Analysis
- max time kernel
86s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/09/2026, 23:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-03_bf9be4f2232845f594129566df799e30_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-03_bf9be4f2232845f594129566df799e30_elex_emotet_stop.exe
- Size 208KB
- Sample260903-3xt77acc89
- SHA256 3cd3fb87cc7653c957f8febbbcb32520e4f22878f209645851305d36c7a43d61
- MD5 bf9be4f2232845f594129566df799e30
- SHA1 9d0e4e523f13008c996bd6f39d55ea61c4822892
- SHA512 bfbf7c519f49135e01ece67b0ab6251c9381a6c210df00f90bce6d3c6a56442397afc816b00ea573baac09854e824c041db84857c300ce78fa0c42391234db6d
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUtL+LOfx4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUp+LOpkEj1
- TLSH T107247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4756 VJCGPG.exe 6016 PHHRF.exe 1648 HKNJF.exe 3756 KXFL.exe 4764 XDFWB.exe 3696 JLYWWL.exe 4132 PHJPCH.exe 2376 KMJB.exe 1152 JXGJWKU.exe 4392 VARX.exe 4932 RGDAQU.exe 1860 QRGQY.exe 1324 YETXJ.exe 5628 GKYE.exe 5220 CPQ.exe 4508 MNVNRJQ.exe 5824 QQUIR.exe 3264 NVMY.exe 2568 LGP.exe 4592 VPRT.exe 5732 CZOBLIA.exe 2424 VAVMVJI.exe 4284 NVZI.exe 2744 DLAHHUG.exe 2448 WDPSYVP.exe 5848 RZUB.exe 6012 AZWGMS.exe 4616 PUG.exe 5296 FKHKDBD.exe 6120 JANS.exe 4948 SAPXT.exe 248 HDZ.exe 1400 IYDFK.exe 624 FZMIVX.exe 5148 YSCT.exe 912 APHN.exe 2492 VVHZWSM.exe 5004 IYYPK.exe 480 YOZP.exe 2692 NJITCDF.exe 4196 ECLJLR.exe 1216 MHYQV.exe 4324 RIAA.exe 2968 JDD.exe 5132 NTSWRC.exe 6028 ZBZ.exe 5752 DRFEP.exe 1396 BME.exe 6136 EAJWW.exe 2988 MFODH.exe 1928 KFVQQ.exe 2912 VVCQ.exe 1504 QJHAMS.exe 1032 QOHOOFU.exe 4464 UEOW.exe 1872 PSSGKX.exe 5892 GSULOVZ.exe 1608 IQAFVDI.exe 4516 SNOZ.exe 3956 WEUA.exe 5796 LUVZW.exe 1272 RUDNFTD.exe 2824 VCKNR.exe 3972 VHKBA.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\RGDAQU.exe VARX.exe File created C:\windows\SysWOW64\NVMY.exe.bat QQUIR.exe File created C:\windows\SysWOW64\VVCQ.exe KFVQQ.exe File created C:\windows\SysWOW64\WEUA.exe SNOZ.exe File created C:\windows\SysWOW64\PTB.exe.bat AYSUG.exe File opened for modification C:\windows\SysWOW64\YFIO.exe EJEEHOS.exe File created C:\windows\SysWOW64\LBGMV.exe.bat AIDU.exe File created C:\windows\SysWOW64\AJPN.exe.bat RBNAMCE.exe File created C:\windows\SysWOW64\GKYE.exe.bat YETXJ.exe File created C:\windows\SysWOW64\AZWGMS.exe RZUB.exe File opened for modification C:\windows\SysWOW64\WEUA.exe SNOZ.exe File opened for modification C:\windows\SysWOW64\YWGOHR.exe PWEJD.exe File created C:\windows\SysWOW64\NJVIYI.exe.bat SWRZ.exe File opened for modification C:\windows\SysWOW64\BMTJVX.exe AJPN.exe File opened for modification C:\windows\SysWOW64\FZMIVX.exe IYDFK.exe File created C:\windows\SysWOW64\JDD.exe.bat RIAA.exe File created C:\windows\SysWOW64\NJVIYI.exe SWRZ.exe File created C:\windows\SysWOW64\BMTJVX.exe AJPN.exe File created C:\windows\SysWOW64\JDD.exe RIAA.exe File created C:\windows\SysWOW64\OVGIA.exe IVYUR.exe File created C:\windows\SysWOW64\IWFCE.exe.bat PTB.exe File created C:\windows\SysWOW64\VOHYB.exe IDYHN.exe File created C:\windows\SysWOW64\RGDAQU.exe VARX.exe File opened for modification C:\windows\SysWOW64\MHYQV.exe ECLJLR.exe File opened for modification C:\windows\SysWOW64\VVCQ.exe KFVQQ.exe File created C:\windows\SysWOW64\VCKNR.exe.bat RUDNFTD.exe File created C:\windows\SysWOW64\IVYUR.exe.bat ZNWPNJT.exe File opened for modification C:\windows\SysWOW64\IWFCE.exe PTB.exe File created C:\windows\SysWOW64\IDYHN.exe.bat YCWU.exe File created C:\windows\SysWOW64\FOS.exe TYMNG.exe File opened for modification C:\windows\SysWOW64\AZWGMS.exe RZUB.exe File created C:\windows\SysWOW64\VVCQ.exe.bat KFVQQ.exe File created C:\windows\SysWOW64\IVYUR.exe ZNWPNJT.exe File created C:\windows\SysWOW64\PTB.exe AYSUG.exe File opened for modification C:\windows\SysWOW64\VOHYB.exe IDYHN.exe File created C:\windows\SysWOW64\LBGMV.exe AIDU.exe File opened for modification C:\windows\SysWOW64\NVMY.exe QQUIR.exe File created C:\windows\SysWOW64\FZMIVX.exe IYDFK.exe File created C:\windows\SysWOW64\GSULOVZ.exe.bat PSSGKX.exe File created C:\windows\SysWOW64\HYQ.exe VHKBA.exe File created C:\windows\SysWOW64\IDYHN.exe YCWU.exe File created C:\windows\SysWOW64\VOHYB.exe.bat IDYHN.exe File opened for modification C:\windows\SysWOW64\AJPN.exe RBNAMCE.exe File opened for modification C:\windows\SysWOW64\JDD.exe RIAA.exe File created C:\windows\SysWOW64\EAJWW.exe.bat BME.exe File created C:\windows\SysWOW64\KFVQQ.exe.bat MFODH.exe File created C:\windows\SysWOW64\YWGOHR.exe.bat PWEJD.exe File opened for modification C:\windows\SysWOW64\OVGIA.exe IVYUR.exe File opened for modification C:\windows\SysWOW64\FOS.exe TYMNG.exe File created C:\windows\SysWOW64\NVMY.exe QQUIR.exe File created C:\windows\SysWOW64\YETXJ.exe.bat QRGQY.exe File created C:\windows\SysWOW64\AZWGMS.exe.bat RZUB.exe File created C:\windows\SysWOW64\WEUA.exe.bat SNOZ.exe File created C:\windows\SysWOW64\PUG.exe AZWGMS.exe File created C:\windows\SysWOW64\FKHKDBD.exe.bat PUG.exe File created C:\windows\SysWOW64\FZMIVX.exe.bat IYDFK.exe File created C:\windows\SysWOW64\HYQ.exe.bat VHKBA.exe File opened for modification C:\windows\SysWOW64\IVYUR.exe ZNWPNJT.exe File opened for modification C:\windows\SysWOW64\PTB.exe AYSUG.exe File created C:\windows\SysWOW64\SWRZ.exe YBMHLJP.exe File created C:\windows\SysWOW64\AAEN.exe FMZ.exe File created C:\windows\SysWOW64\JXGJWKU.exe KMJB.exe File created C:\windows\SysWOW64\YETXJ.exe QRGQY.exe File created C:\windows\SysWOW64\PUG.exe.bat AZWGMS.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\DRFEP.exe ZBZ.exe File opened for modification C:\windows\MFODH.exe EAJWW.exe File opened for modification C:\windows\system\XDFWB.exe KXFL.exe File created C:\windows\system\JLYWWL.exe.bat XDFWB.exe File opened for modification C:\windows\system\MNVNRJQ.exe CPQ.exe File created C:\windows\QQUIR.exe MNVNRJQ.exe File created C:\windows\VPRT.exe LGP.exe File created C:\windows\IYDFK.exe HDZ.exe File opened for modification C:\windows\system\CZOBLIA.exe VPRT.exe File created C:\windows\system\RZUB.exe.bat WDPSYVP.exe File opened for modification C:\windows\system\QOHOOFU.exe QJHAMS.exe File created C:\windows\LUVZW.exe WEUA.exe File opened for modification C:\windows\OJM.exe PQJM.exe File created C:\windows\system\POUA.exe.bat FOS.exe File created C:\windows\EJEEHOS.exe POUA.exe File opened for modification C:\windows\XPT.exe YFIO.exe File opened for modification C:\windows\system\HKNJF.exe PHHRF.exe File opened for modification C:\windows\system\NVZI.exe VAVMVJI.exe File created C:\windows\system\NTSWRC.exe.bat JDD.exe File created C:\windows\MFODH.exe.bat EAJWW.exe File created C:\windows\system\QOHOOFU.exe.bat QJHAMS.exe File created C:\windows\PQJM.exe OVGIA.exe File opened for modification C:\windows\system\BVIRBO.exe AAEN.exe File created C:\windows\system\AIDU.exe WAWUJIS.exe File created C:\windows\KXFL.exe.bat HKNJF.exe File opened for modification C:\windows\system\JLYWWL.exe XDFWB.exe File opened for modification C:\windows\system\CPQ.exe GKYE.exe File opened for modification C:\windows\system\VVHZWSM.exe APHN.exe File created C:\windows\IQAFVDI.exe GSULOVZ.exe File opened for modification C:\windows\FYYPW.exe HYQ.exe File created C:\windows\FMZ.exe NJVIYI.exe File opened for modification C:\windows\EJEEHOS.exe POUA.exe File opened for modification C:\windows\PHJPCH.exe JLYWWL.exe File opened for modification C:\windows\WDPSYVP.exe DLAHHUG.exe File created C:\windows\SAPXT.exe JANS.exe File opened for modification C:\windows\IQAFVDI.exe GSULOVZ.exe File created C:\windows\system\RUDNFTD.exe LUVZW.exe File created C:\windows\FYYPW.exe HYQ.exe File created C:\windows\EWN.exe.bat YWGOHR.exe File created C:\windows\system\VEPP.exe EWN.exe File created C:\windows\VJCGPG.exe 2026-09-03_bf9be4f2232845f594129566df799e30_elex_emotet_stop.exe File created C:\windows\VJCGPG.exe.bat 2026-09-03_bf9be4f2232845f594129566df799e30_elex_emotet_stop.exe File created C:\windows\system\CZOBLIA.exe VPRT.exe File opened for modification C:\windows\IYDFK.exe HDZ.exe File opened for modification C:\windows\system\SNOZ.exe IQAFVDI.exe File created C:\windows\system\RUDNFTD.exe.bat LUVZW.exe File created C:\windows\AYSUG.exe WQDUTS.exe File created C:\windows\AYSUG.exe.bat WQDUTS.exe File created C:\windows\QRGQY.exe RGDAQU.exe File opened for modification C:\windows\system\ECLJLR.exe NJITCDF.exe File created C:\windows\EWN.exe YWGOHR.exe File opened for modification C:\windows\ZWHHIS.exe IWFCE.exe File created C:\windows\system\RBNAMCE.exe.bat LBGMV.exe File created C:\windows\system\CPQ.exe GKYE.exe File opened for modification C:\windows\system\DRFEP.exe ZBZ.exe File opened for modification C:\windows\PSSGKX.exe UEOW.exe File created C:\windows\PSSGKX.exe.bat UEOW.exe File created C:\windows\system\VEPP.exe.bat EWN.exe File created C:\windows\system\NHQGWV.exe.bat ZWHHIS.exe File created C:\windows\system\AIDU.exe.bat WAWUJIS.exe File opened for modification C:\windows\system\RBNAMCE.exe LBGMV.exe File created C:\windows\system\PHHRF.exe VJCGPG.exe File created C:\windows\PHJPCH.exe.bat JLYWWL.exe File opened for modification C:\windows\system\RZUB.exe WDPSYVP.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4960 cmd.exe 1172 cmd.exe 4556 cmd.exe 2528 cmd.exe 4640 cmd.exe 4120 cmd.exe 1596 cmd.exe 6056 cmd.exe 4980 cmd.exe 2852 cmd.exe 476 cmd.exe 2600 cmd.exe 948 cmd.exe 3360 cmd.exe 1044 cmd.exe 4944 cmd.exe 3896 cmd.exe 4632 cmd.exe 5804 cmd.exe 5580 cmd.exe 4660 cmd.exe 440 cmd.exe 4728 cmd.exe 4880 cmd.exe 4104 cmd.exe 1676 cmd.exe 1000 cmd.exe 372 cmd.exe 3396 cmd.exe 2268 cmd.exe 5556 cmd.exe 2104 cmd.exe 2052 cmd.exe 5760 cmd.exe 5976 cmd.exe 1220 cmd.exe 764 cmd.exe 2512 cmd.exe 4168 cmd.exe 3508 cmd.exe 4208 cmd.exe 2616 cmd.exe 1084 cmd.exe 2004 cmd.exe 3524 cmd.exe 4084 cmd.exe 1332 cmd.exe 5512 cmd.exe 5344 cmd.exe 1588 cmd.exe 1420 cmd.exe 3900 cmd.exe 4936 cmd.exe 1564 cmd.exe 884 cmd.exe 4988 cmd.exe 1592 cmd.exe 3192 cmd.exe 5400 cmd.exe 1180 cmd.exe 2476 cmd.exe 5068 cmd.exe 3076 cmd.exe 1076 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2536 5552 WerFault.exe 87 4880 4756 WerFault.exe 93 3992 6016 WerFault.exe 99 5632 1648 WerFault.exe 104 6128 3756 WerFault.exe 109 4248 4764 WerFault.exe 114 1168 3696 WerFault.exe 119 4860 4132 WerFault.exe 124 3840 2376 WerFault.exe 129 3632 1152 WerFault.exe 134 2848 4392 WerFault.exe 138 2912 4932 WerFault.exe 144 3560 1860 WerFault.exe 149 1956 1324 WerFault.exe 154 6008 5628 WerFault.exe 159 4792 5220 WerFault.exe 164 3944 4508 WerFault.exe 169 5964 5824 WerFault.exe 174 5464 3264 WerFault.exe 179 3568 2568 WerFault.exe 183 4124 4592 WerFault.exe 189 6140 5732 WerFault.exe 194 2968 2424 WerFault.exe 199 884 4284 WerFault.exe 204 2672 2744 WerFault.exe 209 5568 2448 WerFault.exe 214 2492 5848 WerFault.exe 219 4636 6012 WerFault.exe 224 1608 4616 WerFault.exe 229 4516 5296 WerFault.exe 234 2828 6120 WerFault.exe 239 5528 4948 WerFault.exe 244 6024 248 WerFault.exe 249 5444 1400 WerFault.exe 254 2344 624 WerFault.exe 260 6028 5148 WerFault.exe 265 3280 912 WerFault.exe 270 3456 2492 WerFault.exe 275 5464 5004 WerFault.exe 280 4516 480 WerFault.exe 285 2800 2692 WerFault.exe 290 2512 4196 WerFault.exe 295 5060 1216 WerFault.exe 300 884 4324 WerFault.exe 305 1220 2968 WerFault.exe 310 756 5132 WerFault.exe 315 1156 6028 WerFault.exe 320 1792 5752 WerFault.exe 325 5960 1396 WerFault.exe 330 5268 6136 WerFault.exe 335 4596 2988 WerFault.exe 340 3372 1928 WerFault.exe 345 1272 2912 WerFault.exe 350 3740 1504 WerFault.exe 355 3508 1032 WerFault.exe 360 3076 4464 WerFault.exe 365 3788 1872 WerFault.exe 370 4740 5892 WerFault.exe 375 1148 1608 WerFault.exe 380 4348 4516 WerFault.exe 385 4124 3956 WerFault.exe 390 3940 5796 WerFault.exe 395 6044 1272 WerFault.exe 400 3508 2824 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKHKDBD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUDNFTD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJVIYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZWGMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVYUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZVHECS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VVCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEPP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVIRBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language POUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLYWWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKNJF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQUIR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WEUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUVZW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAVMVJI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQDUTS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYSUG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJEEHOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XDFWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLAHHUG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFODH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GSULOVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYYPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VJCGPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDPSYVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VHKBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVGIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YFIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FHBP.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5552 2026-09-03_bf9be4f2232845f594129566df799e30_elex_emotet_stop.exe 5552 2026-09-03_bf9be4f2232845f594129566df799e30_elex_emotet_stop.exe 4756 VJCGPG.exe 4756 VJCGPG.exe 6016 PHHRF.exe 6016 PHHRF.exe 1648 HKNJF.exe 1648 HKNJF.exe 3756 KXFL.exe 3756 KXFL.exe 4764 XDFWB.exe 4764 XDFWB.exe 3696 JLYWWL.exe 3696 JLYWWL.exe 4132 PHJPCH.exe 4132 PHJPCH.exe 2376 KMJB.exe 2376 KMJB.exe 1152 JXGJWKU.exe 1152 JXGJWKU.exe 4392 VARX.exe 4392 VARX.exe 4932 RGDAQU.exe 4932 RGDAQU.exe 1860 QRGQY.exe 1860 QRGQY.exe 1324 YETXJ.exe 1324 YETXJ.exe 5628 GKYE.exe 5628 GKYE.exe 5220 CPQ.exe 5220 CPQ.exe 4508 MNVNRJQ.exe 4508 MNVNRJQ.exe 5824 QQUIR.exe 5824 QQUIR.exe 3264 NVMY.exe 3264 NVMY.exe 2568 LGP.exe 2568 LGP.exe 4592 VPRT.exe 4592 VPRT.exe 5732 CZOBLIA.exe 5732 CZOBLIA.exe 2424 VAVMVJI.exe 2424 VAVMVJI.exe 4284 NVZI.exe 4284 NVZI.exe 2744 DLAHHUG.exe 2744 DLAHHUG.exe 2448 WDPSYVP.exe 2448 WDPSYVP.exe 5848 RZUB.exe 5848 RZUB.exe 6012 AZWGMS.exe 6012 AZWGMS.exe 4616 PUG.exe 4616 PUG.exe 5296 FKHKDBD.exe 5296 FKHKDBD.exe 6120 JANS.exe 6120 JANS.exe 4948 SAPXT.exe 4948 SAPXT.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5552 2026-09-03_bf9be4f2232845f594129566df799e30_elex_emotet_stop.exe 5552 2026-09-03_bf9be4f2232845f594129566df799e30_elex_emotet_stop.exe 4756 VJCGPG.exe 4756 VJCGPG.exe 6016 PHHRF.exe 6016 PHHRF.exe 1648 HKNJF.exe 1648 HKNJF.exe 3756 KXFL.exe 3756 KXFL.exe 4764 XDFWB.exe 4764 XDFWB.exe 3696 JLYWWL.exe 3696 JLYWWL.exe 4132 PHJPCH.exe 4132 PHJPCH.exe 2376 KMJB.exe 2376 KMJB.exe 1152 JXGJWKU.exe 1152 JXGJWKU.exe 4392 VARX.exe 4392 VARX.exe 4932 RGDAQU.exe 4932 RGDAQU.exe 1860 QRGQY.exe 1860 QRGQY.exe 1324 YETXJ.exe 1324 YETXJ.exe 5628 GKYE.exe 5628 GKYE.exe 5220 CPQ.exe 5220 CPQ.exe 4508 MNVNRJQ.exe 4508 MNVNRJQ.exe 5824 QQUIR.exe 5824 QQUIR.exe 3264 NVMY.exe 3264 NVMY.exe 2568 LGP.exe 2568 LGP.exe 4592 VPRT.exe 4592 VPRT.exe 5732 CZOBLIA.exe 5732 CZOBLIA.exe 2424 VAVMVJI.exe 2424 VAVMVJI.exe 4284 NVZI.exe 4284 NVZI.exe 2744 DLAHHUG.exe 2744 DLAHHUG.exe 2448 WDPSYVP.exe 2448 WDPSYVP.exe 5848 RZUB.exe 5848 RZUB.exe 6012 AZWGMS.exe 6012 AZWGMS.exe 4616 PUG.exe 4616 PUG.exe 5296 FKHKDBD.exe 5296 FKHKDBD.exe 6120 JANS.exe 6120 JANS.exe 4948 SAPXT.exe 4948 SAPXT.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5552 wrote to memory of 4952 5552 2026-09-03_bf9be4f2232845f594129566df799e30_elex_emotet_stop.exe 89 PID 4952 wrote to memory of 4756 4952 cmd.exe 93 PID 4756 wrote to memory of 5668 4756 VJCGPG.exe 95 PID 5668 wrote to memory of 6016 5668 cmd.exe 99 PID 6016 wrote to memory of 5272 6016 PHHRF.exe 100 PID 5272 wrote to memory of 1648 5272 cmd.exe 104 PID 1648 wrote to memory of 604 1648 HKNJF.exe 105 PID 604 wrote to memory of 3756 604 cmd.exe 109 PID 3756 wrote to memory of 2528 3756 KXFL.exe 110 PID 2528 wrote to memory of 4764 2528 cmd.exe 114 PID 4764 wrote to memory of 2808 4764 XDFWB.exe 115 PID 2808 wrote to memory of 3696 2808 cmd.exe 119 PID 3696 wrote to memory of 4608 3696 JLYWWL.exe 120 PID 4608 wrote to memory of 4132 4608 cmd.exe 124 PID 4132 wrote to memory of 4640 4132 PHJPCH.exe 125 PID 4640 wrote to memory of 2376 4640 cmd.exe 129 PID 2376 wrote to memory of 1532 2376 KMJB.exe 130 PID 1532 wrote to memory of 1152 1532 cmd.exe 134 PID 1152 wrote to memory of 4120 1152 JXGJWKU.exe 135 PID 4120 wrote to memory of 4392 4120 cmd.exe 138 PID 4392 wrote to memory of 2984 4392 VARX.exe 140 PID 2984 wrote to memory of 4932 2984 cmd.exe 144 PID 4932 wrote to memory of 2452 4932 RGDAQU.exe 145 PID 2452 wrote to memory of 1860 2452 cmd.exe 149 PID 1860 wrote to memory of 3420 1860 QRGQY.exe 150 PID 3420 wrote to memory of 1324 3420 cmd.exe 154 PID 1324 wrote to memory of 5976 1324 YETXJ.exe 155 PID 5976 wrote to memory of 5628 5976 cmd.exe 159 PID 5628 wrote to memory of 2892 5628 GKYE.exe 160 PID 2892 wrote to memory of 5220 2892 cmd.exe 164 PID 5220 wrote to memory of 5400 5220 CPQ.exe 165 PID 5400 wrote to memory of 4508 5400 cmd.exe 169 PID 4508 wrote to memory of 3400 4508 MNVNRJQ.exe 170 PID 3400 wrote to memory of 5824 3400 cmd.exe 174 PID 5824 wrote to memory of 1076 5824 QQUIR.exe 175 PID 1076 wrote to memory of 3264 1076 cmd.exe 179 PID 3264 wrote to memory of 3256 3264 NVMY.exe 180 PID 3256 wrote to memory of 2568 3256 cmd.exe 183 PID 2568 wrote to memory of 1596 2568 LGP.exe 185 PID 1596 wrote to memory of 4592 1596 cmd.exe 189 PID 4592 wrote to memory of 5624 4592 VPRT.exe 190 PID 5624 wrote to memory of 5732 5624 cmd.exe 194 PID 5732 wrote to memory of 3660 5732 CZOBLIA.exe 195 PID 3660 wrote to memory of 2424 3660 cmd.exe 199 PID 2424 wrote to memory of 372 2424 VAVMVJI.exe 200 PID 372 wrote to memory of 4284 372 cmd.exe 204 PID 4284 wrote to memory of 3116 4284 NVZI.exe 205 PID 3116 wrote to memory of 2744 3116 cmd.exe 209 PID 2744 wrote to memory of 5580 2744 DLAHHUG.exe 210 PID 5580 wrote to memory of 2448 5580 cmd.exe 214 PID 2448 wrote to memory of 1484 2448 WDPSYVP.exe 215 PID 1484 wrote to memory of 5848 1484 cmd.exe 219 PID 5848 wrote to memory of 4628 5848 RZUB.exe 220 PID 4628 wrote to memory of 6012 4628 cmd.exe 224 PID 6012 wrote to memory of 1492 6012 AZWGMS.exe 225 PID 1492 wrote to memory of 4616 1492 cmd.exe 229 PID 4616 wrote to memory of 948 4616 PUG.exe 230 PID 948 wrote to memory of 5296 948 cmd.exe 234 PID 5296 wrote to memory of 2112 5296 FKHKDBD.exe 235 PID 2112 wrote to memory of 6120 2112 cmd.exe 239 PID 6120 wrote to memory of 5424 6120 JANS.exe 240 PID 5424 wrote to memory of 4948 5424 cmd.exe 244 PID 4948 wrote to memory of 3360 4948 SAPXT.exe 245 PID 3360 wrote to memory of 248 3360 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-03_bf9be4f2232845f594129566df799e30_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-03_bf9be4f2232845f594129566df799e30_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VJCGPG.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\windows\VJCGPG.exeC:\windows\VJCGPG.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHHRF.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\windows\system\PHHRF.exeC:\windows\system\PHHRF.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKNJF.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\windows\system\HKNJF.exeC:\windows\system\HKNJF.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KXFL.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:604 -
C:\windows\KXFL.exeC:\windows\KXFL.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XDFWB.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\windows\system\XDFWB.exeC:\windows\system\XDFWB.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLYWWL.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\windows\system\JLYWWL.exeC:\windows\system\JLYWWL.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PHJPCH.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\windows\PHJPCH.exeC:\windows\PHJPCH.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMJB.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\windows\KMJB.exeC:\windows\KMJB.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JXGJWKU.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\windows\SysWOW64\JXGJWKU.exeC:\windows\system32\JXGJWKU.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VARX.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\windows\system\VARX.exeC:\windows\system\VARX.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RGDAQU.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\windows\SysWOW64\RGDAQU.exeC:\windows\system32\RGDAQU.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QRGQY.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\QRGQY.exeC:\windows\QRGQY.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YETXJ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\windows\SysWOW64\YETXJ.exeC:\windows\system32\YETXJ.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GKYE.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\windows\SysWOW64\GKYE.exeC:\windows\system32\GKYE.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPQ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\system\CPQ.exeC:\windows\system\CPQ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MNVNRJQ.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\windows\system\MNVNRJQ.exeC:\windows\system\MNVNRJQ.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QQUIR.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\windows\QQUIR.exeC:\windows\QQUIR.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVMY.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\windows\SysWOW64\NVMY.exeC:\windows\system32\NVMY.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGP.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\windows\LGP.exeC:\windows\LGP.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPRT.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\windows\VPRT.exeC:\windows\VPRT.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZOBLIA.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\windows\system\CZOBLIA.exeC:\windows\system\CZOBLIA.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VAVMVJI.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\windows\VAVMVJI.exeC:\windows\VAVMVJI.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NVZI.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:372 -
C:\windows\system\NVZI.exeC:\windows\system\NVZI.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLAHHUG.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\windows\SysWOW64\DLAHHUG.exeC:\windows\system32\DLAHHUG.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDPSYVP.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\windows\WDPSYVP.exeC:\windows\WDPSYVP.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RZUB.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\windows\system\RZUB.exeC:\windows\system\RZUB.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZWGMS.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\windows\SysWOW64\AZWGMS.exeC:\windows\system32\AZWGMS.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PUG.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\windows\SysWOW64\PUG.exeC:\windows\system32\PUG.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FKHKDBD.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:948 -
C:\windows\SysWOW64\FKHKDBD.exeC:\windows\system32\FKHKDBD.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JANS.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\windows\JANS.exeC:\windows\JANS.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SAPXT.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\windows\SAPXT.exeC:\windows\SAPXT.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HDZ.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\windows\HDZ.exeC:\windows\HDZ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYDFK.exe.bat" "66⤵PID:52
-
C:\windows\IYDFK.exeC:\windows\IYDFK.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FZMIVX.exe.bat" "68⤵
- Executes a command shell one-liner
PID:1588 -
C:\windows\SysWOW64\FZMIVX.exeC:\windows\system32\FZMIVX.exe69⤵
- Executes dropped EXE
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSCT.exe.bat" "70⤵PID:3172
-
C:\windows\system\YSCT.exeC:\windows\system\YSCT.exe71⤵
- Executes dropped EXE
PID:5148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\APHN.exe.bat" "72⤵PID:3132
-
C:\windows\APHN.exeC:\windows\APHN.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVHZWSM.exe.bat" "74⤵PID:3324
-
C:\windows\system\VVHZWSM.exeC:\windows\system\VVHZWSM.exe75⤵
- Executes dropped EXE
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYYPK.exe.bat" "76⤵PID:1228
-
C:\windows\IYYPK.exeC:\windows\IYYPK.exe77⤵
- Executes dropped EXE
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOZP.exe.bat" "78⤵
- Executes a command shell one-liner
PID:1180 -
C:\windows\YOZP.exeC:\windows\YOZP.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NJITCDF.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:3376 -
C:\windows\system\NJITCDF.exeC:\windows\system\NJITCDF.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECLJLR.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:4156 -
C:\windows\system\ECLJLR.exeC:\windows\system\ECLJLR.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MHYQV.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2476 -
C:\windows\SysWOW64\MHYQV.exeC:\windows\system32\MHYQV.exe85⤵
- Executes dropped EXE
PID:1216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RIAA.exe.bat" "86⤵PID:1544
-
C:\windows\RIAA.exeC:\windows\RIAA.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDD.exe.bat" "88⤵PID:4264
-
C:\windows\SysWOW64\JDD.exeC:\windows\system32\JDD.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NTSWRC.exe.bat" "90⤵PID:5104
-
C:\windows\system\NTSWRC.exeC:\windows\system\NTSWRC.exe91⤵
- Executes dropped EXE
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBZ.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:2684 -
C:\windows\ZBZ.exeC:\windows\ZBZ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DRFEP.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:3392 -
C:\windows\system\DRFEP.exeC:\windows\system\DRFEP.exe95⤵
- Executes dropped EXE
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BME.exe.bat" "96⤵PID:4636
-
C:\windows\system\BME.exeC:\windows\system\BME.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EAJWW.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:1824 -
C:\windows\SysWOW64\EAJWW.exeC:\windows\system32\EAJWW.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MFODH.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1420 -
C:\windows\MFODH.exeC:\windows\MFODH.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KFVQQ.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2600 -
C:\windows\SysWOW64\KFVQQ.exeC:\windows\system32\KFVQQ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VVCQ.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6056 -
C:\windows\SysWOW64\VVCQ.exeC:\windows\system32\VVCQ.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJHAMS.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3904 -
C:\windows\system\QJHAMS.exeC:\windows\system\QJHAMS.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QOHOOFU.exe.bat" "108⤵
- Executes a command shell one-liner
PID:3192 -
C:\windows\system\QOHOOFU.exeC:\windows\system\QOHOOFU.exe109⤵
- Executes dropped EXE
PID:1032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UEOW.exe.bat" "110⤵PID:5768
-
C:\windows\UEOW.exeC:\windows\UEOW.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PSSGKX.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3900 -
C:\windows\PSSGKX.exeC:\windows\PSSGKX.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSULOVZ.exe.bat" "114⤵
- Executes a command shell one-liner
PID:3396 -
C:\windows\SysWOW64\GSULOVZ.exeC:\windows\system32\GSULOVZ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQAFVDI.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1044 -
C:\windows\IQAFVDI.exeC:\windows\IQAFVDI.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SNOZ.exe.bat" "118⤵
- Executes a command shell one-liner
PID:4980 -
C:\windows\system\SNOZ.exeC:\windows\system\SNOZ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WEUA.exe.bat" "120⤵
- Executes a command shell one-liner
PID:3524 -
C:\windows\SysWOW64\WEUA.exeC:\windows\system32\WEUA.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-