Analysis
- max time kernel
83s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 09:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_fe6b85d5d97cc40f09438f6c5277f3a2_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-10_fe6b85d5d97cc40f09438f6c5277f3a2_elex_emotet_stop.exe
- Size 208KB
- Sample260810-la2v3sel9t
- SHA256 1d937383ba6b0d817ec6d86ae99855cfbf6720eea8c598b221b84f198b432ffe
- MD5 fe6b85d5d97cc40f09438f6c5277f3a2
- SHA1 997d73689eeb7aa3d59633bb521bf4e81892d4e1
- SHA512 d9884ae052dce7efff058a3f57312b54c037e5e044c13741d79d7dda47b2ed507011be58723f9d88707bac5b94b7d0b562857755c2b00fb6dcf14a63206a7b19
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUtL+LOfl4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUp+LOdkEj1
- TLSH T190247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4736 KZR.exe 1828 DNKVQNK.exe 1764 FKQPY.exe 3848 GNU.exe 4524 PWWQG.exe 356 ERF.exe 5032 WRHH.exe 5088 LMZMOWI.exe 5052 SCALV.exe 3488 TFEHAZG.exe 2904 ZGLV.exe 4860 DWSDDUW.exe 4132 LBWJGS.exe 5764 UJYOR.exe 244 JZZOQL.exe 4288 NHO.exe 2116 DCXSVQ.exe 3004 JYXB.exe 3364 NGDBEL.exe 3264 WOF.exe 1276 GMLAXRB.exe 3724 KUSIJ.exe 4984 KXVE.exe 4108 FKANZ.exe 3232 AGFXBZC.exe 6064 EOMF.exe 4180 TENWUF.exe 5492 DBARC.exe 5836 QMJ.exe 5140 QSJE.exe 1412 LFONCL.exe 1092 NSS.exe 2596 RIZXYVL.exe 4516 XJHKHXN.exe 5608 BRNSTQB.exe 1940 KZP.exe 5448 LUTBC.exe 2840 PKABPVA.exe 4232 YLCGSB.exe 1128 ELJUJV.exe 4344 EYKI.exe 3668 HMGSV.exe 4828 FBAV.exe 520 WUC.exe 4192 ICJLD.exe 704 GYIMZO.exe 3168 SGP.exe 2120 FQF.exe 2432 UGGKH.exe 4240 IRPIV.exe 2252 MUN.exe 5756 WSBQC.exe 1972 QFFZMJE.exe 5964 UNMH.exe 2600 VQQ.exe 3588 CLZPXM.exe 5096 IHYQUPS.exe 2776 XCIUN.exe 6124 YFMY.exe 3604 YKMN.exe 5728 ELTADZG.exe 4152 ZGY.exe 3876 EGGX.exe 1848 OHICHYY.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\YKMN.exe YFMY.exe File opened for modification C:\windows\SysWOW64\NKPLUHV.exe EBNYQC.exe File opened for modification C:\windows\SysWOW64\QSJE.exe QMJ.exe File created C:\windows\SysWOW64\LFONCL.exe QSJE.exe File created C:\windows\SysWOW64\NSS.exe LFONCL.exe File opened for modification C:\windows\SysWOW64\XCIUN.exe IHYQUPS.exe File created C:\windows\SysWOW64\XCIUN.exe.bat IHYQUPS.exe File opened for modification C:\windows\SysWOW64\DONJEGG.exe CLJOR.exe File created C:\windows\SysWOW64\NKPLUHV.exe.bat EBNYQC.exe File created C:\windows\SysWOW64\XNVMKUH.exe.bat DAQDAV.exe File created C:\windows\SysWOW64\KUSIJ.exe GMLAXRB.exe File created C:\windows\SysWOW64\XCIUN.exe IHYQUPS.exe File opened for modification C:\windows\SysWOW64\OHICHYY.exe EGGX.exe File opened for modification C:\windows\SysWOW64\KUSIJ.exe GMLAXRB.exe File opened for modification C:\windows\SysWOW64\EYKI.exe ELJUJV.exe File created C:\windows\SysWOW64\EGGX.exe ZGY.exe File created C:\windows\SysWOW64\OHICHYY.exe.bat EGGX.exe File created C:\windows\SysWOW64\DONJEGG.exe CLJOR.exe File created C:\windows\SysWOW64\NTADWQT.exe NOAPME.exe File opened for modification C:\windows\SysWOW64\DCXSVQ.exe NHO.exe File created C:\windows\SysWOW64\DBARC.exe.bat TENWUF.exe File created C:\windows\SysWOW64\QSJE.exe QMJ.exe File opened for modification C:\windows\SysWOW64\YFMY.exe XCIUN.exe File created C:\windows\SysWOW64\NTADWQT.exe.bat NOAPME.exe File opened for modification C:\windows\SysWOW64\SEMGKO.exe GWGYYV.exe File opened for modification C:\windows\SysWOW64\NGDBEL.exe JYXB.exe File created C:\windows\SysWOW64\KUSIJ.exe.bat GMLAXRB.exe File created C:\windows\SysWOW64\LFONCL.exe.bat QSJE.exe File opened for modification C:\windows\SysWOW64\YLCGSB.exe PKABPVA.exe File opened for modification C:\windows\SysWOW64\EGGX.exe ZGY.exe File created C:\windows\SysWOW64\FSTSNBK.exe KEOJD.exe File created C:\windows\SysWOW64\NOAPME.exe DQU.exe File opened for modification C:\windows\SysWOW64\QFSVW.exe VRN.exe File created C:\windows\SysWOW64\PWWQG.exe GNU.exe File opened for modification C:\windows\SysWOW64\PWWQG.exe GNU.exe File created C:\windows\SysWOW64\NGDBEL.exe JYXB.exe File created C:\windows\SysWOW64\RIZXYVL.exe.bat NSS.exe File created C:\windows\SysWOW64\YLCGSB.exe PKABPVA.exe File created C:\windows\SysWOW64\YKMN.exe.bat YFMY.exe File opened for modification C:\windows\SysWOW64\DAQDAV.exe NKPLUHV.exe File created C:\windows\SysWOW64\NOAPME.exe.bat DQU.exe File created C:\windows\SysWOW64\DCXSVQ.exe NHO.exe File created C:\windows\SysWOW64\DBARC.exe TENWUF.exe File created C:\windows\SysWOW64\QSJE.exe.bat QMJ.exe File created C:\windows\SysWOW64\EGGX.exe.bat ZGY.exe File created C:\windows\SysWOW64\VRN.exe PRGYDZ.exe File created C:\windows\SysWOW64\NGDBEL.exe.bat JYXB.exe File created C:\windows\SysWOW64\DCXSVQ.exe.bat NHO.exe File created C:\windows\SysWOW64\YFMY.exe XCIUN.exe File created C:\windows\SysWOW64\OHICHYY.exe EGGX.exe File created C:\windows\SysWOW64\YHG.exe URZJON.exe File opened for modification C:\windows\SysWOW64\YHG.exe URZJON.exe File created C:\windows\SysWOW64\VCLPRZ.exe RKJNG.exe File created C:\windows\SysWOW64\FSTSNBK.exe.bat KEOJD.exe File created C:\windows\SysWOW64\EYKI.exe ELJUJV.exe File opened for modification C:\windows\SysWOW64\YKMN.exe YFMY.exe File created C:\windows\SysWOW64\DAQDAV.exe.bat NKPLUHV.exe File created C:\windows\SysWOW64\OVLQUI.exe.bat OHLCS.exe File opened for modification C:\windows\SysWOW64\PRGYDZ.exe NTADWQT.exe File created C:\windows\SysWOW64\SEMGKO.exe GWGYYV.exe File opened for modification C:\windows\SysWOW64\NSS.exe LFONCL.exe File created C:\windows\SysWOW64\YHG.exe.bat URZJON.exe File opened for modification C:\windows\SysWOW64\DQU.exe OVLQUI.exe File created C:\windows\SysWOW64\QFSVW.exe.bat VRN.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\JZZOQL.exe UJYOR.exe File created C:\windows\GMLAXRB.exe.bat WOF.exe File created C:\windows\FKANZ.exe.bat KXVE.exe File created C:\windows\system\UGGKH.exe.bat FQF.exe File created C:\windows\IRPIV.exe.bat UGGKH.exe File created C:\windows\system\UNMH.exe QFFZMJE.exe File opened for modification C:\windows\ZGY.exe ELTADZG.exe File created C:\windows\system\XPC.exe OHICHYY.exe File created C:\windows\GNU.exe FKQPY.exe File created C:\windows\SCALV.exe.bat LMZMOWI.exe File created C:\windows\TFEHAZG.exe SCALV.exe File opened for modification C:\windows\NHO.exe JZZOQL.exe File created C:\windows\WOF.exe.bat NGDBEL.exe File opened for modification C:\windows\system\KZP.exe BRNSTQB.exe File opened for modification C:\windows\ICJLD.exe WUC.exe File created C:\windows\system\QFFZMJE.exe.bat WSBQC.exe File created C:\windows\WOF.exe NGDBEL.exe File created C:\windows\KXVE.exe.bat KUSIJ.exe File opened for modification C:\windows\system\EOMF.exe AGFXBZC.exe File created C:\windows\system\BRNSTQB.exe XJHKHXN.exe File created C:\windows\system\BRNSTQB.exe.bat XJHKHXN.exe File opened for modification C:\windows\LUTBC.exe KZP.exe File created C:\windows\WUC.exe.bat FBAV.exe File created C:\windows\MUN.exe IRPIV.exe File created C:\windows\system\DNKVQNK.exe KZR.exe File opened for modification C:\windows\WOF.exe NGDBEL.exe File created C:\windows\system\SGP.exe GYIMZO.exe File created C:\windows\system\CLZPXM.exe VQQ.exe File opened for modification C:\windows\system\KTLPHN.exe BTJKD.exe File created C:\windows\system\HVOIAHG.exe VCLPRZ.exe File opened for modification C:\windows\system\HVOIAHG.exe VCLPRZ.exe File opened for modification C:\windows\IIOXM.exe NFGZYAF.exe File opened for modification C:\windows\system\DNKVQNK.exe KZR.exe File opened for modification C:\windows\TFEHAZG.exe SCALV.exe File created C:\windows\NHO.exe JZZOQL.exe File created C:\windows\TENWUF.exe.bat EOMF.exe File created C:\windows\system\CLZPXM.exe.bat VQQ.exe File created C:\windows\system\BTJKD.exe.bat CVYPIC.exe File created C:\windows\EBNYQC.exe JZE.exe File created C:\windows\LBBOO.exe HXDBODI.exe File created C:\windows\JYXB.exe DCXSVQ.exe File created C:\windows\ICJLD.exe.bat WUC.exe File created C:\windows\IRPIV.exe UGGKH.exe File opened for modification C:\windows\BVBUX.exe XNVMKUH.exe File created C:\windows\system\OGSLD.exe.bat BVBUX.exe File created C:\windows\LBBOO.exe.bat HXDBODI.exe File created C:\windows\GNU.exe.bat FKQPY.exe File opened for modification C:\windows\IHYQUPS.exe CLZPXM.exe File created C:\windows\system\CLJOR.exe ZYSM.exe File created C:\windows\BVBUX.exe.bat XNVMKUH.exe File created C:\windows\OHLCS.exe.bat NMHYFG.exe File opened for modification C:\windows\GWGYYV.exe LBBOO.exe File opened for modification C:\windows\KZR.exe 2026-08-10_fe6b85d5d97cc40f09438f6c5277f3a2_elex_emotet_stop.exe File created C:\windows\WRHH.exe ERF.exe File created C:\windows\system\UJYOR.exe LBWJGS.exe File created C:\windows\AGFXBZC.exe.bat FKANZ.exe File created C:\windows\system\ELJUJV.exe.bat YLCGSB.exe File created C:\windows\FQF.exe SGP.exe File opened for modification C:\windows\system\QFFZMJE.exe WSBQC.exe File created C:\windows\ZGY.exe.bat ELTADZG.exe File opened for modification C:\windows\GMLAXRB.exe WOF.exe File opened for modification C:\windows\QMJ.exe DBARC.exe File created C:\windows\system\CVYPIC.exe IITYG.exe File created C:\windows\NFGZYAF.exe FSTSNBK.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3532 cmd.exe 5872 cmd.exe 3404 cmd.exe 5428 cmd.exe 1832 cmd.exe 52 cmd.exe 2804 cmd.exe 1404 cmd.exe 5760 cmd.exe 1788 cmd.exe 2164 cmd.exe 1808 cmd.exe 5344 cmd.exe 4372 cmd.exe 2808 cmd.exe 4664 cmd.exe 4480 cmd.exe 3468 cmd.exe 2968 cmd.exe 3256 cmd.exe 2352 cmd.exe 5076 cmd.exe 1264 cmd.exe 4716 cmd.exe 2880 cmd.exe 1836 cmd.exe 1768 cmd.exe 1136 cmd.exe 5044 cmd.exe 5480 cmd.exe 252 cmd.exe 2584 cmd.exe 1240 cmd.exe 2676 cmd.exe 2456 cmd.exe 2148 cmd.exe 3160 cmd.exe 3932 cmd.exe 1812 cmd.exe 4308 cmd.exe 3360 cmd.exe 5248 cmd.exe 3384 cmd.exe 4168 cmd.exe 2484 cmd.exe 5148 cmd.exe 2708 cmd.exe 2568 cmd.exe 4660 cmd.exe 2400 cmd.exe 1504 cmd.exe 4816 cmd.exe 2448 cmd.exe 2344 cmd.exe 4924 cmd.exe 1036 cmd.exe 4304 cmd.exe 5824 cmd.exe 900 cmd.exe 1868 cmd.exe 3424 cmd.exe 4328 cmd.exe 408 cmd.exe 4264 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2028 980 WerFault.exe 88 3936 4736 WerFault.exe 93 3600 1828 WerFault.exe 99 4952 1764 WerFault.exe 104 5660 3848 WerFault.exe 109 2716 4524 WerFault.exe 114 988 356 WerFault.exe 119 4608 5032 WerFault.exe 124 3080 5088 WerFault.exe 129 5428 5052 WerFault.exe 134 500 3488 WerFault.exe 139 2484 2904 WerFault.exe 144 2104 4860 WerFault.exe 149 5644 4132 WerFault.exe 154 52 5764 WerFault.exe 159 4556 244 WerFault.exe 164 2568 4288 WerFault.exe 169 4664 2116 WerFault.exe 174 3664 3004 WerFault.exe 179 3172 3364 WerFault.exe 184 3424 3264 WerFault.exe 189 2740 1276 WerFault.exe 194 4192 3724 WerFault.exe 199 1532 4984 WerFault.exe 204 2492 4108 WerFault.exe 209 4852 3232 WerFault.exe 214 3804 6064 WerFault.exe 219 5528 4180 WerFault.exe 224 4904 5492 WerFault.exe 229 6052 5836 WerFault.exe 234 5472 5140 WerFault.exe 239 2464 1412 WerFault.exe 244 2628 1092 WerFault.exe 249 1880 2596 WerFault.exe 254 5376 4516 WerFault.exe 259 6008 5608 WerFault.exe 264 3284 1940 WerFault.exe 269 260 5448 WerFault.exe 274 1328 2840 WerFault.exe 279 2684 4232 WerFault.exe 284 3456 1128 WerFault.exe 289 4744 4344 WerFault.exe 294 1820 3668 WerFault.exe 299 4128 4828 WerFault.exe 304 5904 520 WerFault.exe 309 5900 4192 WerFault.exe 314 3716 704 WerFault.exe 319 5984 3168 WerFault.exe 324 4276 2120 WerFault.exe 329 4312 2432 WerFault.exe 334 4904 4240 WerFault.exe 339 4204 2252 WerFault.exe 344 4680 5756 WerFault.exe 349 3144 1972 WerFault.exe 354 4876 5964 WerFault.exe 359 4920 2600 WerFault.exe 364 2720 3588 WerFault.exe 369 3932 5096 WerFault.exe 374 4700 2776 WerFault.exe 379 5156 6124 WerFault.exe 384 612 3604 WerFault.exe 389 4692 5728 WerFault.exe 394 4116 4152 WerFault.exe 399 3200 3876 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCLPRZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVBUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOUYOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ERF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CVYPIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZYSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMLAXRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YKMN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KEOJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOAPME.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBBOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCXSVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUSIJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSBQC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELJUJV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLZPXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTLPHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RKJNG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFONCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGGKH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DONJEGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QWBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKANZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELTADZG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFGZYAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_fe6b85d5d97cc40f09438f6c5277f3a2_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMZMOWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUTBC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWGYYV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFEHAZG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZGLV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 980 2026-08-10_fe6b85d5d97cc40f09438f6c5277f3a2_elex_emotet_stop.exe 980 2026-08-10_fe6b85d5d97cc40f09438f6c5277f3a2_elex_emotet_stop.exe 4736 KZR.exe 4736 KZR.exe 1828 DNKVQNK.exe 1828 DNKVQNK.exe 1764 FKQPY.exe 1764 FKQPY.exe 3848 GNU.exe 3848 GNU.exe 4524 PWWQG.exe 4524 PWWQG.exe 356 ERF.exe 356 ERF.exe 5032 WRHH.exe 5032 WRHH.exe 5088 LMZMOWI.exe 5088 LMZMOWI.exe 5052 SCALV.exe 5052 SCALV.exe 3488 TFEHAZG.exe 3488 TFEHAZG.exe 2904 ZGLV.exe 2904 ZGLV.exe 4860 DWSDDUW.exe 4860 DWSDDUW.exe 4132 LBWJGS.exe 4132 LBWJGS.exe 5764 UJYOR.exe 5764 UJYOR.exe 244 JZZOQL.exe 244 JZZOQL.exe 4288 NHO.exe 4288 NHO.exe 2116 DCXSVQ.exe 2116 DCXSVQ.exe 3004 JYXB.exe 3004 JYXB.exe 3364 NGDBEL.exe 3364 NGDBEL.exe 3264 WOF.exe 3264 WOF.exe 1276 GMLAXRB.exe 1276 GMLAXRB.exe 3724 KUSIJ.exe 3724 KUSIJ.exe 4984 KXVE.exe 4984 KXVE.exe 4108 FKANZ.exe 4108 FKANZ.exe 3232 AGFXBZC.exe 3232 AGFXBZC.exe 6064 EOMF.exe 6064 EOMF.exe 4180 TENWUF.exe 4180 TENWUF.exe 5492 DBARC.exe 5492 DBARC.exe 5836 QMJ.exe 5836 QMJ.exe 5140 QSJE.exe 5140 QSJE.exe 1412 LFONCL.exe 1412 LFONCL.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 980 2026-08-10_fe6b85d5d97cc40f09438f6c5277f3a2_elex_emotet_stop.exe 980 2026-08-10_fe6b85d5d97cc40f09438f6c5277f3a2_elex_emotet_stop.exe 4736 KZR.exe 4736 KZR.exe 1828 DNKVQNK.exe 1828 DNKVQNK.exe 1764 FKQPY.exe 1764 FKQPY.exe 3848 GNU.exe 3848 GNU.exe 4524 PWWQG.exe 4524 PWWQG.exe 356 ERF.exe 356 ERF.exe 5032 WRHH.exe 5032 WRHH.exe 5088 LMZMOWI.exe 5088 LMZMOWI.exe 5052 SCALV.exe 5052 SCALV.exe 3488 TFEHAZG.exe 3488 TFEHAZG.exe 2904 ZGLV.exe 2904 ZGLV.exe 4860 DWSDDUW.exe 4860 DWSDDUW.exe 4132 LBWJGS.exe 4132 LBWJGS.exe 5764 UJYOR.exe 5764 UJYOR.exe 244 JZZOQL.exe 244 JZZOQL.exe 4288 NHO.exe 4288 NHO.exe 2116 DCXSVQ.exe 2116 DCXSVQ.exe 3004 JYXB.exe 3004 JYXB.exe 3364 NGDBEL.exe 3364 NGDBEL.exe 3264 WOF.exe 3264 WOF.exe 1276 GMLAXRB.exe 1276 GMLAXRB.exe 3724 KUSIJ.exe 3724 KUSIJ.exe 4984 KXVE.exe 4984 KXVE.exe 4108 FKANZ.exe 4108 FKANZ.exe 3232 AGFXBZC.exe 3232 AGFXBZC.exe 6064 EOMF.exe 6064 EOMF.exe 4180 TENWUF.exe 4180 TENWUF.exe 5492 DBARC.exe 5492 DBARC.exe 5836 QMJ.exe 5836 QMJ.exe 5140 QSJE.exe 5140 QSJE.exe 1412 LFONCL.exe 1412 LFONCL.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 980 wrote to memory of 4168 980 2026-08-10_fe6b85d5d97cc40f09438f6c5277f3a2_elex_emotet_stop.exe 89 PID 4168 wrote to memory of 4736 4168 cmd.exe 93 PID 4736 wrote to memory of 4332 4736 KZR.exe 95 PID 4332 wrote to memory of 1828 4332 cmd.exe 99 PID 1828 wrote to memory of 1980 1828 DNKVQNK.exe 100 PID 1980 wrote to memory of 1764 1980 cmd.exe 104 PID 1764 wrote to memory of 384 1764 FKQPY.exe 105 PID 384 wrote to memory of 3848 384 cmd.exe 109 PID 3848 wrote to memory of 4540 3848 GNU.exe 110 PID 4540 wrote to memory of 4524 4540 cmd.exe 114 PID 4524 wrote to memory of 2672 4524 PWWQG.exe 115 PID 2672 wrote to memory of 356 2672 cmd.exe 119 PID 356 wrote to memory of 5760 356 ERF.exe 120 PID 5760 wrote to memory of 5032 5760 cmd.exe 124 PID 5032 wrote to memory of 1504 5032 WRHH.exe 125 PID 1504 wrote to memory of 5088 1504 cmd.exe 129 PID 5088 wrote to memory of 3532 5088 LMZMOWI.exe 130 PID 3532 wrote to memory of 5052 3532 cmd.exe 134 PID 5052 wrote to memory of 3328 5052 SCALV.exe 135 PID 3328 wrote to memory of 3488 3328 cmd.exe 139 PID 3488 wrote to memory of 5516 3488 TFEHAZG.exe 140 PID 5516 wrote to memory of 2904 5516 cmd.exe 144 PID 2904 wrote to memory of 3820 2904 ZGLV.exe 145 PID 3820 wrote to memory of 4860 3820 cmd.exe 149 PID 4860 wrote to memory of 5872 4860 DWSDDUW.exe 150 PID 5872 wrote to memory of 4132 5872 cmd.exe 154 PID 4132 wrote to memory of 5076 4132 LBWJGS.exe 155 PID 5076 wrote to memory of 5764 5076 cmd.exe 159 PID 5764 wrote to memory of 1768 5764 UJYOR.exe 160 PID 1768 wrote to memory of 244 1768 cmd.exe 164 PID 244 wrote to memory of 1096 244 JZZOQL.exe 165 PID 1096 wrote to memory of 4288 1096 cmd.exe 169 PID 4288 wrote to memory of 2012 4288 NHO.exe 170 PID 2012 wrote to memory of 2116 2012 cmd.exe 174 PID 2116 wrote to memory of 3088 2116 DCXSVQ.exe 175 PID 3088 wrote to memory of 3004 3088 cmd.exe 179 PID 3004 wrote to memory of 1596 3004 JYXB.exe 180 PID 1596 wrote to memory of 3364 1596 cmd.exe 184 PID 3364 wrote to memory of 820 3364 NGDBEL.exe 185 PID 820 wrote to memory of 3264 820 cmd.exe 189 PID 3264 wrote to memory of 5412 3264 WOF.exe 190 PID 5412 wrote to memory of 1276 5412 cmd.exe 194 PID 1276 wrote to memory of 1136 1276 GMLAXRB.exe 195 PID 1136 wrote to memory of 3724 1136 cmd.exe 199 PID 3724 wrote to memory of 3056 3724 KUSIJ.exe 200 PID 3056 wrote to memory of 4984 3056 cmd.exe 204 PID 4984 wrote to memory of 5372 4984 KXVE.exe 205 PID 5372 wrote to memory of 4108 5372 cmd.exe 209 PID 4108 wrote to memory of 4684 4108 FKANZ.exe 210 PID 4684 wrote to memory of 3232 4684 cmd.exe 214 PID 3232 wrote to memory of 5824 3232 AGFXBZC.exe 215 PID 5824 wrote to memory of 6064 5824 cmd.exe 219 PID 6064 wrote to memory of 4816 6064 EOMF.exe 220 PID 4816 wrote to memory of 4180 4816 cmd.exe 224 PID 4180 wrote to memory of 3596 4180 TENWUF.exe 225 PID 3596 wrote to memory of 5492 3596 cmd.exe 229 PID 5492 wrote to memory of 4596 5492 DBARC.exe 230 PID 4596 wrote to memory of 5836 4596 cmd.exe 234 PID 5836 wrote to memory of 4664 5836 QMJ.exe 235 PID 4664 wrote to memory of 5140 4664 cmd.exe 239 PID 5140 wrote to memory of 4224 5140 QSJE.exe 240 PID 4224 wrote to memory of 1412 4224 cmd.exe 244 PID 1412 wrote to memory of 3404 1412 LFONCL.exe 245 PID 3404 wrote to memory of 1092 3404 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_fe6b85d5d97cc40f09438f6c5277f3a2_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_fe6b85d5d97cc40f09438f6c5277f3a2_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KZR.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\windows\KZR.exeC:\windows\KZR.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNKVQNK.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\windows\system\DNKVQNK.exeC:\windows\system\DNKVQNK.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FKQPY.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\windows\system\FKQPY.exeC:\windows\system\FKQPY.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GNU.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:384 -
C:\windows\GNU.exeC:\windows\GNU.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PWWQG.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\windows\SysWOW64\PWWQG.exeC:\windows\system32\PWWQG.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ERF.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\windows\ERF.exeC:\windows\ERF.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WRHH.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\windows\WRHH.exeC:\windows\WRHH.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMZMOWI.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\windows\system\LMZMOWI.exeC:\windows\system\LMZMOWI.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SCALV.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\windows\SCALV.exeC:\windows\SCALV.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TFEHAZG.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\windows\TFEHAZG.exeC:\windows\TFEHAZG.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGLV.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\windows\ZGLV.exeC:\windows\ZGLV.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DWSDDUW.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\windows\system\DWSDDUW.exeC:\windows\system\DWSDDUW.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LBWJGS.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\windows\SysWOW64\LBWJGS.exeC:\windows\system32\LBWJGS.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UJYOR.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\windows\system\UJYOR.exeC:\windows\system\UJYOR.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JZZOQL.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\windows\system\JZZOQL.exeC:\windows\system\JZZOQL.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NHO.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\windows\NHO.exeC:\windows\NHO.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCXSVQ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\windows\SysWOW64\DCXSVQ.exeC:\windows\system32\DCXSVQ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JYXB.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\windows\JYXB.exeC:\windows\JYXB.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NGDBEL.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\windows\SysWOW64\NGDBEL.exeC:\windows\system32\NGDBEL.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WOF.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:820 -
C:\windows\WOF.exeC:\windows\WOF.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMLAXRB.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\windows\GMLAXRB.exeC:\windows\GMLAXRB.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUSIJ.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\windows\SysWOW64\KUSIJ.exeC:\windows\system32\KUSIJ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KXVE.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\windows\KXVE.exeC:\windows\KXVE.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FKANZ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\windows\FKANZ.exeC:\windows\FKANZ.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGFXBZC.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\windows\AGFXBZC.exeC:\windows\AGFXBZC.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EOMF.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\windows\system\EOMF.exeC:\windows\system\EOMF.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TENWUF.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\windows\TENWUF.exeC:\windows\TENWUF.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBARC.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\windows\SysWOW64\DBARC.exeC:\windows\system32\DBARC.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QMJ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\windows\QMJ.exeC:\windows\QMJ.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QSJE.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\windows\SysWOW64\QSJE.exeC:\windows\system32\QSJE.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LFONCL.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\windows\SysWOW64\LFONCL.exeC:\windows\system32\LFONCL.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NSS.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\windows\SysWOW64\NSS.exeC:\windows\system32\NSS.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIZXYVL.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5044 -
C:\windows\SysWOW64\RIZXYVL.exeC:\windows\system32\RIZXYVL.exe67⤵
- Executes dropped EXE
PID:2596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XJHKHXN.exe.bat" "68⤵PID:5284
-
C:\windows\system\XJHKHXN.exeC:\windows\system\XJHKHXN.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BRNSTQB.exe.bat" "70⤵PID:4568
-
C:\windows\system\BRNSTQB.exeC:\windows\system\BRNSTQB.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KZP.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2448 -
C:\windows\system\KZP.exeC:\windows\system\KZP.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LUTBC.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:5544 -
C:\windows\LUTBC.exeC:\windows\LUTBC.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PKABPVA.exe.bat" "76⤵PID:5260
-
C:\windows\system\PKABPVA.exeC:\windows\system\PKABPVA.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YLCGSB.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2344 -
C:\windows\SysWOW64\YLCGSB.exeC:\windows\system32\YLCGSB.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELJUJV.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4364 -
C:\windows\system\ELJUJV.exeC:\windows\system\ELJUJV.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYKI.exe.bat" "82⤵PID:2884
-
C:\windows\SysWOW64\EYKI.exeC:\windows\system32\EYKI.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMGSV.exe.bat" "84⤵PID:2428
-
C:\windows\HMGSV.exeC:\windows\HMGSV.exe85⤵
- Executes dropped EXE
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FBAV.exe.bat" "86⤵
- Executes a command shell one-liner
PID:1240 -
C:\windows\FBAV.exeC:\windows\FBAV.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUC.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4924 -
C:\windows\WUC.exeC:\windows\WUC.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ICJLD.exe.bat" "90⤵
- Executes a command shell one-liner
PID:1788 -
C:\windows\ICJLD.exeC:\windows\ICJLD.exe91⤵
- Executes dropped EXE
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GYIMZO.exe.bat" "92⤵PID:4432
-
C:\windows\system\GYIMZO.exeC:\windows\system\GYIMZO.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGP.exe.bat" "94⤵
- Executes a command shell one-liner
PID:2484 -
C:\windows\system\SGP.exeC:\windows\system\SGP.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FQF.exe.bat" "96⤵PID:3128
-
C:\windows\FQF.exeC:\windows\FQF.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGGKH.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1264 -
C:\windows\system\UGGKH.exeC:\windows\system\UGGKH.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IRPIV.exe.bat" "100⤵PID:2752
-
C:\windows\IRPIV.exeC:\windows\IRPIV.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MUN.exe.bat" "102⤵PID:1380
-
C:\windows\MUN.exeC:\windows\MUN.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WSBQC.exe.bat" "104⤵PID:4616
-
C:\windows\WSBQC.exeC:\windows\WSBQC.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFFZMJE.exe.bat" "106⤵PID:5404
-
C:\windows\system\QFFZMJE.exeC:\windows\system\QFFZMJE.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNMH.exe.bat" "108⤵PID:4608
-
C:\windows\system\UNMH.exeC:\windows\system\UNMH.exe109⤵
- Executes dropped EXE
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQQ.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2400 -
C:\windows\VQQ.exeC:\windows\VQQ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLZPXM.exe.bat" "112⤵
- Executes a command shell one-liner
PID:5480 -
C:\windows\system\CLZPXM.exeC:\windows\system\CLZPXM.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IHYQUPS.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3360 -
C:\windows\IHYQUPS.exeC:\windows\IHYQUPS.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XCIUN.exe.bat" "116⤵PID:5644
-
C:\windows\SysWOW64\XCIUN.exeC:\windows\system32\XCIUN.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YFMY.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5920 -
C:\windows\SysWOW64\YFMY.exeC:\windows\system32\YFMY.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YKMN.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:252 -
C:\windows\SysWOW64\YKMN.exeC:\windows\system32\YKMN.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-