Analysis
- max time kernel
91s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 20:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_fa3c5b2265dd40a48d57d7b7156a287a_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-08_fa3c5b2265dd40a48d57d7b7156a287a_elex_emotet_stop.exe
- Size 208KB
- Sample260808-yq5ccsfc57
- SHA256 f4513ab6143a5b1cba0565f25f4853d0b7071a2f2b1927d3a45854ee58a2215a
- MD5 fa3c5b2265dd40a48d57d7b7156a287a
- SHA1 eca9b593cc47a3c3d93a34ec228993d2b3081b7b
- SHA512 8ebd81067f898bcf2d40b0f5ad5f39299d51f8e778c60099836a7152e34205a2f52fb4568582537c80dff7c314255cadf7325994651815e3626d6fb4995fbc9d
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUtL+LOfB4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUp+LOJkEj1
- TLSH T1EB247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1780 YTWGG.exe 4332 QEVMO.exe 2988 OXXC.exe 1756 QUDXEN.exe 1520 EXTVTQ.exe 2608 GSY.exe 2740 ZNCAI.exe 2984 IWEGML.exe 5152 JRIJZ.exe 5708 DMNTBBZ.exe 5300 LSRZMAV.exe 6080 KPLCH.exe 2744 OSJ.exe 5832 JGOHR.exe 3872 NWUHDQQ.exe 2748 PJZQ.exe 5892 KWEAQQ.exe 2928 EKJ.exe 824 SURIOA.exe 5512 YQQ.exe 3060 NLAVEQ.exe 3884 HYE.exe 3312 JWGY.exe 4548 SJQQ.exe 3480 VWNINJ.exe 968 VCNOOOE.exe 1488 GVQ.exe 4216 FSBKJJT.exe 3620 ZGG.exe 2408 ZLGI.exe 3992 LEBBD.exe 848 FRGKGVP.exe 4976 NFTRQBK.exe 5304 TFAE.exe 3424 LFCJL.exe 1972 QGK.exe 5436 FLIU.exe 1984 QEL.exe 5564 WESBSP.exe 1720 TKYYHYB.exe 5624 NXDH.exe 4280 DNEZQM.exe 3900 JNM.exe 3448 UGHF.exe 1660 SGOTRX.exe 4172 SJS.exe 5640 PHYUL.exe 5920 YPAZPV.exe 4592 VVG.exe 3252 KDHN.exe 1552 IDOBLUD.exe 4640 ZLQ.exe 5896 ZWRID.exe 3744 QETNOB.exe 4128 EPJL.exe 3456 PHEEDT.exe 4004 KVJNNTV.exe 2552 EIOX.exe 2616 VQQCB.exe 2828 QEVLLQB.exe 2016 WEDZU.exe 6116 FEFMXQ.exe 2492 LEM.exe 1096 GARJR.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\MBVHPPA.exe.bat EVCT.exe File created C:\windows\SysWOW64\ALH.exe.bat JLFSX.exe File created C:\windows\SysWOW64\EXPSU.exe ISJVNH.exe File opened for modification C:\windows\SysWOW64\NWUHDQQ.exe JGOHR.exe File created C:\windows\SysWOW64\SJQQ.exe JWGY.exe File opened for modification C:\windows\SysWOW64\CMB.exe FGDENQ.exe File opened for modification C:\windows\SysWOW64\QEVLLQB.exe VQQCB.exe File created C:\windows\SysWOW64\EXTVTQ.exe QUDXEN.exe File created C:\windows\SysWOW64\SGOTRX.exe UGHF.exe File created C:\windows\SysWOW64\QEVLLQB.exe.bat VQQCB.exe File opened for modification C:\windows\SysWOW64\WEDZU.exe QEVLLQB.exe File created C:\windows\SysWOW64\LEM.exe FEFMXQ.exe File created C:\windows\SysWOW64\BUNBPB.exe.bat HHIS.exe File created C:\windows\SysWOW64\EIOX.exe.bat KVJNNTV.exe File created C:\windows\SysWOW64\KTADHZ.exe.bat KGAOYM.exe File opened for modification C:\windows\SysWOW64\FCTZQMG.exe ZBMLZ.exe File created C:\windows\SysWOW64\ALH.exe JLFSX.exe File created C:\windows\SysWOW64\GSY.exe EXTVTQ.exe File created C:\windows\SysWOW64\WEDZU.exe QEVLLQB.exe File opened for modification C:\windows\SysWOW64\MBVHPPA.exe EVCT.exe File created C:\windows\SysWOW64\ZNCAI.exe GSY.exe File created C:\windows\SysWOW64\NWUHDQQ.exe JGOHR.exe File created C:\windows\SysWOW64\QEL.exe.bat FLIU.exe File created C:\windows\SysWOW64\EVCT.exe.bat MAZXIUV.exe File opened for modification C:\windows\SysWOW64\JYYOZ.exe DXRBQAR.exe File opened for modification C:\windows\SysWOW64\EXTVTQ.exe QUDXEN.exe File created C:\windows\SysWOW64\ZNCAI.exe.bat GSY.exe File created C:\windows\SysWOW64\WESBSP.exe QEL.exe File created C:\windows\SysWOW64\SGOTRX.exe.bat UGHF.exe File created C:\windows\SysWOW64\BUNBPB.exe HHIS.exe File opened for modification C:\windows\SysWOW64\FGDENQ.exe LTYM.exe File created C:\windows\SysWOW64\TKYYHYB.exe.bat WESBSP.exe File opened for modification C:\windows\SysWOW64\KVJNNTV.exe PHEEDT.exe File created C:\windows\SysWOW64\EVCT.exe MAZXIUV.exe File created C:\windows\SysWOW64\KUJC.exe ALH.exe File created C:\windows\SysWOW64\GVQ.exe VCNOOOE.exe File opened for modification C:\windows\SysWOW64\IPU.exe ZPSPPBA.exe File opened for modification C:\windows\SysWOW64\ZWL.exe RQTYEHN.exe File created C:\windows\SysWOW64\GVQ.exe.bat VCNOOOE.exe File created C:\windows\SysWOW64\NMQUXIH.exe BUNBPB.exe File created C:\windows\SysWOW64\LTYM.exe.bat ZBVBC.exe File created C:\windows\SysWOW64\EXPSU.exe.bat ISJVNH.exe File created C:\windows\SysWOW64\QEL.exe FLIU.exe File opened for modification C:\windows\SysWOW64\QEL.exe FLIU.exe File created C:\windows\SysWOW64\KUJ.exe CKBCHV.exe File opened for modification C:\windows\SysWOW64\FLIU.exe QGK.exe File opened for modification C:\windows\SysWOW64\BUNBPB.exe HHIS.exe File created C:\windows\SysWOW64\NMQUXIH.exe.bat BUNBPB.exe File created C:\windows\SysWOW64\KGAOYM.exe AAQWQ.exe File opened for modification C:\windows\SysWOW64\KTADHZ.exe KGAOYM.exe File created C:\windows\SysWOW64\FLIU.exe.bat QGK.exe File opened for modification C:\windows\SysWOW64\QEVMO.exe YTWGG.exe File opened for modification C:\windows\SysWOW64\SJQQ.exe JWGY.exe File created C:\windows\SysWOW64\SJQQ.exe.bat JWGY.exe File created C:\windows\SysWOW64\KVJNNTV.exe.bat PHEEDT.exe File created C:\windows\SysWOW64\EIOX.exe KVJNNTV.exe File created C:\windows\SysWOW64\JYYOZ.exe.bat DXRBQAR.exe File opened for modification C:\windows\SysWOW64\LTYM.exe ZBVBC.exe File opened for modification C:\windows\SysWOW64\VOF.exe MBVHPPA.exe File created C:\windows\SysWOW64\JYYOZ.exe DXRBQAR.exe File created C:\windows\SysWOW64\KUJC.exe.bat ALH.exe File created C:\windows\SysWOW64\KUJ.exe.bat CKBCHV.exe File opened for modification C:\windows\SysWOW64\GVQ.exe VCNOOOE.exe File created C:\windows\SysWOW64\VOF.exe.bat MBVHPPA.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\JLFSX.exe.bat DLXF.exe File created C:\windows\system\PHYUL.exe SJS.exe File created C:\windows\system\UAO.exe.bat ZNJWJO.exe File created C:\windows\PJZQ.exe.bat NWUHDQQ.exe File created C:\windows\system\ZLGI.exe ZGG.exe File opened for modification C:\windows\system\CVKT.exe SNI.exe File created C:\windows\system\NFEL.exe.bat CMB.exe File created C:\windows\system\NLAVEQ.exe.bat YQQ.exe File opened for modification C:\windows\system\KDHN.exe VVG.exe File created C:\windows\system\KDHN.exe.bat VVG.exe File opened for modification C:\windows\system\IDOBLUD.exe KDHN.exe File created C:\windows\system\DXRBQAR.exe JCMRGA.exe File opened for modification C:\windows\system\SJS.exe SGOTRX.exe File created C:\windows\system\IDOBLUD.exe.bat KDHN.exe File created C:\windows\system\AAQWQ.exe.bat YFL.exe File opened for modification C:\windows\VCNOOOE.exe VWNINJ.exe File created C:\windows\system\NFTRQBK.exe FRGKGVP.exe File opened for modification C:\windows\ZWRID.exe ZLQ.exe File created C:\windows\system\ISJVNH.exe.bat NFEL.exe File opened for modification C:\windows\system\LSRZMAV.exe DMNTBBZ.exe File created C:\windows\EKJ.exe.bat KWEAQQ.exe File created C:\windows\system\TFAE.exe NFTRQBK.exe File opened for modification C:\windows\system\UGHF.exe JNM.exe File created C:\windows\system\YFL.exe.bat NMQUXIH.exe File opened for modification C:\windows\system\AAQWQ.exe YFL.exe File opened for modification C:\windows\system\DXRBQAR.exe JCMRGA.exe File created C:\windows\system\CVKT.exe.bat SNI.exe File opened for modification C:\windows\system\TNBJ.exe KEZDPPD.exe File created C:\windows\ZBVBC.exe.bat UAO.exe File created C:\windows\IWEGML.exe ZNCAI.exe File created C:\windows\system\FSBKJJT.exe.bat GVQ.exe File created C:\windows\system\FRGKGVP.exe LEBBD.exe File opened for modification C:\windows\system\NFTRQBK.exe FRGKGVP.exe File opened for modification C:\windows\KPLCH.exe LSRZMAV.exe File opened for modification C:\windows\system\MAZXIUV.exe GARJR.exe File created C:\windows\EZAB.exe TGX.exe File created C:\windows\system\JGOHR.exe OSJ.exe File created C:\windows\system\PTI.exe KTADHZ.exe File created C:\windows\CKBCHV.exe.bat TBZXW.exe File created C:\windows\KABS.exe KUJ.exe File created C:\windows\TGX.exe.bat BTMQGWW.exe File created C:\windows\ZBVBC.exe UAO.exe File created C:\windows\system\JRIJZ.exe IWEGML.exe File created C:\windows\system\NLAVEQ.exe YQQ.exe File opened for modification C:\windows\system\VVG.exe YPAZPV.exe File created C:\windows\system\BMLJY.exe PTI.exe File created C:\windows\system\LSRZMAV.exe DMNTBBZ.exe File created C:\windows\HYE.exe NLAVEQ.exe File created C:\windows\VCNOOOE.exe VWNINJ.exe File opened for modification C:\windows\system\FSBKJJT.exe GVQ.exe File created C:\windows\system\DNEZQM.exe.bat NXDH.exe File opened for modification C:\windows\QETNOB.exe ZWRID.exe File created C:\windows\system\JLFSX.exe DLXF.exe File opened for modification C:\windows\system\HJURT.exe PBSM.exe File created C:\windows\EKJ.exe KWEAQQ.exe File created C:\windows\system\FEFMXQ.exe.bat WEDZU.exe File opened for modification C:\windows\system\QGK.exe LFCJL.exe File created C:\windows\NXDH.exe TKYYHYB.exe File created C:\windows\system\VVG.exe.bat YPAZPV.exe File created C:\windows\QETNOB.exe.bat ZWRID.exe File opened for modification C:\windows\VQQCB.exe EIOX.exe File created C:\windows\system\QGK.exe.bat LFCJL.exe File created C:\windows\system\VVG.exe YPAZPV.exe File opened for modification C:\windows\system\JCMRGA.exe MFGCZQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5812 cmd.exe 5728 cmd.exe 4960 cmd.exe 1512 cmd.exe 712 cmd.exe 624 cmd.exe 4844 cmd.exe 4984 cmd.exe 3736 cmd.exe 2876 cmd.exe 1204 cmd.exe 3396 cmd.exe 4296 cmd.exe 2140 cmd.exe 4116 cmd.exe 5696 cmd.exe 5668 cmd.exe 5308 cmd.exe 468 cmd.exe 5748 cmd.exe 3772 cmd.exe 5028 cmd.exe 2248 cmd.exe 108 cmd.exe 5100 cmd.exe 3580 cmd.exe 5208 cmd.exe 2224 cmd.exe 960 cmd.exe 4540 cmd.exe 2892 cmd.exe 4736 cmd.exe 4784 cmd.exe 1356 cmd.exe 1424 cmd.exe 5616 cmd.exe 4816 cmd.exe 4824 cmd.exe 1504 cmd.exe 5452 cmd.exe 4000 cmd.exe 1284 cmd.exe 5860 cmd.exe 5700 cmd.exe 2792 cmd.exe 5328 cmd.exe 3564 cmd.exe 5088 cmd.exe 4724 cmd.exe 5480 cmd.exe 1180 cmd.exe 2352 cmd.exe 2452 cmd.exe 2920 cmd.exe 2488 cmd.exe 5900 cmd.exe 1288 cmd.exe 4140 cmd.exe 4132 cmd.exe 6112 cmd.exe 5872 cmd.exe 4888 cmd.exe 4768 cmd.exe 2156 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4640 4820 WerFault.exe 87 5448 1780 WerFault.exe 92 1224 4332 WerFault.exe 99 3484 2988 WerFault.exe 104 2748 1756 WerFault.exe 109 3452 1520 WerFault.exe 114 756 2608 WerFault.exe 119 3344 2740 WerFault.exe 124 5384 2984 WerFault.exe 129 5728 5152 WerFault.exe 134 292 5708 WerFault.exe 139 2068 5300 WerFault.exe 144 3984 6080 WerFault.exe 149 1896 2744 WerFault.exe 154 992 5832 WerFault.exe 159 5460 3872 WerFault.exe 164 3732 2748 WerFault.exe 169 2324 5892 WerFault.exe 174 3772 2928 WerFault.exe 179 4732 824 WerFault.exe 184 2084 5512 WerFault.exe 189 5516 3060 WerFault.exe 194 3616 3884 WerFault.exe 199 4812 3312 WerFault.exe 204 5876 4548 WerFault.exe 209 2108 3480 WerFault.exe 214 5436 968 WerFault.exe 219 5148 1488 WerFault.exe 224 2152 4216 WerFault.exe 229 1784 3620 WerFault.exe 234 2348 2408 WerFault.exe 239 5652 3992 WerFault.exe 244 5464 848 WerFault.exe 249 2908 4976 WerFault.exe 254 4248 5304 WerFault.exe 259 1328 3424 WerFault.exe 264 2368 1972 WerFault.exe 269 6088 5436 WerFault.exe 274 4308 1984 WerFault.exe 280 2860 5564 WerFault.exe 285 4336 1720 WerFault.exe 290 5312 5624 WerFault.exe 295 3376 4280 WerFault.exe 300 2336 3900 WerFault.exe 305 2448 3448 WerFault.exe 310 1220 1660 WerFault.exe 315 3104 4172 WerFault.exe 320 704 5640 WerFault.exe 325 4648 5920 WerFault.exe 330 5088 4592 WerFault.exe 335 5664 3252 WerFault.exe 340 1868 1552 WerFault.exe 345 2484 4640 WerFault.exe 350 2424 5896 WerFault.exe 355 4516 3744 WerFault.exe 360 3212 4128 WerFault.exe 365 3308 3456 WerFault.exe 370 2132 4004 WerFault.exe 375 3560 2552 WerFault.exe 380 2156 2616 WerFault.exe 385 3324 2828 WerFault.exe 390 1556 2016 WerFault.exe 395 4984 6116 WerFault.exe 400 4284 2492 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JCMRGA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DXRBQAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IDOBLUD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTMQGWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNBJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QEVMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGHF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FSBKJJT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNEZQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QETNOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWUHDQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NLAVEQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PRVUM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUDXEN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYYOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNCAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCNOOOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VWNINJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFTRQBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFCJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4820 2026-08-08_fa3c5b2265dd40a48d57d7b7156a287a_elex_emotet_stop.exe 4820 2026-08-08_fa3c5b2265dd40a48d57d7b7156a287a_elex_emotet_stop.exe 1780 YTWGG.exe 1780 YTWGG.exe 4332 QEVMO.exe 4332 QEVMO.exe 2988 OXXC.exe 2988 OXXC.exe 1756 QUDXEN.exe 1756 QUDXEN.exe 1520 EXTVTQ.exe 1520 EXTVTQ.exe 2608 GSY.exe 2608 GSY.exe 2740 ZNCAI.exe 2740 ZNCAI.exe 2984 IWEGML.exe 2984 IWEGML.exe 5152 JRIJZ.exe 5152 JRIJZ.exe 5708 DMNTBBZ.exe 5708 DMNTBBZ.exe 5300 LSRZMAV.exe 5300 LSRZMAV.exe 6080 KPLCH.exe 6080 KPLCH.exe 2744 OSJ.exe 2744 OSJ.exe 5832 JGOHR.exe 5832 JGOHR.exe 3872 NWUHDQQ.exe 3872 NWUHDQQ.exe 2748 PJZQ.exe 2748 PJZQ.exe 5892 KWEAQQ.exe 5892 KWEAQQ.exe 2928 EKJ.exe 2928 EKJ.exe 824 SURIOA.exe 824 SURIOA.exe 5512 YQQ.exe 5512 YQQ.exe 3060 NLAVEQ.exe 3060 NLAVEQ.exe 3884 HYE.exe 3884 HYE.exe 3312 JWGY.exe 3312 JWGY.exe 4548 SJQQ.exe 4548 SJQQ.exe 3480 VWNINJ.exe 3480 VWNINJ.exe 968 VCNOOOE.exe 968 VCNOOOE.exe 1488 GVQ.exe 1488 GVQ.exe 4216 FSBKJJT.exe 4216 FSBKJJT.exe 3620 ZGG.exe 3620 ZGG.exe 2408 ZLGI.exe 2408 ZLGI.exe 3992 LEBBD.exe 3992 LEBBD.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4820 2026-08-08_fa3c5b2265dd40a48d57d7b7156a287a_elex_emotet_stop.exe 4820 2026-08-08_fa3c5b2265dd40a48d57d7b7156a287a_elex_emotet_stop.exe 1780 YTWGG.exe 1780 YTWGG.exe 4332 QEVMO.exe 4332 QEVMO.exe 2988 OXXC.exe 2988 OXXC.exe 1756 QUDXEN.exe 1756 QUDXEN.exe 1520 EXTVTQ.exe 1520 EXTVTQ.exe 2608 GSY.exe 2608 GSY.exe 2740 ZNCAI.exe 2740 ZNCAI.exe 2984 IWEGML.exe 2984 IWEGML.exe 5152 JRIJZ.exe 5152 JRIJZ.exe 5708 DMNTBBZ.exe 5708 DMNTBBZ.exe 5300 LSRZMAV.exe 5300 LSRZMAV.exe 6080 KPLCH.exe 6080 KPLCH.exe 2744 OSJ.exe 2744 OSJ.exe 5832 JGOHR.exe 5832 JGOHR.exe 3872 NWUHDQQ.exe 3872 NWUHDQQ.exe 2748 PJZQ.exe 2748 PJZQ.exe 5892 KWEAQQ.exe 5892 KWEAQQ.exe 2928 EKJ.exe 2928 EKJ.exe 824 SURIOA.exe 824 SURIOA.exe 5512 YQQ.exe 5512 YQQ.exe 3060 NLAVEQ.exe 3060 NLAVEQ.exe 3884 HYE.exe 3884 HYE.exe 3312 JWGY.exe 3312 JWGY.exe 4548 SJQQ.exe 4548 SJQQ.exe 3480 VWNINJ.exe 3480 VWNINJ.exe 968 VCNOOOE.exe 968 VCNOOOE.exe 1488 GVQ.exe 1488 GVQ.exe 4216 FSBKJJT.exe 4216 FSBKJJT.exe 3620 ZGG.exe 3620 ZGG.exe 2408 ZLGI.exe 2408 ZLGI.exe 3992 LEBBD.exe 3992 LEBBD.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4820 wrote to memory of 3396 4820 2026-08-08_fa3c5b2265dd40a48d57d7b7156a287a_elex_emotet_stop.exe 89 PID 3396 wrote to memory of 1780 3396 cmd.exe 92 PID 1780 wrote to memory of 4676 1780 YTWGG.exe 95 PID 4676 wrote to memory of 4332 4676 cmd.exe 99 PID 4332 wrote to memory of 1796 4332 QEVMO.exe 100 PID 1796 wrote to memory of 2988 1796 cmd.exe 104 PID 2988 wrote to memory of 2352 2988 OXXC.exe 105 PID 2352 wrote to memory of 1756 2352 cmd.exe 109 PID 1756 wrote to memory of 3256 1756 QUDXEN.exe 110 PID 3256 wrote to memory of 1520 3256 cmd.exe 114 PID 1520 wrote to memory of 4720 1520 EXTVTQ.exe 115 PID 4720 wrote to memory of 2608 4720 cmd.exe 119 PID 2608 wrote to memory of 2892 2608 GSY.exe 120 PID 2892 wrote to memory of 2740 2892 cmd.exe 124 PID 2740 wrote to memory of 5616 2740 ZNCAI.exe 125 PID 5616 wrote to memory of 2984 5616 cmd.exe 129 PID 2984 wrote to memory of 5940 2984 IWEGML.exe 130 PID 5940 wrote to memory of 5152 5940 cmd.exe 134 PID 5152 wrote to memory of 4816 5152 JRIJZ.exe 135 PID 4816 wrote to memory of 5708 4816 cmd.exe 139 PID 5708 wrote to memory of 1536 5708 DMNTBBZ.exe 140 PID 1536 wrote to memory of 5300 1536 cmd.exe 144 PID 5300 wrote to memory of 6056 5300 LSRZMAV.exe 145 PID 6056 wrote to memory of 6080 6056 cmd.exe 149 PID 6080 wrote to memory of 4824 6080 KPLCH.exe 150 PID 4824 wrote to memory of 2744 4824 cmd.exe 154 PID 2744 wrote to memory of 2224 2744 OSJ.exe 155 PID 2224 wrote to memory of 5832 2224 cmd.exe 159 PID 5832 wrote to memory of 4296 5832 JGOHR.exe 160 PID 4296 wrote to memory of 3872 4296 cmd.exe 164 PID 3872 wrote to memory of 1236 3872 NWUHDQQ.exe 165 PID 1236 wrote to memory of 2748 1236 cmd.exe 169 PID 2748 wrote to memory of 468 2748 PJZQ.exe 170 PID 468 wrote to memory of 5892 468 cmd.exe 174 PID 5892 wrote to memory of 1512 5892 KWEAQQ.exe 175 PID 1512 wrote to memory of 2928 1512 cmd.exe 179 PID 2928 wrote to memory of 2452 2928 EKJ.exe 180 PID 2452 wrote to memory of 824 2452 cmd.exe 184 PID 824 wrote to memory of 3404 824 SURIOA.exe 185 PID 3404 wrote to memory of 5512 3404 cmd.exe 189 PID 5512 wrote to memory of 5368 5512 YQQ.exe 190 PID 5368 wrote to memory of 3060 5368 cmd.exe 194 PID 3060 wrote to memory of 5840 3060 NLAVEQ.exe 195 PID 5840 wrote to memory of 3884 5840 cmd.exe 199 PID 3884 wrote to memory of 4316 3884 HYE.exe 200 PID 4316 wrote to memory of 3312 4316 cmd.exe 204 PID 3312 wrote to memory of 5124 3312 JWGY.exe 205 PID 5124 wrote to memory of 4548 5124 cmd.exe 209 PID 4548 wrote to memory of 1164 4548 SJQQ.exe 210 PID 1164 wrote to memory of 3480 1164 cmd.exe 214 PID 3480 wrote to memory of 4240 3480 VWNINJ.exe 215 PID 4240 wrote to memory of 968 4240 cmd.exe 219 PID 968 wrote to memory of 2804 968 VCNOOOE.exe 220 PID 2804 wrote to memory of 1488 2804 cmd.exe 224 PID 1488 wrote to memory of 4896 1488 GVQ.exe 225 PID 4896 wrote to memory of 4216 4896 cmd.exe 229 PID 4216 wrote to memory of 684 4216 FSBKJJT.exe 230 PID 684 wrote to memory of 3620 684 cmd.exe 234 PID 3620 wrote to memory of 1312 3620 ZGG.exe 235 PID 1312 wrote to memory of 2408 1312 cmd.exe 239 PID 2408 wrote to memory of 5356 2408 ZLGI.exe 240 PID 5356 wrote to memory of 3992 5356 cmd.exe 244 PID 3992 wrote to memory of 1532 3992 LEBBD.exe 245 PID 1532 wrote to memory of 848 1532 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_fa3c5b2265dd40a48d57d7b7156a287a_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_fa3c5b2265dd40a48d57d7b7156a287a_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YTWGG.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\windows\YTWGG.exeC:\windows\YTWGG.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEVMO.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\windows\SysWOW64\QEVMO.exeC:\windows\system32\QEVMO.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXXC.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\windows\system\OXXC.exeC:\windows\system\OXXC.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QUDXEN.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\windows\system\QUDXEN.exeC:\windows\system\QUDXEN.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXTVTQ.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\windows\SysWOW64\EXTVTQ.exeC:\windows\system32\EXTVTQ.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSY.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\windows\SysWOW64\GSY.exeC:\windows\system32\GSY.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNCAI.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\SysWOW64\ZNCAI.exeC:\windows\system32\ZNCAI.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWEGML.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\windows\IWEGML.exeC:\windows\IWEGML.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JRIJZ.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\windows\system\JRIJZ.exeC:\windows\system\JRIJZ.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMNTBBZ.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\windows\DMNTBBZ.exeC:\windows\DMNTBBZ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LSRZMAV.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\windows\system\LSRZMAV.exeC:\windows\system\LSRZMAV.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPLCH.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\windows\KPLCH.exeC:\windows\KPLCH.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OSJ.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\OSJ.exeC:\windows\OSJ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JGOHR.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\windows\system\JGOHR.exeC:\windows\system\JGOHR.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NWUHDQQ.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\windows\SysWOW64\NWUHDQQ.exeC:\windows\system32\NWUHDQQ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJZQ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\windows\PJZQ.exeC:\windows\PJZQ.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KWEAQQ.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:468 -
C:\windows\KWEAQQ.exeC:\windows\KWEAQQ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EKJ.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\windows\EKJ.exeC:\windows\EKJ.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SURIOA.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\SURIOA.exeC:\windows\SURIOA.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQQ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\windows\YQQ.exeC:\windows\YQQ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLAVEQ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\windows\system\NLAVEQ.exeC:\windows\system\NLAVEQ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYE.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\windows\HYE.exeC:\windows\HYE.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWGY.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\windows\system\JWGY.exeC:\windows\system\JWGY.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SJQQ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\windows\SysWOW64\SJQQ.exeC:\windows\system32\SJQQ.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VWNINJ.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\windows\VWNINJ.exeC:\windows\VWNINJ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VCNOOOE.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\windows\VCNOOOE.exeC:\windows\VCNOOOE.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GVQ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\windows\SysWOW64\GVQ.exeC:\windows\system32\GVQ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FSBKJJT.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\windows\system\FSBKJJT.exeC:\windows\system\FSBKJJT.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGG.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:684 -
C:\windows\system\ZGG.exeC:\windows\system\ZGG.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZLGI.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\windows\system\ZLGI.exeC:\windows\system\ZLGI.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LEBBD.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\windows\system\LEBBD.exeC:\windows\system\LEBBD.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FRGKGVP.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\windows\system\FRGKGVP.exeC:\windows\system\FRGKGVP.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFTRQBK.exe.bat" "66⤵PID:4260
-
C:\windows\system\NFTRQBK.exeC:\windows\system\NFTRQBK.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFAE.exe.bat" "68⤵PID:2020
-
C:\windows\system\TFAE.exeC:\windows\system\TFAE.exe69⤵
- Executes dropped EXE
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFCJL.exe.bat" "70⤵PID:4624
-
C:\windows\system\LFCJL.exeC:\windows\system\LFCJL.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QGK.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3716 -
C:\windows\system\QGK.exeC:\windows\system\QGK.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLIU.exe.bat" "74⤵PID:4224
-
C:\windows\SysWOW64\FLIU.exeC:\windows\system32\FLIU.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEL.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2140 -
C:\windows\SysWOW64\QEL.exeC:\windows\system32\QEL.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WESBSP.exe.bat" "78⤵
- Executes a command shell one-liner
PID:712 -
C:\windows\SysWOW64\WESBSP.exeC:\windows\system32\WESBSP.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKYYHYB.exe.bat" "80⤵PID:800
-
C:\windows\SysWOW64\TKYYHYB.exeC:\windows\system32\TKYYHYB.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXDH.exe.bat" "82⤵PID:3220
-
C:\windows\NXDH.exeC:\windows\NXDH.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNEZQM.exe.bat" "84⤵PID:3176
-
C:\windows\system\DNEZQM.exeC:\windows\system\DNEZQM.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNM.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:624 -
C:\windows\SysWOW64\JNM.exeC:\windows\system32\JNM.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGHF.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2920 -
C:\windows\system\UGHF.exeC:\windows\system\UGHF.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SGOTRX.exe.bat" "90⤵PID:4472
-
C:\windows\SysWOW64\SGOTRX.exeC:\windows\system32\SGOTRX.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SJS.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4900 -
C:\windows\system\SJS.exeC:\windows\system\SJS.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHYUL.exe.bat" "94⤵PID:2368
-
C:\windows\system\PHYUL.exeC:\windows\system\PHYUL.exe95⤵
- Executes dropped EXE
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPAZPV.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4132 -
C:\windows\system\YPAZPV.exeC:\windows\system\YPAZPV.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVG.exe.bat" "98⤵PID:5828
-
C:\windows\system\VVG.exeC:\windows\system\VVG.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDHN.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4844 -
C:\windows\system\KDHN.exeC:\windows\system\KDHN.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IDOBLUD.exe.bat" "102⤵
- Executes a command shell one-liner
PID:5860 -
C:\windows\system\IDOBLUD.exeC:\windows\system\IDOBLUD.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLQ.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4116 -
C:\windows\ZLQ.exeC:\windows\ZLQ.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZWRID.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:1940 -
C:\windows\ZWRID.exeC:\windows\ZWRID.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QETNOB.exe.bat" "108⤵
- Executes a command shell one-liner
PID:5748 -
C:\windows\QETNOB.exeC:\windows\QETNOB.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EPJL.exe.bat" "110⤵
- Executes a command shell one-liner
PID:1180 -
C:\windows\system\EPJL.exeC:\windows\system\EPJL.exe111⤵
- Executes dropped EXE
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHEEDT.exe.bat" "112⤵PID:3504
-
C:\windows\system\PHEEDT.exeC:\windows\system\PHEEDT.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVJNNTV.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:812 -
C:\windows\SysWOW64\KVJNNTV.exeC:\windows\system32\KVJNNTV.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EIOX.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4724 -
C:\windows\SysWOW64\EIOX.exeC:\windows\system32\EIOX.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQQCB.exe.bat" "118⤵PID:1592
-
C:\windows\VQQCB.exeC:\windows\VQQCB.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEVLLQB.exe.bat" "120⤵
- Executes a command shell one-liner
PID:960 -
C:\windows\SysWOW64\QEVLLQB.exeC:\windows\system32\QEVLLQB.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-