Analysis
- max time kernel
83s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 04:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-04_8aaaaed67e37d19e9c4c017b36a60b79_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-04_8aaaaed67e37d19e9c4c017b36a60b79_elex_emotet_stop.exe
- Size 208KB
- Sample260905-evjfxawfre
- SHA256 4c91dc6e6673c5bfa61d28697a86ca4ece479d7720ec1e57885771d1264662d4
- MD5 8aaaaed67e37d19e9c4c017b36a60b79
- SHA1 9edfac7a8c6550828c07405acf0962f0e07f928c
- SHA512 6e1e8b407d7d9783d49844bbe78d8b82f7276b727fcb3b78ca25c2902e1a381e26336222eaf1ff56aadaa133ce9f395ab2c971d64d57cb89ab489b2184f3e29a
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFliKL+LOfD4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFliS+LOLkEj1
- TLSH T18B247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4000 VRVK.exe 6100 FZIZTOO.exe 264 NEUGEMK.exe 3924 DCIX.exe 5408 OVLQUI.exe 3516 SDS.exe 5352 NOAPME.exe 5784 RRYK.exe 1808 QGRFHCI.exe 2788 XXSEOX.exe 4668 RXAPXQ.exe 1532 XKZQCTV.exe 3016 RGE.exe 3456 QVXCZYR.exe 2860 FLYUG.exe 2112 JTF.exe 5956 SCHHWK.exe 3296 NPL.exe 3536 QCQA.exe 4392 GVTQRX.exe 4944 VQDU.exe 6028 ROD.exe 4836 GJUSXI.exe 2732 PROX.exe 1448 IUATOE.exe 1536 XPJF.exe 3432 FVO.exe 1816 EOZCSDT.exe 4740 VOBH.exe 712 QBXQG.exe 5596 JEJU.exe 3392 YZTZE.exe 4544 PIVE.exe 2216 IDYHN.exe 2984 MTF.exe 2004 QTHK.exe 1092 GJCB.exe 5040 KRJBFUG.exe 4688 DKQUONO.exe 4916 RQYYQ.exe 3836 OGMPGFN.exe 2832 BQUOU.exe 4908 WZDLBKE.exe 2432 ICO.exe 2992 QPS.exe 3652 RSIT.exe 2800 KLYE.exe 4728 SQL.exe 4132 WTJFEP.exe 1368 LWSK.exe 3368 MRWNCA.exe 3408 MFBUNY.exe 2884 UKNBP.exe 4880 XGSKAXA.exe 3416 EWTJG.exe 4236 QEA.exe 3560 SCNEALU.exe 1832 TFRH.exe 4144 RPU.exe 3668 MDLZ.exe 6132 LNO.exe 4100 GYEGWR.exe 5232 GEXUGET.exe 240 KUDC.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\XGSKAXA.exe UKNBP.exe File opened for modification C:\windows\SysWOW64\DKQUONO.exe KRJBFUG.exe File created C:\windows\SysWOW64\LNO.exe MDLZ.exe File created C:\windows\SysWOW64\LNO.exe.bat MDLZ.exe File opened for modification C:\windows\SysWOW64\SZMHFS.exe ORGZ.exe File created C:\windows\SysWOW64\GVTQRX.exe QCQA.exe File created C:\windows\SysWOW64\WZDLBKE.exe BQUOU.exe File opened for modification C:\windows\SysWOW64\LWSK.exe WTJFEP.exe File created C:\windows\SysWOW64\GEXUGET.exe.bat GYEGWR.exe File created C:\windows\SysWOW64\NIHP.exe.bat YNYLNCH.exe File created C:\windows\SysWOW64\AAJLV.exe.bat HXFQQU.exe File created C:\windows\SysWOW64\RSIT.exe.bat QPS.exe File opened for modification C:\windows\SysWOW64\FZIZTOO.exe VRVK.exe File created C:\windows\SysWOW64\SDS.exe OVLQUI.exe File created C:\windows\SysWOW64\SDS.exe.bat OVLQUI.exe File created C:\windows\SysWOW64\NOAPME.exe SDS.exe File created C:\windows\SysWOW64\VQDU.exe.bat GVTQRX.exe File created C:\windows\SysWOW64\IDYHN.exe PIVE.exe File created C:\windows\SysWOW64\DKQUONO.exe.bat KRJBFUG.exe File created C:\windows\SysWOW64\OVLQUI.exe DCIX.exe File created C:\windows\SysWOW64\PROX.exe.bat GJUSXI.exe File created C:\windows\SysWOW64\JEJU.exe QBXQG.exe File opened for modification C:\windows\SysWOW64\WZDLBKE.exe BQUOU.exe File created C:\windows\SysWOW64\BQUOU.exe.bat OGMPGFN.exe File created C:\windows\SysWOW64\RSIT.exe QPS.exe File created C:\windows\SysWOW64\MFBUNY.exe.bat MRWNCA.exe File created C:\windows\SysWOW64\ROHDL.exe.bat IFF.exe File created C:\windows\SysWOW64\FZIZTOO.exe.bat VRVK.exe File created C:\windows\SysWOW64\DKQUONO.exe KRJBFUG.exe File created C:\windows\SysWOW64\WZDLBKE.exe.bat BQUOU.exe File created C:\windows\SysWOW64\LWSK.exe.bat WTJFEP.exe File created C:\windows\SysWOW64\XGSKAXA.exe UKNBP.exe File opened for modification C:\windows\SysWOW64\NIHP.exe YNYLNCH.exe File created C:\windows\SysWOW64\TEGQDSF.exe.bat NIHP.exe File opened for modification C:\windows\SysWOW64\AAJLV.exe HXFQQU.exe File created C:\windows\SysWOW64\NEUGEMK.exe.bat FZIZTOO.exe File opened for modification C:\windows\SysWOW64\OVLQUI.exe DCIX.exe File created C:\windows\SysWOW64\NOAPME.exe.bat SDS.exe File created C:\windows\SysWOW64\RQYYQ.exe DKQUONO.exe File created C:\windows\SysWOW64\MFBUNY.exe MRWNCA.exe File opened for modification C:\windows\SysWOW64\USR.exe KUDC.exe File created C:\windows\SysWOW64\ROHDL.exe IFF.exe File opened for modification C:\windows\SysWOW64\ROHDL.exe IFF.exe File created C:\windows\SysWOW64\VQDU.exe GVTQRX.exe File opened for modification C:\windows\SysWOW64\IDYHN.exe PIVE.exe File created C:\windows\SysWOW64\MDLZ.exe RPU.exe File opened for modification C:\windows\SysWOW64\GEXUGET.exe GYEGWR.exe File created C:\windows\SysWOW64\USR.exe KUDC.exe File created C:\windows\SysWOW64\NIHP.exe YNYLNCH.exe File created C:\windows\SysWOW64\PNOPTX.exe PIWAS.exe File created C:\windows\SysWOW64\PNOPTX.exe.bat PIWAS.exe File created C:\windows\SysWOW64\VRVK.exe 2026-09-04_8aaaaed67e37d19e9c4c017b36a60b79_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\SDS.exe OVLQUI.exe File opened for modification C:\windows\SysWOW64\BQUOU.exe OGMPGFN.exe File opened for modification C:\windows\SysWOW64\MFBUNY.exe MRWNCA.exe File opened for modification C:\windows\SysWOW64\TEGQDSF.exe NIHP.exe File created C:\windows\SysWOW64\AAJLV.exe HXFQQU.exe File opened for modification C:\windows\SysWOW64\BIA.exe PXPIUC.exe File created C:\windows\SysWOW64\BIA.exe.bat PXPIUC.exe File created C:\windows\SysWOW64\GVTQRX.exe.bat QCQA.exe File created C:\windows\SysWOW64\RQYYQ.exe.bat DKQUONO.exe File opened for modification C:\windows\SysWOW64\LNO.exe MDLZ.exe File created C:\windows\SysWOW64\SZMHFS.exe.bat ORGZ.exe File opened for modification C:\windows\SysWOW64\IUATOE.exe PROX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\QEA.exe EWTJG.exe File created C:\windows\RPU.exe TFRH.exe File created C:\windows\system\YNYLNCH.exe.bat OFWGK.exe File created C:\windows\system\FKAG.exe.bat GMPDSH.exe File opened for modification C:\windows\system\VNNVFKQ.exe AAJLV.exe File created C:\windows\JTCZR.exe.bat AGRHCET.exe File opened for modification C:\windows\system\XXSEOX.exe QGRFHCI.exe File created C:\windows\JTF.exe.bat FLYUG.exe File created C:\windows\system\OGMPGFN.exe RQYYQ.exe File created C:\windows\system\OGMPGFN.exe.bat RQYYQ.exe File created C:\windows\SQL.exe KLYE.exe File created C:\windows\FUUYFLQ.exe OTS.exe File created C:\windows\system\MSJUY.exe JKAG.exe File opened for modification C:\windows\EOZCSDT.exe FVO.exe File opened for modification C:\windows\VOBH.exe EOZCSDT.exe File created C:\windows\MTF.exe.bat IDYHN.exe File created C:\windows\SQL.exe.bat KLYE.exe File opened for modification C:\windows\system\KDO.exe VNNVFKQ.exe File created C:\windows\system\PRPUS.exe.bat RCERFKX.exe File created C:\windows\system\JGNWB.exe RDJAOC.exe File created C:\windows\FUUYFLQ.exe.bat OTS.exe File created C:\windows\DCIX.exe NEUGEMK.exe File created C:\windows\XKZQCTV.exe RXAPXQ.exe File opened for modification C:\windows\QVXCZYR.exe RGE.exe File created C:\windows\system\UKNBP.exe.bat MFBUNY.exe File created C:\windows\ZJDRYW.exe.bat JTCZR.exe File opened for modification C:\windows\system\MSJUY.exe JKAG.exe File created C:\windows\ZISH.exe SSRIHR.exe File created C:\windows\QBXQG.exe.bat VOBH.exe File created C:\windows\system\QTHK.exe MTF.exe File created C:\windows\SCNEALU.exe.bat QEA.exe File created C:\windows\system\VNNVFKQ.exe.bat AAJLV.exe File opened for modification C:\windows\system\PXPIUC.exe PRPUS.exe File created C:\windows\JTCZR.exe AGRHCET.exe File opened for modification C:\windows\system\RXAPXQ.exe XXSEOX.exe File opened for modification C:\windows\system\RGE.exe XKZQCTV.exe File opened for modification C:\windows\system\OFWGK.exe USR.exe File created C:\windows\system\SCQDL.exe SZMHFS.exe File created C:\windows\DCIX.exe.bat NEUGEMK.exe File created C:\windows\XKZQCTV.exe.bat RXAPXQ.exe File created C:\windows\system\SCHHWK.exe JTF.exe File opened for modification C:\windows\system\SHKQJKH.exe JHILF.exe File created C:\windows\ZISH.exe.bat SSRIHR.exe File created C:\windows\system\RGE.exe XKZQCTV.exe File opened for modification C:\windows\system\UKNBP.exe MFBUNY.exe File opened for modification C:\windows\CJR.exe TEGQDSF.exe File created C:\windows\CJR.exe.bat TEGQDSF.exe File created C:\windows\XOF.exe KDO.exe File created C:\windows\system\QGRFHCI.exe RRYK.exe File created C:\windows\PIVE.exe YZTZE.exe File opened for modification C:\windows\SCNEALU.exe QEA.exe File created C:\windows\system\PIWAS.exe SCQDL.exe File opened for modification C:\windows\system\QGRFHCI.exe RRYK.exe File created C:\windows\system\RXAPXQ.exe.bat XXSEOX.exe File opened for modification C:\windows\system\SCHHWK.exe JTF.exe File opened for modification C:\windows\PIVE.exe YZTZE.exe File created C:\windows\CJR.exe TEGQDSF.exe File created C:\windows\system\MSJUY.exe.bat JKAG.exe File opened for modification C:\windows\ZISH.exe SSRIHR.exe File opened for modification C:\windows\XKZQCTV.exe RXAPXQ.exe File created C:\windows\system\XPJF.exe.bat IUATOE.exe File created C:\windows\KRJBFUG.exe.bat GJCB.exe File created C:\windows\system\WTJFEP.exe.bat SQL.exe File opened for modification C:\windows\system\PRPUS.exe RCERFKX.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1812 cmd.exe 2876 cmd.exe 5148 cmd.exe 2716 cmd.exe 972 cmd.exe 1344 cmd.exe 4284 cmd.exe 4632 cmd.exe 3024 cmd.exe 4364 cmd.exe 5516 cmd.exe 4608 cmd.exe 3312 cmd.exe 6116 cmd.exe 6128 cmd.exe 1124 cmd.exe 3964 cmd.exe 4976 cmd.exe 592 cmd.exe 5620 cmd.exe 5388 cmd.exe 1216 cmd.exe 5932 cmd.exe 2624 cmd.exe 6056 cmd.exe 2448 cmd.exe 2444 cmd.exe 4380 cmd.exe 3660 cmd.exe 5700 cmd.exe 2932 cmd.exe 2524 cmd.exe 2776 cmd.exe 5032 cmd.exe 5072 cmd.exe 1440 cmd.exe 6008 cmd.exe 1708 cmd.exe 2516 cmd.exe 1184 cmd.exe 6088 cmd.exe 1332 cmd.exe 2284 cmd.exe 3356 cmd.exe 2344 cmd.exe 4972 cmd.exe 908 cmd.exe 5572 cmd.exe 852 cmd.exe 2428 cmd.exe 4592 cmd.exe 5752 cmd.exe 2036 cmd.exe 1120 cmd.exe 1096 cmd.exe 4788 cmd.exe 2332 cmd.exe 1664 cmd.exe 696 cmd.exe 1284 cmd.exe 560 cmd.exe 2292 cmd.exe 4292 cmd.exe 1512 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4044 1780 WerFault.exe 87 2628 4000 WerFault.exe 92 4744 6100 WerFault.exe 97 1848 264 WerFault.exe 103 5884 3924 WerFault.exe 108 1328 5408 WerFault.exe 113 5492 3516 WerFault.exe 118 1484 5352 WerFault.exe 123 5464 5784 WerFault.exe 128 1124 1808 WerFault.exe 133 5816 2788 WerFault.exe 138 5692 4668 WerFault.exe 143 1220 1532 WerFault.exe 148 6056 3016 WerFault.exe 153 4256 3456 WerFault.exe 158 5732 2860 WerFault.exe 163 1328 2112 WerFault.exe 168 4144 5956 WerFault.exe 173 2768 3296 WerFault.exe 178 1668 3536 WerFault.exe 183 2032 4392 WerFault.exe 188 5816 4944 WerFault.exe 193 3972 6028 WerFault.exe 198 3988 4836 WerFault.exe 203 5516 2732 WerFault.exe 208 5628 1448 WerFault.exe 213 4600 1536 WerFault.exe 218 5576 3432 WerFault.exe 223 4664 1816 WerFault.exe 228 4780 4740 WerFault.exe 233 2952 712 WerFault.exe 238 1040 5596 WerFault.exe 243 3068 3392 WerFault.exe 248 4128 4544 WerFault.exe 253 1100 2216 WerFault.exe 258 3744 2984 WerFault.exe 263 3832 2004 WerFault.exe 268 3476 1092 WerFault.exe 274 6088 5040 WerFault.exe 279 1404 4688 WerFault.exe 284 2292 4916 WerFault.exe 289 5280 3836 WerFault.exe 294 2956 2832 WerFault.exe 299 3284 4908 WerFault.exe 304 4548 2432 WerFault.exe 309 4904 2992 WerFault.exe 314 5268 3652 WerFault.exe 319 4444 2800 WerFault.exe 324 4284 4728 WerFault.exe 329 704 4132 WerFault.exe 334 1484 1368 WerFault.exe 339 3992 3368 WerFault.exe 344 792 3408 WerFault.exe 349 4888 2884 WerFault.exe 354 4116 4880 WerFault.exe 359 4712 3416 WerFault.exe 364 6120 4236 WerFault.exe 369 3008 3560 WerFault.exe 374 468 1832 WerFault.exe 379 1404 4144 WerFault.exe 384 3700 3668 WerFault.exe 389 5660 6132 WerFault.exe 394 1152 4100 WerFault.exe 399 2960 5232 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PXPIUC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTCZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IDYHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZDLBKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPJF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-04_8aaaaed67e37d19e9c4c017b36a60b79_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOAPME.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PRPUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEUGEMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFRH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQDU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNNVFKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHILF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUATOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMPDSH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCQA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QEA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCNEALU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCQDL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WTJFEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDJAOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JGNWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTHK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKQUONO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXFQQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SZMHFS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSRIHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1780 2026-09-04_8aaaaed67e37d19e9c4c017b36a60b79_elex_emotet_stop.exe 1780 2026-09-04_8aaaaed67e37d19e9c4c017b36a60b79_elex_emotet_stop.exe 4000 VRVK.exe 4000 VRVK.exe 6100 FZIZTOO.exe 6100 FZIZTOO.exe 264 NEUGEMK.exe 264 NEUGEMK.exe 3924 DCIX.exe 3924 DCIX.exe 5408 OVLQUI.exe 5408 OVLQUI.exe 3516 SDS.exe 3516 SDS.exe 5352 NOAPME.exe 5352 NOAPME.exe 5784 RRYK.exe 5784 RRYK.exe 1808 QGRFHCI.exe 1808 QGRFHCI.exe 2788 XXSEOX.exe 2788 XXSEOX.exe 4668 RXAPXQ.exe 4668 RXAPXQ.exe 1532 XKZQCTV.exe 1532 XKZQCTV.exe 3016 RGE.exe 3016 RGE.exe 3456 QVXCZYR.exe 3456 QVXCZYR.exe 2860 FLYUG.exe 2860 FLYUG.exe 2112 JTF.exe 2112 JTF.exe 5956 SCHHWK.exe 5956 SCHHWK.exe 3296 NPL.exe 3296 NPL.exe 3536 QCQA.exe 3536 QCQA.exe 4392 GVTQRX.exe 4392 GVTQRX.exe 4944 VQDU.exe 4944 VQDU.exe 6028 ROD.exe 6028 ROD.exe 4836 GJUSXI.exe 4836 GJUSXI.exe 2732 PROX.exe 2732 PROX.exe 1448 IUATOE.exe 1448 IUATOE.exe 1536 XPJF.exe 1536 XPJF.exe 3432 FVO.exe 3432 FVO.exe 1816 EOZCSDT.exe 1816 EOZCSDT.exe 4740 VOBH.exe 4740 VOBH.exe 712 QBXQG.exe 712 QBXQG.exe 5596 JEJU.exe 5596 JEJU.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1780 2026-09-04_8aaaaed67e37d19e9c4c017b36a60b79_elex_emotet_stop.exe 1780 2026-09-04_8aaaaed67e37d19e9c4c017b36a60b79_elex_emotet_stop.exe 4000 VRVK.exe 4000 VRVK.exe 6100 FZIZTOO.exe 6100 FZIZTOO.exe 264 NEUGEMK.exe 264 NEUGEMK.exe 3924 DCIX.exe 3924 DCIX.exe 5408 OVLQUI.exe 5408 OVLQUI.exe 3516 SDS.exe 3516 SDS.exe 5352 NOAPME.exe 5352 NOAPME.exe 5784 RRYK.exe 5784 RRYK.exe 1808 QGRFHCI.exe 1808 QGRFHCI.exe 2788 XXSEOX.exe 2788 XXSEOX.exe 4668 RXAPXQ.exe 4668 RXAPXQ.exe 1532 XKZQCTV.exe 1532 XKZQCTV.exe 3016 RGE.exe 3016 RGE.exe 3456 QVXCZYR.exe 3456 QVXCZYR.exe 2860 FLYUG.exe 2860 FLYUG.exe 2112 JTF.exe 2112 JTF.exe 5956 SCHHWK.exe 5956 SCHHWK.exe 3296 NPL.exe 3296 NPL.exe 3536 QCQA.exe 3536 QCQA.exe 4392 GVTQRX.exe 4392 GVTQRX.exe 4944 VQDU.exe 4944 VQDU.exe 6028 ROD.exe 6028 ROD.exe 4836 GJUSXI.exe 4836 GJUSXI.exe 2732 PROX.exe 2732 PROX.exe 1448 IUATOE.exe 1448 IUATOE.exe 1536 XPJF.exe 1536 XPJF.exe 3432 FVO.exe 3432 FVO.exe 1816 EOZCSDT.exe 1816 EOZCSDT.exe 4740 VOBH.exe 4740 VOBH.exe 712 QBXQG.exe 712 QBXQG.exe 5596 JEJU.exe 5596 JEJU.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1780 wrote to memory of 4580 1780 2026-09-04_8aaaaed67e37d19e9c4c017b36a60b79_elex_emotet_stop.exe 88 PID 4580 wrote to memory of 4000 4580 cmd.exe 92 PID 4000 wrote to memory of 2332 4000 VRVK.exe 94 PID 2332 wrote to memory of 6100 2332 cmd.exe 97 PID 6100 wrote to memory of 824 6100 FZIZTOO.exe 99 PID 824 wrote to memory of 264 824 cmd.exe 103 PID 264 wrote to memory of 2644 264 NEUGEMK.exe 104 PID 2644 wrote to memory of 3924 2644 cmd.exe 108 PID 3924 wrote to memory of 972 3924 DCIX.exe 109 PID 972 wrote to memory of 5408 972 cmd.exe 113 PID 5408 wrote to memory of 5624 5408 OVLQUI.exe 114 PID 5624 wrote to memory of 3516 5624 cmd.exe 118 PID 3516 wrote to memory of 6008 3516 SDS.exe 119 PID 6008 wrote to memory of 5352 6008 cmd.exe 123 PID 5352 wrote to memory of 1708 5352 NOAPME.exe 124 PID 1708 wrote to memory of 5784 1708 cmd.exe 128 PID 5784 wrote to memory of 2472 5784 RRYK.exe 129 PID 2472 wrote to memory of 1808 2472 cmd.exe 133 PID 1808 wrote to memory of 4644 1808 QGRFHCI.exe 134 PID 4644 wrote to memory of 2788 4644 cmd.exe 138 PID 2788 wrote to memory of 5952 2788 XXSEOX.exe 139 PID 5952 wrote to memory of 4668 5952 cmd.exe 143 PID 4668 wrote to memory of 3964 4668 RXAPXQ.exe 144 PID 3964 wrote to memory of 1532 3964 cmd.exe 148 PID 1532 wrote to memory of 5552 1532 XKZQCTV.exe 149 PID 5552 wrote to memory of 3016 5552 cmd.exe 153 PID 3016 wrote to memory of 1516 3016 RGE.exe 154 PID 1516 wrote to memory of 3456 1516 cmd.exe 158 PID 3456 wrote to memory of 5712 3456 QVXCZYR.exe 159 PID 5712 wrote to memory of 2860 5712 cmd.exe 163 PID 2860 wrote to memory of 2484 2860 FLYUG.exe 164 PID 2484 wrote to memory of 2112 2484 cmd.exe 168 PID 2112 wrote to memory of 3252 2112 JTF.exe 169 PID 3252 wrote to memory of 5956 3252 cmd.exe 173 PID 5956 wrote to memory of 4972 5956 SCHHWK.exe 174 PID 4972 wrote to memory of 3296 4972 cmd.exe 178 PID 3296 wrote to memory of 4292 3296 NPL.exe 179 PID 4292 wrote to memory of 3536 4292 cmd.exe 183 PID 3536 wrote to memory of 4496 3536 QCQA.exe 184 PID 4496 wrote to memory of 4392 4496 cmd.exe 188 PID 4392 wrote to memory of 4892 4392 GVTQRX.exe 189 PID 4892 wrote to memory of 4944 4892 cmd.exe 193 PID 4944 wrote to memory of 1384 4944 VQDU.exe 194 PID 1384 wrote to memory of 6028 1384 cmd.exe 198 PID 6028 wrote to memory of 908 6028 ROD.exe 199 PID 908 wrote to memory of 4836 908 cmd.exe 203 PID 4836 wrote to memory of 3440 4836 GJUSXI.exe 204 PID 3440 wrote to memory of 2732 3440 cmd.exe 208 PID 2732 wrote to memory of 2516 2732 PROX.exe 209 PID 2516 wrote to memory of 1448 2516 cmd.exe 213 PID 1448 wrote to memory of 5700 1448 IUATOE.exe 214 PID 5700 wrote to memory of 1536 5700 cmd.exe 218 PID 1536 wrote to memory of 5572 1536 XPJF.exe 219 PID 5572 wrote to memory of 3432 5572 cmd.exe 223 PID 3432 wrote to memory of 2772 3432 FVO.exe 224 PID 2772 wrote to memory of 1816 2772 cmd.exe 228 PID 1816 wrote to memory of 1556 1816 EOZCSDT.exe 229 PID 1556 wrote to memory of 4740 1556 cmd.exe 233 PID 4740 wrote to memory of 3116 4740 VOBH.exe 234 PID 3116 wrote to memory of 712 3116 cmd.exe 238 PID 712 wrote to memory of 4364 712 QBXQG.exe 239 PID 4364 wrote to memory of 5596 4364 cmd.exe 243 PID 5596 wrote to memory of 5276 5596 JEJU.exe 244 PID 5276 wrote to memory of 3392 5276 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_8aaaaed67e37d19e9c4c017b36a60b79_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_8aaaaed67e37d19e9c4c017b36a60b79_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRVK.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\SysWOW64\VRVK.exeC:\windows\system32\VRVK.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FZIZTOO.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\windows\SysWOW64\FZIZTOO.exeC:\windows\system32\FZIZTOO.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NEUGEMK.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:824 -
C:\windows\SysWOW64\NEUGEMK.exeC:\windows\system32\NEUGEMK.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DCIX.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\windows\DCIX.exeC:\windows\DCIX.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVLQUI.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:972 -
C:\windows\SysWOW64\OVLQUI.exeC:\windows\system32\OVLQUI.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDS.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\windows\SysWOW64\SDS.exeC:\windows\system32\SDS.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOAPME.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\windows\SysWOW64\NOAPME.exeC:\windows\system32\NOAPME.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RRYK.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\windows\SysWOW64\RRYK.exeC:\windows\system32\RRYK.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QGRFHCI.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\windows\system\QGRFHCI.exeC:\windows\system\QGRFHCI.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXSEOX.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\windows\system\XXSEOX.exeC:\windows\system\XXSEOX.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RXAPXQ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\windows\system\RXAPXQ.exeC:\windows\system\RXAPXQ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XKZQCTV.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\windows\XKZQCTV.exeC:\windows\XKZQCTV.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGE.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\windows\system\RGE.exeC:\windows\system\RGE.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVXCZYR.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\windows\QVXCZYR.exeC:\windows\QVXCZYR.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FLYUG.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\windows\FLYUG.exeC:\windows\FLYUG.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JTF.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\windows\JTF.exeC:\windows\JTF.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SCHHWK.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\windows\system\SCHHWK.exeC:\windows\system\SCHHWK.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NPL.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\windows\NPL.exeC:\windows\NPL.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCQA.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\windows\QCQA.exeC:\windows\QCQA.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GVTQRX.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\windows\SysWOW64\GVTQRX.exeC:\windows\system32\GVTQRX.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VQDU.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\windows\SysWOW64\VQDU.exeC:\windows\system32\VQDU.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ROD.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\windows\ROD.exeC:\windows\ROD.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GJUSXI.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:908 -
C:\windows\system\GJUSXI.exeC:\windows\system\GJUSXI.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PROX.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\windows\SysWOW64\PROX.exeC:\windows\system32\PROX.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IUATOE.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\windows\SysWOW64\IUATOE.exeC:\windows\system32\IUATOE.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPJF.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\windows\system\XPJF.exeC:\windows\system\XPJF.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FVO.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\windows\FVO.exeC:\windows\FVO.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EOZCSDT.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\windows\EOZCSDT.exeC:\windows\EOZCSDT.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VOBH.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\windows\VOBH.exeC:\windows\VOBH.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QBXQG.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\windows\QBXQG.exeC:\windows\QBXQG.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JEJU.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\windows\SysWOW64\JEJU.exeC:\windows\system32\JEJU.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YZTZE.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\windows\YZTZE.exeC:\windows\YZTZE.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PIVE.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:1700 -
C:\windows\PIVE.exeC:\windows\PIVE.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IDYHN.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:5220 -
C:\windows\SysWOW64\IDYHN.exeC:\windows\system32\IDYHN.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTF.exe.bat" "70⤵PID:1144
-
C:\windows\MTF.exeC:\windows\MTF.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTHK.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4976 -
C:\windows\system\QTHK.exeC:\windows\system\QTHK.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GJCB.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2036 -
C:\windows\system\GJCB.exeC:\windows\system\GJCB.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KRJBFUG.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2932 -
C:\windows\KRJBFUG.exeC:\windows\KRJBFUG.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DKQUONO.exe.bat" "78⤵PID:3480
-
C:\windows\SysWOW64\DKQUONO.exeC:\windows\system32\DKQUONO.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RQYYQ.exe.bat" "80⤵PID:1476
-
C:\windows\SysWOW64\RQYYQ.exeC:\windows\system32\RQYYQ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGMPGFN.exe.bat" "82⤵PID:5536
-
C:\windows\system\OGMPGFN.exeC:\windows\system\OGMPGFN.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BQUOU.exe.bat" "84⤵
- Executes a command shell one-liner
PID:592 -
C:\windows\SysWOW64\BQUOU.exeC:\windows\system32\BQUOU.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WZDLBKE.exe.bat" "86⤵PID:5368
-
C:\windows\SysWOW64\WZDLBKE.exeC:\windows\system32\WZDLBKE.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ICO.exe.bat" "88⤵
- Executes a command shell one-liner
PID:1216 -
C:\windows\system\ICO.exeC:\windows\system\ICO.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QPS.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:5904 -
C:\windows\system\QPS.exeC:\windows\system\QPS.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RSIT.exe.bat" "92⤵
- Executes a command shell one-liner
PID:2524 -
C:\windows\SysWOW64\RSIT.exeC:\windows\system32\RSIT.exe93⤵
- Executes dropped EXE
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KLYE.exe.bat" "94⤵PID:3656
-
C:\windows\system\KLYE.exeC:\windows\system\KLYE.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SQL.exe.bat" "96⤵
- Executes a command shell one-liner
PID:4788 -
C:\windows\SQL.exeC:\windows\SQL.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WTJFEP.exe.bat" "98⤵PID:5216
-
C:\windows\system\WTJFEP.exeC:\windows\system\WTJFEP.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LWSK.exe.bat" "100⤵PID:2620
-
C:\windows\SysWOW64\LWSK.exeC:\windows\system32\LWSK.exe101⤵
- Executes dropped EXE
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRWNCA.exe.bat" "102⤵PID:3032
-
C:\windows\system\MRWNCA.exeC:\windows\system\MRWNCA.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MFBUNY.exe.bat" "104⤵PID:4484
-
C:\windows\SysWOW64\MFBUNY.exeC:\windows\system32\MFBUNY.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UKNBP.exe.bat" "106⤵PID:5028
-
C:\windows\system\UKNBP.exeC:\windows\system\UKNBP.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XGSKAXA.exe.bat" "108⤵PID:3512
-
C:\windows\SysWOW64\XGSKAXA.exeC:\windows\system32\XGSKAXA.exe109⤵
- Executes dropped EXE
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EWTJG.exe.bat" "110⤵PID:5144
-
C:\windows\EWTJG.exeC:\windows\EWTJG.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QEA.exe.bat" "112⤵PID:3744
-
C:\windows\QEA.exeC:\windows\QEA.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SCNEALU.exe.bat" "114⤵
- Executes a command shell one-liner
PID:1184 -
C:\windows\SCNEALU.exeC:\windows\SCNEALU.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TFRH.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:852 -
C:\windows\TFRH.exeC:\windows\TFRH.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RPU.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5620 -
C:\windows\RPU.exeC:\windows\RPU.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MDLZ.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1812 -
C:\windows\SysWOW64\MDLZ.exeC:\windows\system32\MDLZ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-