Analysis
- max time kernel
71s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 21:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_28187e2188413b69c1459f90d995a0a9_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-29_28187e2188413b69c1459f90d995a0a9_elex_emotet_stop.exe
- Size 282KB
- Sample260729-zy4apsfr9z
- SHA256 f06d542e8a04ec3de8a0f2d4137ab71472a39f421f8f8d93921209c603da78ec
- MD5 28187e2188413b69c1459f90d995a0a9
- SHA1 8e78e5be611d0c63d4c8ddf2e0c961b662ac2e19
- SHA512 8cdd4467497e5159e9295a089d149abce380c2d73383824542139b05cf49a02996864cc105455597294aa1fd87e3b59117f0816426a7ed8b703c4b5f9675d7c0
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOGkEjiPISUOgW9X+hOGzC/:RLWI09QZb6LOGkmZzcukG2/
- TLSH T114549F1776C28273D5A3037209DAC6E9B73ABC71573686C72794730D2B72EA5873A381
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3296 GFTHZX.exe 3680 TATP.exe 3892 PGDEHCQ.exe 992 XTQLKBL.exe 1172 FZURUH.exe 5800 VPVRB.exe 3408 OHLCS.exe 448 NSOS.exe 1488 ELYICP.exe 4984 GYQJVB.exe 5436 AMPHACA.exe 4820 RUDNFTD.exe 1624 VCKNR.exe 5056 WFNQ.exe 3192 YDTDMK.exe 5888 IAHXTS.exe 5144 VYHJ.exe 1920 OBKMJU.exe 4876 HUAXSV.exe 3960 IXETF.exe 3176 YIGJGRI.exe 2524 KYNJSJ.exe 3972 MVBE.exe 800 HYJC.exe 2636 HMJR.exe 3060 RCPLFQE.exe 2888 DCEWOQM.exe 2104 DXIS.exe 716 LLV.exe 1092 AQTVT.exe 4144 LJWOCE.exe 3320 VHBI.exe 3832 URM.exe 4564 DSOEVQ.exe 5720 GNXFH.exe 3784 KVMF.exe 5160 PVO.exe 3684 HZSLK.exe 2916 ARHWU.exe 5308 TMLA.exe 4932 FCRALXB.exe 2780 YFV.exe 4100 WQGUHAZ.exe 3980 MGHLGO.exe 4492 QOO.exe 4152 WOVHBI.exe 3988 UZY.exe 4644 NCCTXE.exe 5732 RSIT.exe 5648 KLYE.exe 5860 FYDNDX.exe 2036 CZFXH.exe 5220 NHTXTMG.exe 4904 MRWNCA.exe 3476 QHDN.exe 4816 PSF.exe 1568 FDQTYE.exe 2108 IYV.exe 3856 BTZGN.exe 880 JHDNY.exe 3404 JCHJ.exe 5236 EXYS.exe 4788 DIJ.exe 2892 DLNEL.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\WFNQ.exe VCKNR.exe File created C:\windows\SysWOW64\IXETF.exe.bat HUAXSV.exe File opened for modification C:\windows\SysWOW64\MVBE.exe KYNJSJ.exe File created C:\windows\SysWOW64\WQGUHAZ.exe YFV.exe File created C:\windows\SysWOW64\RSIT.exe NCCTXE.exe File created C:\windows\SysWOW64\QHDN.exe MRWNCA.exe File created C:\windows\SysWOW64\PKJEEL.exe XPXJ.exe File created C:\windows\SysWOW64\IXETF.exe HUAXSV.exe File created C:\windows\SysWOW64\URM.exe VHBI.exe File created C:\windows\SysWOW64\WQGUHAZ.exe.bat YFV.exe File opened for modification C:\windows\SysWOW64\HTU.exe DLNEL.exe File opened for modification C:\windows\SysWOW64\XPXJ.exe HZWJSA.exe File opened for modification C:\windows\SysWOW64\PKJEEL.exe XPXJ.exe File created C:\windows\SysWOW64\VPVRB.exe FZURUH.exe File opened for modification C:\windows\SysWOW64\WFNQ.exe VCKNR.exe File created C:\windows\SysWOW64\WFNQ.exe.bat VCKNR.exe File created C:\windows\SysWOW64\WOVHBI.exe QOO.exe File opened for modification C:\windows\SysWOW64\VPVRB.exe FZURUH.exe File created C:\windows\SysWOW64\WOVHBI.exe.bat QOO.exe File created C:\windows\SysWOW64\CZFXH.exe.bat FYDNDX.exe File opened for modification C:\windows\SysWOW64\JHDNY.exe BTZGN.exe File created C:\windows\SysWOW64\JHDNY.exe.bat BTZGN.exe File opened for modification C:\windows\SysWOW64\DVDM.exe NFCNGS.exe File created C:\windows\SysWOW64\HUAXSV.exe.bat OBKMJU.exe File created C:\windows\SysWOW64\MVBE.exe KYNJSJ.exe File created C:\windows\SysWOW64\LJWOCE.exe AQTVT.exe File created C:\windows\SysWOW64\QHDN.exe.bat MRWNCA.exe File opened for modification C:\windows\SysWOW64\FDQTYE.exe PSF.exe File created C:\windows\SysWOW64\DVDM.exe.bat NFCNGS.exe File created C:\windows\SysWOW64\HMJR.exe HYJC.exe File opened for modification C:\windows\SysWOW64\RSIT.exe NCCTXE.exe File created C:\windows\SysWOW64\HUAXSV.exe OBKMJU.exe File opened for modification C:\windows\SysWOW64\KYNJSJ.exe YIGJGRI.exe File created C:\windows\SysWOW64\KYNJSJ.exe.bat YIGJGRI.exe File opened for modification C:\windows\SysWOW64\DCEWOQM.exe RCPLFQE.exe File created C:\windows\SysWOW64\FDQTYE.exe PSF.exe File created C:\windows\SysWOW64\BYPW.exe SQNQXAC.exe File created C:\windows\SysWOW64\HMJR.exe.bat HYJC.exe File created C:\windows\SysWOW64\LJWOCE.exe.bat AQTVT.exe File opened for modification C:\windows\SysWOW64\URM.exe VHBI.exe File created C:\windows\SysWOW64\PKJEEL.exe.bat XPXJ.exe File created C:\windows\SysWOW64\YDTDMK.exe WFNQ.exe File created C:\windows\SysWOW64\MVBE.exe.bat KYNJSJ.exe File created C:\windows\SysWOW64\VPVRB.exe.bat FZURUH.exe File opened for modification C:\windows\SysWOW64\HMJR.exe HYJC.exe File opened for modification C:\windows\SysWOW64\LJWOCE.exe AQTVT.exe File opened for modification C:\windows\SysWOW64\GNXFH.exe DSOEVQ.exe File created C:\windows\SysWOW64\GNXFH.exe.bat DSOEVQ.exe File created C:\windows\SysWOW64\BYPW.exe.bat SQNQXAC.exe File created C:\windows\SysWOW64\QAEXMP.exe.bat BFU.exe File opened for modification C:\windows\SysWOW64\VCKNR.exe RUDNFTD.exe File opened for modification C:\windows\SysWOW64\CZFXH.exe FYDNDX.exe File opened for modification C:\windows\SysWOW64\QAEXMP.exe BFU.exe File created C:\windows\SysWOW64\WLJ.exe.bat UNDB.exe File created C:\windows\SysWOW64\VCKNR.exe.bat RUDNFTD.exe File created C:\windows\SysWOW64\HTU.exe DLNEL.exe File opened for modification C:\windows\SysWOW64\BYPW.exe SQNQXAC.exe File created C:\windows\SysWOW64\XPXJ.exe.bat HZWJSA.exe File created C:\windows\SysWOW64\WLJ.exe UNDB.exe File opened for modification C:\windows\SysWOW64\WLJ.exe UNDB.exe File opened for modification C:\windows\SysWOW64\IXETF.exe HUAXSV.exe File opened for modification C:\windows\SysWOW64\WOVHBI.exe QOO.exe File created C:\windows\SysWOW64\RSIT.exe.bat NCCTXE.exe File opened for modification C:\windows\SysWOW64\QHDN.exe MRWNCA.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\PVO.exe KVMF.exe File created C:\windows\system\NHTXTMG.exe CZFXH.exe File created C:\windows\system\EXYS.exe JCHJ.exe File created C:\windows\system\EXYS.exe.bat JCHJ.exe File created C:\windows\XXOLOK.exe PKJEEL.exe File opened for modification C:\windows\system\WWDY.exe QAEXMP.exe File opened for modification C:\windows\system\UNDB.exe OSE.exe File created C:\windows\OHLCS.exe VPVRB.exe File created C:\windows\QOO.exe.bat MGHLGO.exe File created C:\windows\system\NCCTXE.exe.bat UZY.exe File created C:\windows\system\UNDB.exe OSE.exe File created C:\windows\system\XOMZO.exe WLJ.exe File created C:\windows\system\TATP.exe GFTHZX.exe File created C:\windows\system\KLYE.exe.bat RSIT.exe File created C:\windows\system\DLNEL.exe.bat DIJ.exe File created C:\windows\system\AMPHACA.exe GYQJVB.exe File created C:\windows\system\IAHXTS.exe YDTDMK.exe File created C:\windows\system\DSOEVQ.exe URM.exe File created C:\windows\system\PZHCWH.exe WWDY.exe File created C:\windows\VYHJ.exe.bat IAHXTS.exe File created C:\windows\system\FYDNDX.exe KLYE.exe File opened for modification C:\windows\DIJ.exe EXYS.exe File opened for modification C:\windows\system\LJAMJ.exe HTU.exe File created C:\windows\BFU.exe XXOLOK.exe File created C:\windows\system\XOMZO.exe.bat WLJ.exe File opened for modification C:\windows\system\TATP.exe GFTHZX.exe File created C:\windows\system\TATP.exe.bat GFTHZX.exe File opened for modification C:\windows\TMLA.exe ARHWU.exe File opened for modification C:\windows\OSE.exe EUYG.exe File opened for modification C:\windows\OHLCS.exe VPVRB.exe File created C:\windows\ELYICP.exe NSOS.exe File opened for modification C:\windows\PVO.exe KVMF.exe File created C:\windows\system\HZSLK.exe.bat PVO.exe File created C:\windows\YFV.exe FCRALXB.exe File opened for modification C:\windows\system\FYDNDX.exe KLYE.exe File opened for modification C:\windows\QPPVYL.exe XMLZSVO.exe File created C:\windows\system\HZWJSA.exe BYPW.exe File created C:\windows\system\NSOS.exe OHLCS.exe File opened for modification C:\windows\GYQJVB.exe ELYICP.exe File created C:\windows\system\MRWNCA.exe NHTXTMG.exe File opened for modification C:\windows\XXOLOK.exe PKJEEL.exe File created C:\windows\XTQLKBL.exe.bat PGDEHCQ.exe File created C:\windows\GYQJVB.exe ELYICP.exe File created C:\windows\VHBI.exe LJWOCE.exe File opened for modification C:\windows\BFU.exe XXOLOK.exe File opened for modification C:\windows\VDGU.exe XOMZO.exe File opened for modification C:\windows\ELYICP.exe NSOS.exe File created C:\windows\system\LLV.exe DXIS.exe File opened for modification C:\windows\VHBI.exe LJWOCE.exe File opened for modification C:\windows\system\DSOEVQ.exe URM.exe File created C:\windows\FCRALXB.exe TMLA.exe File created C:\windows\QPPVYL.exe XMLZSVO.exe File created C:\windows\QPPVYL.exe.bat XMLZSVO.exe File opened for modification C:\windows\PGDEHCQ.exe TATP.exe File created C:\windows\system\YIGJGRI.exe IXETF.exe File created C:\windows\system\NCCTXE.exe UZY.exe File created C:\windows\system\NHTXTMG.exe.bat CZFXH.exe File created C:\windows\XMLZSVO.exe.bat LJAMJ.exe File created C:\windows\NFCNGS.exe QPPVYL.exe File opened for modification C:\windows\system\SQNQXAC.exe DVDM.exe File opened for modification C:\windows\system\YIGJGRI.exe IXETF.exe File created C:\windows\system\HYJC.exe.bat MVBE.exe File created C:\windows\PGDEHCQ.exe TATP.exe File created C:\windows\system\OBKMJU.exe.bat VYHJ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3004 cmd.exe 5184 cmd.exe 4116 cmd.exe 1400 cmd.exe 5956 cmd.exe 3580 cmd.exe 3844 cmd.exe 3836 cmd.exe 3768 cmd.exe 3720 cmd.exe 2128 cmd.exe 2564 cmd.exe 2268 cmd.exe 2784 cmd.exe 4600 cmd.exe 3256 cmd.exe 4412 cmd.exe 4256 cmd.exe 4456 cmd.exe 3204 cmd.exe 4124 cmd.exe 6036 cmd.exe 2264 cmd.exe 5736 cmd.exe 1668 cmd.exe 3196 cmd.exe 2604 cmd.exe 5932 cmd.exe 1788 cmd.exe 5100 cmd.exe 3896 cmd.exe 1928 cmd.exe 3496 cmd.exe 5576 cmd.exe 5000 cmd.exe 6104 cmd.exe 5212 cmd.exe 1220 cmd.exe 1456 cmd.exe 5980 cmd.exe 2712 cmd.exe 4488 cmd.exe 1656 cmd.exe 3552 cmd.exe 5684 cmd.exe 4752 cmd.exe 4376 cmd.exe 1748 cmd.exe 3116 cmd.exe 4316 cmd.exe 4648 cmd.exe 836 cmd.exe 2908 cmd.exe 3348 cmd.exe 4476 cmd.exe 3284 cmd.exe 5968 cmd.exe 4348 cmd.exe 3976 cmd.exe 3828 cmd.exe 5064 cmd.exe 1124 cmd.exe 4800 cmd.exe 5704 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4288 916 WerFault.exe 86 4448 3296 WerFault.exe 92 4484 3680 WerFault.exe 98 2176 3892 WerFault.exe 103 4832 992 WerFault.exe 108 2344 1172 WerFault.exe 113 5308 5800 WerFault.exe 118 2140 3408 WerFault.exe 123 1204 448 WerFault.exe 128 6016 1488 WerFault.exe 133 440 4984 WerFault.exe 138 3832 5436 WerFault.exe 143 4064 4820 WerFault.exe 148 2636 1624 WerFault.exe 153 3496 5056 WerFault.exe 158 6088 3192 WerFault.exe 163 5408 5888 WerFault.exe 168 4812 5144 WerFault.exe 172 4868 1920 WerFault.exe 178 4940 4876 WerFault.exe 183 268 3960 WerFault.exe 188 4100 3176 WerFault.exe 193 1184 2524 WerFault.exe 198 5720 3972 WerFault.exe 203 1224 800 WerFault.exe 208 2976 2636 WerFault.exe 213 4384 3060 WerFault.exe 218 5076 2888 WerFault.exe 223 1668 2104 WerFault.exe 228 1904 716 WerFault.exe 232 684 1092 WerFault.exe 237 1144 4144 WerFault.exe 243 5356 3320 WerFault.exe 248 5876 3832 WerFault.exe 253 4900 4564 WerFault.exe 258 4524 5720 WerFault.exe 263 2976 3784 WerFault.exe 269 4260 5160 WerFault.exe 274 5472 3684 WerFault.exe 279 4080 2916 WerFault.exe 284 2324 5308 WerFault.exe 289 3976 4932 WerFault.exe 294 1096 2780 WerFault.exe 299 4140 4100 WerFault.exe 304 4920 3980 WerFault.exe 309 4448 4492 WerFault.exe 314 4848 4152 WerFault.exe 319 1472 3988 WerFault.exe 324 2700 4644 WerFault.exe 329 5504 5732 WerFault.exe 334 2684 5648 WerFault.exe 339 4324 5860 WerFault.exe 344 4124 2036 WerFault.exe 349 5952 5220 WerFault.exe 354 4976 4904 WerFault.exe 359 5756 3476 WerFault.exe 364 4612 4816 WerFault.exe 369 4836 1568 WerFault.exe 374 5184 2108 WerFault.exe 379 1068 3856 WerFault.exe 384 1904 880 WerFault.exe 389 1620 3404 WerFault.exe 394 4224 5236 WerFault.exe 399 6012 4788 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFTHZX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UNDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TMLA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOMZO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GNXFH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXYS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZURUH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OBKMJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EUYG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYNJSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJWOCE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZSLK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JCHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQGUHAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NCCTXE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YIGJGRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RCPLFQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MGHLGO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MRWNCA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QPPVYL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCKNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGDEHCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VHBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQNQXAC.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 916 2026-07-29_28187e2188413b69c1459f90d995a0a9_elex_emotet_stop.exe 916 2026-07-29_28187e2188413b69c1459f90d995a0a9_elex_emotet_stop.exe 3296 GFTHZX.exe 3296 GFTHZX.exe 3680 TATP.exe 3680 TATP.exe 3892 PGDEHCQ.exe 3892 PGDEHCQ.exe 992 XTQLKBL.exe 992 XTQLKBL.exe 1172 FZURUH.exe 1172 FZURUH.exe 5800 VPVRB.exe 5800 VPVRB.exe 3408 OHLCS.exe 3408 OHLCS.exe 448 NSOS.exe 448 NSOS.exe 1488 ELYICP.exe 1488 ELYICP.exe 4984 GYQJVB.exe 4984 GYQJVB.exe 5436 AMPHACA.exe 5436 AMPHACA.exe 4820 RUDNFTD.exe 4820 RUDNFTD.exe 1624 VCKNR.exe 1624 VCKNR.exe 5056 WFNQ.exe 5056 WFNQ.exe 3192 YDTDMK.exe 3192 YDTDMK.exe 5888 IAHXTS.exe 5888 IAHXTS.exe 5144 VYHJ.exe 5144 VYHJ.exe 1920 OBKMJU.exe 1920 OBKMJU.exe 4876 HUAXSV.exe 4876 HUAXSV.exe 3960 IXETF.exe 3960 IXETF.exe 3176 YIGJGRI.exe 3176 YIGJGRI.exe 2524 KYNJSJ.exe 2524 KYNJSJ.exe 3972 MVBE.exe 3972 MVBE.exe 800 HYJC.exe 800 HYJC.exe 2636 HMJR.exe 2636 HMJR.exe 3060 RCPLFQE.exe 3060 RCPLFQE.exe 2888 DCEWOQM.exe 2888 DCEWOQM.exe 2104 DXIS.exe 2104 DXIS.exe 716 LLV.exe 716 LLV.exe 1092 AQTVT.exe 1092 AQTVT.exe 4144 LJWOCE.exe 4144 LJWOCE.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 916 2026-07-29_28187e2188413b69c1459f90d995a0a9_elex_emotet_stop.exe 916 2026-07-29_28187e2188413b69c1459f90d995a0a9_elex_emotet_stop.exe 3296 GFTHZX.exe 3296 GFTHZX.exe 3680 TATP.exe 3680 TATP.exe 3892 PGDEHCQ.exe 3892 PGDEHCQ.exe 992 XTQLKBL.exe 992 XTQLKBL.exe 1172 FZURUH.exe 1172 FZURUH.exe 5800 VPVRB.exe 5800 VPVRB.exe 3408 OHLCS.exe 3408 OHLCS.exe 448 NSOS.exe 448 NSOS.exe 1488 ELYICP.exe 1488 ELYICP.exe 4984 GYQJVB.exe 4984 GYQJVB.exe 5436 AMPHACA.exe 5436 AMPHACA.exe 4820 RUDNFTD.exe 4820 RUDNFTD.exe 1624 VCKNR.exe 1624 VCKNR.exe 5056 WFNQ.exe 5056 WFNQ.exe 3192 YDTDMK.exe 3192 YDTDMK.exe 5888 IAHXTS.exe 5888 IAHXTS.exe 5144 VYHJ.exe 5144 VYHJ.exe 1920 OBKMJU.exe 1920 OBKMJU.exe 4876 HUAXSV.exe 4876 HUAXSV.exe 3960 IXETF.exe 3960 IXETF.exe 3176 YIGJGRI.exe 3176 YIGJGRI.exe 2524 KYNJSJ.exe 2524 KYNJSJ.exe 3972 MVBE.exe 3972 MVBE.exe 800 HYJC.exe 800 HYJC.exe 2636 HMJR.exe 2636 HMJR.exe 3060 RCPLFQE.exe 3060 RCPLFQE.exe 2888 DCEWOQM.exe 2888 DCEWOQM.exe 2104 DXIS.exe 2104 DXIS.exe 716 LLV.exe 716 LLV.exe 1092 AQTVT.exe 1092 AQTVT.exe 4144 LJWOCE.exe 4144 LJWOCE.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 916 wrote to memory of 2404 916 2026-07-29_28187e2188413b69c1459f90d995a0a9_elex_emotet_stop.exe 88 PID 2404 wrote to memory of 3296 2404 cmd.exe 92 PID 3296 wrote to memory of 4028 3296 GFTHZX.exe 94 PID 4028 wrote to memory of 3680 4028 cmd.exe 98 PID 3680 wrote to memory of 2056 3680 TATP.exe 99 PID 2056 wrote to memory of 3892 2056 cmd.exe 103 PID 3892 wrote to memory of 2348 3892 PGDEHCQ.exe 104 PID 2348 wrote to memory of 992 2348 cmd.exe 108 PID 992 wrote to memory of 2364 992 XTQLKBL.exe 109 PID 2364 wrote to memory of 1172 2364 cmd.exe 113 PID 1172 wrote to memory of 2864 1172 FZURUH.exe 114 PID 2864 wrote to memory of 5800 2864 cmd.exe 118 PID 5800 wrote to memory of 3036 5800 VPVRB.exe 119 PID 3036 wrote to memory of 3408 3036 cmd.exe 123 PID 3408 wrote to memory of 1340 3408 OHLCS.exe 124 PID 1340 wrote to memory of 448 1340 cmd.exe 128 PID 448 wrote to memory of 708 448 NSOS.exe 129 PID 708 wrote to memory of 1488 708 cmd.exe 133 PID 1488 wrote to memory of 5956 1488 ELYICP.exe 134 PID 5956 wrote to memory of 4984 5956 cmd.exe 138 PID 4984 wrote to memory of 5000 4984 GYQJVB.exe 139 PID 5000 wrote to memory of 5436 5000 cmd.exe 143 PID 5436 wrote to memory of 5932 5436 AMPHACA.exe 144 PID 5932 wrote to memory of 4820 5932 cmd.exe 148 PID 4820 wrote to memory of 4012 4820 RUDNFTD.exe 149 PID 4012 wrote to memory of 1624 4012 cmd.exe 153 PID 1624 wrote to memory of 4588 1624 VCKNR.exe 154 PID 4588 wrote to memory of 5056 4588 cmd.exe 158 PID 5056 wrote to memory of 1152 5056 WFNQ.exe 159 PID 1152 wrote to memory of 3192 1152 cmd.exe 163 PID 3192 wrote to memory of 4652 3192 YDTDMK.exe 164 PID 4652 wrote to memory of 5888 4652 cmd.exe 168 PID 5888 wrote to memory of 5548 5888 IAHXTS.exe 169 PID 5548 wrote to memory of 5144 5548 cmd.exe 172 PID 5144 wrote to memory of 1788 5144 VYHJ.exe 174 PID 1788 wrote to memory of 1920 1788 cmd.exe 178 PID 1920 wrote to memory of 2712 1920 OBKMJU.exe 179 PID 2712 wrote to memory of 4876 2712 cmd.exe 183 PID 4876 wrote to memory of 1424 4876 HUAXSV.exe 184 PID 1424 wrote to memory of 3960 1424 cmd.exe 188 PID 3960 wrote to memory of 2704 3960 IXETF.exe 189 PID 2704 wrote to memory of 3176 2704 cmd.exe 193 PID 3176 wrote to memory of 2672 3176 YIGJGRI.exe 194 PID 2672 wrote to memory of 2524 2672 cmd.exe 198 PID 2524 wrote to memory of 5572 2524 KYNJSJ.exe 199 PID 5572 wrote to memory of 3972 5572 cmd.exe 203 PID 3972 wrote to memory of 5968 3972 MVBE.exe 204 PID 5968 wrote to memory of 800 5968 cmd.exe 208 PID 800 wrote to memory of 4728 800 HYJC.exe 209 PID 4728 wrote to memory of 2636 4728 cmd.exe 213 PID 2636 wrote to memory of 1176 2636 HMJR.exe 214 PID 1176 wrote to memory of 3060 1176 cmd.exe 218 PID 3060 wrote to memory of 3580 3060 RCPLFQE.exe 219 PID 3580 wrote to memory of 2888 3580 cmd.exe 223 PID 2888 wrote to memory of 1400 2888 DCEWOQM.exe 224 PID 1400 wrote to memory of 2104 1400 cmd.exe 228 PID 2104 wrote to memory of 1008 2104 DXIS.exe 229 PID 1008 wrote to memory of 716 1008 cmd.exe 232 PID 716 wrote to memory of 5764 716 LLV.exe 234 PID 5764 wrote to memory of 1092 5764 cmd.exe 237 PID 1092 wrote to memory of 4256 1092 AQTVT.exe 239 PID 4256 wrote to memory of 4144 4256 cmd.exe 243 PID 4144 wrote to memory of 3632 4144 LJWOCE.exe 244 PID 3632 wrote to memory of 3320 3632 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_28187e2188413b69c1459f90d995a0a9_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_28187e2188413b69c1459f90d995a0a9_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GFTHZX.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\windows\GFTHZX.exeC:\windows\GFTHZX.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TATP.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\windows\system\TATP.exeC:\windows\system\TATP.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PGDEHCQ.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\windows\PGDEHCQ.exeC:\windows\PGDEHCQ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTQLKBL.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\windows\XTQLKBL.exeC:\windows\XTQLKBL.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZURUH.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\windows\system\FZURUH.exeC:\windows\system\FZURUH.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPVRB.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\windows\SysWOW64\VPVRB.exeC:\windows\system32\VPVRB.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHLCS.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\windows\OHLCS.exeC:\windows\OHLCS.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSOS.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\windows\system\NSOS.exeC:\windows\system\NSOS.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ELYICP.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:708 -
C:\windows\ELYICP.exeC:\windows\ELYICP.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYQJVB.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\windows\GYQJVB.exeC:\windows\GYQJVB.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMPHACA.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\windows\system\AMPHACA.exeC:\windows\system\AMPHACA.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RUDNFTD.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\windows\system\RUDNFTD.exeC:\windows\system\RUDNFTD.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VCKNR.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\windows\SysWOW64\VCKNR.exeC:\windows\system32\VCKNR.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WFNQ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\windows\SysWOW64\WFNQ.exeC:\windows\system32\WFNQ.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDTDMK.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\windows\SysWOW64\YDTDMK.exeC:\windows\system32\YDTDMK.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IAHXTS.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\windows\system\IAHXTS.exeC:\windows\system\IAHXTS.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VYHJ.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\windows\VYHJ.exeC:\windows\VYHJ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OBKMJU.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\windows\system\OBKMJU.exeC:\windows\system\OBKMJU.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUAXSV.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\windows\SysWOW64\HUAXSV.exeC:\windows\system32\HUAXSV.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXETF.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\windows\SysWOW64\IXETF.exeC:\windows\system32\IXETF.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YIGJGRI.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\windows\system\YIGJGRI.exeC:\windows\system\YIGJGRI.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYNJSJ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\windows\SysWOW64\KYNJSJ.exeC:\windows\system32\KYNJSJ.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVBE.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\windows\SysWOW64\MVBE.exeC:\windows\system32\MVBE.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HYJC.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\windows\system\HYJC.exeC:\windows\system\HYJC.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HMJR.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\windows\SysWOW64\HMJR.exeC:\windows\system32\HMJR.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RCPLFQE.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\windows\system\RCPLFQE.exeC:\windows\system\RCPLFQE.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCEWOQM.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\windows\SysWOW64\DCEWOQM.exeC:\windows\system32\DCEWOQM.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DXIS.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\windows\system\DXIS.exeC:\windows\system\DXIS.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LLV.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\windows\system\LLV.exeC:\windows\system\LLV.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AQTVT.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\windows\AQTVT.exeC:\windows\AQTVT.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJWOCE.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\windows\SysWOW64\LJWOCE.exeC:\windows\system32\LJWOCE.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VHBI.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\windows\VHBI.exeC:\windows\VHBI.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\URM.exe.bat" "66⤵PID:5444
-
C:\windows\SysWOW64\URM.exeC:\windows\system32\URM.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DSOEVQ.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1052 -
C:\windows\system\DSOEVQ.exeC:\windows\system\DSOEVQ.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GNXFH.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4456 -
C:\windows\SysWOW64\GNXFH.exeC:\windows\system32\GNXFH.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KVMF.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:5020 -
C:\windows\KVMF.exeC:\windows\KVMF.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PVO.exe.bat" "74⤵PID:6040
-
C:\windows\PVO.exeC:\windows\PVO.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HZSLK.exe.bat" "76⤵PID:4832
-
C:\windows\system\HZSLK.exeC:\windows\system\HZSLK.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ARHWU.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4944 -
C:\windows\system\ARHWU.exeC:\windows\system\ARHWU.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TMLA.exe.bat" "80⤵PID:4308
-
C:\windows\TMLA.exeC:\windows\TMLA.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FCRALXB.exe.bat" "82⤵PID:5156
-
C:\windows\FCRALXB.exeC:\windows\FCRALXB.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YFV.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4488 -
C:\windows\YFV.exeC:\windows\YFV.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQGUHAZ.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2564 -
C:\windows\SysWOW64\WQGUHAZ.exeC:\windows\system32\WQGUHAZ.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MGHLGO.exe.bat" "88⤵
- Executes a command shell one-liner
PID:6036 -
C:\windows\system\MGHLGO.exeC:\windows\system\MGHLGO.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QOO.exe.bat" "90⤵PID:4508
-
C:\windows\QOO.exeC:\windows\QOO.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WOVHBI.exe.bat" "92⤵
- Executes a command shell one-liner
PID:4348 -
C:\windows\SysWOW64\WOVHBI.exeC:\windows\system32\WOVHBI.exe93⤵
- Executes dropped EXE
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UZY.exe.bat" "94⤵PID:3676
-
C:\windows\UZY.exeC:\windows\UZY.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NCCTXE.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4364 -
C:\windows\system\NCCTXE.exeC:\windows\system\NCCTXE.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RSIT.exe.bat" "98⤵PID:4020
-
C:\windows\SysWOW64\RSIT.exeC:\windows\system32\RSIT.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KLYE.exe.bat" "100⤵PID:5472
-
C:\windows\system\KLYE.exeC:\windows\system\KLYE.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FYDNDX.exe.bat" "102⤵
- Executes a command shell one-liner
PID:3204 -
C:\windows\system\FYDNDX.exeC:\windows\system\FYDNDX.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CZFXH.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:3008 -
C:\windows\SysWOW64\CZFXH.exeC:\windows\system32\CZFXH.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHTXTMG.exe.bat" "106⤵
- Executes a command shell one-liner
PID:3976 -
C:\windows\system\NHTXTMG.exeC:\windows\system\NHTXTMG.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRWNCA.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1656 -
C:\windows\system\MRWNCA.exeC:\windows\system\MRWNCA.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QHDN.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5100 -
C:\windows\SysWOW64\QHDN.exeC:\windows\system32\QHDN.exe111⤵
- Executes dropped EXE
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PSF.exe.bat" "112⤵PID:5432
-
C:\windows\system\PSF.exeC:\windows\system\PSF.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FDQTYE.exe.bat" "114⤵PID:1780
-
C:\windows\SysWOW64\FDQTYE.exeC:\windows\system32\FDQTYE.exe115⤵
- Executes dropped EXE
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYV.exe.bat" "116⤵PID:2156
-
C:\windows\IYV.exeC:\windows\IYV.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BTZGN.exe.bat" "118⤵PID:2060
-
C:\windows\BTZGN.exeC:\windows\BTZGN.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JHDNY.exe.bat" "120⤵
- Executes a command shell one-liner
PID:2268 -
C:\windows\SysWOW64\JHDNY.exeC:\windows\system32\JHDNY.exe121⤵
- Executes dropped EXE
PID:880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-