Analysis
- max time kernel
94s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 04:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_0132bada6990982d3b27beecc8272d62_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-15_0132bada6990982d3b27beecc8272d62_elex_emotet_stop.exe
- Size 208KB
- Sample260815-e26vsaztcs
- SHA256 a6daa985d7316e144619fda35d9351f3bb94091dc725354cd6aeae5b13d65f6c
- MD5 0132bada6990982d3b27beecc8272d62
- SHA1 82ca328698a968b15ab099cc72be4fdccd565697
- SHA512 c9319313da05a1a37fd810e8b67ddcdabd264213c3733ec0f6e2f6c567eefb60966287c0f967bf0db31c870b27916c136d306e18c3eaf44f15cba021f8b04b0c
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFl1dL+LOfg4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFl15+LOokEj1
- TLSH T1F2247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2524 FXZQ.exe 5856 VGUCZ.exe 3448 NOIZMQJ.exe 3140 VUNGXWE.exe 4416 XRAA.exe 5048 SPA.exe 4452 ADNSYPK.exe 1012 CASNGXT.exe 1752 GIZN.exe 4496 VZA.exe 1984 DMNTBBZ.exe 5988 LSRZMAV.exe 2476 KPLCH.exe 5476 OSJ.exe 2704 BDROVJ.exe 4220 NWUHDQQ.exe 5876 PJZQ.exe 1832 EEIDZLF.exe 4916 XHMY.exe 1596 HFA.exe 5936 AAEOZ.exe 5684 UVIYBZN.exe 2736 AJAGG.exe 3756 KGNT.exe 4132 FCSKYK.exe 4344 JKZ.exe 4700 NSFKWN.exe 5624 CIGK.exe 5280 VIWVMJH.exe 5832 ZQCVYTD.exe 5292 PGD.exe 248 EBNYQC.exe 1164 WERCW.exe 2872 KCZ.exe 4176 QCGB.exe 5672 ZLAHSDP.exe 4652 LTPH.exe 2036 GOUYOV.exe 3968 LOB.exe 5524 CZEUGDQ.exe 4968 UAGH.exe 1392 XQNHWT.exe 5752 LSVG.exe 6068 AIWXJZY.exe 5748 VEBG.exe 4688 PRGYDZ.exe 2748 VRN.exe 1152 FPBYCB.exe 5904 OPVL.exe 1656 GYXQJ.exe 912 VTG.exe 6088 QGLEE.exe 1604 QULSFE.exe 3892 VUT.exe 484 QHYPZ.exe 5060 ZIACKD.exe 4804 WNG.exe 5628 CNF.exe 3532 PLNRCTN.exe 5828 TBUZOL.exe 4352 UEY.exe 3096 HHGTIM.exe 2668 LXVTU.exe 2924 TDNIWJ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\WERCW.exe.bat EBNYQC.exe File created C:\windows\SysWOW64\AIWXJZY.exe.bat LSVG.exe File created C:\windows\SysWOW64\DMQOQA.exe.bat BOCUJSB.exe File opened for modification C:\windows\SysWOW64\NJVIYI.exe DMQOQA.exe File created C:\windows\SysWOW64\NJVIYI.exe.bat DMQOQA.exe File created C:\windows\SysWOW64\PQOTE.exe FIMOBKU.exe File created C:\windows\SysWOW64\AAEOZ.exe HFA.exe File opened for modification C:\windows\SysWOW64\WERCW.exe EBNYQC.exe File created C:\windows\SysWOW64\KCZ.exe.bat WERCW.exe File opened for modification C:\windows\SysWOW64\AIWXJZY.exe LSVG.exe File created C:\windows\SysWOW64\VLCBX.exe PLUOO.exe File created C:\windows\SysWOW64\FUKP.exe NUIKYW.exe File created C:\windows\SysWOW64\JKZ.exe.bat FCSKYK.exe File created C:\windows\SysWOW64\VGUCZ.exe.bat FXZQ.exe File created C:\windows\SysWOW64\NWUHDQQ.exe BDROVJ.exe File created C:\windows\SysWOW64\VGUCZ.exe FXZQ.exe File created C:\windows\SysWOW64\KFP.exe.bat ZMUMNWT.exe File created C:\windows\SysWOW64\PQOTE.exe.bat FIMOBKU.exe File created C:\windows\SysWOW64\FIWMCW.exe ZIPZLT.exe File created C:\windows\SysWOW64\OPVL.exe FPBYCB.exe File opened for modification C:\windows\SysWOW64\GEA.exe EJJMBGC.exe File created C:\windows\SysWOW64\GEA.exe.bat EJJMBGC.exe File created C:\windows\SysWOW64\LBGMV.exe.bat ODA.exe File created C:\windows\SysWOW64\ZIFASQT.exe DKZDD.exe File created C:\windows\SysWOW64\NWUHDQQ.exe.bat BDROVJ.exe File created C:\windows\SysWOW64\KGNT.exe AJAGG.exe File created C:\windows\SysWOW64\WERCW.exe EBNYQC.exe File created C:\windows\SysWOW64\FPBYCB.exe.bat VRN.exe File opened for modification C:\windows\SysWOW64\TBUZOL.exe PLNRCTN.exe File created C:\windows\SysWOW64\TBUZOL.exe.bat PLNRCTN.exe File opened for modification C:\windows\SysWOW64\LBGMV.exe ODA.exe File opened for modification C:\windows\SysWOW64\ZIFASQT.exe DKZDD.exe File created C:\windows\SysWOW64\NOIZMQJ.exe VGUCZ.exe File created C:\windows\SysWOW64\VRN.exe PRGYDZ.exe File opened for modification C:\windows\SysWOW64\EJJMBGC.exe OTIN.exe File created C:\windows\SysWOW64\GEA.exe EJJMBGC.exe File created C:\windows\SysWOW64\JRDI.exe CBCJVN.exe File opened for modification C:\windows\SysWOW64\OTIN.exe MGR.exe File opened for modification C:\windows\SysWOW64\JRDI.exe CBCJVN.exe File created C:\windows\SysWOW64\HGAIN.exe LJC.exe File opened for modification C:\windows\SysWOW64\ZIPZLT.exe FUKP.exe File created C:\windows\SysWOW64\VEBG.exe.bat AIWXJZY.exe File opened for modification C:\windows\SysWOW64\GYXQJ.exe OPVL.exe File created C:\windows\SysWOW64\KFP.exe ZMUMNWT.exe File created C:\windows\SysWOW64\TZTUU.exe.bat GWLWGIS.exe File created C:\windows\SysWOW64\EJJMBGC.exe OTIN.exe File created C:\windows\SysWOW64\CBCJVN.exe QTVJ.exe File opened for modification C:\windows\SysWOW64\KFP.exe ZMUMNWT.exe File created C:\windows\SysWOW64\HGAIN.exe.bat LJC.exe File created C:\windows\SysWOW64\VRN.exe.bat PRGYDZ.exe File opened for modification C:\windows\SysWOW64\LTPH.exe ZLAHSDP.exe File created C:\windows\SysWOW64\DMQOQA.exe BOCUJSB.exe File created C:\windows\SysWOW64\KUDC.exe ZBI.exe File created C:\windows\SysWOW64\KGNT.exe.bat AJAGG.exe File created C:\windows\SysWOW64\EAUPF.exe.bat KFP.exe File created C:\windows\SysWOW64\VLCBX.exe.bat PLUOO.exe File created C:\windows\SysWOW64\HFA.exe.bat XHMY.exe File created C:\windows\SysWOW64\KCZ.exe WERCW.exe File created C:\windows\SysWOW64\TDNIWJ.exe.bat LXVTU.exe File created C:\windows\SysWOW64\EJJMBGC.exe.bat OTIN.exe File created C:\windows\SysWOW64\NJVIYI.exe DMQOQA.exe File created C:\windows\SysWOW64\LBGMV.exe ODA.exe File created C:\windows\SysWOW64\KHXY.exe PTSPKFX.exe File opened for modification C:\windows\SysWOW64\VGUCZ.exe FXZQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\CASNGXT.exe.bat ADNSYPK.exe File opened for modification C:\windows\UEY.exe TBUZOL.exe File created C:\windows\UEY.exe.bat TBUZOL.exe File opened for modification C:\windows\OQISBE.exe OCQDZR.exe File opened for modification C:\windows\system\VUNGXWE.exe NOIZMQJ.exe File created C:\windows\system\SPA.exe XRAA.exe File opened for modification C:\windows\ZLAHSDP.exe QCGB.exe File opened for modification C:\windows\QTVJ.exe XQRFDFY.exe File created C:\windows\IHPSF.exe.bat ERI.exe File created C:\windows\VTG.exe GYXQJ.exe File created C:\windows\MGR.exe.bat TDNIWJ.exe File opened for modification C:\windows\EEIDZLF.exe PJZQ.exe File created C:\windows\system\ZIACKD.exe QHYPZ.exe File created C:\windows\VUT.exe QULSFE.exe File opened for modification C:\windows\FCSKYK.exe KGNT.exe File created C:\windows\DMNTBBZ.exe.bat VZA.exe File created C:\windows\system\XHMY.exe.bat EEIDZLF.exe File created C:\windows\CNF.exe WNG.exe File opened for modification C:\windows\system\BAWINO.exe FVDTFSJ.exe File created C:\windows\GWLWGIS.exe.bat LBGMV.exe File created C:\windows\DMNTBBZ.exe VZA.exe File created C:\windows\SFKG.exe.bat QHEMLZ.exe File opened for modification C:\windows\OBZT.exe UNC.exe File created C:\windows\OBZT.exe.bat UNC.exe File opened for modification C:\windows\XRAA.exe VUNGXWE.exe File created C:\windows\EEIDZLF.exe.bat PJZQ.exe File created C:\windows\system\ZUN.exe OCSCWG.exe File created C:\windows\system\VUNGXWE.exe NOIZMQJ.exe File created C:\windows\FCSKYK.exe.bat KGNT.exe File created C:\windows\QCGB.exe KCZ.exe File created C:\windows\UAGH.exe CZEUGDQ.exe File opened for modification C:\windows\system\XQRFDFY.exe PCFYTHD.exe File created C:\windows\FIMOBKU.exe ZIFASQT.exe File opened for modification C:\windows\system\UNC.exe FIWMCW.exe File created C:\windows\QULSFE.exe QGLEE.exe File opened for modification C:\windows\system\WNG.exe ZIACKD.exe File opened for modification C:\windows\FIMOBKU.exe ZIFASQT.exe File created C:\windows\OCQDZR.exe SFKG.exe File created C:\windows\system\DKZDD.exe KHV.exe File created C:\windows\system\SPA.exe.bat XRAA.exe File created C:\windows\system\XQRFDFY.exe PCFYTHD.exe File opened for modification C:\windows\NFUDHQ.exe EAUPF.exe File created C:\windows\NFUDHQ.exe.bat EAUPF.exe File opened for modification C:\windows\PJZQ.exe NWUHDQQ.exe File created C:\windows\PJZQ.exe.bat NWUHDQQ.exe File created C:\windows\PLNRCTN.exe.bat CNF.exe File opened for modification C:\windows\system\OUBN.exe GEA.exe File created C:\windows\system\LSRZMAV.exe.bat DMNTBBZ.exe File opened for modification C:\windows\XQNHWT.exe UAGH.exe File opened for modification C:\windows\ERI.exe OBZT.exe File created C:\windows\system\ADNSYPK.exe.bat SPA.exe File created C:\windows\GOUYOV.exe LTPH.exe File opened for modification C:\windows\system\BOCUJSB.exe ALYYW.exe File created C:\windows\system\BOCUJSB.exe.bat ALYYW.exe File created C:\windows\system\XQRFDFY.exe.bat PCFYTHD.exe File opened for modification C:\windows\KHV.exe TZTUU.exe File opened for modification C:\windows\SFKG.exe QHEMLZ.exe File created C:\windows\QNXBWX.exe KNQO.exe File created C:\windows\XRAA.exe.bat VUNGXWE.exe File created C:\windows\MGR.exe TDNIWJ.exe File created C:\windows\FVDTFSJ.exe.bat OUBN.exe File created C:\windows\GWLWGIS.exe LBGMV.exe File created C:\windows\system\KUTCPLF.exe.bat IHPSF.exe File opened for modification C:\windows\VUT.exe QULSFE.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4212 cmd.exe 4152 cmd.exe 1376 cmd.exe 2832 cmd.exe 6096 cmd.exe 4400 cmd.exe 4760 cmd.exe 3436 cmd.exe 2340 cmd.exe 2288 cmd.exe 1824 cmd.exe 4864 cmd.exe 2760 cmd.exe 6020 cmd.exe 2280 cmd.exe 1236 cmd.exe 4960 cmd.exe 4988 cmd.exe 5340 cmd.exe 5472 cmd.exe 5608 cmd.exe 2564 cmd.exe 5872 cmd.exe 5064 cmd.exe 3904 cmd.exe 1104 cmd.exe 2236 cmd.exe 3412 cmd.exe 3732 cmd.exe 3444 cmd.exe 2136 cmd.exe 1064 cmd.exe 4512 cmd.exe 1100 cmd.exe 5536 cmd.exe 2824 cmd.exe 4992 cmd.exe 3628 cmd.exe 1472 cmd.exe 4460 cmd.exe 1976 cmd.exe 5768 cmd.exe 5728 cmd.exe 2360 cmd.exe 5424 cmd.exe 4552 cmd.exe 3512 cmd.exe 1880 cmd.exe 5808 cmd.exe 4316 cmd.exe 1480 cmd.exe 5916 cmd.exe 3004 cmd.exe 1468 cmd.exe 808 cmd.exe 3164 cmd.exe 2140 cmd.exe 3440 cmd.exe 6092 cmd.exe 6100 cmd.exe 2692 cmd.exe 4912 cmd.exe 5688 cmd.exe 1144 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2980 4932 WerFault.exe 88 2280 2524 WerFault.exe 93 4520 5856 WerFault.exe 99 976 3448 WerFault.exe 104 1056 3140 WerFault.exe 109 6032 4416 WerFault.exe 114 448 5048 WerFault.exe 119 3212 4452 WerFault.exe 124 4192 1012 WerFault.exe 129 3152 1752 WerFault.exe 134 5356 4496 WerFault.exe 139 4776 1984 WerFault.exe 144 5504 5988 WerFault.exe 149 5572 2476 WerFault.exe 154 1548 5476 WerFault.exe 159 3976 2704 WerFault.exe 164 5816 4220 WerFault.exe 169 804 5876 WerFault.exe 174 768 1832 WerFault.exe 179 5768 4916 WerFault.exe 184 4172 1596 WerFault.exe 189 3196 5936 WerFault.exe 194 5504 5684 WerFault.exe 199 6068 2736 WerFault.exe 204 4280 3756 WerFault.exe 209 1092 4132 WerFault.exe 214 3340 4344 WerFault.exe 219 2784 4700 WerFault.exe 224 3984 5624 WerFault.exe 229 5840 5280 WerFault.exe 234 1556 5832 WerFault.exe 239 4776 5292 WerFault.exe 244 3804 248 WerFault.exe 249 2252 1164 WerFault.exe 254 2924 2872 WerFault.exe 259 840 4176 WerFault.exe 264 2748 5672 WerFault.exe 269 2784 4652 WerFault.exe 275 1648 2036 WerFault.exe 280 3372 3968 WerFault.exe 285 3264 5524 WerFault.exe 290 6020 4968 WerFault.exe 295 4232 1392 WerFault.exe 300 4764 5752 WerFault.exe 305 1976 6068 WerFault.exe 310 3000 5748 WerFault.exe 315 2240 4688 WerFault.exe 320 448 2748 WerFault.exe 325 1760 1152 WerFault.exe 330 2984 5904 WerFault.exe 335 2644 1656 WerFault.exe 340 2828 912 WerFault.exe 345 1292 6088 WerFault.exe 350 2668 1604 WerFault.exe 355 5400 3892 WerFault.exe 360 2292 484 WerFault.exe 365 5324 5060 WerFault.exe 370 1624 4804 WerFault.exe 375 2204 5628 WerFault.exe 380 5312 3532 WerFault.exe 385 4332 5828 WerFault.exe 390 2320 4352 WerFault.exe 395 4276 3096 WerFault.exe 400 4288 2668 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FIMOBKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZUN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XQNHWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXZQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XHMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QULSFE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADNSYPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEIDZLF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBGMV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCFYTHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NUIKYW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPBYCB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KPLCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UVIYBZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJAGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHGTIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJVIYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQISBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OPVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PLNRCTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCGB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TBUZOL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKZDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QNXBWX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4932 2026-08-15_0132bada6990982d3b27beecc8272d62_elex_emotet_stop.exe 4932 2026-08-15_0132bada6990982d3b27beecc8272d62_elex_emotet_stop.exe 2524 FXZQ.exe 2524 FXZQ.exe 5856 VGUCZ.exe 5856 VGUCZ.exe 3448 NOIZMQJ.exe 3448 NOIZMQJ.exe 3140 VUNGXWE.exe 3140 VUNGXWE.exe 4416 XRAA.exe 4416 XRAA.exe 5048 SPA.exe 5048 SPA.exe 4452 ADNSYPK.exe 4452 ADNSYPK.exe 1012 CASNGXT.exe 1012 CASNGXT.exe 1752 GIZN.exe 1752 GIZN.exe 4496 VZA.exe 4496 VZA.exe 1984 DMNTBBZ.exe 1984 DMNTBBZ.exe 5988 LSRZMAV.exe 5988 LSRZMAV.exe 2476 KPLCH.exe 2476 KPLCH.exe 5476 OSJ.exe 5476 OSJ.exe 2704 BDROVJ.exe 2704 BDROVJ.exe 4220 NWUHDQQ.exe 4220 NWUHDQQ.exe 5876 PJZQ.exe 5876 PJZQ.exe 1832 EEIDZLF.exe 1832 EEIDZLF.exe 4916 XHMY.exe 4916 XHMY.exe 1596 HFA.exe 1596 HFA.exe 5936 AAEOZ.exe 5936 AAEOZ.exe 5684 UVIYBZN.exe 5684 UVIYBZN.exe 2736 AJAGG.exe 2736 AJAGG.exe 3756 KGNT.exe 3756 KGNT.exe 4132 FCSKYK.exe 4132 FCSKYK.exe 4344 JKZ.exe 4344 JKZ.exe 4700 NSFKWN.exe 4700 NSFKWN.exe 5624 CIGK.exe 5624 CIGK.exe 5280 VIWVMJH.exe 5280 VIWVMJH.exe 5832 ZQCVYTD.exe 5832 ZQCVYTD.exe 5292 PGD.exe 5292 PGD.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4932 2026-08-15_0132bada6990982d3b27beecc8272d62_elex_emotet_stop.exe 4932 2026-08-15_0132bada6990982d3b27beecc8272d62_elex_emotet_stop.exe 2524 FXZQ.exe 2524 FXZQ.exe 5856 VGUCZ.exe 5856 VGUCZ.exe 3448 NOIZMQJ.exe 3448 NOIZMQJ.exe 3140 VUNGXWE.exe 3140 VUNGXWE.exe 4416 XRAA.exe 4416 XRAA.exe 5048 SPA.exe 5048 SPA.exe 4452 ADNSYPK.exe 4452 ADNSYPK.exe 1012 CASNGXT.exe 1012 CASNGXT.exe 1752 GIZN.exe 1752 GIZN.exe 4496 VZA.exe 4496 VZA.exe 1984 DMNTBBZ.exe 1984 DMNTBBZ.exe 5988 LSRZMAV.exe 5988 LSRZMAV.exe 2476 KPLCH.exe 2476 KPLCH.exe 5476 OSJ.exe 5476 OSJ.exe 2704 BDROVJ.exe 2704 BDROVJ.exe 4220 NWUHDQQ.exe 4220 NWUHDQQ.exe 5876 PJZQ.exe 5876 PJZQ.exe 1832 EEIDZLF.exe 1832 EEIDZLF.exe 4916 XHMY.exe 4916 XHMY.exe 1596 HFA.exe 1596 HFA.exe 5936 AAEOZ.exe 5936 AAEOZ.exe 5684 UVIYBZN.exe 5684 UVIYBZN.exe 2736 AJAGG.exe 2736 AJAGG.exe 3756 KGNT.exe 3756 KGNT.exe 4132 FCSKYK.exe 4132 FCSKYK.exe 4344 JKZ.exe 4344 JKZ.exe 4700 NSFKWN.exe 4700 NSFKWN.exe 5624 CIGK.exe 5624 CIGK.exe 5280 VIWVMJH.exe 5280 VIWVMJH.exe 5832 ZQCVYTD.exe 5832 ZQCVYTD.exe 5292 PGD.exe 5292 PGD.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4932 wrote to memory of 4620 4932 2026-08-15_0132bada6990982d3b27beecc8272d62_elex_emotet_stop.exe 89 PID 4620 wrote to memory of 2524 4620 cmd.exe 93 PID 2524 wrote to memory of 4244 2524 FXZQ.exe 95 PID 4244 wrote to memory of 5856 4244 cmd.exe 99 PID 5856 wrote to memory of 2236 5856 VGUCZ.exe 100 PID 2236 wrote to memory of 3448 2236 cmd.exe 104 PID 3448 wrote to memory of 1772 3448 NOIZMQJ.exe 105 PID 1772 wrote to memory of 3140 1772 cmd.exe 109 PID 3140 wrote to memory of 5892 3140 VUNGXWE.exe 110 PID 5892 wrote to memory of 4416 5892 cmd.exe 114 PID 4416 wrote to memory of 6084 4416 XRAA.exe 115 PID 6084 wrote to memory of 5048 6084 cmd.exe 119 PID 5048 wrote to memory of 1408 5048 SPA.exe 120 PID 1408 wrote to memory of 4452 1408 cmd.exe 124 PID 4452 wrote to memory of 5076 4452 ADNSYPK.exe 125 PID 5076 wrote to memory of 1012 5076 cmd.exe 129 PID 1012 wrote to memory of 4920 1012 CASNGXT.exe 130 PID 4920 wrote to memory of 1752 4920 cmd.exe 134 PID 1752 wrote to memory of 3728 1752 GIZN.exe 135 PID 3728 wrote to memory of 4496 3728 cmd.exe 139 PID 4496 wrote to memory of 3628 4496 VZA.exe 140 PID 3628 wrote to memory of 1984 3628 cmd.exe 144 PID 1984 wrote to memory of 5564 1984 DMNTBBZ.exe 145 PID 5564 wrote to memory of 5988 5564 cmd.exe 149 PID 5988 wrote to memory of 1472 5988 LSRZMAV.exe 150 PID 1472 wrote to memory of 2476 1472 cmd.exe 154 PID 2476 wrote to memory of 1260 2476 KPLCH.exe 155 PID 1260 wrote to memory of 5476 1260 cmd.exe 159 PID 5476 wrote to memory of 4216 5476 OSJ.exe 160 PID 4216 wrote to memory of 2704 4216 cmd.exe 164 PID 2704 wrote to memory of 2768 2704 BDROVJ.exe 165 PID 2768 wrote to memory of 4220 2768 cmd.exe 169 PID 4220 wrote to memory of 1280 4220 NWUHDQQ.exe 170 PID 1280 wrote to memory of 5876 1280 cmd.exe 174 PID 5876 wrote to memory of 3444 5876 PJZQ.exe 175 PID 3444 wrote to memory of 1832 3444 cmd.exe 179 PID 1832 wrote to memory of 5652 1832 EEIDZLF.exe 180 PID 5652 wrote to memory of 4916 5652 cmd.exe 184 PID 4916 wrote to memory of 1376 4916 XHMY.exe 185 PID 1376 wrote to memory of 1596 1376 cmd.exe 189 PID 1596 wrote to memory of 1924 1596 HFA.exe 190 PID 1924 wrote to memory of 5936 1924 cmd.exe 194 PID 5936 wrote to memory of 4988 5936 AAEOZ.exe 195 PID 4988 wrote to memory of 5684 4988 cmd.exe 199 PID 5684 wrote to memory of 268 5684 UVIYBZN.exe 200 PID 268 wrote to memory of 2736 268 cmd.exe 204 PID 2736 wrote to memory of 2832 2736 AJAGG.exe 205 PID 2832 wrote to memory of 3756 2832 cmd.exe 209 PID 3756 wrote to memory of 808 3756 KGNT.exe 210 PID 808 wrote to memory of 4132 808 cmd.exe 214 PID 4132 wrote to memory of 2772 4132 FCSKYK.exe 215 PID 2772 wrote to memory of 4344 2772 cmd.exe 219 PID 4344 wrote to memory of 2452 4344 JKZ.exe 220 PID 2452 wrote to memory of 4700 2452 cmd.exe 224 PID 4700 wrote to memory of 4328 4700 NSFKWN.exe 225 PID 4328 wrote to memory of 5624 4328 cmd.exe 229 PID 5624 wrote to memory of 4148 5624 CIGK.exe 230 PID 4148 wrote to memory of 5280 4148 cmd.exe 234 PID 5280 wrote to memory of 5964 5280 VIWVMJH.exe 235 PID 5964 wrote to memory of 5832 5964 cmd.exe 239 PID 5832 wrote to memory of 2288 5832 ZQCVYTD.exe 240 PID 2288 wrote to memory of 5292 2288 cmd.exe 244 PID 5292 wrote to memory of 1136 5292 PGD.exe 245 PID 1136 wrote to memory of 248 1136 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_0132bada6990982d3b27beecc8272d62_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_0132bada6990982d3b27beecc8272d62_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXZQ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\windows\system\FXZQ.exeC:\windows\system\FXZQ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VGUCZ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\windows\SysWOW64\VGUCZ.exeC:\windows\system32\VGUCZ.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOIZMQJ.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\windows\SysWOW64\NOIZMQJ.exeC:\windows\system32\NOIZMQJ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VUNGXWE.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\windows\system\VUNGXWE.exeC:\windows\system\VUNGXWE.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRAA.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\windows\XRAA.exeC:\windows\XRAA.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SPA.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\windows\system\SPA.exeC:\windows\system\SPA.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADNSYPK.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\windows\system\ADNSYPK.exeC:\windows\system\ADNSYPK.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CASNGXT.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\windows\CASNGXT.exeC:\windows\CASNGXT.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIZN.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\windows\GIZN.exeC:\windows\GIZN.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZA.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\windows\SysWOW64\VZA.exeC:\windows\system32\VZA.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMNTBBZ.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\windows\DMNTBBZ.exeC:\windows\DMNTBBZ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LSRZMAV.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\windows\system\LSRZMAV.exeC:\windows\system\LSRZMAV.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPLCH.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\windows\KPLCH.exeC:\windows\KPLCH.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OSJ.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\windows\OSJ.exeC:\windows\OSJ.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDROVJ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\SysWOW64\BDROVJ.exeC:\windows\system32\BDROVJ.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NWUHDQQ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\windows\SysWOW64\NWUHDQQ.exeC:\windows\system32\NWUHDQQ.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJZQ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\windows\PJZQ.exeC:\windows\PJZQ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEIDZLF.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\windows\EEIDZLF.exeC:\windows\EEIDZLF.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XHMY.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\windows\system\XHMY.exeC:\windows\system\XHMY.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HFA.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\windows\SysWOW64\HFA.exeC:\windows\system32\HFA.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAEOZ.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\windows\SysWOW64\AAEOZ.exeC:\windows\system32\AAEOZ.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVIYBZN.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\windows\system\UVIYBZN.exeC:\windows\system\UVIYBZN.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AJAGG.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:268 -
C:\windows\AJAGG.exeC:\windows\AJAGG.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGNT.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\windows\SysWOW64\KGNT.exeC:\windows\system32\KGNT.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FCSKYK.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:808 -
C:\windows\FCSKYK.exeC:\windows\FCSKYK.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JKZ.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\windows\SysWOW64\JKZ.exeC:\windows\system32\JKZ.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NSFKWN.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\SysWOW64\NSFKWN.exeC:\windows\system32\NSFKWN.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CIGK.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\windows\system\CIGK.exeC:\windows\system\CIGK.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VIWVMJH.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\windows\VIWVMJH.exeC:\windows\VIWVMJH.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQCVYTD.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\windows\ZQCVYTD.exeC:\windows\ZQCVYTD.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGD.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\windows\system\PGD.exeC:\windows\system\PGD.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EBNYQC.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\windows\EBNYQC.exeC:\windows\EBNYQC.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WERCW.exe.bat" "66⤵PID:2488
-
C:\windows\SysWOW64\WERCW.exeC:\windows\system32\WERCW.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KCZ.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5340 -
C:\windows\SysWOW64\KCZ.exeC:\windows\system32\KCZ.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCGB.exe.bat" "70⤵PID:3972
-
C:\windows\QCGB.exeC:\windows\QCGB.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLAHSDP.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2136 -
C:\windows\ZLAHSDP.exeC:\windows\ZLAHSDP.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LTPH.exe.bat" "74⤵PID:2352
-
C:\windows\SysWOW64\LTPH.exeC:\windows\system32\LTPH.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GOUYOV.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1824 -
C:\windows\GOUYOV.exeC:\windows\GOUYOV.exe77⤵
- Executes dropped EXE
PID:2036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LOB.exe.bat" "78⤵PID:2972
-
C:\windows\system\LOB.exeC:\windows\system\LOB.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZEUGDQ.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4724 -
C:\windows\system\CZEUGDQ.exeC:\windows\system\CZEUGDQ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UAGH.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4864 -
C:\windows\UAGH.exeC:\windows\UAGH.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XQNHWT.exe.bat" "84⤵PID:4240
-
C:\windows\XQNHWT.exeC:\windows\XQNHWT.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LSVG.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:2780 -
C:\windows\system\LSVG.exeC:\windows\system\LSVG.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AIWXJZY.exe.bat" "88⤵PID:4356
-
C:\windows\SysWOW64\AIWXJZY.exeC:\windows\system32\AIWXJZY.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEBG.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4460 -
C:\windows\SysWOW64\VEBG.exeC:\windows\system32\VEBG.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRGYDZ.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2760 -
C:\windows\SysWOW64\PRGYDZ.exeC:\windows\system32\PRGYDZ.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRN.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4116 -
C:\windows\SysWOW64\VRN.exeC:\windows\system32\VRN.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPBYCB.exe.bat" "96⤵PID:4888
-
C:\windows\SysWOW64\FPBYCB.exeC:\windows\system32\FPBYCB.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OPVL.exe.bat" "98⤵
- Executes a command shell one-liner
PID:5472 -
C:\windows\SysWOW64\OPVL.exeC:\windows\system32\OPVL.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GYXQJ.exe.bat" "100⤵PID:1256
-
C:\windows\SysWOW64\GYXQJ.exeC:\windows\system32\GYXQJ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VTG.exe.bat" "102⤵PID:3856
-
C:\windows\VTG.exeC:\windows\VTG.exe103⤵
- Executes dropped EXE
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QGLEE.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:4776 -
C:\windows\system\QGLEE.exeC:\windows\system\QGLEE.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QULSFE.exe.bat" "106⤵PID:2640
-
C:\windows\QULSFE.exeC:\windows\QULSFE.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUT.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6096 -
C:\windows\VUT.exeC:\windows\VUT.exe109⤵
- Executes dropped EXE
PID:3892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHYPZ.exe.bat" "110⤵
- Executes a command shell one-liner
PID:1976 -
C:\windows\system\QHYPZ.exeC:\windows\system\QHYPZ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZIACKD.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2544 -
C:\windows\system\ZIACKD.exeC:\windows\system\ZIACKD.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WNG.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4552 -
C:\windows\system\WNG.exeC:\windows\system\WNG.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNF.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:5800 -
C:\windows\CNF.exeC:\windows\CNF.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PLNRCTN.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1064 -
C:\windows\PLNRCTN.exeC:\windows\PLNRCTN.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TBUZOL.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:5664 -
C:\windows\SysWOW64\TBUZOL.exeC:\windows\system32\TBUZOL.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-