Analysis
- max time kernel
74s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 18:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_c47fc27df9252b6fe3028ba9693445f2_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-12_c47fc27df9252b6fe3028ba9693445f2_elex_emotet_stop.exe
- Size 208KB
- Sample260812-xjfvrashlf
- SHA256 6d0e7d8e075edb30bf32d8443d65270cf3799dfbe6ba460bdc66b382ea8145d5
- MD5 c47fc27df9252b6fe3028ba9693445f2
- SHA1 e57d68d5cf20f65d662d591ba1383f6847d6921e
- SHA512 3938adb5d6f722aa9084b86f90a231c9d30408c0b0588e9db27666a83bd6986f97554ef522d02647f429e96fca31dd0d05fd3812dc550ee7a556f144ec7512a0
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfR4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOJQEjK
- TLSH T188247D2235D2C073E4B7023188F6C7787BB6BD919B36928B7BC03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4772 DNNEK.exe 3512 OQF.exe 5656 YOSSFPH.exe 4416 BJK.exe 4964 SUMKHOL.exe 2624 RUBPTFO.exe 5356 EABTVR.exe 5620 GYGND.exe 3396 ARW.exe 4424 RZKDH.exe 2256 ZEPKR.exe 692 HSBQU.exe 4340 BFI.exe 2744 JLN.exe 3040 BORZPEB.exe 5928 FWXZ.exe 4868 GZJCPM.exe 1632 RSRNYN.exe 4048 QAFLLE.exe 2060 HLIBT.exe 6108 PQVHE.exe 3588 IRCSO.exe 4324 NUI.exe 700 QCPVA.exe 5824 ZPTCK.exe 5004 BCLEW.exe 5956 TGRWEE.exe 1192 GIZN.exe 5460 QGNH.exe 5740 JJQLFO.exe 2760 RPVRQ.exe 4728 CFCRCWJ.exe 4696 BABAH.exe 5552 JGOHR.exe 2776 HDZ.exe 1840 GOKSNRY.exe 5672 QMPMU.exe 1880 OZO.exe 4492 QVG.exe 4148 TDGLR.exe 1940 NVW.exe 4636 EEKBV.exe 3308 XHOXBQM.exe 672 MXPWI.exe 204 ZZY.exe 5436 JXL.exe 4532 LVRCL.exe 1208 BLS.exe 1464 ZWDJAGY.exe 5764 EBNYQC.exe 3624 LROY.exe 6024 KCZ.exe 4756 DDGZPE.exe 252 WYKUU.exe 4872 RJA.exe 4412 DWZR.exe 3392 WPPC.exe 1616 VZRSGN.exe 460 XXFMVW.exe 2524 QYNXEW.exe 5568 PIXNN.exe 5036 YJRSRI.exe 916 QGRFHCI.exe 2188 JJVJNS.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\PIXNN.exe QYNXEW.exe File created C:\windows\SysWOW64\KKVEIA.exe RHJJDLY.exe File created C:\windows\SysWOW64\RZKDH.exe ARW.exe File opened for modification C:\windows\SysWOW64\RZKDH.exe ARW.exe File opened for modification C:\windows\SysWOW64\ZEPKR.exe RZKDH.exe File created C:\windows\SysWOW64\JJQLFO.exe.bat QGNH.exe File created C:\windows\SysWOW64\NVW.exe.bat TDGLR.exe File created C:\windows\SysWOW64\ZWDJAGY.exe BLS.exe File opened for modification C:\windows\SysWOW64\KKVEIA.exe RHJJDLY.exe File opened for modification C:\windows\SysWOW64\DSTM.exe VCS.exe File created C:\windows\SysWOW64\DNNEK.exe 2026-08-12_c47fc27df9252b6fe3028ba9693445f2_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\WLIX.exe DSTM.exe File created C:\windows\SysWOW64\XNZ.exe.bat YCWU.exe File opened for modification C:\windows\SysWOW64\JJQLFO.exe QGNH.exe File opened for modification C:\windows\SysWOW64\QMPMU.exe GOKSNRY.exe File created C:\windows\SysWOW64\PIXNN.exe QYNXEW.exe File created C:\windows\SysWOW64\EYG.exe WSC.exe File created C:\windows\SysWOW64\ZEPKR.exe RZKDH.exe File created C:\windows\SysWOW64\ZEPKR.exe.bat RZKDH.exe File created C:\windows\SysWOW64\JJQLFO.exe QGNH.exe File opened for modification C:\windows\SysWOW64\KCZ.exe LROY.exe File created C:\windows\SysWOW64\DWZR.exe.bat RJA.exe File created C:\windows\SysWOW64\DSTM.exe.bat VCS.exe File created C:\windows\SysWOW64\IRCSO.exe PQVHE.exe File created C:\windows\SysWOW64\QMPMU.exe.bat GOKSNRY.exe File opened for modification C:\windows\SysWOW64\SMX.exe VLVF.exe File created C:\windows\SysWOW64\RZKDH.exe.bat ARW.exe File created C:\windows\SysWOW64\KCZ.exe.bat LROY.exe File created C:\windows\SysWOW64\IRCSO.exe.bat PQVHE.exe File opened for modification C:\windows\SysWOW64\NVW.exe TDGLR.exe File created C:\windows\SysWOW64\GOKSNRY.exe HDZ.exe File created C:\windows\SysWOW64\KCZ.exe LROY.exe File created C:\windows\SysWOW64\SMX.exe.bat VLVF.exe File created C:\windows\SysWOW64\WLIX.exe.bat DSTM.exe File created C:\windows\SysWOW64\RUBPTFO.exe SUMKHOL.exe File created C:\windows\SysWOW64\KKVEIA.exe.bat RHJJDLY.exe File created C:\windows\SysWOW64\WLIX.exe DSTM.exe File created C:\windows\SysWOW64\OFRIC.exe ZPI.exe File opened for modification C:\windows\SysWOW64\IRCSO.exe PQVHE.exe File created C:\windows\SysWOW64\QMPMU.exe GOKSNRY.exe File created C:\windows\SysWOW64\VZRSGN.exe WPPC.exe File created C:\windows\SysWOW64\SMX.exe VLVF.exe File opened for modification C:\windows\SysWOW64\OFRIC.exe ZPI.exe File created C:\windows\SysWOW64\XNZ.exe YCWU.exe File opened for modification C:\windows\SysWOW64\XNZ.exe YCWU.exe File created C:\windows\SysWOW64\RUBPTFO.exe.bat SUMKHOL.exe File opened for modification C:\windows\SysWOW64\EYG.exe WSC.exe File created C:\windows\SysWOW64\EYG.exe.bat WSC.exe File created C:\windows\SysWOW64\DNNEK.exe.bat 2026-08-12_c47fc27df9252b6fe3028ba9693445f2_elex_emotet_stop.exe File created C:\windows\SysWOW64\GOKSNRY.exe.bat HDZ.exe File created C:\windows\SysWOW64\DWZR.exe RJA.exe File created C:\windows\SysWOW64\JJVJNS.exe QGRFHCI.exe File opened for modification C:\windows\SysWOW64\JJVJNS.exe QGRFHCI.exe File created C:\windows\SysWOW64\OFRIC.exe.bat ZPI.exe File created C:\windows\SysWOW64\JJVJNS.exe.bat QGRFHCI.exe File opened for modification C:\windows\SysWOW64\GOKSNRY.exe HDZ.exe File created C:\windows\SysWOW64\YOSSFPH.exe OQF.exe File opened for modification C:\windows\SysWOW64\YOSSFPH.exe OQF.exe File opened for modification C:\windows\SysWOW64\ZWDJAGY.exe BLS.exe File created C:\windows\SysWOW64\YOSSFPH.exe.bat OQF.exe File opened for modification C:\windows\SysWOW64\RUBPTFO.exe SUMKHOL.exe File created C:\windows\SysWOW64\ZWDJAGY.exe.bat BLS.exe File created C:\windows\SysWOW64\VZRSGN.exe.bat WPPC.exe File created C:\windows\SysWOW64\PIXNN.exe.bat QYNXEW.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\OGASIM.exe LYT.exe File created C:\windows\OQF.exe.bat DNNEK.exe File opened for modification C:\windows\BORZPEB.exe JLN.exe File opened for modification C:\windows\system\TDGLR.exe QVG.exe File created C:\windows\XXFMVW.exe.bat VZRSGN.exe File opened for modification C:\windows\QYNXEW.exe XXFMVW.exe File created C:\windows\VCS.exe WRPE.exe File opened for modification C:\windows\ZPI.exe RJDC.exe File created C:\windows\system\SUMKHOL.exe BJK.exe File created C:\windows\system\SUMKHOL.exe.bat BJK.exe File created C:\windows\BABAH.exe CFCRCWJ.exe File created C:\windows\system\MXPWI.exe.bat XHOXBQM.exe File created C:\windows\LVRCL.exe.bat JXL.exe File created C:\windows\LROY.exe.bat EBNYQC.exe File opened for modification C:\windows\WPPC.exe DWZR.exe File created C:\windows\WSC.exe KKVEIA.exe File opened for modification C:\windows\HSBQU.exe ZEPKR.exe File opened for modification C:\windows\system\BCLEW.exe ZPTCK.exe File created C:\windows\WPPC.exe.bat DWZR.exe File created C:\windows\system\HUYZV.exe JJVJNS.exe File opened for modification C:\windows\system\HUYZV.exe JJVJNS.exe File created C:\windows\system\LYT.exe.bat VISTP.exe File created C:\windows\WSC.exe.bat KKVEIA.exe File opened for modification C:\windows\VLVF.exe MLT.exe File created C:\windows\OQF.exe DNNEK.exe File created C:\windows\HSBQU.exe ZEPKR.exe File created C:\windows\system\QCPVA.exe NUI.exe File created C:\windows\system\BLS.exe LVRCL.exe File created C:\windows\system\QGRFHCI.exe YJRSRI.exe File opened for modification C:\windows\system\QGRFHCI.exe YJRSRI.exe File created C:\windows\system\HUYZV.exe.bat JJVJNS.exe File opened for modification C:\windows\WSC.exe KKVEIA.exe File created C:\windows\system\BLS.exe.bat LVRCL.exe File created C:\windows\EABTVR.exe.bat RUBPTFO.exe File created C:\windows\LROY.exe EBNYQC.exe File created C:\windows\ZPI.exe.bat RJDC.exe File created C:\windows\EABTVR.exe RUBPTFO.exe File opened for modification C:\windows\TGRWEE.exe BCLEW.exe File created C:\windows\system\RPVRQ.exe.bat JJQLFO.exe File created C:\windows\OZO.exe.bat QMPMU.exe File created C:\windows\EBNYQC.exe ZWDJAGY.exe File created C:\windows\YJRSRI.exe.bat PIXNN.exe File created C:\windows\VLVF.exe.bat MLT.exe File created C:\windows\VCS.exe.bat WRPE.exe File opened for modification C:\windows\BJK.exe YOSSFPH.exe File created C:\windows\OGASIM.exe.bat LYT.exe File created C:\windows\JXL.exe ZZY.exe File created C:\windows\BFI.exe HSBQU.exe File opened for modification C:\windows\BABAH.exe CFCRCWJ.exe File opened for modification C:\windows\system\JGOHR.exe BABAH.exe File created C:\windows\WPPC.exe DWZR.exe File opened for modification C:\windows\VCS.exe WRPE.exe File opened for modification C:\windows\system\SUMKHOL.exe BJK.exe File created C:\windows\system\ARW.exe.bat GYGND.exe File created C:\windows\system\RSRNYN.exe GZJCPM.exe File opened for modification C:\windows\NUI.exe IRCSO.exe File created C:\windows\BABAH.exe.bat CFCRCWJ.exe File created C:\windows\JXL.exe.bat ZZY.exe File opened for modification C:\windows\system\IXCUJWH.exe HUYZV.exe File opened for modification C:\windows\system\VISTP.exe IXCUJWH.exe File created C:\windows\BJK.exe YOSSFPH.exe File opened for modification C:\windows\system\EEKBV.exe NVW.exe File opened for modification C:\windows\XXFMVW.exe VZRSGN.exe File created C:\windows\system\EWBK.exe OGASIM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4452 cmd.exe 4836 cmd.exe 4192 cmd.exe 2032 cmd.exe 1908 cmd.exe 3008 cmd.exe 1248 cmd.exe 1232 cmd.exe 124 cmd.exe 5668 cmd.exe 5368 cmd.exe 1384 cmd.exe 1752 cmd.exe 3140 cmd.exe 2928 cmd.exe 4592 cmd.exe 5664 cmd.exe 4752 cmd.exe 2104 cmd.exe 5228 cmd.exe 5692 cmd.exe 4612 cmd.exe 1088 cmd.exe 1312 cmd.exe 5068 cmd.exe 5456 cmd.exe 1380 cmd.exe 5616 cmd.exe 1904 cmd.exe 4552 cmd.exe 1412 cmd.exe 5100 cmd.exe 1788 cmd.exe 2520 cmd.exe 4892 cmd.exe 4624 cmd.exe 1132 cmd.exe 4768 cmd.exe 2488 cmd.exe 4456 cmd.exe 3572 cmd.exe 1724 cmd.exe 3348 cmd.exe 1644 cmd.exe 5916 cmd.exe 4584 cmd.exe 4556 cmd.exe 2380 cmd.exe 2480 cmd.exe 3652 cmd.exe 3012 cmd.exe 2764 cmd.exe 4488 cmd.exe 2688 cmd.exe 5904 cmd.exe 1740 cmd.exe 1256 cmd.exe 4368 cmd.exe 5800 cmd.exe 6012 cmd.exe 3320 cmd.exe 2192 cmd.exe 5816 cmd.exe 2648 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2220 1900 WerFault.exe 88 2884 4772 WerFault.exe 93 5512 3512 WerFault.exe 99 5864 5656 WerFault.exe 104 2056 4416 WerFault.exe 108 2504 4964 WerFault.exe 114 4672 2624 WerFault.exe 119 4492 5356 WerFault.exe 124 2916 5620 WerFault.exe 129 4112 3396 WerFault.exe 134 4344 4424 WerFault.exe 139 5988 2256 WerFault.exe 144 256 692 WerFault.exe 149 1104 4340 WerFault.exe 154 3944 2744 WerFault.exe 159 1744 3040 WerFault.exe 163 2468 5928 WerFault.exe 169 1084 4868 WerFault.exe 174 2496 1632 WerFault.exe 179 6100 4048 WerFault.exe 184 1912 2060 WerFault.exe 189 5288 6108 WerFault.exe 194 4696 3588 WerFault.exe 198 4244 4324 WerFault.exe 204 2888 700 WerFault.exe 209 1132 5824 WerFault.exe 214 2560 5004 WerFault.exe 219 2860 5956 WerFault.exe 224 1608 1192 WerFault.exe 229 1464 5460 WerFault.exe 234 4628 5740 WerFault.exe 239 2228 2760 WerFault.exe 244 1092 4728 WerFault.exe 249 4244 4696 WerFault.exe 254 3448 5552 WerFault.exe 259 4760 2776 WerFault.exe 265 4332 1840 WerFault.exe 270 5604 5672 WerFault.exe 275 4052 1880 WerFault.exe 280 1504 4492 WerFault.exe 285 1100 4148 WerFault.exe 290 1740 1940 WerFault.exe 295 3228 4636 WerFault.exe 300 1856 3308 WerFault.exe 305 3892 672 WerFault.exe 310 5864 204 WerFault.exe 315 616 5436 WerFault.exe 320 2764 4532 WerFault.exe 325 5704 1208 WerFault.exe 330 1272 1464 WerFault.exe 335 3304 5764 WerFault.exe 340 4136 3624 WerFault.exe 345 5564 6024 WerFault.exe 350 2632 4756 WerFault.exe 355 4760 252 WerFault.exe 360 1128 4872 WerFault.exe 365 4188 4412 WerFault.exe 370 4748 3392 WerFault.exe 375 1284 1616 WerFault.exe 380 5548 460 WerFault.exe 385 2584 2524 WerFault.exe 390 3644 5568 WerFault.exe 395 1096 5036 WerFault.exe 400 5276 916 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCPVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BORZPEB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RJDC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QAFLLE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPTCK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_c47fc27df9252b6fe3028ba9693445f2_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HSBQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLIBT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYNXEW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IRCSO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCLEW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TDGLR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIXNN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUYZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOSSFPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LROY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUBPTFO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQVHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGASIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGRFHCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXCUJWH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1900 2026-08-12_c47fc27df9252b6fe3028ba9693445f2_elex_emotet_stop.exe 1900 2026-08-12_c47fc27df9252b6fe3028ba9693445f2_elex_emotet_stop.exe 4772 DNNEK.exe 4772 DNNEK.exe 3512 OQF.exe 3512 OQF.exe 5656 YOSSFPH.exe 5656 YOSSFPH.exe 4416 BJK.exe 4416 BJK.exe 4964 SUMKHOL.exe 4964 SUMKHOL.exe 2624 RUBPTFO.exe 2624 RUBPTFO.exe 5356 EABTVR.exe 5356 EABTVR.exe 5620 GYGND.exe 5620 GYGND.exe 3396 ARW.exe 3396 ARW.exe 4424 RZKDH.exe 4424 RZKDH.exe 2256 ZEPKR.exe 2256 ZEPKR.exe 692 HSBQU.exe 692 HSBQU.exe 4340 BFI.exe 4340 BFI.exe 2744 JLN.exe 2744 JLN.exe 3040 BORZPEB.exe 3040 BORZPEB.exe 5928 FWXZ.exe 5928 FWXZ.exe 4868 GZJCPM.exe 4868 GZJCPM.exe 1632 RSRNYN.exe 1632 RSRNYN.exe 4048 QAFLLE.exe 4048 QAFLLE.exe 2060 HLIBT.exe 2060 HLIBT.exe 6108 PQVHE.exe 6108 PQVHE.exe 3588 IRCSO.exe 3588 IRCSO.exe 4324 NUI.exe 4324 NUI.exe 700 QCPVA.exe 700 QCPVA.exe 5824 ZPTCK.exe 5824 ZPTCK.exe 5004 BCLEW.exe 5004 BCLEW.exe 5956 TGRWEE.exe 5956 TGRWEE.exe 1192 GIZN.exe 1192 GIZN.exe 5460 QGNH.exe 5460 QGNH.exe 5740 JJQLFO.exe 5740 JJQLFO.exe 2760 RPVRQ.exe 2760 RPVRQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1900 2026-08-12_c47fc27df9252b6fe3028ba9693445f2_elex_emotet_stop.exe 1900 2026-08-12_c47fc27df9252b6fe3028ba9693445f2_elex_emotet_stop.exe 4772 DNNEK.exe 4772 DNNEK.exe 3512 OQF.exe 3512 OQF.exe 5656 YOSSFPH.exe 5656 YOSSFPH.exe 4416 BJK.exe 4416 BJK.exe 4964 SUMKHOL.exe 4964 SUMKHOL.exe 2624 RUBPTFO.exe 2624 RUBPTFO.exe 5356 EABTVR.exe 5356 EABTVR.exe 5620 GYGND.exe 5620 GYGND.exe 3396 ARW.exe 3396 ARW.exe 4424 RZKDH.exe 4424 RZKDH.exe 2256 ZEPKR.exe 2256 ZEPKR.exe 692 HSBQU.exe 692 HSBQU.exe 4340 BFI.exe 4340 BFI.exe 2744 JLN.exe 2744 JLN.exe 3040 BORZPEB.exe 3040 BORZPEB.exe 5928 FWXZ.exe 5928 FWXZ.exe 4868 GZJCPM.exe 4868 GZJCPM.exe 1632 RSRNYN.exe 1632 RSRNYN.exe 4048 QAFLLE.exe 4048 QAFLLE.exe 2060 HLIBT.exe 2060 HLIBT.exe 6108 PQVHE.exe 6108 PQVHE.exe 3588 IRCSO.exe 3588 IRCSO.exe 4324 NUI.exe 4324 NUI.exe 700 QCPVA.exe 700 QCPVA.exe 5824 ZPTCK.exe 5824 ZPTCK.exe 5004 BCLEW.exe 5004 BCLEW.exe 5956 TGRWEE.exe 5956 TGRWEE.exe 1192 GIZN.exe 1192 GIZN.exe 5460 QGNH.exe 5460 QGNH.exe 5740 JJQLFO.exe 5740 JJQLFO.exe 2760 RPVRQ.exe 2760 RPVRQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 5692 1900 2026-08-12_c47fc27df9252b6fe3028ba9693445f2_elex_emotet_stop.exe 89 PID 5692 wrote to memory of 4772 5692 cmd.exe 93 PID 4772 wrote to memory of 1752 4772 DNNEK.exe 95 PID 1752 wrote to memory of 3512 1752 cmd.exe 99 PID 3512 wrote to memory of 5600 3512 OQF.exe 100 PID 5600 wrote to memory of 5656 5600 cmd.exe 104 PID 5656 wrote to memory of 3648 5656 YOSSFPH.exe 105 PID 3648 wrote to memory of 4416 3648 cmd.exe 108 PID 4416 wrote to memory of 1644 4416 BJK.exe 110 PID 1644 wrote to memory of 4964 1644 cmd.exe 114 PID 4964 wrote to memory of 6092 4964 SUMKHOL.exe 115 PID 6092 wrote to memory of 2624 6092 cmd.exe 119 PID 2624 wrote to memory of 2828 2624 RUBPTFO.exe 120 PID 2828 wrote to memory of 5356 2828 cmd.exe 124 PID 5356 wrote to memory of 3600 5356 EABTVR.exe 125 PID 3600 wrote to memory of 5620 3600 cmd.exe 129 PID 5620 wrote to memory of 2032 5620 GYGND.exe 130 PID 2032 wrote to memory of 3396 2032 cmd.exe 134 PID 3396 wrote to memory of 1296 3396 ARW.exe 135 PID 1296 wrote to memory of 4424 1296 cmd.exe 139 PID 4424 wrote to memory of 1560 4424 RZKDH.exe 140 PID 1560 wrote to memory of 2256 1560 cmd.exe 144 PID 2256 wrote to memory of 2340 2256 ZEPKR.exe 145 PID 2340 wrote to memory of 692 2340 cmd.exe 149 PID 692 wrote to memory of 4856 692 HSBQU.exe 150 PID 4856 wrote to memory of 4340 4856 cmd.exe 154 PID 4340 wrote to memory of 4716 4340 BFI.exe 155 PID 4716 wrote to memory of 2744 4716 cmd.exe 159 PID 2744 wrote to memory of 5984 2744 JLN.exe 160 PID 5984 wrote to memory of 3040 5984 cmd.exe 163 PID 3040 wrote to memory of 3320 3040 BORZPEB.exe 165 PID 3320 wrote to memory of 5928 3320 cmd.exe 169 PID 5928 wrote to memory of 1844 5928 FWXZ.exe 170 PID 1844 wrote to memory of 4868 1844 cmd.exe 174 PID 4868 wrote to memory of 5284 4868 GZJCPM.exe 175 PID 5284 wrote to memory of 1632 5284 cmd.exe 179 PID 1632 wrote to memory of 2000 1632 RSRNYN.exe 180 PID 2000 wrote to memory of 4048 2000 cmd.exe 184 PID 4048 wrote to memory of 5164 4048 QAFLLE.exe 185 PID 5164 wrote to memory of 2060 5164 cmd.exe 189 PID 2060 wrote to memory of 4612 2060 HLIBT.exe 190 PID 4612 wrote to memory of 6108 4612 cmd.exe 194 PID 6108 wrote to memory of 5100 6108 PQVHE.exe 195 PID 5100 wrote to memory of 3588 5100 cmd.exe 198 PID 3588 wrote to memory of 4644 3588 IRCSO.exe 200 PID 4644 wrote to memory of 4324 4644 cmd.exe 204 PID 4324 wrote to memory of 2728 4324 NUI.exe 205 PID 2728 wrote to memory of 700 2728 cmd.exe 209 PID 700 wrote to memory of 828 700 QCPVA.exe 210 PID 828 wrote to memory of 5824 828 cmd.exe 214 PID 5824 wrote to memory of 2556 5824 ZPTCK.exe 215 PID 2556 wrote to memory of 5004 2556 cmd.exe 219 PID 5004 wrote to memory of 1996 5004 BCLEW.exe 220 PID 1996 wrote to memory of 5956 1996 cmd.exe 224 PID 5956 wrote to memory of 4316 5956 TGRWEE.exe 225 PID 4316 wrote to memory of 1192 4316 cmd.exe 229 PID 1192 wrote to memory of 4456 1192 GIZN.exe 230 PID 4456 wrote to memory of 5460 4456 cmd.exe 234 PID 5460 wrote to memory of 5668 5460 QGNH.exe 235 PID 5668 wrote to memory of 5740 5668 cmd.exe 239 PID 5740 wrote to memory of 3144 5740 JJQLFO.exe 240 PID 3144 wrote to memory of 2760 3144 cmd.exe 244 PID 2760 wrote to memory of 1788 2760 RPVRQ.exe 245 PID 1788 wrote to memory of 4728 1788 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_c47fc27df9252b6fe3028ba9693445f2_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_c47fc27df9252b6fe3028ba9693445f2_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DNNEK.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\windows\SysWOW64\DNNEK.exeC:\windows\system32\DNNEK.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQF.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\windows\OQF.exeC:\windows\OQF.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YOSSFPH.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\windows\SysWOW64\YOSSFPH.exeC:\windows\system32\YOSSFPH.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BJK.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\windows\BJK.exeC:\windows\BJK.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SUMKHOL.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\windows\system\SUMKHOL.exeC:\windows\system\SUMKHOL.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUBPTFO.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\windows\SysWOW64\RUBPTFO.exeC:\windows\system32\RUBPTFO.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EABTVR.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\windows\EABTVR.exeC:\windows\EABTVR.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYGND.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\windows\GYGND.exeC:\windows\GYGND.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ARW.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\windows\system\ARW.exeC:\windows\system\ARW.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RZKDH.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\windows\SysWOW64\RZKDH.exeC:\windows\system32\RZKDH.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZEPKR.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\windows\SysWOW64\ZEPKR.exeC:\windows\system32\ZEPKR.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HSBQU.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\windows\HSBQU.exeC:\windows\HSBQU.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BFI.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\windows\BFI.exeC:\windows\BFI.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLN.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\windows\JLN.exeC:\windows\JLN.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BORZPEB.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\windows\BORZPEB.exeC:\windows\BORZPEB.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWXZ.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\windows\FWXZ.exeC:\windows\FWXZ.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZJCPM.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\windows\GZJCPM.exeC:\windows\GZJCPM.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSRNYN.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\windows\system\RSRNYN.exeC:\windows\system\RSRNYN.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QAFLLE.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\windows\QAFLLE.exeC:\windows\QAFLLE.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLIBT.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\windows\HLIBT.exeC:\windows\HLIBT.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQVHE.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\windows\system\PQVHE.exeC:\windows\system\PQVHE.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IRCSO.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\windows\SysWOW64\IRCSO.exeC:\windows\system32\IRCSO.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NUI.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\windows\NUI.exeC:\windows\NUI.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QCPVA.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\windows\system\QCPVA.exeC:\windows\system\QCPVA.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPTCK.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:828 -
C:\windows\ZPTCK.exeC:\windows\ZPTCK.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BCLEW.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\windows\system\BCLEW.exeC:\windows\system\BCLEW.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TGRWEE.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\windows\TGRWEE.exeC:\windows\TGRWEE.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIZN.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\windows\GIZN.exeC:\windows\GIZN.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGNH.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\windows\QGNH.exeC:\windows\QGNH.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JJQLFO.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\windows\SysWOW64\JJQLFO.exeC:\windows\system32\JJQLFO.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPVRQ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\windows\system\RPVRQ.exeC:\windows\system\RPVRQ.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CFCRCWJ.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\windows\SysWOW64\CFCRCWJ.exeC:\windows\system32\CFCRCWJ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BABAH.exe.bat" "66⤵PID:2336
-
C:\windows\BABAH.exeC:\windows\BABAH.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JGOHR.exe.bat" "68⤵
- Executes a command shell one-liner
PID:1088 -
C:\windows\system\JGOHR.exeC:\windows\system\JGOHR.exe69⤵
- Executes dropped EXE
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HDZ.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3572 -
C:\windows\HDZ.exeC:\windows\HDZ.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GOKSNRY.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2688 -
C:\windows\SysWOW64\GOKSNRY.exeC:\windows\system32\GOKSNRY.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QMPMU.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:2560 -
C:\windows\SysWOW64\QMPMU.exeC:\windows\system32\QMPMU.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OZO.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5916 -
C:\windows\OZO.exeC:\windows\OZO.exe77⤵
- Executes dropped EXE
PID:1880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVG.exe.bat" "78⤵PID:4516
-
C:\windows\QVG.exeC:\windows\QVG.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDGLR.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:5540 -
C:\windows\system\TDGLR.exeC:\windows\system\TDGLR.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVW.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:2916 -
C:\windows\SysWOW64\NVW.exeC:\windows\system32\NVW.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EEKBV.exe.bat" "84⤵
- Executes a command shell one-liner
PID:5368 -
C:\windows\system\EEKBV.exeC:\windows\system\EEKBV.exe85⤵
- Executes dropped EXE
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHOXBQM.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3140 -
C:\windows\XHOXBQM.exeC:\windows\XHOXBQM.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXPWI.exe.bat" "88⤵PID:5716
-
C:\windows\system\MXPWI.exeC:\windows\system\MXPWI.exe89⤵
- Executes dropped EXE
PID:672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZY.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:3680 -
C:\windows\system\ZZY.exeC:\windows\system\ZZY.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXL.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:5244 -
C:\windows\JXL.exeC:\windows\JXL.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LVRCL.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:2468 -
C:\windows\LVRCL.exeC:\windows\LVRCL.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BLS.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5904 -
C:\windows\system\BLS.exeC:\windows\system\BLS.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZWDJAGY.exe.bat" "98⤵PID:4676
-
C:\windows\SysWOW64\ZWDJAGY.exeC:\windows\system32\ZWDJAGY.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EBNYQC.exe.bat" "100⤵
- Executes a command shell one-liner
PID:1232 -
C:\windows\EBNYQC.exeC:\windows\EBNYQC.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LROY.exe.bat" "102⤵PID:4560
-
C:\windows\LROY.exeC:\windows\LROY.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KCZ.exe.bat" "104⤵PID:4356
-
C:\windows\SysWOW64\KCZ.exeC:\windows\system32\KCZ.exe105⤵
- Executes dropped EXE
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDGZPE.exe.bat" "106⤵PID:2080
-
C:\windows\system\DDGZPE.exeC:\windows\system\DDGZPE.exe107⤵
- Executes dropped EXE
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WYKUU.exe.bat" "108⤵
- Executes a command shell one-liner
PID:124 -
C:\windows\WYKUU.exeC:\windows\WYKUU.exe109⤵
- Executes dropped EXE
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RJA.exe.bat" "110⤵PID:5980
-
C:\windows\system\RJA.exeC:\windows\system\RJA.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DWZR.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:5360 -
C:\windows\SysWOW64\DWZR.exeC:\windows\system32\DWZR.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPPC.exe.bat" "114⤵PID:1060
-
C:\windows\WPPC.exeC:\windows\WPPC.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZRSGN.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:1364 -
C:\windows\SysWOW64\VZRSGN.exeC:\windows\system32\VZRSGN.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XXFMVW.exe.bat" "118⤵PID:5504
-
C:\windows\XXFMVW.exeC:\windows\XXFMVW.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYNXEW.exe.bat" "120⤵PID:2148
-
C:\windows\QYNXEW.exeC:\windows\QYNXEW.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-