Analysis
- max time kernel
91s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 18:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_2a434b476d13b11ed329285877798f37_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_2a434b476d13b11ed329285877798f37_elex_emotet_stop.exe
- Size 208KB
- Sample260809-xdklrabr8x
- SHA256 fea31730423a2b379307b08fcc9d2c18ac499502c1a6d066fee547b3e3eb9124
- MD5 2a434b476d13b11ed329285877798f37
- SHA1 8460ed220f367ad52dee2177f6d492a7571f5a16
- SHA512 93fc05e5d4526e1067afee0075397cf760f6d3f046d5a2151339d1bde1da686c3c941612ada2573bb8f743b7b1712af0439c4dea67ea9a313d11d4749311d96b
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUtL+LOfg4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUp+LOIkEj1
- TLSH T10C247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4836 NOY.exe 4704 JZWE.exe 5260 DSLP.exe 3828 BDO.exe 5660 UGSJY.exe 5920 PTXSJF.exe 5340 PWBOO.exe 2384 ZUO.exe 1124 QFRYMRM.exe 4692 FAADX.exe 3252 PXOX.exe 3032 IASBSC.exe 4468 IVWWY.exe 1096 HOYMGGC.exe 4328 QPASK.exe 1100 PMUV.exe 2596 UFW.exe 3516 YVCXV.exe 2856 WQB.exe 5524 UGNBMNH.exe 4024 LGP.exe 2980 VPRT.exe 5804 FXFH.exe 3452 ZSKQZD.exe 4396 RSMD.exe 1000 SQZPSJ.exe 1912 IGAPQ.exe 2408 XBK.exe 552 SXPD.exe 4076 CMUXBZV.exe 4688 RCVWI.exe 4188 GFF.exe 2484 OLR.exe 5344 AEUA.exe 884 BBAUTV.exe 3872 WPF.exe 708 NXHJHBD.exe 6000 IKL.exe 4168 FLNDVXB.exe 1972 LLVQE.exe 4496 FYAAOZ.exe 5292 PZC.exe 2456 RUGOC.exe 2400 GPQTNRQ.exe 5208 OFRSUE.exe 3560 JQHR.exe 5308 SQBWL.exe 5472 TTNR.exe 3900 GWWQFNZ.exe 2680 KMCQ.exe 4772 VFFJZN.exe 4900 VKXXBA.exe 4876 UIRAW.exe 2828 AVQ.exe 3016 FBAQJD.exe 4444 OJCV.exe 8 SRJDZTO.exe 4208 SXJ.exe 5772 USOB.exe 3060 YAUBXYB.exe 3320 AYIWEH.exe 3384 SGCBPEE.exe 4828 KBOE.exe 3396 PHYUL.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\OLR.exe GFF.exe File opened for modification C:\windows\SysWOW64\WQB.exe YVCXV.exe File created C:\windows\SysWOW64\IKL.exe.bat NXHJHBD.exe File opened for modification C:\windows\SysWOW64\YVCXV.exe UFW.exe File created C:\windows\SysWOW64\ZSKQZD.exe FXFH.exe File opened for modification C:\windows\SysWOW64\VFFJZN.exe KMCQ.exe File created C:\windows\SysWOW64\FBAQJD.exe.bat AVQ.exe File created C:\windows\SysWOW64\XADPX.exe.bat YPAZPV.exe File created C:\windows\SysWOW64\KPPQPYC.exe AAJ.exe File opened for modification C:\windows\SysWOW64\KPPQPYC.exe AAJ.exe File created C:\windows\SysWOW64\KPPQPYC.exe.bat AAJ.exe File created C:\windows\SysWOW64\JZWE.exe.bat NOY.exe File created C:\windows\SysWOW64\WPF.exe.bat BBAUTV.exe File created C:\windows\SysWOW64\IKL.exe NXHJHBD.exe File created C:\windows\SysWOW64\VJGTCQ.exe NETMZS.exe File created C:\windows\SysWOW64\IVWWY.exe IASBSC.exe File created C:\windows\SysWOW64\WQB.exe.bat YVCXV.exe File created C:\windows\SysWOW64\XBK.exe.bat IGAPQ.exe File created C:\windows\SysWOW64\KMCQ.exe GWWQFNZ.exe File created C:\windows\SysWOW64\VNJXYY.exe CKFB.exe File opened for modification C:\windows\SysWOW64\KBOE.exe SGCBPEE.exe File created C:\windows\SysWOW64\QDPLDZI.exe XADPX.exe File created C:\windows\SysWOW64\PTXSJF.exe UGSJY.exe File created C:\windows\SysWOW64\XBK.exe IGAPQ.exe File opened for modification C:\windows\SysWOW64\KMCQ.exe GWWQFNZ.exe File created C:\windows\SysWOW64\YOM.exe.bat XLIA.exe File opened for modification C:\windows\SysWOW64\FBAQJD.exe AVQ.exe File created C:\windows\SysWOW64\RTFLJ.exe WYA.exe File created C:\windows\SysWOW64\CVF.exe.bat BABIHN.exe File created C:\windows\SysWOW64\GGS.exe.bat GBSKFSC.exe File created C:\windows\SysWOW64\ZKWU.exe GGS.exe File opened for modification C:\windows\SysWOW64\ZSKQZD.exe FXFH.exe File created C:\windows\SysWOW64\TTNR.exe.bat SQBWL.exe File created C:\windows\SysWOW64\XADPX.exe YPAZPV.exe File opened for modification C:\windows\SysWOW64\CVF.exe BABIHN.exe File created C:\windows\SysWOW64\WPF.exe BBAUTV.exe File created C:\windows\SysWOW64\YVCXV.exe UFW.exe File created C:\windows\SysWOW64\KMCQ.exe.bat GWWQFNZ.exe File created C:\windows\SysWOW64\KBOE.exe SGCBPEE.exe File opened for modification C:\windows\SysWOW64\QDPLDZI.exe XADPX.exe File opened for modification C:\windows\SysWOW64\VNJXYY.exe CKFB.exe File opened for modification C:\windows\SysWOW64\PTXSJF.exe UGSJY.exe File created C:\windows\SysWOW64\ZSKQZD.exe.bat FXFH.exe File created C:\windows\SysWOW64\GFF.exe RCVWI.exe File created C:\windows\SysWOW64\VKXXBA.exe VFFJZN.exe File created C:\windows\SysWOW64\FBAQJD.exe AVQ.exe File created C:\windows\SysWOW64\RTFLJ.exe.bat WYA.exe File created C:\windows\SysWOW64\CVF.exe BABIHN.exe File opened for modification C:\windows\SysWOW64\XAFHD.exe KPPQPYC.exe File opened for modification C:\windows\SysWOW64\YOM.exe XLIA.exe File created C:\windows\SysWOW64\GGS.exe GBSKFSC.exe File opened for modification C:\windows\SysWOW64\JZWE.exe NOY.exe File created C:\windows\SysWOW64\PTXSJF.exe.bat UGSJY.exe File created C:\windows\SysWOW64\IVWWY.exe.bat IASBSC.exe File created C:\windows\SysWOW64\KBOE.exe.bat SGCBPEE.exe File created C:\windows\SysWOW64\OLR.exe.bat GFF.exe File opened for modification C:\windows\SysWOW64\XBK.exe IGAPQ.exe File opened for modification C:\windows\SysWOW64\GFF.exe RCVWI.exe File created C:\windows\SysWOW64\GFF.exe.bat RCVWI.exe File created C:\windows\SysWOW64\TTNR.exe SQBWL.exe File created C:\windows\SysWOW64\VFFJZN.exe KMCQ.exe File created C:\windows\SysWOW64\VFFJZN.exe.bat KMCQ.exe File opened for modification C:\windows\SysWOW64\VKXXBA.exe VFFJZN.exe File created C:\windows\SysWOW64\OLR.exe GFF.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\UFW.exe PMUV.exe File created C:\windows\RSMD.exe.bat ZSKQZD.exe File created C:\windows\CMUXBZV.exe SXPD.exe File created C:\windows\CMUXBZV.exe.bat SXPD.exe File opened for modification C:\windows\OJCV.exe FBAQJD.exe File created C:\windows\AYIWEH.exe YAUBXYB.exe File created C:\windows\FXFH.exe PCVCEI.exe File created C:\windows\SXJ.exe.bat SRJDZTO.exe File opened for modification C:\windows\system\AAJ.exe KJIWBC.exe File created C:\windows\system\AEUA.exe OLR.exe File created C:\windows\OJCV.exe.bat FBAQJD.exe File opened for modification C:\windows\system\YPAZPV.exe PHYUL.exe File created C:\windows\system\ZOPQ.exe PGNCBG.exe File created C:\windows\CJO.exe.bat TQYC.exe File opened for modification C:\windows\system\PXOX.exe FAADX.exe File created C:\windows\system\NXHJHBD.exe WPF.exe File created C:\windows\system\PJC.exe.bat FLORFG.exe File opened for modification C:\windows\system\TQYC.exe EVOYLD.exe File opened for modification C:\windows\system\ZUO.exe PWBOO.exe File opened for modification C:\windows\FAADX.exe QFRYMRM.exe File created C:\windows\system\YPAZPV.exe.bat PHYUL.exe File created C:\windows\system\PGNCBG.exe CVF.exe File created C:\windows\system\ZOPQ.exe.bat PGNCBG.exe File created C:\windows\system\IASBSC.exe PXOX.exe File created C:\windows\system\UGNBMNH.exe WQB.exe File created C:\windows\system\IGAPQ.exe.bat SQZPSJ.exe File created C:\windows\system\WAOU.exe.bat MZMPAOA.exe File created C:\windows\NETMZS.exe.bat PJC.exe File opened for modification C:\windows\UXBDWV.exe ZKWU.exe File created C:\windows\SEHYQO.exe OWA.exe File opened for modification C:\windows\system\QFRYMRM.exe ZUO.exe File opened for modification C:\windows\system\IGAPQ.exe SQZPSJ.exe File opened for modification C:\windows\OFRSUE.exe GPQTNRQ.exe File created C:\windows\system\AVQ.exe.bat UIRAW.exe File created C:\windows\system\SGCBPEE.exe AYIWEH.exe File created C:\windows\system\CKFB.exe YCYBG.exe File created C:\windows\system\TQYC.exe EVOYLD.exe File created C:\windows\DSLP.exe.bat JZWE.exe File created C:\windows\JQHR.exe.bat OFRSUE.exe File opened for modification C:\windows\WYA.exe WTAOYE.exe File created C:\windows\system\ZUO.exe.bat PWBOO.exe File opened for modification C:\windows\PMUV.exe QPASK.exe File opened for modification C:\windows\system\SQZPSJ.exe RSMD.exe File created C:\windows\system\NXHJHBD.exe.bat WPF.exe File created C:\windows\PZC.exe FYAAOZ.exe File created C:\windows\PSVF.exe WAOU.exe File created C:\windows\system\TQYC.exe.bat EVOYLD.exe File created C:\windows\FAADX.exe QFRYMRM.exe File created C:\windows\PMUV.exe.bat QPASK.exe File created C:\windows\OFRSUE.exe GPQTNRQ.exe File created C:\windows\UIRAW.exe VKXXBA.exe File opened for modification C:\windows\FXFH.exe PCVCEI.exe File created C:\windows\system\PWBOO.exe.bat PTXSJF.exe File opened for modification C:\windows\BBAUTV.exe AEUA.exe File opened for modification C:\windows\system\GWWQFNZ.exe TTNR.exe File created C:\windows\system\YAUBXYB.exe.bat USOB.exe File created C:\windows\system\KJIWBC.exe ZJTLRB.exe File created C:\windows\NOY.exe.bat 2026-08-09_2a434b476d13b11ed329285877798f37_elex_emotet_stop.exe File created C:\windows\system\HOYMGGC.exe IVWWY.exe File opened for modification C:\windows\system\HOYMGGC.exe IVWWY.exe File opened for modification C:\windows\system\SQBWL.exe JQHR.exe File opened for modification C:\windows\SRJDZTO.exe OJCV.exe File opened for modification C:\windows\system\UGNBMNH.exe WQB.exe File created C:\windows\system\RCVWI.exe CMUXBZV.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4160 cmd.exe 2012 cmd.exe 1924 cmd.exe 776 cmd.exe 3108 cmd.exe 3512 cmd.exe 1396 cmd.exe 5040 cmd.exe 1180 cmd.exe 4284 cmd.exe 5484 cmd.exe 3616 cmd.exe 6028 cmd.exe 3112 cmd.exe 4752 cmd.exe 4452 cmd.exe 4132 cmd.exe 2064 cmd.exe 5136 cmd.exe 4948 cmd.exe 716 cmd.exe 5404 cmd.exe 4348 cmd.exe 3356 cmd.exe 1128 cmd.exe 5396 cmd.exe 2464 cmd.exe 4268 cmd.exe 2144 cmd.exe 4596 cmd.exe 1800 cmd.exe 3428 cmd.exe 5096 cmd.exe 5584 cmd.exe 1724 cmd.exe 1736 cmd.exe 2780 cmd.exe 3656 cmd.exe 980 cmd.exe 1404 cmd.exe 6100 cmd.exe 2424 cmd.exe 3284 cmd.exe 4940 cmd.exe 4608 cmd.exe 2528 cmd.exe 5856 cmd.exe 984 cmd.exe 248 cmd.exe 1320 cmd.exe 5980 cmd.exe 5556 cmd.exe 4428 cmd.exe 5916 cmd.exe 2460 cmd.exe 4056 cmd.exe 4848 cmd.exe 2340 cmd.exe 4492 cmd.exe 3708 cmd.exe 3300 cmd.exe 1536 cmd.exe 4864 cmd.exe 2760 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4544 6068 WerFault.exe 87 620 4836 WerFault.exe 93 824 4704 WerFault.exe 99 2492 5260 WerFault.exe 104 2760 3828 WerFault.exe 109 3376 5660 WerFault.exe 114 5732 5920 WerFault.exe 119 932 5340 WerFault.exe 124 1056 2384 WerFault.exe 129 4644 1124 WerFault.exe 134 5480 4692 WerFault.exe 139 4552 3252 WerFault.exe 144 2968 3032 WerFault.exe 149 6036 4468 WerFault.exe 154 5624 1096 WerFault.exe 159 3416 4328 WerFault.exe 164 5240 1100 WerFault.exe 169 5068 2596 WerFault.exe 174 4228 3516 WerFault.exe 179 4196 2856 WerFault.exe 184 776 5524 WerFault.exe 189 2860 4024 WerFault.exe 194 4876 2980 WerFault.exe 199 5672 4660 WerFault.exe 204 884 5804 WerFault.exe 209 920 3452 WerFault.exe 214 6072 4396 WerFault.exe 219 2068 1000 WerFault.exe 224 4640 1912 WerFault.exe 229 1724 2408 WerFault.exe 233 1832 552 WerFault.exe 239 4476 4076 WerFault.exe 244 3532 4688 WerFault.exe 249 5588 4188 WerFault.exe 254 2116 2484 WerFault.exe 259 4796 5344 WerFault.exe 264 856 884 WerFault.exe 269 1404 3872 WerFault.exe 274 4956 708 WerFault.exe 279 1388 6000 WerFault.exe 284 4160 4168 WerFault.exe 289 4196 1972 WerFault.exe 294 3784 4496 WerFault.exe 299 3884 5292 WerFault.exe 304 2968 2456 WerFault.exe 309 4352 2400 WerFault.exe 314 1556 5208 WerFault.exe 319 4232 3560 WerFault.exe 324 4240 5308 WerFault.exe 329 2432 5472 WerFault.exe 334 4316 3900 WerFault.exe 339 5696 2680 WerFault.exe 344 1716 4772 WerFault.exe 349 3196 4900 WerFault.exe 354 4796 4876 WerFault.exe 359 1644 2828 WerFault.exe 364 2848 3016 WerFault.exe 369 3064 4444 WerFault.exe 374 3316 8 WerFault.exe 379 2696 4208 WerFault.exe 384 4748 5772 WerFault.exe 389 4084 3060 WerFault.exe 394 3820 3320 WerFault.exe 399 5384 3384 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PWBOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DPU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NETMZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLNDVXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBAQJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WTAOYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OFRSUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DSLP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BABIHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMUXBZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IASBSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPAZPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PXOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSKQZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQBWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IGAPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TLKZQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBSKFSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMAMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYAAOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KBOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KPPQPYC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEHYQO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKFB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFRYMRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXFH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6068 2026-08-09_2a434b476d13b11ed329285877798f37_elex_emotet_stop.exe 6068 2026-08-09_2a434b476d13b11ed329285877798f37_elex_emotet_stop.exe 4836 NOY.exe 4836 NOY.exe 4704 JZWE.exe 4704 JZWE.exe 5260 DSLP.exe 5260 DSLP.exe 3828 BDO.exe 3828 BDO.exe 5660 UGSJY.exe 5660 UGSJY.exe 5920 PTXSJF.exe 5920 PTXSJF.exe 5340 PWBOO.exe 5340 PWBOO.exe 2384 ZUO.exe 2384 ZUO.exe 1124 QFRYMRM.exe 1124 QFRYMRM.exe 4692 FAADX.exe 4692 FAADX.exe 3252 PXOX.exe 3252 PXOX.exe 3032 IASBSC.exe 3032 IASBSC.exe 4468 IVWWY.exe 4468 IVWWY.exe 1096 HOYMGGC.exe 1096 HOYMGGC.exe 4328 QPASK.exe 4328 QPASK.exe 1100 PMUV.exe 1100 PMUV.exe 2596 UFW.exe 2596 UFW.exe 3516 YVCXV.exe 3516 YVCXV.exe 2856 WQB.exe 2856 WQB.exe 5524 UGNBMNH.exe 5524 UGNBMNH.exe 4024 LGP.exe 4024 LGP.exe 4660 PCVCEI.exe 4660 PCVCEI.exe 5804 FXFH.exe 5804 FXFH.exe 3452 ZSKQZD.exe 3452 ZSKQZD.exe 4396 RSMD.exe 4396 RSMD.exe 1000 SQZPSJ.exe 1000 SQZPSJ.exe 1912 IGAPQ.exe 1912 IGAPQ.exe 2408 XBK.exe 2408 XBK.exe 552 SXPD.exe 552 SXPD.exe 4076 CMUXBZV.exe 4076 CMUXBZV.exe 4688 RCVWI.exe 4688 RCVWI.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 6068 2026-08-09_2a434b476d13b11ed329285877798f37_elex_emotet_stop.exe 6068 2026-08-09_2a434b476d13b11ed329285877798f37_elex_emotet_stop.exe 4836 NOY.exe 4836 NOY.exe 4704 JZWE.exe 4704 JZWE.exe 5260 DSLP.exe 5260 DSLP.exe 3828 BDO.exe 3828 BDO.exe 5660 UGSJY.exe 5660 UGSJY.exe 5920 PTXSJF.exe 5920 PTXSJF.exe 5340 PWBOO.exe 5340 PWBOO.exe 2384 ZUO.exe 2384 ZUO.exe 1124 QFRYMRM.exe 1124 QFRYMRM.exe 4692 FAADX.exe 4692 FAADX.exe 3252 PXOX.exe 3252 PXOX.exe 3032 IASBSC.exe 3032 IASBSC.exe 4468 IVWWY.exe 4468 IVWWY.exe 1096 HOYMGGC.exe 1096 HOYMGGC.exe 4328 QPASK.exe 4328 QPASK.exe 1100 PMUV.exe 1100 PMUV.exe 2596 UFW.exe 2596 UFW.exe 3516 YVCXV.exe 3516 YVCXV.exe 2856 WQB.exe 2856 WQB.exe 5524 UGNBMNH.exe 5524 UGNBMNH.exe 4024 LGP.exe 4024 LGP.exe 4660 PCVCEI.exe 4660 PCVCEI.exe 5804 FXFH.exe 5804 FXFH.exe 3452 ZSKQZD.exe 3452 ZSKQZD.exe 4396 RSMD.exe 4396 RSMD.exe 1000 SQZPSJ.exe 1000 SQZPSJ.exe 1912 IGAPQ.exe 1912 IGAPQ.exe 2408 XBK.exe 2408 XBK.exe 552 SXPD.exe 552 SXPD.exe 4076 CMUXBZV.exe 4076 CMUXBZV.exe 4688 RCVWI.exe 4688 RCVWI.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6068 wrote to memory of 3428 6068 2026-08-09_2a434b476d13b11ed329285877798f37_elex_emotet_stop.exe 89 PID 3428 wrote to memory of 4836 3428 cmd.exe 93 PID 4836 wrote to memory of 4996 4836 NOY.exe 95 PID 4996 wrote to memory of 4704 4996 cmd.exe 99 PID 4704 wrote to memory of 1916 4704 JZWE.exe 100 PID 1916 wrote to memory of 5260 1916 cmd.exe 104 PID 5260 wrote to memory of 5096 5260 DSLP.exe 105 PID 5096 wrote to memory of 3828 5096 cmd.exe 109 PID 3828 wrote to memory of 5980 3828 BDO.exe 110 PID 5980 wrote to memory of 5660 5980 cmd.exe 114 PID 5660 wrote to memory of 4348 5660 UGSJY.exe 115 PID 4348 wrote to memory of 5920 4348 cmd.exe 119 PID 5920 wrote to memory of 3512 5920 PTXSJF.exe 120 PID 3512 wrote to memory of 5340 3512 cmd.exe 124 PID 5340 wrote to memory of 2628 5340 PWBOO.exe 125 PID 2628 wrote to memory of 2384 2628 cmd.exe 129 PID 2384 wrote to memory of 3184 2384 ZUO.exe 130 PID 3184 wrote to memory of 1124 3184 cmd.exe 134 PID 1124 wrote to memory of 2764 1124 QFRYMRM.exe 135 PID 2764 wrote to memory of 4692 2764 cmd.exe 139 PID 4692 wrote to memory of 5584 4692 FAADX.exe 140 PID 5584 wrote to memory of 3252 5584 cmd.exe 144 PID 3252 wrote to memory of 1396 3252 PXOX.exe 145 PID 1396 wrote to memory of 3032 1396 cmd.exe 149 PID 3032 wrote to memory of 1312 3032 IASBSC.exe 150 PID 1312 wrote to memory of 4468 1312 cmd.exe 154 PID 4468 wrote to memory of 980 4468 IVWWY.exe 155 PID 980 wrote to memory of 1096 980 cmd.exe 159 PID 1096 wrote to memory of 4504 1096 HOYMGGC.exe 160 PID 4504 wrote to memory of 4328 4504 cmd.exe 164 PID 4328 wrote to memory of 3612 4328 QPASK.exe 165 PID 3612 wrote to memory of 1100 3612 cmd.exe 169 PID 1100 wrote to memory of 1052 1100 PMUV.exe 170 PID 1052 wrote to memory of 2596 1052 cmd.exe 174 PID 2596 wrote to memory of 3224 2596 UFW.exe 175 PID 3224 wrote to memory of 3516 3224 cmd.exe 179 PID 3516 wrote to memory of 2392 3516 YVCXV.exe 180 PID 2392 wrote to memory of 2856 2392 cmd.exe 184 PID 2856 wrote to memory of 1108 2856 WQB.exe 185 PID 1108 wrote to memory of 5524 1108 cmd.exe 189 PID 5524 wrote to memory of 5972 5524 UGNBMNH.exe 190 PID 5972 wrote to memory of 4024 5972 cmd.exe 194 PID 4024 wrote to memory of 4256 4024 LGP.exe 195 PID 4256 wrote to memory of 2980 4256 cmd.exe 199 PID 5080 wrote to memory of 4660 5080 cmd.exe 204 PID 4660 wrote to memory of 2460 4660 PCVCEI.exe 205 PID 2460 wrote to memory of 5804 2460 cmd.exe 209 PID 5804 wrote to memory of 1580 5804 FXFH.exe 210 PID 1580 wrote to memory of 3452 1580 cmd.exe 214 PID 3452 wrote to memory of 4788 3452 ZSKQZD.exe 215 PID 4788 wrote to memory of 4396 4788 cmd.exe 219 PID 4396 wrote to memory of 5612 4396 RSMD.exe 220 PID 5612 wrote to memory of 1000 5612 cmd.exe 224 PID 1000 wrote to memory of 3416 1000 SQZPSJ.exe 225 PID 3416 wrote to memory of 1912 3416 cmd.exe 229 PID 1912 wrote to memory of 3284 1912 IGAPQ.exe 230 PID 3284 wrote to memory of 2408 3284 cmd.exe 233 PID 2408 wrote to memory of 4756 2408 XBK.exe 235 PID 4756 wrote to memory of 552 4756 cmd.exe 239 PID 552 wrote to memory of 4132 552 SXPD.exe 240 PID 4132 wrote to memory of 4076 4132 cmd.exe 244 PID 4076 wrote to memory of 5124 4076 CMUXBZV.exe 245 PID 5124 wrote to memory of 4688 5124 cmd.exe 249 PID 4688 wrote to memory of 4548 4688 RCVWI.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_2a434b476d13b11ed329285877798f37_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_2a434b476d13b11ed329285877798f37_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NOY.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\windows\NOY.exeC:\windows\NOY.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JZWE.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\windows\SysWOW64\JZWE.exeC:\windows\system32\JZWE.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DSLP.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\windows\DSLP.exeC:\windows\DSLP.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BDO.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\windows\system\BDO.exeC:\windows\system\BDO.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGSJY.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\windows\system\UGSJY.exeC:\windows\system\UGSJY.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PTXSJF.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\windows\SysWOW64\PTXSJF.exeC:\windows\system32\PTXSJF.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWBOO.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\windows\system\PWBOO.exeC:\windows\system\PWBOO.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZUO.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\windows\system\ZUO.exeC:\windows\system\ZUO.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFRYMRM.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\windows\system\QFRYMRM.exeC:\windows\system\QFRYMRM.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FAADX.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\windows\FAADX.exeC:\windows\FAADX.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PXOX.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\windows\system\PXOX.exeC:\windows\system\PXOX.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IASBSC.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\windows\system\IASBSC.exeC:\windows\system\IASBSC.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVWWY.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\windows\SysWOW64\IVWWY.exeC:\windows\system32\IVWWY.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOYMGGC.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:980 -
C:\windows\system\HOYMGGC.exeC:\windows\system\HOYMGGC.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QPASK.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\windows\system\QPASK.exeC:\windows\system\QPASK.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMUV.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\windows\PMUV.exeC:\windows\PMUV.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UFW.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\windows\system\UFW.exeC:\windows\system\UFW.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YVCXV.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\windows\SysWOW64\YVCXV.exeC:\windows\system32\YVCXV.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQB.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\windows\SysWOW64\WQB.exeC:\windows\system32\WQB.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGNBMNH.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\windows\system\UGNBMNH.exeC:\windows\system\UGNBMNH.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGP.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\windows\LGP.exeC:\windows\LGP.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPRT.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\windows\VPRT.exeC:\windows\VPRT.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PCVCEI.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\windows\PCVCEI.exeC:\windows\PCVCEI.exe47⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXFH.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\windows\FXFH.exeC:\windows\FXFH.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZSKQZD.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\windows\SysWOW64\ZSKQZD.exeC:\windows\system32\ZSKQZD.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RSMD.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\windows\RSMD.exeC:\windows\RSMD.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQZPSJ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\windows\system\SQZPSJ.exeC:\windows\system\SQZPSJ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IGAPQ.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\windows\system\IGAPQ.exeC:\windows\system\IGAPQ.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XBK.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\windows\SysWOW64\XBK.exeC:\windows\system32\XBK.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SXPD.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\windows\system\SXPD.exeC:\windows\system\SXPD.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMUXBZV.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\windows\CMUXBZV.exeC:\windows\CMUXBZV.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RCVWI.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\windows\system\RCVWI.exeC:\windows\system\RCVWI.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GFF.exe.bat" "66⤵PID:4548
-
C:\windows\SysWOW64\GFF.exeC:\windows\system32\GFF.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OLR.exe.bat" "68⤵PID:4244
-
C:\windows\SysWOW64\OLR.exeC:\windows\system32\OLR.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AEUA.exe.bat" "70⤵PID:1088
-
C:\windows\system\AEUA.exeC:\windows\system\AEUA.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BBAUTV.exe.bat" "72⤵PID:2104
-
C:\windows\BBAUTV.exeC:\windows\BBAUTV.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WPF.exe.bat" "74⤵PID:6036
-
C:\windows\SysWOW64\WPF.exeC:\windows\system32\WPF.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NXHJHBD.exe.bat" "76⤵PID:5624
-
C:\windows\system\NXHJHBD.exeC:\windows\system\NXHJHBD.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IKL.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:3132 -
C:\windows\SysWOW64\IKL.exeC:\windows\system32\IKL.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FLNDVXB.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4056 -
C:\windows\FLNDVXB.exeC:\windows\FLNDVXB.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LLVQE.exe.bat" "82⤵PID:3644
-
C:\windows\system\LLVQE.exeC:\windows\system\LLVQE.exe83⤵
- Executes dropped EXE
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYAAOZ.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3356 -
C:\windows\FYAAOZ.exeC:\windows\FYAAOZ.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PZC.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:4800 -
C:\windows\PZC.exeC:\windows\PZC.exe87⤵
- Executes dropped EXE
PID:5292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RUGOC.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3112 -
C:\windows\RUGOC.exeC:\windows\RUGOC.exe89⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GPQTNRQ.exe.bat" "90⤵PID:2116
-
C:\windows\system\GPQTNRQ.exeC:\windows\system\GPQTNRQ.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OFRSUE.exe.bat" "92⤵PID:3392
-
C:\windows\OFRSUE.exeC:\windows\OFRSUE.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JQHR.exe.bat" "94⤵PID:3660
-
C:\windows\JQHR.exeC:\windows\JQHR.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQBWL.exe.bat" "96⤵PID:124
-
C:\windows\system\SQBWL.exeC:\windows\system\SQBWL.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTNR.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4848 -
C:\windows\SysWOW64\TTNR.exeC:\windows\system32\TTNR.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GWWQFNZ.exe.bat" "100⤵PID:2656
-
C:\windows\system\GWWQFNZ.exeC:\windows\system\GWWQFNZ.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMCQ.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4160 -
C:\windows\SysWOW64\KMCQ.exeC:\windows\system32\KMCQ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFFJZN.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:464 -
C:\windows\SysWOW64\VFFJZN.exeC:\windows\system32\VFFJZN.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VKXXBA.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4940 -
C:\windows\SysWOW64\VKXXBA.exeC:\windows\system32\VKXXBA.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UIRAW.exe.bat" "108⤵
- Executes a command shell one-liner
PID:4752 -
C:\windows\UIRAW.exeC:\windows\UIRAW.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AVQ.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4608 -
C:\windows\system\AVQ.exeC:\windows\system\AVQ.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBAQJD.exe.bat" "112⤵
- Executes a command shell one-liner
PID:2340 -
C:\windows\SysWOW64\FBAQJD.exeC:\windows\system32\FBAQJD.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJCV.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4492 -
C:\windows\OJCV.exeC:\windows\OJCV.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SRJDZTO.exe.bat" "116⤵PID:1200
-
C:\windows\SRJDZTO.exeC:\windows\SRJDZTO.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:8 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SXJ.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:6012 -
C:\windows\SXJ.exeC:\windows\SXJ.exe119⤵
- Executes dropped EXE
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USOB.exe.bat" "120⤵PID:3412
-
C:\windows\system\USOB.exeC:\windows\system\USOB.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-