Analysis
- max time kernel
86s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 02:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-04_9aade912faa8dd0bb5fbb759d98474a5_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-04_9aade912faa8dd0bb5fbb759d98474a5_elex_emotet_stop.exe
- Size 208KB
- Sample260905-cwwfravfjd
- SHA256 c574bc497367626fc63b829e418496647e3ea99a52888296ec9db5db24153ee8
- MD5 9aade912faa8dd0bb5fbb759d98474a5
- SHA1 ea72f5abe13d73e54283c32ffce952908eeecf8e
- SHA512 1c3dc6578374f4808a9afaf0bea23cdee9d12118e74b72fa4f0eb568fb9f354a59f22d6b258d885962cbb584027815742a81ed56b7bc7f2daf97e8cd437085c3
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfr4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LODkEj1
- TLSH T150247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5260 OJGFKLF.exe 1352 VPHSYXJ.exe 2644 TFSVLK.exe 6124 HKSH.exe 2284 YTGE.exe 4560 ITIJLKX.exe 1464 UJPRP.exe 5588 HMX.exe 5240 NHXRII.exe 5892 RPD.exe 4100 JSPVA.exe 2080 VIWVMJH.exe 1972 FJYAQG.exe 5308 ZWDJAGY.exe 4744 TWKUJH.exe 4216 VMYOZ.exe 1348 VPBSEFZ.exe 5160 OIJDOGH.exe 2960 TTHQV.exe 4408 PYZFM.exe 3504 MRJQQ.exe 5828 HCR.exe 5448 PSSGKX.exe 4996 DNEZQM.exe 4972 BYHPZ.exe 5948 YDZEP.exe 5548 ZGDIVLF.exe 4676 GWEZB.exe 5504 VRN.exe 1308 BNNM.exe 5116 QIWRCJT.exe 1200 AIY.exe 4868 UDDNQOS.exe 4312 JYM.exe 4780 KBQNORU.exe 5924 DWUR.exe 5172 LCUF.exe 6052 FXZPFT.exe 2000 VSIT.exe 5804 NVM.exe 1456 ZOPQ.exe 4396 OJZUXYV.exe 3704 FJB.exe 4700 JZHHNO.exe 1276 YPIY.exe 6140 KIL.exe 2384 GNDG.exe 4876 GTWVT.exe 2376 BGAEWZ.exe 5576 DUF.exe 5472 YPKXQ.exe 240 LSS.exe 4880 MVERKZK.exe 5864 VDY.exe 3492 BDGSEZ.exe 3396 KEIXIWP.exe 1460 QEQL.exe 2280 WEXZAB.exe 5852 HXA.exe 3488 RFCX.exe 5712 XFKKDI.exe 1160 OGMPGFN.exe 3596 MGTDP.exe 6008 BWUDWV.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\HXA.exe.bat WEXZAB.exe File created C:\windows\SysWOW64\RFCX.exe HXA.exe File created C:\windows\SysWOW64\DVTGLJ.exe TXNLDB.exe File created C:\windows\SysWOW64\YJYPVJW.exe.bat DVTGLJ.exe File opened for modification C:\windows\SysWOW64\YOWMQN.exe PFUHFHA.exe File created C:\windows\SysWOW64\VBP.exe JIMOMAV.exe File opened for modification C:\windows\SysWOW64\QIWRCJT.exe BNNM.exe File opened for modification C:\windows\SysWOW64\NVM.exe VSIT.exe File created C:\windows\SysWOW64\MVERKZK.exe LSS.exe File created C:\windows\SysWOW64\DVTGLJ.exe.bat TXNLDB.exe File opened for modification C:\windows\SysWOW64\DPVQGL.exe CMRU.exe File created C:\windows\SysWOW64\QTDIOKX.exe UOGLZ.exe File created C:\windows\SysWOW64\ZMC.exe YRZQEU.exe File opened for modification C:\windows\SysWOW64\MVERKZK.exe LSS.exe File opened for modification C:\windows\SysWOW64\YTGE.exe HKSH.exe File created C:\windows\SysWOW64\KBQNORU.exe JYM.exe File created C:\windows\SysWOW64\VSIT.exe.bat FXZPFT.exe File created C:\windows\SysWOW64\VPHSYXJ.exe OJGFKLF.exe File created C:\windows\SysWOW64\YTGE.exe HKSH.exe File created C:\windows\SysWOW64\JSPVA.exe RPD.exe File opened for modification C:\windows\SysWOW64\VSIT.exe FXZPFT.exe File created C:\windows\SysWOW64\NVM.exe VSIT.exe File created C:\windows\SysWOW64\JZHHNO.exe.bat FJB.exe File created C:\windows\SysWOW64\LSS.exe YPKXQ.exe File opened for modification C:\windows\SysWOW64\UOGLZ.exe IVDS.exe File created C:\windows\SysWOW64\WEXZAB.exe QEQL.exe File created C:\windows\SysWOW64\LSS.exe.bat YPKXQ.exe File created C:\windows\SysWOW64\VPHSYXJ.exe.bat OJGFKLF.exe File created C:\windows\SysWOW64\HKSH.exe TFSVLK.exe File opened for modification C:\windows\SysWOW64\TWKUJH.exe ZWDJAGY.exe File created C:\windows\SysWOW64\TWKUJH.exe.bat ZWDJAGY.exe File opened for modification C:\windows\SysWOW64\DWUR.exe KBQNORU.exe File created C:\windows\SysWOW64\YOWMQN.exe PFUHFHA.exe File created C:\windows\SysWOW64\TWKUJH.exe ZWDJAGY.exe File created C:\windows\SysWOW64\QIWRCJT.exe BNNM.exe File opened for modification C:\windows\SysWOW64\DVTGLJ.exe TXNLDB.exe File opened for modification C:\windows\SysWOW64\HZMLQWL.exe DJGDE.exe File created C:\windows\SysWOW64\ZJA.exe YOWMQN.exe File created C:\windows\SysWOW64\ZJA.exe.bat YOWMQN.exe File opened for modification C:\windows\SysWOW64\YAGG.exe OSE.exe File opened for modification C:\windows\SysWOW64\ZWDJAGY.exe FJYAQG.exe File created C:\windows\SysWOW64\HXA.exe WEXZAB.exe File created C:\windows\SysWOW64\RFCX.exe.bat HXA.exe File created C:\windows\SysWOW64\DJGDE.exe YJYPVJW.exe File created C:\windows\SysWOW64\DJGDE.exe.bat YJYPVJW.exe File created C:\windows\SysWOW64\HZMLQWL.exe DJGDE.exe File opened for modification C:\windows\SysWOW64\QTDIOKX.exe UOGLZ.exe File created C:\windows\SysWOW64\FDAAZ.exe.bat UKXH.exe File created C:\windows\SysWOW64\DWUR.exe.bat KBQNORU.exe File created C:\windows\SysWOW64\NVM.exe.bat VSIT.exe File opened for modification C:\windows\SysWOW64\JZHHNO.exe FJB.exe File created C:\windows\SysWOW64\GNDG.exe.bat KIL.exe File created C:\windows\SysWOW64\YPKXQ.exe DUF.exe File created C:\windows\SysWOW64\UOGLZ.exe.bat IVDS.exe File created C:\windows\SysWOW64\YAGG.exe OSE.exe File created C:\windows\SysWOW64\YAGG.exe.bat OSE.exe File created C:\windows\SysWOW64\ZWDJAGY.exe FJYAQG.exe File created C:\windows\SysWOW64\ZWDJAGY.exe.bat FJYAQG.exe File created C:\windows\SysWOW64\QIWRCJT.exe.bat BNNM.exe File opened for modification C:\windows\SysWOW64\YPKXQ.exe DUF.exe File opened for modification C:\windows\SysWOW64\WEXZAB.exe QEQL.exe File created C:\windows\SysWOW64\QTDIOKX.exe.bat UOGLZ.exe File created C:\windows\SysWOW64\ZMC.exe.bat YRZQEU.exe File opened for modification C:\windows\SysWOW64\VBP.exe JIMOMAV.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\KEIXIWP.exe.bat BDGSEZ.exe File created C:\windows\system\TXNLDB.exe AUKQ.exe File created C:\windows\system\SVC.exe NVVSF.exe File opened for modification C:\windows\QXQKDD.exe NBMB.exe File created C:\windows\ZGDIVLF.exe.bat YDZEP.exe File created C:\windows\system\ZOPQ.exe NVM.exe File opened for modification C:\windows\system\JOH.exe QTDIOKX.exe File created C:\windows\system\UKXH.exe.bat ZXSXHBZ.exe File created C:\windows\KKXA.exe.bat TBVNHNP.exe File created C:\windows\DZD.exe.bat ILYXBT.exe File created C:\windows\system\ANEOHXB.exe XRIEX.exe File created C:\windows\GWEZB.exe.bat ZGDIVLF.exe File created C:\windows\system\GTWVT.exe GNDG.exe File opened for modification C:\windows\system\MGTDP.exe OGMPGFN.exe File created C:\windows\system\NVVSF.exe BCSZ.exe File opened for modification C:\windows\system\NVVSF.exe BCSZ.exe File created C:\windows\system\YGCXIJ.exe.bat ETXNY.exe File created C:\windows\NBMB.exe.bat YGCXIJ.exe File created C:\windows\system\ANEOHXB.exe.bat XRIEX.exe File opened for modification C:\windows\BNNM.exe VRN.exe File created C:\windows\system\QREH.exe.bat BWUDWV.exe File opened for modification C:\windows\CMRU.exe HZMLQWL.exe File created C:\windows\system\IVDS.exe XCA.exe File created C:\windows\system\JOH.exe.bat QTDIOKX.exe File created C:\windows\system\KOLVRQT.exe.bat UYK.exe File created C:\windows\system\ILYXBT.exe.bat VBP.exe File created C:\windows\system\XRIEX.exe ORGZ.exe File opened for modification C:\windows\TTHQV.exe OIJDOGH.exe File opened for modification C:\windows\system\DNEZQM.exe PSSGKX.exe File opened for modification C:\windows\YRZQEU.exe JOH.exe File created C:\windows\UYK.exe FDAAZ.exe File created C:\windows\TBVNHNP.exe KOLVRQT.exe File created C:\windows\system\ILYXBT.exe VBP.exe File created C:\windows\system\RPD.exe.bat NHXRII.exe File created C:\windows\FXZPFT.exe LCUF.exe File created C:\windows\system\SBU.exe SVC.exe File opened for modification C:\windows\UJPRP.exe ITIJLKX.exe File opened for modification C:\windows\HMX.exe UJPRP.exe File opened for modification C:\windows\system\VMYOZ.exe TWKUJH.exe File created C:\windows\ZGDIVLF.exe YDZEP.exe File opened for modification C:\windows\AIY.exe QIWRCJT.exe File created C:\windows\BDGSEZ.exe.bat VDY.exe File opened for modification C:\windows\AUKQ.exe AZGMK.exe File opened for modification C:\windows\system\SBU.exe SVC.exe File created C:\windows\XFKKDI.exe.bat RFCX.exe File created C:\windows\system\MGTDP.exe.bat OGMPGFN.exe File opened for modification C:\windows\system\QREH.exe BWUDWV.exe File opened for modification C:\windows\system\AZGMK.exe QREH.exe File created C:\windows\KKXA.exe TBVNHNP.exe File opened for modification C:\windows\KKXA.exe TBVNHNP.exe File created C:\windows\OSE.exe.bat KKXA.exe File opened for modification C:\windows\system\JIMOMAV.exe YAGG.exe File created C:\windows\system\VMYOZ.exe TWKUJH.exe File created C:\windows\FXZPFT.exe.bat LCUF.exe File created C:\windows\system\OGMPGFN.exe XFKKDI.exe File created C:\windows\system\JIMOMAV.exe.bat YAGG.exe File created C:\windows\system\XRIEX.exe.bat ORGZ.exe File opened for modification C:\windows\FJYAQG.exe VIWVMJH.exe File created C:\windows\ITIJLKX.exe.bat YTGE.exe File opened for modification C:\windows\ZGDIVLF.exe YDZEP.exe File created C:\windows\AIY.exe.bat QIWRCJT.exe File opened for modification C:\windows\system\KIL.exe YPIY.exe File created C:\windows\UJPRP.exe.bat ITIJLKX.exe File created C:\windows\HCR.exe.bat MRJQQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2560 cmd.exe 3292 cmd.exe 5536 cmd.exe 3732 cmd.exe 1652 cmd.exe 5092 cmd.exe 4172 cmd.exe 3404 cmd.exe 4992 cmd.exe 3424 cmd.exe 5564 cmd.exe 2344 cmd.exe 5112 cmd.exe 4360 cmd.exe 3696 cmd.exe 768 cmd.exe 5440 cmd.exe 6048 cmd.exe 2988 cmd.exe 3400 cmd.exe 972 cmd.exe 4764 cmd.exe 3192 cmd.exe 3280 cmd.exe 6056 cmd.exe 924 cmd.exe 4948 cmd.exe 5256 cmd.exe 1700 cmd.exe 5752 cmd.exe 4228 cmd.exe 1112 cmd.exe 5724 cmd.exe 5100 cmd.exe 3616 cmd.exe 3004 cmd.exe 2296 cmd.exe 1736 cmd.exe 5556 cmd.exe 1592 cmd.exe 5720 cmd.exe 2980 cmd.exe 5744 cmd.exe 4168 cmd.exe 2012 cmd.exe 5812 cmd.exe 5176 cmd.exe 4532 cmd.exe 2804 cmd.exe 2600 cmd.exe 4412 cmd.exe 2076 cmd.exe 3048 cmd.exe 1640 cmd.exe 1184 cmd.exe 3708 cmd.exe 1696 cmd.exe 4660 cmd.exe 2152 cmd.exe 6128 cmd.exe 5956 cmd.exe 3820 cmd.exe 1176 cmd.exe 1396 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3252 4848 WerFault.exe 88 2616 5260 WerFault.exe 93 972 1352 WerFault.exe 99 4780 2644 WerFault.exe 104 2900 6124 WerFault.exe 109 2868 2284 WerFault.exe 114 712 4560 WerFault.exe 119 2656 1464 WerFault.exe 124 1432 5588 WerFault.exe 129 3960 5240 WerFault.exe 134 2652 5892 WerFault.exe 139 1228 4100 WerFault.exe 144 5216 2080 WerFault.exe 149 1776 1972 WerFault.exe 154 1828 5308 WerFault.exe 159 5560 4744 WerFault.exe 164 2920 4216 WerFault.exe 169 5540 1348 WerFault.exe 174 768 5160 WerFault.exe 179 1932 2960 WerFault.exe 184 1052 4408 WerFault.exe 189 4576 3504 WerFault.exe 194 5040 5828 WerFault.exe 199 2460 5448 WerFault.exe 204 6140 4996 WerFault.exe 209 5348 4972 WerFault.exe 214 2756 5948 WerFault.exe 219 560 5548 WerFault.exe 224 2000 4676 WerFault.exe 229 3384 5504 WerFault.exe 234 3276 1308 WerFault.exe 239 4464 5116 WerFault.exe 244 3740 1200 WerFault.exe 249 3844 4868 WerFault.exe 254 4604 4312 WerFault.exe 259 4384 4780 WerFault.exe 264 1892 5924 WerFault.exe 269 3984 5172 WerFault.exe 275 3160 6052 WerFault.exe 280 4192 2000 WerFault.exe 285 4660 5804 WerFault.exe 290 4464 1456 WerFault.exe 295 2144 4396 WerFault.exe 300 1800 3704 WerFault.exe 305 1776 4700 WerFault.exe 310 3292 1276 WerFault.exe 315 5752 6140 WerFault.exe 320 3984 2384 WerFault.exe 325 3816 4876 WerFault.exe 330 1216 2376 WerFault.exe 335 2892 5576 WerFault.exe 340 564 5472 WerFault.exe 345 3976 240 WerFault.exe 350 4656 4880 WerFault.exe 355 4648 5864 WerFault.exe 360 1412 3492 WerFault.exe 365 1140 3396 WerFault.exe 370 3028 1460 WerFault.exe 375 3480 2280 WerFault.exe 380 4372 5852 WerFault.exe 385 4936 3488 WerFault.exe 390 3844 5712 WerFault.exe 395 4604 1160 WerFault.exe 400 2540 3596 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QIWRCJT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZJA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HCR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCUF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCSZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSPVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPBSEFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIJDOGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDZEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJZUXYV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPIY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DVTGLJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZMLQWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QEQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTHQV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BGAEWZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPKXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXNLDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTDIOKX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OMJUH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDAAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TWKUJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KEIXIWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DPVQGL.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4848 2026-09-04_9aade912faa8dd0bb5fbb759d98474a5_elex_emotet_stop.exe 4848 2026-09-04_9aade912faa8dd0bb5fbb759d98474a5_elex_emotet_stop.exe 5260 OJGFKLF.exe 5260 OJGFKLF.exe 1352 VPHSYXJ.exe 1352 VPHSYXJ.exe 2644 TFSVLK.exe 2644 TFSVLK.exe 6124 HKSH.exe 6124 HKSH.exe 2284 YTGE.exe 2284 YTGE.exe 4560 ITIJLKX.exe 4560 ITIJLKX.exe 1464 UJPRP.exe 1464 UJPRP.exe 5588 HMX.exe 5588 HMX.exe 5240 NHXRII.exe 5240 NHXRII.exe 5892 RPD.exe 5892 RPD.exe 4100 JSPVA.exe 4100 JSPVA.exe 2080 VIWVMJH.exe 2080 VIWVMJH.exe 1972 FJYAQG.exe 1972 FJYAQG.exe 5308 ZWDJAGY.exe 5308 ZWDJAGY.exe 4744 TWKUJH.exe 4744 TWKUJH.exe 4216 VMYOZ.exe 4216 VMYOZ.exe 1348 VPBSEFZ.exe 1348 VPBSEFZ.exe 5160 OIJDOGH.exe 5160 OIJDOGH.exe 2960 TTHQV.exe 2960 TTHQV.exe 4408 PYZFM.exe 4408 PYZFM.exe 3504 MRJQQ.exe 3504 MRJQQ.exe 5828 HCR.exe 5828 HCR.exe 5448 PSSGKX.exe 5448 PSSGKX.exe 4996 DNEZQM.exe 4996 DNEZQM.exe 4972 BYHPZ.exe 4972 BYHPZ.exe 5948 YDZEP.exe 5948 YDZEP.exe 5548 ZGDIVLF.exe 5548 ZGDIVLF.exe 4676 GWEZB.exe 4676 GWEZB.exe 5504 VRN.exe 5504 VRN.exe 1308 BNNM.exe 1308 BNNM.exe 5116 QIWRCJT.exe 5116 QIWRCJT.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4848 2026-09-04_9aade912faa8dd0bb5fbb759d98474a5_elex_emotet_stop.exe 4848 2026-09-04_9aade912faa8dd0bb5fbb759d98474a5_elex_emotet_stop.exe 5260 OJGFKLF.exe 5260 OJGFKLF.exe 1352 VPHSYXJ.exe 1352 VPHSYXJ.exe 2644 TFSVLK.exe 2644 TFSVLK.exe 6124 HKSH.exe 6124 HKSH.exe 2284 YTGE.exe 2284 YTGE.exe 4560 ITIJLKX.exe 4560 ITIJLKX.exe 1464 UJPRP.exe 1464 UJPRP.exe 5588 HMX.exe 5588 HMX.exe 5240 NHXRII.exe 5240 NHXRII.exe 5892 RPD.exe 5892 RPD.exe 4100 JSPVA.exe 4100 JSPVA.exe 2080 VIWVMJH.exe 2080 VIWVMJH.exe 1972 FJYAQG.exe 1972 FJYAQG.exe 5308 ZWDJAGY.exe 5308 ZWDJAGY.exe 4744 TWKUJH.exe 4744 TWKUJH.exe 4216 VMYOZ.exe 4216 VMYOZ.exe 1348 VPBSEFZ.exe 1348 VPBSEFZ.exe 5160 OIJDOGH.exe 5160 OIJDOGH.exe 2960 TTHQV.exe 2960 TTHQV.exe 4408 PYZFM.exe 4408 PYZFM.exe 3504 MRJQQ.exe 3504 MRJQQ.exe 5828 HCR.exe 5828 HCR.exe 5448 PSSGKX.exe 5448 PSSGKX.exe 4996 DNEZQM.exe 4996 DNEZQM.exe 4972 BYHPZ.exe 4972 BYHPZ.exe 5948 YDZEP.exe 5948 YDZEP.exe 5548 ZGDIVLF.exe 5548 ZGDIVLF.exe 4676 GWEZB.exe 4676 GWEZB.exe 5504 VRN.exe 5504 VRN.exe 1308 BNNM.exe 1308 BNNM.exe 5116 QIWRCJT.exe 5116 QIWRCJT.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4848 wrote to memory of 4764 4848 2026-09-04_9aade912faa8dd0bb5fbb759d98474a5_elex_emotet_stop.exe 89 PID 4764 wrote to memory of 5260 4764 cmd.exe 93 PID 5260 wrote to memory of 872 5260 OJGFKLF.exe 95 PID 872 wrote to memory of 1352 872 cmd.exe 99 PID 1352 wrote to memory of 1608 1352 VPHSYXJ.exe 100 PID 1608 wrote to memory of 2644 1608 cmd.exe 104 PID 2644 wrote to memory of 2852 2644 TFSVLK.exe 105 PID 2852 wrote to memory of 6124 2852 cmd.exe 109 PID 6124 wrote to memory of 4536 6124 HKSH.exe 110 PID 4536 wrote to memory of 2284 4536 cmd.exe 114 PID 2284 wrote to memory of 1392 2284 YTGE.exe 115 PID 1392 wrote to memory of 4560 1392 cmd.exe 119 PID 4560 wrote to memory of 2908 4560 ITIJLKX.exe 120 PID 2908 wrote to memory of 1464 2908 cmd.exe 124 PID 1464 wrote to memory of 2296 1464 UJPRP.exe 125 PID 2296 wrote to memory of 5588 2296 cmd.exe 129 PID 5588 wrote to memory of 1508 5588 HMX.exe 130 PID 1508 wrote to memory of 5240 1508 cmd.exe 134 PID 5240 wrote to memory of 3652 5240 NHXRII.exe 135 PID 3652 wrote to memory of 5892 3652 cmd.exe 139 PID 5892 wrote to memory of 3896 5892 RPD.exe 140 PID 3896 wrote to memory of 4100 3896 cmd.exe 144 PID 4100 wrote to memory of 3192 4100 JSPVA.exe 145 PID 3192 wrote to memory of 2080 3192 cmd.exe 149 PID 2080 wrote to memory of 3004 2080 VIWVMJH.exe 150 PID 3004 wrote to memory of 1972 3004 cmd.exe 154 PID 1972 wrote to memory of 5572 1972 FJYAQG.exe 155 PID 5572 wrote to memory of 5308 5572 cmd.exe 159 PID 5308 wrote to memory of 5044 5308 ZWDJAGY.exe 160 PID 5044 wrote to memory of 4744 5044 cmd.exe 164 PID 4744 wrote to memory of 5288 4744 TWKUJH.exe 165 PID 5288 wrote to memory of 4216 5288 cmd.exe 169 PID 4216 wrote to memory of 4432 4216 VMYOZ.exe 170 PID 4432 wrote to memory of 1348 4432 cmd.exe 174 PID 1348 wrote to memory of 2360 1348 VPBSEFZ.exe 175 PID 2360 wrote to memory of 5160 2360 cmd.exe 179 PID 5160 wrote to memory of 1736 5160 OIJDOGH.exe 180 PID 1736 wrote to memory of 2960 1736 cmd.exe 184 PID 2960 wrote to memory of 5256 2960 TTHQV.exe 185 PID 5256 wrote to memory of 4408 5256 cmd.exe 189 PID 4408 wrote to memory of 948 4408 PYZFM.exe 190 PID 948 wrote to memory of 3504 948 cmd.exe 194 PID 3504 wrote to memory of 244 3504 MRJQQ.exe 195 PID 244 wrote to memory of 5828 244 cmd.exe 199 PID 5828 wrote to memory of 548 5828 HCR.exe 200 PID 548 wrote to memory of 5448 548 cmd.exe 204 PID 5448 wrote to memory of 4680 5448 PSSGKX.exe 205 PID 4680 wrote to memory of 4996 4680 cmd.exe 209 PID 4996 wrote to memory of 3616 4996 DNEZQM.exe 210 PID 3616 wrote to memory of 4972 3616 cmd.exe 214 PID 4972 wrote to memory of 1384 4972 BYHPZ.exe 215 PID 1384 wrote to memory of 5948 1384 cmd.exe 219 PID 5948 wrote to memory of 3448 5948 YDZEP.exe 220 PID 3448 wrote to memory of 5548 3448 cmd.exe 224 PID 5548 wrote to memory of 1132 5548 ZGDIVLF.exe 225 PID 1132 wrote to memory of 4676 1132 cmd.exe 229 PID 4676 wrote to memory of 2152 4676 GWEZB.exe 230 PID 2152 wrote to memory of 5504 2152 cmd.exe 234 PID 5504 wrote to memory of 5136 5504 VRN.exe 235 PID 5136 wrote to memory of 1308 5136 cmd.exe 239 PID 1308 wrote to memory of 3304 1308 BNNM.exe 240 PID 3304 wrote to memory of 5116 3304 cmd.exe 244 PID 5116 wrote to memory of 1184 5116 QIWRCJT.exe 245 PID 1184 wrote to memory of 1200 1184 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_9aade912faa8dd0bb5fbb759d98474a5_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_9aade912faa8dd0bb5fbb759d98474a5_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJGFKLF.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\windows\OJGFKLF.exeC:\windows\OJGFKLF.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPHSYXJ.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:872 -
C:\windows\SysWOW64\VPHSYXJ.exeC:\windows\system32\VPHSYXJ.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFSVLK.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\windows\system\TFSVLK.exeC:\windows\system\TFSVLK.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKSH.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\windows\SysWOW64\HKSH.exeC:\windows\system32\HKSH.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YTGE.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\windows\SysWOW64\YTGE.exeC:\windows\system32\YTGE.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ITIJLKX.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\windows\ITIJLKX.exeC:\windows\ITIJLKX.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UJPRP.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\windows\UJPRP.exeC:\windows\UJPRP.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMX.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\windows\HMX.exeC:\windows\HMX.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHXRII.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\windows\system\NHXRII.exeC:\windows\system\NHXRII.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPD.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\windows\system\RPD.exeC:\windows\system\RPD.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSPVA.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\windows\SysWOW64\JSPVA.exeC:\windows\system32\JSPVA.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VIWVMJH.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\windows\VIWVMJH.exeC:\windows\VIWVMJH.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJYAQG.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\windows\FJYAQG.exeC:\windows\FJYAQG.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZWDJAGY.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\windows\SysWOW64\ZWDJAGY.exeC:\windows\system32\ZWDJAGY.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TWKUJH.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\windows\SysWOW64\TWKUJH.exeC:\windows\system32\TWKUJH.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMYOZ.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\windows\system\VMYOZ.exeC:\windows\system\VMYOZ.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPBSEFZ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\windows\VPBSEFZ.exeC:\windows\VPBSEFZ.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OIJDOGH.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\windows\system\OIJDOGH.exeC:\windows\system\OIJDOGH.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TTHQV.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\windows\TTHQV.exeC:\windows\TTHQV.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PYZFM.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\windows\PYZFM.exeC:\windows\PYZFM.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRJQQ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\windows\system\MRJQQ.exeC:\windows\system\MRJQQ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HCR.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:244 -
C:\windows\HCR.exeC:\windows\HCR.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PSSGKX.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548 -
C:\windows\PSSGKX.exeC:\windows\PSSGKX.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNEZQM.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\windows\system\DNEZQM.exeC:\windows\system\DNEZQM.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BYHPZ.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\windows\SysWOW64\BYHPZ.exeC:\windows\system32\BYHPZ.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDZEP.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\windows\YDZEP.exeC:\windows\YDZEP.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGDIVLF.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\windows\ZGDIVLF.exeC:\windows\ZGDIVLF.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWEZB.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\windows\GWEZB.exeC:\windows\GWEZB.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRN.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\windows\SysWOW64\VRN.exeC:\windows\system32\VRN.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNNM.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\windows\BNNM.exeC:\windows\BNNM.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QIWRCJT.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\windows\SysWOW64\QIWRCJT.exeC:\windows\system32\QIWRCJT.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AIY.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\windows\AIY.exeC:\windows\AIY.exe65⤵
- Executes dropped EXE
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDDNQOS.exe.bat" "66⤵
- Executes a command shell one-liner
PID:6128 -
C:\windows\system\UDDNQOS.exeC:\windows\system\UDDNQOS.exe67⤵
- Executes dropped EXE
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JYM.exe.bat" "68⤵PID:1908
-
C:\windows\system\JYM.exeC:\windows\system\JYM.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KBQNORU.exe.bat" "70⤵PID:4684
-
C:\windows\SysWOW64\KBQNORU.exeC:\windows\system32\KBQNORU.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DWUR.exe.bat" "72⤵PID:5436
-
C:\windows\SysWOW64\DWUR.exeC:\windows\system32\DWUR.exe73⤵
- Executes dropped EXE
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCUF.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4360 -
C:\windows\LCUF.exeC:\windows\LCUF.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXZPFT.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5956 -
C:\windows\FXZPFT.exeC:\windows\FXZPFT.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VSIT.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5824 -
C:\windows\SysWOW64\VSIT.exeC:\windows\system32\VSIT.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVM.exe.bat" "80⤵PID:5920
-
C:\windows\SysWOW64\NVM.exeC:\windows\system32\NVM.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOPQ.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3696 -
C:\windows\system\ZOPQ.exeC:\windows\system\ZOPQ.exe83⤵
- Executes dropped EXE
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJZUXYV.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:1052 -
C:\windows\OJZUXYV.exeC:\windows\OJZUXYV.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FJB.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:2864 -
C:\windows\system\FJB.exeC:\windows\system\FJB.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JZHHNO.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:5512 -
C:\windows\SysWOW64\JZHHNO.exeC:\windows\system32\JZHHNO.exe89⤵
- Executes dropped EXE
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YPIY.exe.bat" "90⤵PID:1344
-
C:\windows\YPIY.exeC:\windows\YPIY.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KIL.exe.bat" "92⤵
- Executes a command shell one-liner
PID:3708 -
C:\windows\system\KIL.exeC:\windows\system\KIL.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GNDG.exe.bat" "94⤵
- Executes a command shell one-liner
PID:5100 -
C:\windows\SysWOW64\GNDG.exeC:\windows\system32\GNDG.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GTWVT.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1700 -
C:\windows\system\GTWVT.exeC:\windows\system\GTWVT.exe97⤵
- Executes dropped EXE
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BGAEWZ.exe.bat" "98⤵PID:3772
-
C:\windows\system\BGAEWZ.exeC:\windows\system\BGAEWZ.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DUF.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:768 -
C:\windows\system\DUF.exeC:\windows\system\DUF.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YPKXQ.exe.bat" "102⤵
- Executes a command shell one-liner
PID:3404 -
C:\windows\SysWOW64\YPKXQ.exeC:\windows\system32\YPKXQ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LSS.exe.bat" "104⤵PID:3736
-
C:\windows\SysWOW64\LSS.exeC:\windows\system32\LSS.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVERKZK.exe.bat" "106⤵
- Executes a command shell one-liner
PID:1592 -
C:\windows\SysWOW64\MVERKZK.exeC:\windows\system32\MVERKZK.exe107⤵
- Executes dropped EXE
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VDY.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:3440 -
C:\windows\VDY.exeC:\windows\VDY.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDGSEZ.exe.bat" "110⤵PID:4276
-
C:\windows\BDGSEZ.exeC:\windows\BDGSEZ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KEIXIWP.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3280 -
C:\windows\KEIXIWP.exeC:\windows\KEIXIWP.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QEQL.exe.bat" "114⤵PID:5272
-
C:\windows\system\QEQL.exeC:\windows\system\QEQL.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WEXZAB.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:2732 -
C:\windows\SysWOW64\WEXZAB.exeC:\windows\system32\WEXZAB.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXA.exe.bat" "118⤵
- Executes a command shell one-liner
PID:5440 -
C:\windows\SysWOW64\HXA.exeC:\windows\system32\HXA.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RFCX.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5536 -
C:\windows\SysWOW64\RFCX.exeC:\windows\system32\RFCX.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-