Analysis
- max time kernel
83s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 15:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_7abe31b6aec1ed6064de0f1e0ca74b2f_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-20_7abe31b6aec1ed6064de0f1e0ca74b2f_elex_emotet_stop.exe
- Size 208KB
- Sample260820-smwcdsszhs
- SHA256 9487707afcc289a9af0e7a67975a7f9366e829ff08008537aedd6bf80ae394b9
- MD5 7abe31b6aec1ed6064de0f1e0ca74b2f
- SHA1 4eb191a02a32009f00e3a8452379a9d034e9bd86
- SHA512 bd60b6226d5725657d2a652e12929f9b852de7ce51075f4aaec9d80a16a5a5d7b769bf4ca48aee1737eeedd490cb06f227c6e91a84fccbd66123ec4e8bfebdc9
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfL4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOzQEj1
- TLSH T141247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1840 GBNN.exe 2140 MRC.exe 3752 RSRNYN.exe 704 GISN.exe 4912 CSIDTLR.exe 3816 EQOYBUS.exe 4712 IYUY.exe 4672 OTUHR.exe 5900 OXXC.exe 3800 LCQ.exe 4160 UCSXRG.exe 1260 EAX.exe 4964 BBHTKKT.exe 5844 WDPSYVP.exe 1764 NWSIZB.exe 4640 GPITQ.exe 3364 DPKVUY.exe 3432 NFX.exe 1640 GIBTPEM.exe 4576 ETEB.exe 4296 ORR.exe 764 YOX.exe 4264 RRBMA.exe 5816 QCEC.exe 1632 FXVOTSY.exe 1848 OGP.exe 4300 SOETJ.exe 3444 TRHX.exe 4340 GBQODIT.exe 4560 BPVF.exe 2160 ZZY.exe 4696 PQHMUK.exe 3312 TGNM.exe 2732 RQQ.exe 3708 STUGV.exe 3904 QJN.exe 1828 OEEKUG.exe 4916 PIQ.exe 4564 OXBJNB.exe 2756 XYD.exe 5532 JOKODZJ.exe 5100 QEL.exe 5056 ABQ.exe 4272 CZEUGDQ.exe 3932 SPFT.exe 2624 QFQWAEM.exe 1908 VGA.exe 2404 OJEUR.exe 2012 BLM.exe 3516 HHMUCE.exe 4492 AZBFTF.exe 6084 ZKE.exe 5208 MVU.exe 4952 HIZDS.exe 5996 HLDGYLG.exe 5112 JJITNT.exe 4596 IULJW.exe 3948 RCNOZFF.exe 2720 HXXA.exe 3544 QVKUSAO.exe 5636 CNF.exe 5728 GVU.exe 1516 EOXDV.exe 2760 EUXSX.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\QWY.exe TEW.exe File opened for modification C:\windows\SysWOW64\GBNN.exe 2026-08-20_7abe31b6aec1ed6064de0f1e0ca74b2f_elex_emotet_stop.exe File created C:\windows\SysWOW64\GISN.exe RSRNYN.exe File opened for modification C:\windows\SysWOW64\NWSIZB.exe WDPSYVP.exe File created C:\windows\SysWOW64\DPKVUY.exe.bat GPITQ.exe File created C:\windows\SysWOW64\IULJW.exe.bat JJITNT.exe File created C:\windows\SysWOW64\EOXDV.exe.bat GVU.exe File created C:\windows\SysWOW64\AYV.exe.bat LDLPF.exe File created C:\windows\SysWOW64\CCQ.exe HHTRQQQ.exe File created C:\windows\SysWOW64\GISN.exe.bat RSRNYN.exe File opened for modification C:\windows\SysWOW64\GPITQ.exe NWSIZB.exe File opened for modification C:\windows\SysWOW64\RRBMA.exe YOX.exe File opened for modification C:\windows\SysWOW64\XYD.exe OXBJNB.exe File opened for modification C:\windows\SysWOW64\CPNRJ.exe PEESV.exe File created C:\windows\SysWOW64\DYZIV.exe ZNBNVVE.exe File created C:\windows\SysWOW64\XRFXIII.exe.bat TBZXW.exe File created C:\windows\SysWOW64\KIC.exe.bat CCQ.exe File created C:\windows\SysWOW64\GPITQ.exe.bat NWSIZB.exe File created C:\windows\SysWOW64\MVU.exe.bat ZKE.exe File opened for modification C:\windows\SysWOW64\IULJW.exe JJITNT.exe File opened for modification C:\windows\SysWOW64\AYV.exe LDLPF.exe File opened for modification C:\windows\SysWOW64\CCQ.exe HHTRQQQ.exe File created C:\windows\SysWOW64\NFX.exe.bat DPKVUY.exe File opened for modification C:\windows\SysWOW64\BPVF.exe GBQODIT.exe File opened for modification C:\windows\SysWOW64\LXDBZL.exe BAPH.exe File created C:\windows\SysWOW64\LRWTYNK.exe.bat ZYHI.exe File opened for modification C:\windows\SysWOW64\XRFXIII.exe TBZXW.exe File created C:\windows\SysWOW64\KIC.exe CCQ.exe File created C:\windows\SysWOW64\DPKVUY.exe GPITQ.exe File created C:\windows\SysWOW64\OXBJNB.exe.bat PIQ.exe File created C:\windows\SysWOW64\XYD.exe OXBJNB.exe File opened for modification C:\windows\SysWOW64\QEL.exe JOKODZJ.exe File created C:\windows\SysWOW64\HXXA.exe.bat RCNOZFF.exe File created C:\windows\SysWOW64\LXDBZL.exe.bat BAPH.exe File created C:\windows\SysWOW64\RQQ.exe TGNM.exe File created C:\windows\SysWOW64\QEL.exe.bat JOKODZJ.exe File opened for modification C:\windows\SysWOW64\ZKE.exe AZBFTF.exe File created C:\windows\SysWOW64\QWY.exe.bat TEW.exe File created C:\windows\SysWOW64\CSIDTLR.exe.bat GISN.exe File created C:\windows\SysWOW64\NFX.exe DPKVUY.exe File created C:\windows\SysWOW64\BPVF.exe GBQODIT.exe File created C:\windows\SysWOW64\IULJW.exe JJITNT.exe File created C:\windows\SysWOW64\GES.exe XDQRN.exe File created C:\windows\SysWOW64\FYIV.exe XKVP.exe File created C:\windows\SysWOW64\FYIV.exe.bat XKVP.exe File created C:\windows\SysWOW64\ZYHI.exe.bat XLCZENO.exe File created C:\windows\SysWOW64\GPITQ.exe NWSIZB.exe File opened for modification C:\windows\SysWOW64\FYIV.exe XKVP.exe File opened for modification C:\windows\SysWOW64\LRWTYNK.exe ZYHI.exe File opened for modification C:\windows\SysWOW64\QWY.exe TEW.exe File opened for modification C:\windows\SysWOW64\DYZIV.exe ZNBNVVE.exe File created C:\windows\SysWOW64\CCQ.exe.bat HHTRQQQ.exe File created C:\windows\SysWOW64\CSIDTLR.exe GISN.exe File created C:\windows\SysWOW64\QEL.exe JOKODZJ.exe File created C:\windows\SysWOW64\HXXA.exe RCNOZFF.exe File created C:\windows\SysWOW64\EOXDV.exe GVU.exe File created C:\windows\SysWOW64\BPVF.exe.bat GBQODIT.exe File created C:\windows\SysWOW64\MVU.exe ZKE.exe File opened for modification C:\windows\SysWOW64\HXXA.exe RCNOZFF.exe File created C:\windows\SysWOW64\CPNRJ.exe.bat PEESV.exe File created C:\windows\SysWOW64\GBNN.exe.bat 2026-08-20_7abe31b6aec1ed6064de0f1e0ca74b2f_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\CSIDTLR.exe GISN.exe File opened for modification C:\windows\SysWOW64\RQQ.exe TGNM.exe File created C:\windows\SysWOW64\AYV.exe LDLPF.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\KUF.exe EUXSX.exe File created C:\windows\system\PPV.exe LHOTTV.exe File opened for modification C:\windows\system\HHTRQQQ.exe XRFXIII.exe File created C:\windows\system\BBHTKKT.exe.bat EAX.exe File opened for modification C:\windows\OGP.exe FXVOTSY.exe File created C:\windows\QUMTX.exe KUF.exe File created C:\windows\BAPH.exe CPNRJ.exe File opened for modification C:\windows\system\XLCZENO.exe LXDBZL.exe File created C:\windows\EAX.exe.bat UCSXRG.exe File created C:\windows\system\ORR.exe.bat ETEB.exe File created C:\windows\PQHMUK.exe.bat ZZY.exe File created C:\windows\JOKODZJ.exe XYD.exe File created C:\windows\system\QAEIY.exe QUMTX.exe File created C:\windows\YZTZE.exe.bat ZPI.exe File opened for modification C:\windows\system\XKVP.exe YZTZE.exe File created C:\windows\UCSXRG.exe.bat LCQ.exe File created C:\windows\QCEC.exe RRBMA.exe File created C:\windows\system\ABQ.exe.bat QEL.exe File opened for modification C:\windows\VGA.exe QFQWAEM.exe File created C:\windows\system\PPV.exe.bat LHOTTV.exe File created C:\windows\HIZDS.exe MVU.exe File opened for modification C:\windows\UCSXRG.exe LCQ.exe File created C:\windows\YOX.exe ORR.exe File created C:\windows\system\TRHX.exe SOETJ.exe File created C:\windows\TGNM.exe.bat PQHMUK.exe File created C:\windows\system\STUGV.exe RQQ.exe File created C:\windows\system\JJITNT.exe.bat HLDGYLG.exe File created C:\windows\SSPU.exe RPMQR.exe File opened for modification C:\windows\system\OXXC.exe OTUHR.exe File created C:\windows\LCQ.exe.bat OXXC.exe File created C:\windows\EAX.exe UCSXRG.exe File opened for modification C:\windows\JOKODZJ.exe XYD.exe File created C:\windows\SPFT.exe CZEUGDQ.exe File opened for modification C:\windows\HHMUCE.exe BLM.exe File opened for modification C:\windows\RCNOZFF.exe IULJW.exe File opened for modification C:\windows\QUMTX.exe KUF.exe File opened for modification C:\windows\system\ZZY.exe BPVF.exe File created C:\windows\EUXSX.exe EOXDV.exe File opened for modification C:\windows\system\QAEIY.exe QUMTX.exe File created C:\windows\XDQRN.exe.bat TNJRICL.exe File created C:\windows\VHBI.exe GES.exe File created C:\windows\system\XKVP.exe YZTZE.exe File created C:\windows\system\XLCZENO.exe LXDBZL.exe File created C:\windows\EQOYBUS.exe CSIDTLR.exe File created C:\windows\JOKODZJ.exe.bat XYD.exe File opened for modification C:\windows\system\JJITNT.exe HLDGYLG.exe File created C:\windows\system\KUF.exe.bat EUXSX.exe File created C:\windows\SSPU.exe.bat RPMQR.exe File created C:\windows\system\MRC.exe.bat GBNN.exe File created C:\windows\OTUHR.exe IYUY.exe File created C:\windows\YOX.exe.bat ORR.exe File created C:\windows\system\QJN.exe.bat STUGV.exe File created C:\windows\system\QFQWAEM.exe.bat SPFT.exe File created C:\windows\system\QVKUSAO.exe HXXA.exe File created C:\windows\system\BBHTKKT.exe EAX.exe File opened for modification C:\windows\system\BBHTKKT.exe EAX.exe File opened for modification C:\windows\system\TRHX.exe SOETJ.exe File created C:\windows\system\TRHX.exe.bat SOETJ.exe File opened for modification C:\windows\TGNM.exe PQHMUK.exe File created C:\windows\system\GVU.exe.bat CNF.exe File created C:\windows\system\XKVP.exe.bat YZTZE.exe File created C:\windows\system\NDN.exe.bat FYIV.exe File created C:\windows\IYUY.exe.bat EQOYBUS.exe File created C:\windows\BAPH.exe.bat CPNRJ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4180 cmd.exe 1536 cmd.exe 3420 cmd.exe 4336 cmd.exe 2364 cmd.exe 5812 cmd.exe 3000 cmd.exe 5164 cmd.exe 6128 cmd.exe 1108 cmd.exe 3860 cmd.exe 4276 cmd.exe 4032 cmd.exe 4972 cmd.exe 3836 cmd.exe 5916 cmd.exe 1868 cmd.exe 2496 cmd.exe 5352 cmd.exe 6048 cmd.exe 1132 cmd.exe 1832 cmd.exe 1844 cmd.exe 6116 cmd.exe 5384 cmd.exe 5184 cmd.exe 3576 cmd.exe 5592 cmd.exe 4968 cmd.exe 2476 cmd.exe 5432 cmd.exe 4668 cmd.exe 1440 cmd.exe 4920 cmd.exe 2320 cmd.exe 1040 cmd.exe 1088 cmd.exe 2020 cmd.exe 5516 cmd.exe 2736 cmd.exe 2260 cmd.exe 5560 cmd.exe 5504 cmd.exe 6112 cmd.exe 1272 cmd.exe 1192 cmd.exe 4556 cmd.exe 5696 cmd.exe 3940 cmd.exe 5408 cmd.exe 5008 cmd.exe 4352 cmd.exe 5784 cmd.exe 2992 cmd.exe 5548 cmd.exe 1452 cmd.exe 5520 cmd.exe 2520 cmd.exe 3292 cmd.exe 5172 cmd.exe 2924 cmd.exe 1680 cmd.exe 2576 cmd.exe 2028 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4684 4600 WerFault.exe 88 1936 1840 WerFault.exe 93 1316 2140 WerFault.exe 99 2620 3752 WerFault.exe 104 1904 704 WerFault.exe 109 5256 4912 WerFault.exe 114 5412 3816 WerFault.exe 119 2080 4712 WerFault.exe 124 3716 4672 WerFault.exe 129 1468 5900 WerFault.exe 134 2376 3800 WerFault.exe 139 4644 4160 WerFault.exe 144 4148 1260 WerFault.exe 149 5536 4964 WerFault.exe 154 1568 5844 WerFault.exe 159 1832 1764 WerFault.exe 164 3420 4640 WerFault.exe 169 1844 3364 WerFault.exe 174 2148 3432 WerFault.exe 179 5424 1640 WerFault.exe 184 2912 4576 WerFault.exe 189 4140 4296 WerFault.exe 194 3340 764 WerFault.exe 199 2772 4264 WerFault.exe 204 3708 5816 WerFault.exe 209 4880 1632 WerFault.exe 214 2444 1848 WerFault.exe 219 2856 4300 WerFault.exe 224 5888 3444 WerFault.exe 229 5972 4340 WerFault.exe 234 3544 4560 WerFault.exe 239 5020 2160 WerFault.exe 244 4572 4696 WerFault.exe 249 4308 3312 WerFault.exe 254 2968 2732 WerFault.exe 259 5960 3708 WerFault.exe 264 5044 3904 WerFault.exe 270 5548 1828 WerFault.exe 275 5888 4916 WerFault.exe 280 2720 4564 WerFault.exe 285 3544 2756 WerFault.exe 290 5152 5532 WerFault.exe 295 6112 5100 WerFault.exe 300 3760 5056 WerFault.exe 305 936 4272 WerFault.exe 310 4824 3932 WerFault.exe 315 1984 2624 WerFault.exe 320 4312 1908 WerFault.exe 325 5888 2404 WerFault.exe 330 2148 2012 WerFault.exe 335 4212 3516 WerFault.exe 340 5376 4492 WerFault.exe 345 4684 6084 WerFault.exe 350 3336 5208 WerFault.exe 355 1872 4952 WerFault.exe 360 6052 5996 WerFault.exe 365 3356 5112 WerFault.exe 370 2584 4596 WerFault.exe 375 1040 3948 WerFault.exe 380 1440 2720 WerFault.exe 385 3132 3544 WerFault.exe 390 1480 5636 WerFault.exe 395 5012 5728 WerFault.exe 400 5536 1516 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OXBJNB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSPU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SOETJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRHX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XDQRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEEKUG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZBFTF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LRWTYNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHOTTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYZIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GPITQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VHBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUAXDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QWY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBHTKKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWSIZB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPFT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LDLPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZYHI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4600 2026-08-20_7abe31b6aec1ed6064de0f1e0ca74b2f_elex_emotet_stop.exe 4600 2026-08-20_7abe31b6aec1ed6064de0f1e0ca74b2f_elex_emotet_stop.exe 1840 GBNN.exe 1840 GBNN.exe 2140 MRC.exe 2140 MRC.exe 3752 RSRNYN.exe 3752 RSRNYN.exe 704 GISN.exe 704 GISN.exe 4912 CSIDTLR.exe 4912 CSIDTLR.exe 3816 EQOYBUS.exe 3816 EQOYBUS.exe 4712 IYUY.exe 4712 IYUY.exe 4672 OTUHR.exe 4672 OTUHR.exe 5900 OXXC.exe 5900 OXXC.exe 3800 LCQ.exe 3800 LCQ.exe 4160 UCSXRG.exe 4160 UCSXRG.exe 1260 EAX.exe 1260 EAX.exe 4964 BBHTKKT.exe 4964 BBHTKKT.exe 5844 WDPSYVP.exe 5844 WDPSYVP.exe 1764 NWSIZB.exe 1764 NWSIZB.exe 4640 GPITQ.exe 4640 GPITQ.exe 3364 DPKVUY.exe 3364 DPKVUY.exe 3432 NFX.exe 3432 NFX.exe 1640 GIBTPEM.exe 1640 GIBTPEM.exe 4576 ETEB.exe 4576 ETEB.exe 4296 ORR.exe 4296 ORR.exe 764 YOX.exe 764 YOX.exe 4264 RRBMA.exe 4264 RRBMA.exe 5816 QCEC.exe 5816 QCEC.exe 1632 FXVOTSY.exe 1632 FXVOTSY.exe 1848 OGP.exe 1848 OGP.exe 4300 SOETJ.exe 4300 SOETJ.exe 3444 TRHX.exe 3444 TRHX.exe 4340 GBQODIT.exe 4340 GBQODIT.exe 4560 BPVF.exe 4560 BPVF.exe 2160 ZZY.exe 2160 ZZY.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4600 2026-08-20_7abe31b6aec1ed6064de0f1e0ca74b2f_elex_emotet_stop.exe 4600 2026-08-20_7abe31b6aec1ed6064de0f1e0ca74b2f_elex_emotet_stop.exe 1840 GBNN.exe 1840 GBNN.exe 2140 MRC.exe 2140 MRC.exe 3752 RSRNYN.exe 3752 RSRNYN.exe 704 GISN.exe 704 GISN.exe 4912 CSIDTLR.exe 4912 CSIDTLR.exe 3816 EQOYBUS.exe 3816 EQOYBUS.exe 4712 IYUY.exe 4712 IYUY.exe 4672 OTUHR.exe 4672 OTUHR.exe 5900 OXXC.exe 5900 OXXC.exe 3800 LCQ.exe 3800 LCQ.exe 4160 UCSXRG.exe 4160 UCSXRG.exe 1260 EAX.exe 1260 EAX.exe 4964 BBHTKKT.exe 4964 BBHTKKT.exe 5844 WDPSYVP.exe 5844 WDPSYVP.exe 1764 NWSIZB.exe 1764 NWSIZB.exe 4640 GPITQ.exe 4640 GPITQ.exe 3364 DPKVUY.exe 3364 DPKVUY.exe 3432 NFX.exe 3432 NFX.exe 1640 GIBTPEM.exe 1640 GIBTPEM.exe 4576 ETEB.exe 4576 ETEB.exe 4296 ORR.exe 4296 ORR.exe 764 YOX.exe 764 YOX.exe 4264 RRBMA.exe 4264 RRBMA.exe 5816 QCEC.exe 5816 QCEC.exe 1632 FXVOTSY.exe 1632 FXVOTSY.exe 1848 OGP.exe 1848 OGP.exe 4300 SOETJ.exe 4300 SOETJ.exe 3444 TRHX.exe 3444 TRHX.exe 4340 GBQODIT.exe 4340 GBQODIT.exe 4560 BPVF.exe 4560 BPVF.exe 2160 ZZY.exe 2160 ZZY.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4600 wrote to memory of 4960 4600 2026-08-20_7abe31b6aec1ed6064de0f1e0ca74b2f_elex_emotet_stop.exe 89 PID 4960 wrote to memory of 1840 4960 cmd.exe 93 PID 1840 wrote to memory of 2944 1840 GBNN.exe 95 PID 2944 wrote to memory of 2140 2944 cmd.exe 99 PID 2140 wrote to memory of 4584 2140 MRC.exe 100 PID 4584 wrote to memory of 3752 4584 cmd.exe 104 PID 3752 wrote to memory of 2920 3752 RSRNYN.exe 105 PID 2920 wrote to memory of 704 2920 cmd.exe 109 PID 704 wrote to memory of 5176 704 GISN.exe 110 PID 5176 wrote to memory of 4912 5176 cmd.exe 114 PID 4912 wrote to memory of 4896 4912 CSIDTLR.exe 115 PID 4896 wrote to memory of 3816 4896 cmd.exe 119 PID 3816 wrote to memory of 2260 3816 EQOYBUS.exe 120 PID 2260 wrote to memory of 4712 2260 cmd.exe 124 PID 4712 wrote to memory of 4180 4712 IYUY.exe 125 PID 4180 wrote to memory of 4672 4180 cmd.exe 129 PID 4672 wrote to memory of 2608 4672 OTUHR.exe 130 PID 2608 wrote to memory of 5900 2608 cmd.exe 134 PID 5900 wrote to memory of 1868 5900 OXXC.exe 135 PID 1868 wrote to memory of 3800 1868 cmd.exe 139 PID 3800 wrote to memory of 1424 3800 LCQ.exe 140 PID 1424 wrote to memory of 4160 1424 cmd.exe 144 PID 4160 wrote to memory of 5560 4160 UCSXRG.exe 145 PID 5560 wrote to memory of 1260 5560 cmd.exe 149 PID 1260 wrote to memory of 2364 1260 EAX.exe 150 PID 2364 wrote to memory of 4964 2364 cmd.exe 154 PID 4964 wrote to memory of 5312 4964 BBHTKKT.exe 155 PID 5312 wrote to memory of 5844 5312 cmd.exe 159 PID 5844 wrote to memory of 5156 5844 WDPSYVP.exe 160 PID 5156 wrote to memory of 1764 5156 cmd.exe 164 PID 1764 wrote to memory of 5812 1764 NWSIZB.exe 165 PID 5812 wrote to memory of 4640 5812 cmd.exe 169 PID 4640 wrote to memory of 3764 4640 GPITQ.exe 170 PID 3764 wrote to memory of 3364 3764 cmd.exe 174 PID 3364 wrote to memory of 5904 3364 DPKVUY.exe 175 PID 5904 wrote to memory of 3432 5904 cmd.exe 179 PID 3432 wrote to memory of 4416 3432 NFX.exe 180 PID 4416 wrote to memory of 1640 4416 cmd.exe 184 PID 1640 wrote to memory of 3868 1640 GIBTPEM.exe 185 PID 3868 wrote to memory of 4576 3868 cmd.exe 189 PID 4576 wrote to memory of 2052 4576 ETEB.exe 190 PID 2052 wrote to memory of 4296 2052 cmd.exe 194 PID 4296 wrote to memory of 1808 4296 ORR.exe 195 PID 1808 wrote to memory of 764 1808 cmd.exe 199 PID 764 wrote to memory of 3860 764 YOX.exe 200 PID 3860 wrote to memory of 4264 3860 cmd.exe 204 PID 4264 wrote to memory of 2416 4264 RRBMA.exe 205 PID 2416 wrote to memory of 5816 2416 cmd.exe 209 PID 5816 wrote to memory of 3296 5816 QCEC.exe 210 PID 3296 wrote to memory of 1632 3296 cmd.exe 214 PID 1632 wrote to memory of 3748 1632 FXVOTSY.exe 215 PID 3748 wrote to memory of 1848 3748 cmd.exe 219 PID 1848 wrote to memory of 756 1848 OGP.exe 220 PID 756 wrote to memory of 4300 756 cmd.exe 224 PID 4300 wrote to memory of 3940 4300 SOETJ.exe 225 PID 3940 wrote to memory of 3444 3940 cmd.exe 229 PID 3444 wrote to memory of 4920 3444 TRHX.exe 230 PID 4920 wrote to memory of 4340 4920 cmd.exe 234 PID 4340 wrote to memory of 1896 4340 GBQODIT.exe 235 PID 1896 wrote to memory of 4560 1896 cmd.exe 239 PID 4560 wrote to memory of 5408 4560 BPVF.exe 240 PID 5408 wrote to memory of 2160 5408 cmd.exe 244 PID 2160 wrote to memory of 6072 2160 ZZY.exe 245 PID 6072 wrote to memory of 4696 6072 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_7abe31b6aec1ed6064de0f1e0ca74b2f_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_7abe31b6aec1ed6064de0f1e0ca74b2f_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GBNN.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\windows\SysWOW64\GBNN.exeC:\windows\system32\GBNN.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRC.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\windows\system\MRC.exeC:\windows\system\MRC.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSRNYN.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\windows\system\RSRNYN.exeC:\windows\system\RSRNYN.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GISN.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\windows\SysWOW64\GISN.exeC:\windows\system32\GISN.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CSIDTLR.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\windows\SysWOW64\CSIDTLR.exeC:\windows\system32\CSIDTLR.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQOYBUS.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\windows\EQOYBUS.exeC:\windows\EQOYBUS.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYUY.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\windows\IYUY.exeC:\windows\IYUY.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTUHR.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\windows\OTUHR.exeC:\windows\OTUHR.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXXC.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\windows\system\OXXC.exeC:\windows\system\OXXC.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCQ.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\windows\LCQ.exeC:\windows\LCQ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCSXRG.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\windows\UCSXRG.exeC:\windows\UCSXRG.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EAX.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\windows\EAX.exeC:\windows\EAX.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBHTKKT.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\windows\system\BBHTKKT.exeC:\windows\system\BBHTKKT.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDPSYVP.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\windows\WDPSYVP.exeC:\windows\WDPSYVP.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NWSIZB.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\windows\SysWOW64\NWSIZB.exeC:\windows\system32\NWSIZB.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GPITQ.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\windows\SysWOW64\GPITQ.exeC:\windows\system32\GPITQ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DPKVUY.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\windows\SysWOW64\DPKVUY.exeC:\windows\system32\DPKVUY.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NFX.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\windows\SysWOW64\NFX.exeC:\windows\system32\NFX.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GIBTPEM.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\windows\system\GIBTPEM.exeC:\windows\system\GIBTPEM.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ETEB.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\windows\ETEB.exeC:\windows\ETEB.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORR.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\windows\system\ORR.exeC:\windows\system\ORR.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOX.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\windows\YOX.exeC:\windows\YOX.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RRBMA.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\windows\SysWOW64\RRBMA.exeC:\windows\system32\RRBMA.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCEC.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\windows\QCEC.exeC:\windows\QCEC.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXVOTSY.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\windows\system\FXVOTSY.exeC:\windows\system\FXVOTSY.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OGP.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\windows\OGP.exeC:\windows\OGP.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SOETJ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\windows\SOETJ.exeC:\windows\SOETJ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRHX.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\windows\system\TRHX.exeC:\windows\system\TRHX.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GBQODIT.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\windows\GBQODIT.exeC:\windows\GBQODIT.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BPVF.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\windows\SysWOW64\BPVF.exeC:\windows\system32\BPVF.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZY.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\windows\system\ZZY.exeC:\windows\system\ZZY.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PQHMUK.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\windows\PQHMUK.exeC:\windows\PQHMUK.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TGNM.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5384 -
C:\windows\TGNM.exeC:\windows\TGNM.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RQQ.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3260 -
C:\windows\SysWOW64\RQQ.exeC:\windows\system32\RQQ.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STUGV.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2028 -
C:\windows\system\STUGV.exeC:\windows\system\STUGV.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJN.exe.bat" "72⤵
- Executes a command shell one-liner
PID:1536 -
C:\windows\system\QJN.exeC:\windows\system\QJN.exe73⤵
- Executes dropped EXE
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OEEKUG.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1832 -
C:\windows\system\OEEKUG.exeC:\windows\system\OEEKUG.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PIQ.exe.bat" "76⤵PID:2492
-
C:\windows\system\PIQ.exeC:\windows\system\PIQ.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OXBJNB.exe.bat" "78⤵PID:4872
-
C:\windows\SysWOW64\OXBJNB.exeC:\windows\system32\OXBJNB.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XYD.exe.bat" "80⤵PID:3856
-
C:\windows\SysWOW64\XYD.exeC:\windows\system32\XYD.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JOKODZJ.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:2428 -
C:\windows\JOKODZJ.exeC:\windows\JOKODZJ.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEL.exe.bat" "84⤵PID:1164
-
C:\windows\SysWOW64\QEL.exeC:\windows\system32\QEL.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABQ.exe.bat" "86⤵PID:2956
-
C:\windows\system\ABQ.exeC:\windows\system\ABQ.exe87⤵
- Executes dropped EXE
PID:5056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZEUGDQ.exe.bat" "88⤵PID:2544
-
C:\windows\system\CZEUGDQ.exeC:\windows\system\CZEUGDQ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SPFT.exe.bat" "90⤵PID:4168
-
C:\windows\SPFT.exeC:\windows\SPFT.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFQWAEM.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3000 -
C:\windows\system\QFQWAEM.exeC:\windows\system\QFQWAEM.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VGA.exe.bat" "94⤵PID:2284
-
C:\windows\VGA.exeC:\windows\VGA.exe95⤵
- Executes dropped EXE
PID:1908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OJEUR.exe.bat" "96⤵
- Executes a command shell one-liner
PID:5164 -
C:\windows\SysWOW64\OJEUR.exeC:\windows\system32\OJEUR.exe97⤵
- Executes dropped EXE
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BLM.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2736 -
C:\windows\system\BLM.exeC:\windows\system\BLM.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HHMUCE.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2320 -
C:\windows\HHMUCE.exeC:\windows\HHMUCE.exe101⤵
- Executes dropped EXE
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AZBFTF.exe.bat" "102⤵PID:5416
-
C:\windows\AZBFTF.exeC:\windows\AZBFTF.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZKE.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2576 -
C:\windows\SysWOW64\ZKE.exeC:\windows\system32\ZKE.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVU.exe.bat" "106⤵PID:5360
-
C:\windows\SysWOW64\MVU.exeC:\windows\system32\MVU.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIZDS.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5696 -
C:\windows\HIZDS.exeC:\windows\HIZDS.exe109⤵
- Executes dropped EXE
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HLDGYLG.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:1936 -
C:\windows\system\HLDGYLG.exeC:\windows\system\HLDGYLG.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJITNT.exe.bat" "112⤵PID:256
-
C:\windows\system\JJITNT.exeC:\windows\system\JJITNT.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IULJW.exe.bat" "114⤵PID:2392
-
C:\windows\SysWOW64\IULJW.exeC:\windows\system32\IULJW.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RCNOZFF.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1844 -
C:\windows\RCNOZFF.exeC:\windows\RCNOZFF.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXXA.exe.bat" "118⤵PID:4780
-
C:\windows\SysWOW64\HXXA.exeC:\windows\system32\HXXA.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QVKUSAO.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1452 -
C:\windows\system\QVKUSAO.exeC:\windows\system\QVKUSAO.exe121⤵
- Executes dropped EXE
PID:3544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-