Analysis
- max time kernel
86s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 16:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-13_0d783f6eff9c68fc68bda2d4c3f015b9_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-13_0d783f6eff9c68fc68bda2d4c3f015b9_elex_emotet_stop.exe
- Size 208KB
- Sample260813-vfg8asvbna
- SHA256 0d0ff9492eb3d797d6a073ff9e1a3c327848bf4d04310bc17a77ad5abffbf6ba
- MD5 0d783f6eff9c68fc68bda2d4c3f015b9
- SHA1 6718b0ce8435c3f436363cc3d30bdaeb7569699e
- SHA512 69f4b28e4a0be90da8422b562ee8ca44594f45e91115db38f6cfe906c457919fd3e8532547f160d7a475e0f5cdf78c45a92a5aff31188684fe94a3b76c9bf648
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOf74NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOjQEj1
- TLSH T104247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4944 WFKV.exe 2428 ZOGKGRM.exe 5308 VTY.exe 2608 EZQO.exe 5452 RJGELCX.exe 3452 PUJUUQ.exe 4860 ZCLZYNV.exe 4520 DLSH.exe 1756 YVAY.exe 3476 CYGTYBP.exe 5616 RTQYJ.exe 3856 RHIMKB.exe 4812 MUN.exe 980 KKGYIO.exe 1472 CSIDTLR.exe 1144 YLKGXQA.exe 4308 AJYAEY.exe 2796 QMHM.exe 1660 KZMWAK.exe 5404 APNN.exe 4888 KNSIWOW.exe 3980 IYVYWU.exe 2856 MGK.exe 1544 UTO.exe 4752 YBVMF.exe 2580 IZJH.exe 904 CMUXBZV.exe 3096 PSUJD.exe 6008 ENM.exe 4560 OWGAZDH.exe 4216 YTTM.exe 5660 GZYB.exe 1844 PHAGVHO.exe 3668 KKQXJ.exe 936 USSKNP.exe 1776 JNCO.exe 4268 PJBPCFJ.exe 2560 TRHX.exe 1052 CZJCSD.exe 4968 OHQ.exe 3636 DCAOXI.exe 3332 WFDKD.exe 2496 FFFPGV.exe 2568 IBK.exe 1080 AWOCW.exe 988 SECAJ.exe 3916 QPFQ.exe 3728 CHIIZ.exe 2448 MFODH.exe 1780 VSYVX.exe 5900 BOX.exe 3860 VBCFE.exe 5252 NONXTC.exe 5260 NUNLVP.exe 2812 FXRPI.exe 728 USA.exe 3028 MSCZX.exe 5316 GOHIHX.exe 4368 UQPH.exe 5892 UEQVX.exe 4856 GMWV.exe 4876 PUYINC.exe 2096 EPIN.exe 2792 KDHN.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\CSIDTLR.exe KKGYIO.exe File created C:\windows\SysWOW64\OWGAZDH.exe.bat ENM.exe File created C:\windows\SysWOW64\USA.exe FXRPI.exe File opened for modification C:\windows\SysWOW64\GOHIHX.exe MSCZX.exe File created C:\windows\SysWOW64\UQPH.exe.bat GOHIHX.exe File opened for modification C:\windows\SysWOW64\SEMGKO.exe PWEJD.exe File created C:\windows\SysWOW64\CYGTYBP.exe.bat YVAY.exe File created C:\windows\SysWOW64\KNSIWOW.exe.bat APNN.exe File created C:\windows\SysWOW64\IYVYWU.exe.bat KNSIWOW.exe File created C:\windows\SysWOW64\MGK.exe IYVYWU.exe File created C:\windows\SysWOW64\QPFQ.exe.bat SECAJ.exe File created C:\windows\SysWOW64\TCS.exe SEMGKO.exe File opened for modification C:\windows\SysWOW64\DZG.exe TCS.exe File created C:\windows\SysWOW64\DZG.exe.bat TCS.exe File created C:\windows\SysWOW64\PFPJ.exe.bat CUZL.exe File created C:\windows\SysWOW64\DVTGLJ.exe ZNM.exe File opened for modification C:\windows\SysWOW64\CSIDTLR.exe KKGYIO.exe File created C:\windows\SysWOW64\IYVYWU.exe KNSIWOW.exe File created C:\windows\SysWOW64\PFPJ.exe CUZL.exe File opened for modification C:\windows\SysWOW64\SPXJN.exe UEUTEZ.exe File created C:\windows\SysWOW64\YVAY.exe DLSH.exe File created C:\windows\SysWOW64\YVAY.exe.bat DLSH.exe File opened for modification C:\windows\SysWOW64\CYGTYBP.exe YVAY.exe File created C:\windows\SysWOW64\UQPH.exe GOHIHX.exe File created C:\windows\SysWOW64\PUYINC.exe.bat GMWV.exe File created C:\windows\SysWOW64\DZG.exe TCS.exe File created C:\windows\SysWOW64\OPHI.exe.bat ERBOOR.exe File created C:\windows\SysWOW64\APNN.exe.bat KZMWAK.exe File opened for modification C:\windows\SysWOW64\ZDVVNL.exe PFPJ.exe File opened for modification C:\windows\SysWOW64\MBVHPPA.exe ZDVVNL.exe File opened for modification C:\windows\SysWOW64\SQISQOS.exe RNEPK.exe File opened for modification C:\windows\SysWOW64\ZNM.exe VCOLZ.exe File created C:\windows\SysWOW64\WFKV.exe.bat 2026-08-13_0d783f6eff9c68fc68bda2d4c3f015b9_elex_emotet_stop.exe File created C:\windows\SysWOW64\CYGTYBP.exe YVAY.exe File created C:\windows\SysWOW64\KZMWAK.exe.bat QMHM.exe File created C:\windows\SysWOW64\UTO.exe MGK.exe File opened for modification C:\windows\SysWOW64\CHIIZ.exe QPFQ.exe File opened for modification C:\windows\SysWOW64\PUYINC.exe GMWV.exe File opened for modification C:\windows\SysWOW64\TCS.exe SEMGKO.exe File opened for modification C:\windows\SysWOW64\UTO.exe MGK.exe File created C:\windows\SysWOW64\UTO.exe.bat MGK.exe File created C:\windows\SysWOW64\OWGAZDH.exe ENM.exe File opened for modification C:\windows\SysWOW64\OWGAZDH.exe ENM.exe File created C:\windows\SysWOW64\CHIIZ.exe.bat QPFQ.exe File opened for modification C:\windows\SysWOW64\USA.exe FXRPI.exe File created C:\windows\SysWOW64\GOHIHX.exe MSCZX.exe File created C:\windows\SysWOW64\SEMGKO.exe PWEJD.exe File created C:\windows\SysWOW64\APNN.exe KZMWAK.exe File created C:\windows\SysWOW64\GOHIHX.exe.bat MSCZX.exe File created C:\windows\SysWOW64\SQISQOS.exe.bat RNEPK.exe File opened for modification C:\windows\SysWOW64\OPHI.exe ERBOOR.exe File created C:\windows\SysWOW64\DVTGLJ.exe.bat ZNM.exe File created C:\windows\SysWOW64\CSIDTLR.exe.bat KKGYIO.exe File opened for modification C:\windows\SysWOW64\KZMWAK.exe QMHM.exe File opened for modification C:\windows\SysWOW64\APNN.exe KZMWAK.exe File opened for modification C:\windows\SysWOW64\KNSIWOW.exe APNN.exe File opened for modification C:\windows\SysWOW64\QPFQ.exe SECAJ.exe File created C:\windows\SysWOW64\CHIIZ.exe QPFQ.exe File opened for modification C:\windows\SysWOW64\UQPH.exe GOHIHX.exe File created C:\windows\SysWOW64\SQISQOS.exe RNEPK.exe File created C:\windows\SysWOW64\WFKV.exe 2026-08-13_0d783f6eff9c68fc68bda2d4c3f015b9_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\IYVYWU.exe KNSIWOW.exe File opened for modification C:\windows\SysWOW64\MGK.exe IYVYWU.exe File created C:\windows\SysWOW64\SEMGKO.exe.bat PWEJD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\YTTM.exe OWGAZDH.exe File created C:\windows\BOX.exe.bat VSYVX.exe File created C:\windows\UUMT.exe.bat AZI.exe File opened for modification C:\windows\EVOYLD.exe UUMT.exe File created C:\windows\PUJUUQ.exe.bat RJGELCX.exe File created C:\windows\MFODH.exe.bat CHIIZ.exe File opened for modification C:\windows\system\ZOGKGRM.exe WFKV.exe File opened for modification C:\windows\system\UEQVX.exe UQPH.exe File created C:\windows\EPIN.exe.bat PUYINC.exe File created C:\windows\VSYVX.exe.bat MFODH.exe File created C:\windows\system\PWEJD.exe FYYPW.exe File opened for modification C:\windows\PVRBW.exe FXLHO.exe File created C:\windows\system\PSUJD.exe CMUXBZV.exe File created C:\windows\system\PJBPCFJ.exe JNCO.exe File opened for modification C:\windows\system\NONXTC.exe VBCFE.exe File created C:\windows\PVRBW.exe FXLHO.exe File created C:\windows\RNEPK.exe XAZ.exe File opened for modification C:\windows\BAPH.exe OPHI.exe File created C:\windows\system\SAB.exe.bat RFXW.exe File created C:\windows\ZCLZYNV.exe.bat PUJUUQ.exe File created C:\windows\PHAGVHO.exe.bat GZYB.exe File opened for modification C:\windows\AWOCW.exe IBK.exe File opened for modification C:\windows\system\VBCFE.exe BOX.exe File created C:\windows\system\FBYREZN.exe SQISQOS.exe File opened for modification C:\windows\ERBOOR.exe FGRGFLI.exe File opened for modification C:\windows\JNCO.exe USSKNP.exe File opened for modification C:\windows\system\FBYREZN.exe SQISQOS.exe File opened for modification C:\windows\system\SAB.exe RFXW.exe File created C:\windows\EVOYLD.exe UUMT.exe File created C:\windows\ENM.exe.bat PSUJD.exe File created C:\windows\system\KDHN.exe EPIN.exe File created C:\windows\JUNLGX.exe.bat LYOKC.exe File opened for modification C:\windows\system\USSKNP.exe KKQXJ.exe File opened for modification C:\windows\VSYVX.exe MFODH.exe File opened for modification C:\windows\ZCLZYNV.exe PUJUUQ.exe File opened for modification C:\windows\system\IZJH.exe YBVMF.exe File created C:\windows\BOX.exe VSYVX.exe File created C:\windows\system\XAZ.exe LHS.exe File created C:\windows\system\MGHLGO.exe IDJ.exe File created C:\windows\system\MGHLGO.exe.bat IDJ.exe File created C:\windows\system\TRHX.exe PJBPCFJ.exe File opened for modification C:\windows\system\PWEJD.exe FYYPW.exe File created C:\windows\VEROYOC.exe HYJC.exe File created C:\windows\system\CUZL.exe DKWUIMY.exe File created C:\windows\system\FBYREZN.exe.bat SQISQOS.exe File created C:\windows\QOO.exe.bat MGHLGO.exe File opened for modification C:\windows\RFXW.exe EVOYLD.exe File created C:\windows\system\YLKGXQA.exe.bat CSIDTLR.exe File created C:\windows\YTTM.exe.bat OWGAZDH.exe File opened for modification C:\windows\system\IBK.exe FFFPGV.exe File created C:\windows\system\GMWV.exe.bat UEQVX.exe File opened for modification C:\windows\system\FXLHO.exe DZG.exe File created C:\windows\RHIMKB.exe.bat RTQYJ.exe File created C:\windows\system\NONXTC.exe VBCFE.exe File created C:\windows\system\RJGELCX.exe.bat EZQO.exe File created C:\windows\system\ZOGKGRM.exe.bat WFKV.exe File opened for modification C:\windows\system\XAZ.exe LHS.exe File created C:\windows\QGKE.exe.bat DVTGLJ.exe File opened for modification C:\windows\EPIN.exe PUYINC.exe File created C:\windows\system\IDJ.exe.bat WNUQUD.exe File opened for modification C:\windows\QGKE.exe DVTGLJ.exe File created C:\windows\VEROYOC.exe.bat HYJC.exe File created C:\windows\XMDSNG.exe QGKE.exe File created C:\windows\system\HQCS.exe SAB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2588 cmd.exe 3424 cmd.exe 3580 cmd.exe 368 cmd.exe 2404 cmd.exe 3940 cmd.exe 2816 cmd.exe 2368 cmd.exe 5804 cmd.exe 3224 cmd.exe 1624 cmd.exe 5704 cmd.exe 1380 cmd.exe 2516 cmd.exe 5720 cmd.exe 5748 cmd.exe 5964 cmd.exe 5716 cmd.exe 4852 cmd.exe 2828 cmd.exe 204 cmd.exe 2396 cmd.exe 3176 cmd.exe 4616 cmd.exe 3152 cmd.exe 4152 cmd.exe 5508 cmd.exe 4244 cmd.exe 4452 cmd.exe 5492 cmd.exe 3428 cmd.exe 1856 cmd.exe 3380 cmd.exe 1768 cmd.exe 5340 cmd.exe 5740 cmd.exe 1532 cmd.exe 4092 cmd.exe 4588 cmd.exe 3352 cmd.exe 5608 cmd.exe 4248 cmd.exe 4328 cmd.exe 4692 cmd.exe 5312 cmd.exe 4072 cmd.exe 2012 cmd.exe 5940 cmd.exe 2124 cmd.exe 2388 cmd.exe 832 cmd.exe 4648 cmd.exe 5084 cmd.exe 3252 cmd.exe 1960 cmd.exe 5908 cmd.exe 2476 cmd.exe 6080 cmd.exe 2340 cmd.exe 2636 cmd.exe 4748 cmd.exe 4792 cmd.exe 2200 cmd.exe 2160 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2324 1812 WerFault.exe 87 1432 4944 WerFault.exe 93 2876 2428 WerFault.exe 99 3944 5308 WerFault.exe 104 1816 2608 WerFault.exe 109 3336 5452 WerFault.exe 114 1176 3452 WerFault.exe 119 2720 4860 WerFault.exe 124 5464 4520 WerFault.exe 129 1256 1756 WerFault.exe 134 1960 3476 WerFault.exe 139 3860 5616 WerFault.exe 144 2300 3856 WerFault.exe 149 5100 4812 WerFault.exe 154 3720 980 WerFault.exe 159 2500 1472 WerFault.exe 164 4756 1144 WerFault.exe 169 5156 4308 WerFault.exe 174 5748 2796 WerFault.exe 179 5140 1660 WerFault.exe 184 3676 5404 WerFault.exe 189 4576 4888 WerFault.exe 194 4492 3980 WerFault.exe 199 2264 2856 WerFault.exe 204 5224 1544 WerFault.exe 209 3144 4752 WerFault.exe 214 1872 2580 WerFault.exe 219 3188 904 WerFault.exe 224 4648 3096 WerFault.exe 229 4700 6008 WerFault.exe 234 5820 4560 WerFault.exe 239 1980 4216 WerFault.exe 244 3424 5660 WerFault.exe 249 3724 1844 WerFault.exe 254 2096 3668 WerFault.exe 259 2524 936 WerFault.exe 264 624 1776 WerFault.exe 269 5268 4268 WerFault.exe 275 3108 2560 WerFault.exe 280 4336 1052 WerFault.exe 285 5904 4968 WerFault.exe 290 2108 3636 WerFault.exe 295 3232 3332 WerFault.exe 300 252 2496 WerFault.exe 305 5708 2568 WerFault.exe 310 3036 1080 WerFault.exe 315 3192 988 WerFault.exe 320 5268 3916 WerFault.exe 325 1768 3728 WerFault.exe 330 3248 2448 WerFault.exe 335 4196 1780 WerFault.exe 340 5036 5900 WerFault.exe 345 2324 3860 WerFault.exe 350 5960 5252 WerFault.exe 355 3240 5260 WerFault.exe 360 804 2812 WerFault.exe 365 4156 728 WerFault.exe 370 1568 3028 WerFault.exe 375 828 5316 WerFault.exe 380 556 4368 WerFault.exe 385 4580 5892 WerFault.exe 390 4712 4856 WerFault.exe 395 2780 4876 WerFault.exe 400 5944 2096 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHIMKB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSCZX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFKV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUJUUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APNN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYVYWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFPJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTQYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RNEPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQISQOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WNUQUD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKQXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EPIN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HYJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MGK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFFPGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJYAEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KNSIWOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USSKNP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXRPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSYVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMDSNG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKWUIMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NUNLVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEROYOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLSH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMUXBZV.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1812 2026-08-13_0d783f6eff9c68fc68bda2d4c3f015b9_elex_emotet_stop.exe 1812 2026-08-13_0d783f6eff9c68fc68bda2d4c3f015b9_elex_emotet_stop.exe 4944 WFKV.exe 4944 WFKV.exe 2428 ZOGKGRM.exe 2428 ZOGKGRM.exe 5308 VTY.exe 5308 VTY.exe 2608 EZQO.exe 2608 EZQO.exe 5452 RJGELCX.exe 5452 RJGELCX.exe 3452 PUJUUQ.exe 3452 PUJUUQ.exe 4860 ZCLZYNV.exe 4860 ZCLZYNV.exe 4520 DLSH.exe 4520 DLSH.exe 1756 YVAY.exe 1756 YVAY.exe 3476 CYGTYBP.exe 3476 CYGTYBP.exe 5616 RTQYJ.exe 5616 RTQYJ.exe 3856 RHIMKB.exe 3856 RHIMKB.exe 4812 MUN.exe 4812 MUN.exe 980 KKGYIO.exe 980 KKGYIO.exe 1472 CSIDTLR.exe 1472 CSIDTLR.exe 1144 YLKGXQA.exe 1144 YLKGXQA.exe 4308 AJYAEY.exe 4308 AJYAEY.exe 2796 QMHM.exe 2796 QMHM.exe 1660 KZMWAK.exe 1660 KZMWAK.exe 5404 APNN.exe 5404 APNN.exe 4888 KNSIWOW.exe 4888 KNSIWOW.exe 3980 IYVYWU.exe 3980 IYVYWU.exe 2856 MGK.exe 2856 MGK.exe 1544 UTO.exe 1544 UTO.exe 4752 YBVMF.exe 4752 YBVMF.exe 2580 IZJH.exe 2580 IZJH.exe 904 CMUXBZV.exe 904 CMUXBZV.exe 3096 PSUJD.exe 3096 PSUJD.exe 6008 ENM.exe 6008 ENM.exe 4560 OWGAZDH.exe 4560 OWGAZDH.exe 4216 YTTM.exe 4216 YTTM.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1812 2026-08-13_0d783f6eff9c68fc68bda2d4c3f015b9_elex_emotet_stop.exe 1812 2026-08-13_0d783f6eff9c68fc68bda2d4c3f015b9_elex_emotet_stop.exe 4944 WFKV.exe 4944 WFKV.exe 2428 ZOGKGRM.exe 2428 ZOGKGRM.exe 5308 VTY.exe 5308 VTY.exe 2608 EZQO.exe 2608 EZQO.exe 5452 RJGELCX.exe 5452 RJGELCX.exe 3452 PUJUUQ.exe 3452 PUJUUQ.exe 4860 ZCLZYNV.exe 4860 ZCLZYNV.exe 4520 DLSH.exe 4520 DLSH.exe 1756 YVAY.exe 1756 YVAY.exe 3476 CYGTYBP.exe 3476 CYGTYBP.exe 5616 RTQYJ.exe 5616 RTQYJ.exe 3856 RHIMKB.exe 3856 RHIMKB.exe 4812 MUN.exe 4812 MUN.exe 980 KKGYIO.exe 980 KKGYIO.exe 1472 CSIDTLR.exe 1472 CSIDTLR.exe 1144 YLKGXQA.exe 1144 YLKGXQA.exe 4308 AJYAEY.exe 4308 AJYAEY.exe 2796 QMHM.exe 2796 QMHM.exe 1660 KZMWAK.exe 1660 KZMWAK.exe 5404 APNN.exe 5404 APNN.exe 4888 KNSIWOW.exe 4888 KNSIWOW.exe 3980 IYVYWU.exe 3980 IYVYWU.exe 2856 MGK.exe 2856 MGK.exe 1544 UTO.exe 1544 UTO.exe 4752 YBVMF.exe 4752 YBVMF.exe 2580 IZJH.exe 2580 IZJH.exe 904 CMUXBZV.exe 904 CMUXBZV.exe 3096 PSUJD.exe 3096 PSUJD.exe 6008 ENM.exe 6008 ENM.exe 4560 OWGAZDH.exe 4560 OWGAZDH.exe 4216 YTTM.exe 4216 YTTM.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1812 wrote to memory of 3312 1812 2026-08-13_0d783f6eff9c68fc68bda2d4c3f015b9_elex_emotet_stop.exe 89 PID 3312 wrote to memory of 4944 3312 cmd.exe 93 PID 4944 wrote to memory of 5720 4944 WFKV.exe 95 PID 5720 wrote to memory of 2428 5720 cmd.exe 99 PID 2428 wrote to memory of 4668 2428 ZOGKGRM.exe 100 PID 4668 wrote to memory of 5308 4668 cmd.exe 104 PID 5308 wrote to memory of 2476 5308 VTY.exe 105 PID 2476 wrote to memory of 2608 2476 cmd.exe 109 PID 2608 wrote to memory of 3224 2608 EZQO.exe 110 PID 3224 wrote to memory of 5452 3224 cmd.exe 114 PID 5452 wrote to memory of 1624 5452 RJGELCX.exe 115 PID 1624 wrote to memory of 3452 1624 cmd.exe 119 PID 3452 wrote to memory of 4248 3452 PUJUUQ.exe 120 PID 4248 wrote to memory of 4860 4248 cmd.exe 124 PID 4860 wrote to memory of 4328 4860 ZCLZYNV.exe 125 PID 4328 wrote to memory of 4520 4328 cmd.exe 129 PID 4520 wrote to memory of 2200 4520 DLSH.exe 130 PID 2200 wrote to memory of 1756 2200 cmd.exe 134 PID 1756 wrote to memory of 5060 1756 YVAY.exe 135 PID 5060 wrote to memory of 3476 5060 cmd.exe 139 PID 3476 wrote to memory of 4692 3476 CYGTYBP.exe 140 PID 4692 wrote to memory of 5616 4692 cmd.exe 144 PID 5616 wrote to memory of 1184 5616 RTQYJ.exe 145 PID 1184 wrote to memory of 3856 1184 cmd.exe 149 PID 3856 wrote to memory of 2712 3856 RHIMKB.exe 150 PID 2712 wrote to memory of 4812 2712 cmd.exe 154 PID 4812 wrote to memory of 5468 4812 MUN.exe 155 PID 5468 wrote to memory of 980 5468 cmd.exe 159 PID 980 wrote to memory of 4192 980 KKGYIO.exe 160 PID 4192 wrote to memory of 1472 4192 cmd.exe 164 PID 1472 wrote to memory of 580 1472 CSIDTLR.exe 165 PID 580 wrote to memory of 1144 580 cmd.exe 169 PID 1144 wrote to memory of 4608 1144 YLKGXQA.exe 170 PID 4608 wrote to memory of 4308 4608 cmd.exe 174 PID 4308 wrote to memory of 4188 4308 AJYAEY.exe 175 PID 4188 wrote to memory of 2796 4188 cmd.exe 179 PID 2796 wrote to memory of 6080 2796 QMHM.exe 180 PID 6080 wrote to memory of 1660 6080 cmd.exe 184 PID 1660 wrote to memory of 5340 1660 KZMWAK.exe 185 PID 5340 wrote to memory of 5404 5340 cmd.exe 189 PID 5404 wrote to memory of 2044 5404 APNN.exe 190 PID 2044 wrote to memory of 4888 2044 cmd.exe 194 PID 4888 wrote to memory of 6116 4888 KNSIWOW.exe 195 PID 6116 wrote to memory of 3980 6116 cmd.exe 199 PID 3980 wrote to memory of 5040 3980 IYVYWU.exe 200 PID 5040 wrote to memory of 2856 5040 cmd.exe 204 PID 2856 wrote to memory of 5740 2856 MGK.exe 205 PID 5740 wrote to memory of 1544 5740 cmd.exe 209 PID 1544 wrote to memory of 4244 1544 UTO.exe 210 PID 4244 wrote to memory of 4752 4244 cmd.exe 214 PID 4752 wrote to memory of 3448 4752 YBVMF.exe 215 PID 3448 wrote to memory of 2580 3448 cmd.exe 219 PID 2580 wrote to memory of 2828 2580 IZJH.exe 220 PID 2828 wrote to memory of 904 2828 cmd.exe 224 PID 904 wrote to memory of 1696 904 CMUXBZV.exe 225 PID 1696 wrote to memory of 3096 1696 cmd.exe 229 PID 3096 wrote to memory of 5624 3096 PSUJD.exe 230 PID 5624 wrote to memory of 6008 5624 cmd.exe 234 PID 6008 wrote to memory of 5748 6008 ENM.exe 235 PID 5748 wrote to memory of 4560 5748 cmd.exe 239 PID 4560 wrote to memory of 4488 4560 OWGAZDH.exe 240 PID 4488 wrote to memory of 4216 4488 cmd.exe 244 PID 4216 wrote to memory of 5312 4216 YTTM.exe 245 PID 5312 wrote to memory of 5660 5312 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_0d783f6eff9c68fc68bda2d4c3f015b9_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_0d783f6eff9c68fc68bda2d4c3f015b9_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WFKV.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\windows\SysWOW64\WFKV.exeC:\windows\system32\WFKV.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOGKGRM.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\windows\system\ZOGKGRM.exeC:\windows\system\ZOGKGRM.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VTY.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\windows\VTY.exeC:\windows\VTY.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EZQO.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\windows\EZQO.exeC:\windows\EZQO.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RJGELCX.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\windows\system\RJGELCX.exeC:\windows\system\RJGELCX.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUJUUQ.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\windows\PUJUUQ.exeC:\windows\PUJUUQ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZCLZYNV.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\windows\ZCLZYNV.exeC:\windows\ZCLZYNV.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLSH.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\windows\system\DLSH.exeC:\windows\system\DLSH.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YVAY.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\windows\SysWOW64\YVAY.exeC:\windows\system32\YVAY.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYGTYBP.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\windows\SysWOW64\CYGTYBP.exeC:\windows\system32\CYGTYBP.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RTQYJ.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\windows\system\RTQYJ.exeC:\windows\system\RTQYJ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHIMKB.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\windows\RHIMKB.exeC:\windows\RHIMKB.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MUN.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\windows\MUN.exeC:\windows\MUN.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KKGYIO.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\windows\system\KKGYIO.exeC:\windows\system\KKGYIO.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CSIDTLR.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\windows\SysWOW64\CSIDTLR.exeC:\windows\system32\CSIDTLR.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YLKGXQA.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:580 -
C:\windows\system\YLKGXQA.exeC:\windows\system\YLKGXQA.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AJYAEY.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\windows\AJYAEY.exeC:\windows\AJYAEY.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QMHM.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\windows\system\QMHM.exeC:\windows\system\QMHM.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZMWAK.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\windows\SysWOW64\KZMWAK.exeC:\windows\system32\KZMWAK.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\APNN.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\windows\SysWOW64\APNN.exeC:\windows\system32\APNN.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNSIWOW.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\windows\SysWOW64\KNSIWOW.exeC:\windows\system32\KNSIWOW.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IYVYWU.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\windows\SysWOW64\IYVYWU.exeC:\windows\system32\IYVYWU.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MGK.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\windows\SysWOW64\MGK.exeC:\windows\system32\MGK.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTO.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\windows\SysWOW64\UTO.exeC:\windows\system32\UTO.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBVMF.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\windows\system\YBVMF.exeC:\windows\system\YBVMF.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IZJH.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\windows\system\IZJH.exeC:\windows\system\IZJH.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMUXBZV.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\windows\CMUXBZV.exeC:\windows\CMUXBZV.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PSUJD.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\windows\system\PSUJD.exeC:\windows\system\PSUJD.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENM.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\windows\ENM.exeC:\windows\ENM.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWGAZDH.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\windows\SysWOW64\OWGAZDH.exeC:\windows\system32\OWGAZDH.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YTTM.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\windows\YTTM.exeC:\windows\YTTM.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZYB.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\windows\GZYB.exeC:\windows\GZYB.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PHAGVHO.exe.bat" "66⤵
- Executes a command shell one-liner
PID:3940 -
C:\windows\PHAGVHO.exeC:\windows\PHAGVHO.exe67⤵
- Executes dropped EXE
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKQXJ.exe.bat" "68⤵PID:1264
-
C:\windows\SysWOW64\KKQXJ.exeC:\windows\system32\KKQXJ.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USSKNP.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2532 -
C:\windows\system\USSKNP.exeC:\windows\system\USSKNP.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JNCO.exe.bat" "72⤵
- Executes a command shell one-liner
PID:204 -
C:\windows\JNCO.exeC:\windows\JNCO.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJBPCFJ.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2588 -
C:\windows\system\PJBPCFJ.exeC:\windows\system\PJBPCFJ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRHX.exe.bat" "76⤵
- Executes a command shell one-liner
PID:1532 -
C:\windows\system\TRHX.exeC:\windows\system\TRHX.exe77⤵
- Executes dropped EXE
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZJCSD.exe.bat" "78⤵
- Executes a command shell one-liner
PID:4648 -
C:\windows\CZJCSD.exeC:\windows\CZJCSD.exe79⤵
- Executes dropped EXE
PID:1052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHQ.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5704 -
C:\windows\system\OHQ.exeC:\windows\system\OHQ.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCAOXI.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:4836 -
C:\windows\SysWOW64\DCAOXI.exeC:\windows\system32\DCAOXI.exe83⤵
- Executes dropped EXE
PID:3636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFDKD.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2124 -
C:\windows\WFDKD.exeC:\windows\WFDKD.exe85⤵
- Executes dropped EXE
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FFFPGV.exe.bat" "86⤵
- Executes a command shell one-liner
PID:3424 -
C:\windows\system\FFFPGV.exeC:\windows\system\FFFPGV.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBK.exe.bat" "88⤵PID:5980
-
C:\windows\system\IBK.exeC:\windows\system\IBK.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AWOCW.exe.bat" "90⤵PID:2264
-
C:\windows\AWOCW.exeC:\windows\AWOCW.exe91⤵
- Executes dropped EXE
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SECAJ.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:5484 -
C:\windows\SECAJ.exeC:\windows\SECAJ.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QPFQ.exe.bat" "94⤵PID:3920
-
C:\windows\SysWOW64\QPFQ.exeC:\windows\system32\QPFQ.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CHIIZ.exe.bat" "96⤵
- Executes a command shell one-liner
PID:2160 -
C:\windows\SysWOW64\CHIIZ.exeC:\windows\system32\CHIIZ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MFODH.exe.bat" "98⤵PID:5336
-
C:\windows\MFODH.exeC:\windows\MFODH.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSYVX.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4092 -
C:\windows\VSYVX.exeC:\windows\VSYVX.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOX.exe.bat" "102⤵PID:5332
-
C:\windows\BOX.exeC:\windows\BOX.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBCFE.exe.bat" "104⤵PID:2860
-
C:\windows\system\VBCFE.exeC:\windows\system\VBCFE.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NONXTC.exe.bat" "106⤵PID:2728
-
C:\windows\system\NONXTC.exeC:\windows\system\NONXTC.exe107⤵
- Executes dropped EXE
PID:5252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NUNLVP.exe.bat" "108⤵PID:252
-
C:\windows\system\NUNLVP.exeC:\windows\system\NUNLVP.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXRPI.exe.bat" "110⤵PID:4528
-
C:\windows\system\FXRPI.exeC:\windows\system\FXRPI.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\USA.exe.bat" "112⤵PID:3144
-
C:\windows\SysWOW64\USA.exeC:\windows\system32\USA.exe113⤵
- Executes dropped EXE
PID:728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MSCZX.exe.bat" "114⤵PID:3968
-
C:\windows\MSCZX.exeC:\windows\MSCZX.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GOHIHX.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:2020 -
C:\windows\SysWOW64\GOHIHX.exeC:\windows\system32\GOHIHX.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UQPH.exe.bat" "118⤵PID:1572
-
C:\windows\SysWOW64\UQPH.exeC:\windows\system32\UQPH.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UEQVX.exe.bat" "120⤵PID:2176
-
C:\windows\system\UEQVX.exeC:\windows\system\UEQVX.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-