File created C:\windows\GZETR.exe.bat YMSNH.exe File created C:\windows\system\PRWTJE.exe.bat OOTX.exe File opened for modification C:\windows\system\KOLVRQT.exe TOJ.exe File opened for modification C:\windows\UWVSB.exe BTROOI.exe File created C:\windows\HVLHC.exe XVJCZHZ.exe File opened for modification C:\windows\FWR.exe XJN.exe File created C:\windows\HVLHC.exe.bat XVJCZHZ.exe File created C:\windows\system\PTSQV.exe.bat SOM.exe File created C:\windows\system\VPIPJ.exe WEXZAB.exe File opened for modification C:\windows\system\VLZKRO.exe DLXF.exe File opened for modification C:\windows\system\JZOERPB.exe NOFF.exe File created C:\windows\BPTDLLE.exe.bat BMQ.exe File opened for modification C:\windows\system\LQVI.exe BPTDLLE.exe File created C:\windows\system\HGMF.exe MSHWBID.exe File opened for modification C:\windows\system\VPIPJ.exe WEXZAB.exe File created C:\windows\QTVJ.exe RASTA.exe File created C:\windows\system\DLXF.exe XKXRXOK.exe File created C:\windows\NOFF.exe GYEGWR.exe File opened for modification C:\windows\FTZGZ.exe QDY.exe File created C:\windows\system\GSAIS.exe.bat PKYD.exe File opened for modification C:\windows\system\HGMF.exe MSHWBID.exe File created C:\windows\BTROOI.exe HGMF.exe File created C:\windows\system\VLZKRO.exe DLXF.exe File created C:\windows\system\NSNRG.exe.bat BAGGP.exe File created C:\windows\system\HSGJ.exe PSE.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3884 cmd.exe 2424 cmd.exe 2732 cmd.exe 488 cmd.exe 6008 cmd.exe 2172 cmd.exe 3064 cmd.exe 5748 cmd.exe 4256 cmd.exe 5016 cmd.exe 4320 cmd.exe 4156 cmd.exe 4296 cmd.exe 1008 cmd.exe 4228 cmd.exe 5400 cmd.exe 4124 cmd.exe 5996 cmd.exe 3876 cmd.exe 1520 cmd.exe 4196 cmd.exe 4952 cmd.exe 2132 cmd.exe 940 cmd.exe 3800 cmd.exe 1264 cmd.exe 3980 cmd.exe 1808 cmd.exe 4908 cmd.exe 4180 cmd.exe 3512 cmd.exe 2964 cmd.exe 2056 cmd.exe 1496 cmd.exe 5732 cmd.exe 3932 cmd.exe 4448 cmd.exe 2136 cmd.exe 4404 cmd.exe 1964 cmd.exe 3312 cmd.exe 2616 cmd.exe 1060 cmd.exe 3152 cmd.exe 3816 cmd.exe 236 cmd.exe 4780 cmd.exe 3552 cmd.exe 3504 cmd.exe 2428 cmd.exe 1644 cmd.exe 3396 cmd.exe 5924 cmd.exe 3436 cmd.exe 5784 cmd.exe 5368 cmd.exe 5916 cmd.exe 5164 cmd.exe 3416 cmd.exe 5228 cmd.exe 4252 cmd.exe 6028 cmd.exe 5212 cmd.exe 3728 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4672 5556 WerFault.exe 87 4228 1556 WerFault.exe 92 5164 204 WerFault.exe 98 2128 4264 WerFault.exe 103 1664 4676 WerFault.exe 108 2040 4588 WerFault.exe 113 948 5388 WerFault.exe 118 2736 564 WerFault.exe 123 2732 1132 WerFault.exe 128 3216 1452 WerFault.exe 133 5728 3248 WerFault.exe 138 1888 5708 WerFault.exe 143 5364 1692 WerFault.exe 148 3204 2696 WerFault.exe 153 836 4288 WerFault.exe 158 2608 3964 WerFault.exe 163 3208 3868 WerFault.exe 168 5212 6040 WerFault.exe 173 1348 2992 WerFault.exe 178 1076 6048 WerFault.exe 183 4456 3104 WerFault.exe 188 4348 1256 WerFault.exe 193 1088 1000 WerFault.exe 198 4440 4568 WerFault.exe 203 468 2488 WerFault.exe 208 4724 3420 WerFault.exe 213 2400 5544 WerFault.exe 218 2572 1768 WerFault.exe 223 1140 4652 WerFault.exe 228 2376 4764 WerFault.exe 233 4640 5848 WerFault.exe 238 2896 4944 WerFault.exe 243 3536 4740 WerFault.exe 248 2088 4532 WerFault.exe 253 5184 4564 WerFault.exe 258 1612 2664 WerFault.exe 263 2916 2620 WerFault.exe 268 3988 2092 WerFault.exe 273 4604 3720 WerFault.exe 278 5072 4216 WerFault.exe 284 4364 3408 WerFault.exe 289 4348 3196 WerFault.exe 294 2812 1412 WerFault.exe 299 5076 4536 WerFault.exe 304 1664 5160 WerFault.exe 309 2192 2700 WerFault.exe 314 3064 5436 WerFault.exe 319 1300 1320 WerFault.exe 324 5108 3860 WerFault.exe 329 4496 5600 WerFault.exe 334 2920 4672 WerFault.exe 339 2164 4664 WerFault.exe 344 4972 3472 WerFault.exe 349 3040 2088 WerFault.exe 354 5512 1564 WerFault.exe 359 5804 2768 WerFault.exe 364 1104 3288 WerFault.exe 369 1140 2384 WerFault.exe 374 4172 5548 WerFault.exe 379 4364 3640 WerFault.exe 384 3460 924 WerFault.exe 389 3260 4512 WerFault.exe 394 3188 5432 WerFault.exe 399 5724 5076 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYEGWR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ESO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GJE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UWVSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSHWBID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTROOI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QDNMGB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZETR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VOHYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WEXZAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABUFSHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OCVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RCSMHRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKMYXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFDZBMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LDYH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LQVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUHUIFB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDQHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OERD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XVJCZHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VLZKRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPIPJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZOERPB.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5556 2026-07-27_5d40dff5fccfc7296e72bf1b54bfc0f9_elex_emotet_stop.exe 5556 2026-07-27_5d40dff5fccfc7296e72bf1b54bfc0f9_elex_emotet_stop.exe 1556 MVYVG.exe 1556 MVYVG.exe 204 XYP.exe 204 XYP.exe 4264 LJFNHJ.exe 4264 LJFNHJ.exe 4676 OZMVL.exe 4676 OZMVL.exe 4588 LWKLA.exe 4588 LWKLA.exe 5388 WPNDAK.exe 5388 WPNDAK.exe 564 AFTL.exe 564 AFTL.exe 1132 ZQE.exe 1132 ZQE.exe 3248 SOM.exe 3248 SOM.exe 5708 PTSQV.exe 5708 PTSQV.exe 1692 NEUGEMK.exe 1692 NEUGEMK.exe 2696 IAZP.exe 2696 IAZP.exe 4288 XVJCZHZ.exe 4288 XVJCZHZ.exe 3964 HVLHC.exe 3964 HVLHC.exe 3868 QDNMGB.exe 3868 QDNMGB.exe 6040 WEUA.exe 6040 WEUA.exe 2992 GBAUEM.exe 2992 GBAUEM.exe 6048 GHAIGZQ.exe 6048 GHAIGZQ.exe 3104 MHIW.exe 3104 MHIW.exe 1256 QPOWBM.exe 1256 QPOWBM.exe 1000 QSSAH.exe 1000 QSSAH.exe 4568 ABUFSHR.exe 4568 ABUFSHR.exe 2488 PWEJD.exe 2488 PWEJD.exe 3420 JJITNT.exe 3420 JJITNT.exe 5544 JOJHPGJ.exe 5544 JOJHPGJ.exe 1768 MKNQ.exe 1768 MKNQ.exe 4652 QSUZDR.exe 4652 QSUZDR.exe 4764 WSC.exe 4764 WSC.exe 5848 FAERY.exe 5848 FAERY.exe 4944 LBLFHSZ.exe 4944 LBLFHSZ.exe 4740 UBF.exe 4740 UBF.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5556 2026-07-27_5d40dff5fccfc7296e72bf1b54bfc0f9_elex_emotet_stop.exe 5556 2026-07-27_5d40dff5fccfc7296e72bf1b54bfc0f9_elex_emotet_stop.exe 1556 MVYVG.exe 1556 MVYVG.exe 204 XYP.exe 204 XYP.exe 4264 LJFNHJ.exe 4264 LJFNHJ.exe 4676 OZMVL.exe 4676 OZMVL.exe 4588 LWKLA.exe 4588 LWKLA.exe 5388 WPNDAK.exe 5388 WPNDAK.exe 564 AFTL.exe 564 AFTL.exe 1132 ZQE.exe 1132 ZQE.exe 3248 SOM.exe 3248 SOM.exe 5708 PTSQV.exe 5708 PTSQV.exe 1692 NEUGEMK.exe 1692 NEUGEMK.exe 2696 IAZP.exe 2696 IAZP.exe 4288 XVJCZHZ.exe 4288 XVJCZHZ.exe 3964 HVLHC.exe 3964 HVLHC.exe 3868 QDNMGB.exe 3868 QDNMGB.exe 6040 WEUA.exe 6040 WEUA.exe 2992 GBAUEM.exe 2992 GBAUEM.exe 6048 GHAIGZQ.exe 6048 GHAIGZQ.exe 3104 MHIW.exe 3104 MHIW.exe 1256 QPOWBM.exe 1256 QPOWBM.exe 1000 QSSAH.exe 1000 QSSAH.exe 4568 ABUFSHR.exe 4568 ABUFSHR.exe 2488 PWEJD.exe 2488 PWEJD.exe 3420 JJITNT.exe 3420 JJITNT.exe 5544 JOJHPGJ.exe 5544 JOJHPGJ.exe 1768 MKNQ.exe 1768 MKNQ.exe 4652 QSUZDR.exe 4652 QSUZDR.exe 4764 WSC.exe 4764 WSC.exe 5848 FAERY.exe 5848 FAERY.exe 4944 LBLFHSZ.exe 4944 LBLFHSZ.exe 4740 UBF.exe 4740 UBF.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5556 wrote to memory of 3728 5556 2026-07-27_5d40dff5fccfc7296e72bf1b54bfc0f9_elex_emotet_stop.exe 88 PID 3728 wrote to memory of 1556 3728 cmd.exe 92 PID 1556 wrote to memory of 5692 1556 MVYVG.exe 94 PID 5692 wrote to memory of 204 5692 cmd.exe 98 PID 204 wrote to memory of 4404 204 XYP.exe 99 PID 4404 wrote to memory of 4264 4404 cmd.exe 103 PID 4264 wrote to memory of 5880 4264 LJFNHJ.exe 104 PID 5880 wrote to memory of 4676 5880 cmd.exe 108 PID 4676 wrote to memory of 2944 4676 OZMVL.exe 109 PID 2944 wrote to memory of 4588 2944 cmd.exe 113 PID 4588 wrote to memory of 1008 4588 LWKLA.exe 114 PID 1008 wrote to memory of 5388 1008 cmd.exe 118 PID 5388 wrote to memory of 3128 5388 WPNDAK.exe 119 PID 3128 wrote to memory of 564 3128 cmd.exe 123 PID 564 wrote to memory of 4592 564 AFTL.exe 124 PID 4592 wrote to memory of 1132 4592 cmd.exe 128 PID 1132 wrote to memory of 1344 1132 ZQE.exe 129 PID 1344 wrote to memory of 1452 1344 cmd.exe 133 PID 2208 wrote to memory of 3248 2208 cmd.exe 138 PID 3248 wrote to memory of 2476 3248 SOM.exe 139 PID 2476 wrote to memory of 5708 2476 cmd.exe 143 PID 5708 wrote to memory of 4228 5708 PTSQV.exe 144 PID 4228 wrote to memory of 1692 4228 cmd.exe 148 PID 1692 wrote to memory of 2908 1692 NEUGEMK.exe 149 PID 2908 wrote to memory of 2696 2908 cmd.exe 153 PID 2696 wrote to memory of 1964 2696 IAZP.exe 154 PID 1964 wrote to memory of 4288 1964 cmd.exe 158 PID 4288 wrote to memory of 1416 4288 XVJCZHZ.exe 159 PID 1416 wrote to memory of 3964 1416 cmd.exe 163 PID 3964 wrote to memory of 3800 3964 HVLHC.exe 164 PID 3800 wrote to memory of 3868 3800 cmd.exe 168 PID 3868 wrote to memory of 5720 3868 QDNMGB.exe 169 PID 5720 wrote to memory of 6040 5720 cmd.exe 173 PID 6040 wrote to memory of 948 6040 WEUA.exe 174 PID 948 wrote to memory of 2992 948 cmd.exe 178 PID 2992 wrote to memory of 2428 2992 GBAUEM.exe 179 PID 2428 wrote to memory of 6048 2428 cmd.exe 183 PID 6048 wrote to memory of 3312 6048 GHAIGZQ.exe 184 PID 3312 wrote to memory of 3104 3312 cmd.exe 188 PID 3104 wrote to memory of 4444 3104 MHIW.exe 189 PID 4444 wrote to memory of 1256 4444 cmd.exe 193 PID 1256 wrote to memory of 2424 1256 QPOWBM.exe 194 PID 2424 wrote to memory of 1000 2424 cmd.exe 198 PID 1000 wrote to memory of 1844 1000 QSSAH.exe 199 PID 1844 wrote to memory of 4568 1844 cmd.exe 203 PID 4568 wrote to memory of 2312 4568 ABUFSHR.exe 204 PID 2312 wrote to memory of 2488 2312 cmd.exe 208 PID 2488 wrote to memory of 4916 2488 PWEJD.exe 209 PID 4916 wrote to memory of 3420 4916 cmd.exe 213 PID 3420 wrote to memory of 2108 3420 JJITNT.exe 214 PID 2108 wrote to memory of 5544 2108 cmd.exe 218 PID 5544 wrote to memory of 5732 5544 JOJHPGJ.exe 219 PID 5732 wrote to memory of 1768 5732 cmd.exe 223 PID 1768 wrote to memory of 1392 1768 MKNQ.exe 224 PID 1392 wrote to memory of 4652 1392 cmd.exe 228 PID 4652 wrote to memory of 3580 4652 QSUZDR.exe 229 PID 3580 wrote to memory of 4764 3580 cmd.exe 233 PID 4764 wrote to memory of 2732 4764 WSC.exe 234 PID 2732 wrote to memory of 5848 2732 cmd.exe 238 PID 5848 wrote to memory of 732 5848 FAERY.exe 239 PID 732 wrote to memory of 4944 732 cmd.exe 243 PID 4944 wrote to memory of 488 4944 LBLFHSZ.exe 244 PID 488 wrote to memory of 4740 488 cmd.exe 248 PID 4740 wrote to memory of 1428 4740 UBF.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_5d40dff5fccfc7296e72bf1b54bfc0f9_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_5d40dff5fccfc7296e72bf1b54bfc0f9_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVYVG.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\windows\SysWOW64\MVYVG.exeC:\windows\system32\MVYVG.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYP.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\windows\XYP.exeC:\windows\XYP.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJFNHJ.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\windows\LJFNHJ.exeC:\windows\LJFNHJ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OZMVL.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\windows\SysWOW64\OZMVL.exeC:\windows\system32\OZMVL.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LWKLA.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\windows\SysWOW64\LWKLA.exeC:\windows\system32\LWKLA.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPNDAK.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\windows\WPNDAK.exeC:\windows\WPNDAK.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFTL.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\windows\AFTL.exeC:\windows\AFTL.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQE.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\windows\SysWOW64\ZQE.exeC:\windows\system32\ZQE.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZVW.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\windows\ZVW.exeC:\windows\ZVW.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SOM.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\windows\system\SOM.exeC:\windows\system\SOM.exe21⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PTSQV.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\windows\system\PTSQV.exeC:\windows\system\PTSQV.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NEUGEMK.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\windows\SysWOW64\NEUGEMK.exeC:\windows\system32\NEUGEMK.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAZP.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\windows\SysWOW64\IAZP.exeC:\windows\system32\IAZP.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XVJCZHZ.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\windows\XVJCZHZ.exeC:\windows\XVJCZHZ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HVLHC.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\windows\HVLHC.exeC:\windows\HVLHC.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QDNMGB.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\windows\SysWOW64\QDNMGB.exeC:\windows\system32\QDNMGB.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WEUA.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\windows\SysWOW64\WEUA.exeC:\windows\system32\WEUA.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GBAUEM.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\windows\SysWOW64\GBAUEM.exeC:\windows\system32\GBAUEM.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GHAIGZQ.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\windows\GHAIGZQ.exeC:\windows\GHAIGZQ.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MHIW.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\windows\MHIW.exeC:\windows\MHIW.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPOWBM.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\windows\QPOWBM.exeC:\windows\QPOWBM.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSSAH.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\windows\QSSAH.exeC:\windows\QSSAH.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABUFSHR.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\windows\system\ABUFSHR.exeC:\windows\system\ABUFSHR.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWEJD.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\windows\system\PWEJD.exeC:\windows\system\PWEJD.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJITNT.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\windows\system\JJITNT.exeC:\windows\system\JJITNT.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JOJHPGJ.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\windows\SysWOW64\JOJHPGJ.exeC:\windows\system32\JOJHPGJ.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKNQ.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\windows\system\MKNQ.exeC:\windows\system\MKNQ.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QSUZDR.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\windows\system\QSUZDR.exeC:\windows\system\QSUZDR.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WSC.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\windows\WSC.exeC:\windows\WSC.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FAERY.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\windows\system\FAERY.exeC:\windows\system\FAERY.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LBLFHSZ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:732 -
C:\windows\LBLFHSZ.exeC:\windows\LBLFHSZ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBF.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:488 -
C:\windows\system\UBF.exeC:\windows\system\UBF.exe65⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEROYOC.exe.bat" "66⤵PID:1428
-
C:\windows\VEROYOC.exeC:\windows\VEROYOC.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PROX.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:808 -
C:\windows\SysWOW64\PROX.exeC:\windows\system32\PROX.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IUATOE.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5164 -
C:\windows\SysWOW64\IUATOE.exeC:\windows\system32\IUATOE.exe71⤵
- Executes dropped EXE
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVH.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2616 -
C:\windows\system\OVH.exeC:\windows\system\OVH.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UVHCG.exe.bat" "74⤵PID:1608
-
C:\windows\SysWOW64\UVHCG.exeC:\windows\system32\UVHCG.exe75⤵
- Executes dropped EXE
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OIMMQAS.exe.bat" "76⤵PID:2652
-
C:\windows\SysWOW64\OIMMQAS.exeC:\windows\system32\OIMMQAS.exe77⤵
- Executes dropped EXE
PID:3720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJOR.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:6068 -
C:\windows\GJOR.exeC:\windows\GJOR.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YMSNH.exe.bat" "80⤵PID:3428
-
C:\windows\SysWOW64\YMSNH.exeC:\windows\system32\YMSNH.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZETR.exe.bat" "82⤵
- Executes a command shell one-liner
PID:3416 -
C:\windows\GZETR.exeC:\windows\GZETR.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUIX.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5820 -
C:\windows\SysWOW64\HUIX.exeC:\windows\system32\HUIX.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YFL.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:4116 -
C:\windows\system\YFL.exeC:\windows\system\YFL.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TQBMUA.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:5364 -
C:\windows\system\TQBMUA.exeC:\windows\system\TQBMUA.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VOHYB.exe.bat" "90⤵PID:2576
-
C:\windows\SysWOW64\VOHYB.exeC:\windows\system32\VOHYB.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HEO.exe.bat" "92⤵PID:3324
-
C:\windows\SysWOW64\HEO.exeC:\windows\system32\HEO.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QEQL.exe.bat" "94⤵
- Executes a command shell one-liner
PID:1644 -
C:\windows\system\QEQL.exeC:\windows\system\QEQL.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WEXZAB.exe.bat" "96⤵PID:2492
-
C:\windows\SysWOW64\WEXZAB.exeC:\windows\system32\WEXZAB.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VPIPJ.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4780 -
C:\windows\system\VPIPJ.exeC:\windows\system\VPIPJ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNO.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5400 -
C:\windows\SysWOW64\XNO.exeC:\windows\system32\XNO.exe101⤵
- Executes dropped EXE
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RASTA.exe.bat" "102⤵PID:4520
-
C:\windows\RASTA.exeC:\windows\RASTA.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QTVJ.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4196 -
C:\windows\QTVJ.exeC:\windows\QTVJ.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGAST.exe.bat" "106⤵PID:2004
-
C:\windows\LGAST.exeC:\windows\LGAST.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AWBJ.exe.bat" "108⤵
- Executes a command shell one-liner
PID:4180 -
C:\windows\SysWOW64\AWBJ.exeC:\windows\system32\AWBJ.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EEIREJ.exe.bat" "110⤵
- Executes a command shell one-liner
PID:940 -
C:\windows\SysWOW64\EEIREJ.exeC:\windows\system32\EEIREJ.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OCVE.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:4756 -
C:\windows\SysWOW64\OCVE.exeC:\windows\system32\OCVE.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XKXRXOK.exe.bat" "114⤵
- Executes a command shell one-liner
PID:5016 -
C:\windows\SysWOW64\XKXRXOK.exeC:\windows\system32\XKXRXOK.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLXF.exe.bat" "116⤵
- Executes a command shell one-liner
PID:3932 -
C:\windows\system\DLXF.exeC:\windows\system\DLXF.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VLZKRO.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:2468 -
C:\windows\system\VLZKRO.exeC:\windows\system\VLZKRO.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XJN.exe.bat" "120⤵
- Executes a command shell one-liner
PID:1060 -
C:\windows\system\XJN.exeC:\windows\system\XJN.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-