Analysis
- max time kernel
69s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 16:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_c6701d50d5e6433e93fb5a3bd86ac112_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_c6701d50d5e6433e93fb5a3bd86ac112_elex_emotet_stop.exe
- Size 208KB
- Sample260809-tfwj9ahn7t
- SHA256 9ee7d802b85279391d2b0c98c03ac2c41c77bfee862526a8dab4ec205619ee9e
- MD5 c6701d50d5e6433e93fb5a3bd86ac112
- SHA1 d42a2bad8c27ed233d9c242db9bc509cc11a2467
- SHA512 df27577192500d57d4f4c217e92a40e0e50f69387c90650b9f2b2d022788d73aba7c5feb29a5fe376a0ee9c960180c5450c9eac5705b9a8384c2792e1b17e9dd
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfx4NLthEjQT6c:MlZtbLWIgd1LZ9oECZbclc5+LOJQEje
- TLSH T1E7247D2235D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5064 QFRYMRM.exe 4596 VUR.exe 5604 BQC.exe 1392 RGDAQU.exe 1552 GBNN.exe 5680 NROEH.exe 1780 VEBLS.exe 3444 HMHT.exe 1372 LCOTQLC.exe 5144 LIOHSYX.exe 5436 PQVHE.exe 1820 QTYLKGV.exe 6096 PEBBSM.exe 1416 SUIBE.exe 4756 LXUFKVO.exe 4108 GACVY.exe 1288 SSFOYN.exe 4464 MGK.exe 3044 UTO.exe 5304 TERUCRX.exe 4712 XUGC.exe 4808 GUIHS.exe 1400 VPR.exe 2828 NYTROZ.exe 3004 AACQ.exe 2488 GWBQZNJ.exe 4872 ZZFU.exe 6104 OUOYXPT.exe 2112 FCQ.exe 1868 JKXLNF.exe 4448 NAD.exe 5748 NGEABL.exe 3088 ZOK.exe 2492 UJPRP.exe 3344 METNDTN.exe 5860 HRYW.exe 1060 CCOV.exe 3020 VFSZH.exe 5544 PTXIJLV.exe 1564 DDTHWK.exe 1548 IEAU.exe 4828 IJBJ.exe 5440 OPALZZY.exe 4728 DKKPK.exe 5692 DYKEMY.exe 2284 PGR.exe 2308 NGYAHL.exe 3192 VMYOIY.exe 948 BMGC.exe 1104 WHLLC.exe 2384 FINQNXL.exe 2912 LIVE.exe 2440 RIUSFU.exe 1256 AIWXJZY.exe 4584 BLAB.exe 1496 HMIOFJB.exe 2680 SEL.exe 2292 DXOA.exe 3328 SSXEHTG.exe 3456 LVBA.exe 3016 KGE.exe 3708 EBIZF.exe 5816 EMRBL.exe 2832 XEUUTI.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\DDTHWK.exe PTXIJLV.exe File created C:\windows\SysWOW64\DDTHWK.exe.bat PTXIJLV.exe File created C:\windows\SysWOW64\GBNN.exe.bat RGDAQU.exe File created C:\windows\SysWOW64\VEBLS.exe.bat NROEH.exe File created C:\windows\SysWOW64\LCOTQLC.exe.bat HMHT.exe File created C:\windows\SysWOW64\KGE.exe LVBA.exe File created C:\windows\SysWOW64\RGDAQU.exe BQC.exe File opened for modification C:\windows\SysWOW64\RGDAQU.exe BQC.exe File created C:\windows\SysWOW64\HMHT.exe VEBLS.exe File opened for modification C:\windows\SysWOW64\LCOTQLC.exe HMHT.exe File created C:\windows\SysWOW64\MGK.exe.bat SSFOYN.exe File opened for modification C:\windows\SysWOW64\GUIHS.exe XUGC.exe File opened for modification C:\windows\SysWOW64\VPR.exe GUIHS.exe File created C:\windows\SysWOW64\RGDAQU.exe.bat BQC.exe File opened for modification C:\windows\SysWOW64\MGK.exe SSFOYN.exe File created C:\windows\SysWOW64\VPR.exe.bat GUIHS.exe File opened for modification C:\windows\SysWOW64\FCQ.exe OUOYXPT.exe File opened for modification C:\windows\SysWOW64\DDTHWK.exe PTXIJLV.exe File created C:\windows\SysWOW64\BQC.exe VUR.exe File created C:\windows\SysWOW64\GBNN.exe RGDAQU.exe File created C:\windows\SysWOW64\SSFOYN.exe.bat GACVY.exe File opened for modification C:\windows\SysWOW64\UTO.exe MGK.exe File created C:\windows\SysWOW64\GUIHS.exe XUGC.exe File opened for modification C:\windows\SysWOW64\HRYW.exe METNDTN.exe File opened for modification C:\windows\SysWOW64\AIWXJZY.exe RIUSFU.exe File created C:\windows\SysWOW64\BLAB.exe AIWXJZY.exe File created C:\windows\SysWOW64\GUIHS.exe.bat XUGC.exe File created C:\windows\SysWOW64\WOYSAYN.exe.bat HTPG.exe File created C:\windows\SysWOW64\LCOTQLC.exe HMHT.exe File created C:\windows\SysWOW64\QTYLKGV.exe PQVHE.exe File created C:\windows\SysWOW64\SSFOYN.exe GACVY.exe File created C:\windows\SysWOW64\PTXIJLV.exe.bat VFSZH.exe File opened for modification C:\windows\SysWOW64\KGE.exe LVBA.exe File created C:\windows\SysWOW64\VEWGHZ.exe XEWS.exe File opened for modification C:\windows\SysWOW64\SSFOYN.exe GACVY.exe File created C:\windows\SysWOW64\UTO.exe MGK.exe File opened for modification C:\windows\SysWOW64\BLAB.exe AIWXJZY.exe File created C:\windows\SysWOW64\YSNBMG.exe.bat XPJF.exe File created C:\windows\SysWOW64\BQC.exe.bat VUR.exe File opened for modification C:\windows\SysWOW64\GBNN.exe RGDAQU.exe File created C:\windows\SysWOW64\VEBLS.exe NROEH.exe File opened for modification C:\windows\SysWOW64\QTYLKGV.exe PQVHE.exe File opened for modification C:\windows\SysWOW64\YSNBMG.exe XPJF.exe File opened for modification C:\windows\SysWOW64\BQC.exe VUR.exe File created C:\windows\SysWOW64\OUOYXPT.exe.bat ZZFU.exe File created C:\windows\SysWOW64\VMYOIY.exe.bat NGYAHL.exe File created C:\windows\SysWOW64\AIWXJZY.exe RIUSFU.exe File created C:\windows\SysWOW64\AIWXJZY.exe.bat RIUSFU.exe File opened for modification C:\windows\SysWOW64\VEWGHZ.exe XEWS.exe File created C:\windows\SysWOW64\WOYSAYN.exe HTPG.exe File opened for modification C:\windows\SysWOW64\HMHT.exe VEBLS.exe File created C:\windows\SysWOW64\NYTROZ.exe VPR.exe File created C:\windows\SysWOW64\FCQ.exe.bat OUOYXPT.exe File opened for modification C:\windows\SysWOW64\PTXIJLV.exe VFSZH.exe File created C:\windows\SysWOW64\KGE.exe.bat LVBA.exe File created C:\windows\SysWOW64\VEWGHZ.exe.bat XEWS.exe File opened for modification C:\windows\SysWOW64\NYTROZ.exe VPR.exe File created C:\windows\SysWOW64\PTXIJLV.exe VFSZH.exe File created C:\windows\SysWOW64\YSNBMG.exe XPJF.exe File opened for modification C:\windows\SysWOW64\VEBLS.exe NROEH.exe File created C:\windows\SysWOW64\MGK.exe SSFOYN.exe File created C:\windows\SysWOW64\NYTROZ.exe.bat VPR.exe File created C:\windows\SysWOW64\FCQ.exe OUOYXPT.exe File created C:\windows\SysWOW64\HRYW.exe.bat METNDTN.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\VUR.exe QFRYMRM.exe File created C:\windows\system\PQVHE.exe LIOHSYX.exe File created C:\windows\system\IJBJ.exe IEAU.exe File created C:\windows\DKKPK.exe OPALZZY.exe File opened for modification C:\windows\NGYAHL.exe PGR.exe File opened for modification C:\windows\system\GXZZH.exe VEWGHZ.exe File created C:\windows\system\ZPCSPWA.exe GXZZH.exe File created C:\windows\FIQQ.exe UQN.exe File created C:\windows\system\GACVY.exe.bat LXUFKVO.exe File created C:\windows\GWBQZNJ.exe AACQ.exe File created C:\windows\system\IJBJ.exe.bat IEAU.exe File opened for modification C:\windows\OPALZZY.exe FPYGOB.exe File opened for modification C:\windows\DKKPK.exe OPALZZY.exe File created C:\windows\WHLLC.exe BMGC.exe File created C:\windows\XEWS.exe.bat AYQVJVA.exe File opened for modification C:\windows\IJFHO.exe RJDC.exe File opened for modification C:\windows\system\VUR.exe QFRYMRM.exe File created C:\windows\system\PEBBSM.exe QTYLKGV.exe File created C:\windows\TERUCRX.exe.bat UTO.exe File created C:\windows\BMGC.exe.bat VMYOIY.exe File opened for modification C:\windows\WHLLC.exe BMGC.exe File created C:\windows\system\XPJF.exe ZPCSPWA.exe File created C:\windows\system\VRZ.exe PQS.exe File opened for modification C:\windows\system\VRZ.exe PQS.exe File created C:\windows\system\METNDTN.exe UJPRP.exe File created C:\windows\VFSZH.exe CCOV.exe File created C:\windows\system\DYKEMY.exe.bat DKKPK.exe File created C:\windows\system\EMRBL.exe.bat EBIZF.exe File created C:\windows\system\GJCB.exe VRZ.exe File opened for modification C:\windows\system\MKCPCW.exe GJCB.exe File opened for modification C:\windows\system\QFRYMRM.exe 2026-08-09_c6701d50d5e6433e93fb5a3bd86ac112_elex_emotet_stop.exe File created C:\windows\JKXLNF.exe.bat FCQ.exe File created C:\windows\system\HMIOFJB.exe.bat BLAB.exe File opened for modification C:\windows\DXOA.exe SEL.exe File created C:\windows\system\GXZZH.exe VEWGHZ.exe File opened for modification C:\windows\system\HTPG.exe YSNBMG.exe File created C:\windows\UQN.exe FVDTFSJ.exe File created C:\windows\BKMIW.exe.bat VKE.exe File created C:\windows\system\LXUFKVO.exe SUIBE.exe File created C:\windows\AACQ.exe.bat NYTROZ.exe File opened for modification C:\windows\GWBQZNJ.exe AACQ.exe File created C:\windows\NAD.exe JKXLNF.exe File created C:\windows\system\METNDTN.exe.bat UJPRP.exe File created C:\windows\DXOA.exe.bat SEL.exe File opened for modification C:\windows\system\XPJF.exe ZPCSPWA.exe File opened for modification C:\windows\system\PQS.exe FIQQ.exe File opened for modification C:\windows\system\PQVHE.exe LIOHSYX.exe File opened for modification C:\windows\VFSZH.exe CCOV.exe File created C:\windows\system\HMIOFJB.exe BLAB.exe File created C:\windows\DXOA.exe SEL.exe File created C:\windows\system\AYQVJVA.exe.bat GLLMZ.exe File created C:\windows\system\RJDC.exe WOYSAYN.exe File created C:\windows\FII.exe.bat BABIHN.exe File created C:\windows\system\GLLMZ.exe FII.exe File created C:\windows\OPALZZY.exe FPYGOB.exe File created C:\windows\WHLLC.exe.bat BMGC.exe File created C:\windows\system\AYQVJVA.exe GLLMZ.exe File created C:\windows\system\GACVY.exe LXUFKVO.exe File opened for modification C:\windows\AACQ.exe NYTROZ.exe File opened for modification C:\windows\NAD.exe JKXLNF.exe File opened for modification C:\windows\system\NGEABL.exe NAD.exe File opened for modification C:\windows\system\IJBJ.exe IEAU.exe File opened for modification C:\windows\system\EBIZF.exe KGE.exe File opened for modification C:\windows\system\AYQVJVA.exe GLLMZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1616 cmd.exe 2188 cmd.exe 5076 cmd.exe 5980 cmd.exe 5108 cmd.exe 4932 cmd.exe 704 cmd.exe 3844 cmd.exe 4492 cmd.exe 5572 cmd.exe 2512 cmd.exe 1276 cmd.exe 1308 cmd.exe 2068 cmd.exe 5764 cmd.exe 4268 cmd.exe 5416 cmd.exe 4232 cmd.exe 5132 cmd.exe 1776 cmd.exe 3388 cmd.exe 2428 cmd.exe 748 cmd.exe 5008 cmd.exe 4976 cmd.exe 2396 cmd.exe 5516 cmd.exe 1328 cmd.exe 4084 cmd.exe 3252 cmd.exe 2328 cmd.exe 1940 cmd.exe 5708 cmd.exe 5172 cmd.exe 3424 cmd.exe 1008 cmd.exe 6012 cmd.exe 6028 cmd.exe 712 cmd.exe 5644 cmd.exe 2268 cmd.exe 2132 cmd.exe 3560 cmd.exe 4244 cmd.exe 4920 cmd.exe 5976 cmd.exe 2212 cmd.exe 3912 cmd.exe 5536 cmd.exe 3064 cmd.exe 5324 cmd.exe 5368 cmd.exe 5344 cmd.exe 4484 cmd.exe 5984 cmd.exe 1468 cmd.exe 6076 cmd.exe 2844 cmd.exe 3168 cmd.exe 1260 cmd.exe 1424 cmd.exe 2744 cmd.exe 3828 cmd.exe 1928 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4204 3860 WerFault.exe 88 2924 5064 WerFault.exe 93 3012 4596 WerFault.exe 99 3756 5604 WerFault.exe 104 1960 1392 WerFault.exe 109 2124 1552 WerFault.exe 114 3896 5680 WerFault.exe 119 2696 1780 WerFault.exe 124 4136 3444 WerFault.exe 129 3524 1372 WerFault.exe 133 1512 5144 WerFault.exe 139 4248 5436 WerFault.exe 144 4916 1820 WerFault.exe 149 3428 6096 WerFault.exe 154 4080 1416 WerFault.exe 159 4308 4756 WerFault.exe 164 2996 4108 WerFault.exe 169 3260 1288 WerFault.exe 174 3460 4464 WerFault.exe 179 3328 3044 WerFault.exe 184 5736 5304 WerFault.exe 189 4376 4712 WerFault.exe 194 3584 4808 WerFault.exe 199 5608 1400 WerFault.exe 204 1188 2828 WerFault.exe 209 1468 3004 WerFault.exe 214 6112 2488 WerFault.exe 219 3020 4872 WerFault.exe 224 2680 6104 WerFault.exe 229 3460 2112 WerFault.exe 234 1528 1868 WerFault.exe 239 616 4448 WerFault.exe 244 2908 5748 WerFault.exe 249 4280 3088 WerFault.exe 254 2420 2492 WerFault.exe 259 4460 3344 WerFault.exe 264 1736 5860 WerFault.exe 269 5532 1060 WerFault.exe 275 1584 3020 WerFault.exe 280 948 5544 WerFault.exe 285 1104 1564 WerFault.exe 290 1972 1548 WerFault.exe 295 2752 4828 WerFault.exe 300 3096 2128 WerFault.exe 305 5816 5440 WerFault.exe 310 4348 4728 WerFault.exe 315 6112 5692 WerFault.exe 320 4272 2284 WerFault.exe 325 4496 2308 WerFault.exe 330 5584 3192 WerFault.exe 335 4192 948 WerFault.exe 340 2064 1104 WerFault.exe 345 2224 2384 WerFault.exe 350 5220 2912 WerFault.exe 355 3464 2440 WerFault.exe 360 2132 1256 WerFault.exe 365 552 4584 WerFault.exe 370 4176 1496 WerFault.exe 375 1056 2680 WerFault.exe 380 3984 2292 WerFault.exe 385 5924 3328 WerFault.exe 390 4488 3456 WerFault.exe 395 1428 3016 WerFault.exe 400 3244 3708 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BQC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPYGOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKKPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XEUUTI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMHT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDTHWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYKEMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIWXJZY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEAU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEWGHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FINQNXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NAD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMIOFJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYQVJVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOYSAYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUIBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGYAHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXUFKVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSFOYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMRBL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AACQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWBQZNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUOYXPT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NYTROZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3860 2026-08-09_c6701d50d5e6433e93fb5a3bd86ac112_elex_emotet_stop.exe 3860 2026-08-09_c6701d50d5e6433e93fb5a3bd86ac112_elex_emotet_stop.exe 5064 QFRYMRM.exe 5064 QFRYMRM.exe 4596 VUR.exe 4596 VUR.exe 5604 BQC.exe 5604 BQC.exe 1392 RGDAQU.exe 1392 RGDAQU.exe 1552 GBNN.exe 1552 GBNN.exe 5680 NROEH.exe 5680 NROEH.exe 1780 VEBLS.exe 1780 VEBLS.exe 3444 HMHT.exe 3444 HMHT.exe 1372 LCOTQLC.exe 1372 LCOTQLC.exe 5144 LIOHSYX.exe 5144 LIOHSYX.exe 5436 PQVHE.exe 5436 PQVHE.exe 1820 QTYLKGV.exe 1820 QTYLKGV.exe 6096 PEBBSM.exe 6096 PEBBSM.exe 1416 SUIBE.exe 1416 SUIBE.exe 4756 LXUFKVO.exe 4756 LXUFKVO.exe 4108 GACVY.exe 4108 GACVY.exe 1288 SSFOYN.exe 1288 SSFOYN.exe 4464 MGK.exe 4464 MGK.exe 3044 UTO.exe 3044 UTO.exe 5304 TERUCRX.exe 5304 TERUCRX.exe 4712 XUGC.exe 4712 XUGC.exe 4808 GUIHS.exe 4808 GUIHS.exe 1400 VPR.exe 1400 VPR.exe 2828 NYTROZ.exe 2828 NYTROZ.exe 3004 AACQ.exe 3004 AACQ.exe 2488 GWBQZNJ.exe 2488 GWBQZNJ.exe 4872 ZZFU.exe 4872 ZZFU.exe 6104 OUOYXPT.exe 6104 OUOYXPT.exe 2112 FCQ.exe 2112 FCQ.exe 1868 JKXLNF.exe 1868 JKXLNF.exe 4448 NAD.exe 4448 NAD.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3860 2026-08-09_c6701d50d5e6433e93fb5a3bd86ac112_elex_emotet_stop.exe 3860 2026-08-09_c6701d50d5e6433e93fb5a3bd86ac112_elex_emotet_stop.exe 5064 QFRYMRM.exe 5064 QFRYMRM.exe 4596 VUR.exe 4596 VUR.exe 5604 BQC.exe 5604 BQC.exe 1392 RGDAQU.exe 1392 RGDAQU.exe 1552 GBNN.exe 1552 GBNN.exe 5680 NROEH.exe 5680 NROEH.exe 1780 VEBLS.exe 1780 VEBLS.exe 3444 HMHT.exe 3444 HMHT.exe 1372 LCOTQLC.exe 1372 LCOTQLC.exe 5144 LIOHSYX.exe 5144 LIOHSYX.exe 5436 PQVHE.exe 5436 PQVHE.exe 1820 QTYLKGV.exe 1820 QTYLKGV.exe 6096 PEBBSM.exe 6096 PEBBSM.exe 1416 SUIBE.exe 1416 SUIBE.exe 4756 LXUFKVO.exe 4756 LXUFKVO.exe 4108 GACVY.exe 4108 GACVY.exe 1288 SSFOYN.exe 1288 SSFOYN.exe 4464 MGK.exe 4464 MGK.exe 3044 UTO.exe 3044 UTO.exe 5304 TERUCRX.exe 5304 TERUCRX.exe 4712 XUGC.exe 4712 XUGC.exe 4808 GUIHS.exe 4808 GUIHS.exe 1400 VPR.exe 1400 VPR.exe 2828 NYTROZ.exe 2828 NYTROZ.exe 3004 AACQ.exe 3004 AACQ.exe 2488 GWBQZNJ.exe 2488 GWBQZNJ.exe 4872 ZZFU.exe 4872 ZZFU.exe 6104 OUOYXPT.exe 6104 OUOYXPT.exe 2112 FCQ.exe 2112 FCQ.exe 1868 JKXLNF.exe 1868 JKXLNF.exe 4448 NAD.exe 4448 NAD.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3860 wrote to memory of 3144 3860 2026-08-09_c6701d50d5e6433e93fb5a3bd86ac112_elex_emotet_stop.exe 89 PID 3144 wrote to memory of 5064 3144 cmd.exe 93 PID 5064 wrote to memory of 2844 5064 QFRYMRM.exe 95 PID 2844 wrote to memory of 4596 2844 cmd.exe 99 PID 4596 wrote to memory of 1328 4596 VUR.exe 100 PID 1328 wrote to memory of 5604 1328 cmd.exe 104 PID 5604 wrote to memory of 3476 5604 BQC.exe 105 PID 3476 wrote to memory of 1392 3476 cmd.exe 109 PID 1392 wrote to memory of 4876 1392 RGDAQU.exe 110 PID 4876 wrote to memory of 1552 4876 cmd.exe 114 PID 1552 wrote to memory of 1776 1552 GBNN.exe 115 PID 1776 wrote to memory of 5680 1776 cmd.exe 119 PID 5680 wrote to memory of 4540 5680 NROEH.exe 120 PID 4540 wrote to memory of 1780 4540 cmd.exe 124 PID 1780 wrote to memory of 3388 1780 VEBLS.exe 125 PID 3388 wrote to memory of 3444 3388 cmd.exe 129 PID 3444 wrote to memory of 4972 3444 HMHT.exe 130 PID 4972 wrote to memory of 1372 4972 cmd.exe 133 PID 1372 wrote to memory of 3972 1372 LCOTQLC.exe 135 PID 3972 wrote to memory of 5144 3972 cmd.exe 139 PID 5144 wrote to memory of 2264 5144 LIOHSYX.exe 140 PID 2264 wrote to memory of 5436 2264 cmd.exe 144 PID 5436 wrote to memory of 3036 5436 PQVHE.exe 145 PID 3036 wrote to memory of 1820 3036 cmd.exe 149 PID 1820 wrote to memory of 992 1820 QTYLKGV.exe 150 PID 992 wrote to memory of 6096 992 cmd.exe 154 PID 6096 wrote to memory of 1516 6096 PEBBSM.exe 155 PID 1516 wrote to memory of 1416 1516 cmd.exe 159 PID 1416 wrote to memory of 3828 1416 SUIBE.exe 160 PID 3828 wrote to memory of 4756 3828 cmd.exe 164 PID 4756 wrote to memory of 2540 4756 LXUFKVO.exe 165 PID 2540 wrote to memory of 4108 2540 cmd.exe 169 PID 4108 wrote to memory of 1696 4108 GACVY.exe 170 PID 1696 wrote to memory of 1288 1696 cmd.exe 174 PID 1288 wrote to memory of 5172 1288 SSFOYN.exe 175 PID 5172 wrote to memory of 4464 5172 cmd.exe 179 PID 4464 wrote to memory of 4748 4464 MGK.exe 180 PID 4748 wrote to memory of 3044 4748 cmd.exe 184 PID 3044 wrote to memory of 4768 3044 UTO.exe 185 PID 4768 wrote to memory of 5304 4768 cmd.exe 189 PID 5304 wrote to memory of 2432 5304 TERUCRX.exe 190 PID 2432 wrote to memory of 4712 2432 cmd.exe 194 PID 4712 wrote to memory of 3040 4712 XUGC.exe 195 PID 3040 wrote to memory of 4808 3040 cmd.exe 199 PID 4808 wrote to memory of 5960 4808 GUIHS.exe 200 PID 5960 wrote to memory of 1400 5960 cmd.exe 204 PID 1400 wrote to memory of 4624 1400 VPR.exe 205 PID 4624 wrote to memory of 2828 4624 cmd.exe 209 PID 2828 wrote to memory of 3424 2828 NYTROZ.exe 210 PID 3424 wrote to memory of 3004 3424 cmd.exe 214 PID 3004 wrote to memory of 1132 3004 AACQ.exe 215 PID 1132 wrote to memory of 2488 1132 cmd.exe 219 PID 2488 wrote to memory of 5980 2488 GWBQZNJ.exe 220 PID 5980 wrote to memory of 4872 5980 cmd.exe 224 PID 4872 wrote to memory of 2116 4872 ZZFU.exe 225 PID 2116 wrote to memory of 6104 2116 cmd.exe 229 PID 6104 wrote to memory of 1880 6104 OUOYXPT.exe 230 PID 1880 wrote to memory of 2112 1880 cmd.exe 234 PID 2112 wrote to memory of 4084 2112 FCQ.exe 235 PID 4084 wrote to memory of 1868 4084 cmd.exe 239 PID 1868 wrote to memory of 4484 1868 JKXLNF.exe 240 PID 4484 wrote to memory of 4448 4484 cmd.exe 244 PID 4448 wrote to memory of 1856 4448 NAD.exe 245 PID 1856 wrote to memory of 5748 1856 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_c6701d50d5e6433e93fb5a3bd86ac112_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_c6701d50d5e6433e93fb5a3bd86ac112_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFRYMRM.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\windows\system\QFRYMRM.exeC:\windows\system\QFRYMRM.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VUR.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\windows\system\VUR.exeC:\windows\system\VUR.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BQC.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\windows\SysWOW64\BQC.exeC:\windows\system32\BQC.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RGDAQU.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\windows\SysWOW64\RGDAQU.exeC:\windows\system32\RGDAQU.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GBNN.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\windows\SysWOW64\GBNN.exeC:\windows\system32\GBNN.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NROEH.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\windows\system\NROEH.exeC:\windows\system\NROEH.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEBLS.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\windows\SysWOW64\VEBLS.exeC:\windows\system32\VEBLS.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HMHT.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\windows\SysWOW64\HMHT.exeC:\windows\system32\HMHT.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LCOTQLC.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\windows\SysWOW64\LCOTQLC.exeC:\windows\system32\LCOTQLC.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIOHSYX.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\windows\system\LIOHSYX.exeC:\windows\system\LIOHSYX.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQVHE.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\windows\system\PQVHE.exeC:\windows\system\PQVHE.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QTYLKGV.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\windows\SysWOW64\QTYLKGV.exeC:\windows\system32\QTYLKGV.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEBBSM.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:992 -
C:\windows\system\PEBBSM.exeC:\windows\system\PEBBSM.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SUIBE.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\windows\system\SUIBE.exeC:\windows\system\SUIBE.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LXUFKVO.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\windows\system\LXUFKVO.exeC:\windows\system\LXUFKVO.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GACVY.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\windows\system\GACVY.exeC:\windows\system\GACVY.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSFOYN.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\windows\SysWOW64\SSFOYN.exeC:\windows\system32\SSFOYN.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MGK.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\windows\SysWOW64\MGK.exeC:\windows\system32\MGK.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTO.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\windows\SysWOW64\UTO.exeC:\windows\system32\UTO.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TERUCRX.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\windows\TERUCRX.exeC:\windows\TERUCRX.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUGC.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\windows\system\XUGC.exeC:\windows\system\XUGC.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GUIHS.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\windows\SysWOW64\GUIHS.exeC:\windows\system32\GUIHS.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPR.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\windows\SysWOW64\VPR.exeC:\windows\system32\VPR.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYTROZ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\windows\SysWOW64\NYTROZ.exeC:\windows\system32\NYTROZ.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AACQ.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\windows\AACQ.exeC:\windows\AACQ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWBQZNJ.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\windows\GWBQZNJ.exeC:\windows\GWBQZNJ.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZFU.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\windows\system\ZZFU.exeC:\windows\system\ZZFU.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUOYXPT.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\windows\SysWOW64\OUOYXPT.exeC:\windows\system32\OUOYXPT.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCQ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\windows\SysWOW64\FCQ.exeC:\windows\system32\FCQ.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JKXLNF.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\windows\JKXLNF.exeC:\windows\JKXLNF.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NAD.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\windows\NAD.exeC:\windows\NAD.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NGEABL.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\windows\system\NGEABL.exeC:\windows\system\NGEABL.exe65⤵
- Executes dropped EXE
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOK.exe.bat" "66⤵PID:4264
-
C:\windows\ZOK.exeC:\windows\ZOK.exe67⤵
- Executes dropped EXE
PID:3088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UJPRP.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5108 -
C:\windows\UJPRP.exeC:\windows\UJPRP.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\METNDTN.exe.bat" "70⤵PID:5036
-
C:\windows\system\METNDTN.exeC:\windows\system\METNDTN.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HRYW.exe.bat" "72⤵PID:1188
-
C:\windows\SysWOW64\HRYW.exeC:\windows\system32\HRYW.exe73⤵
- Executes dropped EXE
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCOV.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:2036 -
C:\windows\CCOV.exeC:\windows\CCOV.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VFSZH.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:2024 -
C:\windows\VFSZH.exeC:\windows\VFSZH.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PTXIJLV.exe.bat" "78⤵PID:5464
-
C:\windows\SysWOW64\PTXIJLV.exeC:\windows\system32\PTXIJLV.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDTHWK.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:5600 -
C:\windows\SysWOW64\DDTHWK.exeC:\windows\system32\DDTHWK.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IEAU.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:2840 -
C:\windows\system\IEAU.exeC:\windows\system\IEAU.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IJBJ.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5944 -
C:\windows\system\IJBJ.exeC:\windows\system\IJBJ.exe85⤵
- Executes dropped EXE
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FPYGOB.exe.bat" "86⤵PID:4996
-
C:\windows\system\FPYGOB.exeC:\windows\system\FPYGOB.exe87⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OPALZZY.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:2076 -
C:\windows\OPALZZY.exeC:\windows\OPALZZY.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DKKPK.exe.bat" "90⤵PID:6100
-
C:\windows\DKKPK.exeC:\windows\DKKPK.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYKEMY.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:248 -
C:\windows\system\DYKEMY.exeC:\windows\system\DYKEMY.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGR.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1928 -
C:\windows\system\PGR.exeC:\windows\system\PGR.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NGYAHL.exe.bat" "96⤵PID:3440
-
C:\windows\NGYAHL.exeC:\windows\NGYAHL.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VMYOIY.exe.bat" "98⤵PID:2468
-
C:\windows\SysWOW64\VMYOIY.exeC:\windows\system32\VMYOIY.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMGC.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:2960 -
C:\windows\BMGC.exeC:\windows\BMGC.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WHLLC.exe.bat" "102⤵PID:5632
-
C:\windows\WHLLC.exeC:\windows\WHLLC.exe103⤵
- Executes dropped EXE
PID:1104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FINQNXL.exe.bat" "104⤵PID:2528
-
C:\windows\FINQNXL.exeC:\windows\FINQNXL.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIVE.exe.bat" "106⤵
- Executes a command shell one-liner
PID:5984 -
C:\windows\system\LIVE.exeC:\windows\system\LIVE.exe107⤵
- Executes dropped EXE
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RIUSFU.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:2896 -
C:\windows\RIUSFU.exeC:\windows\RIUSFU.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AIWXJZY.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:2424 -
C:\windows\SysWOW64\AIWXJZY.exeC:\windows\system32\AIWXJZY.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BLAB.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:4348 -
C:\windows\SysWOW64\BLAB.exeC:\windows\system32\BLAB.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HMIOFJB.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:5556 -
C:\windows\system\HMIOFJB.exeC:\windows\system\HMIOFJB.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEL.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1468 -
C:\windows\system\SEL.exeC:\windows\system\SEL.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DXOA.exe.bat" "118⤵
- Executes a command shell one-liner
PID:5536 -
C:\windows\DXOA.exeC:\windows\DXOA.exe119⤵
- Executes dropped EXE
PID:2292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSXEHTG.exe.bat" "120⤵
- Executes a command shell one-liner
PID:4932 -
C:\windows\SSXEHTG.exeC:\windows\SSXEHTG.exe121⤵
- Executes dropped EXE
PID:3328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-