Analysis
- max time kernel
91s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/09/2026, 14:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-09_a3a7805c0a1e1ef7f302afb2370b3b72_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-09_a3a7805c0a1e1ef7f302afb2370b3b72_elex_emotet_stop.exe
- Size 208KB
- Sample260909-rt6ahace46
- SHA256 3f704bf3fc4f3094efeec63f8a854f3459ffbff3fcbf74de223431be430d2b67
- MD5 a3a7805c0a1e1ef7f302afb2370b3b72
- SHA1 33c2a96472565f3983a244f16bf6e771e78fa935
- SHA512 b86a08388e03829e4a3d9c94ea5c2014533206f5b6a9d315b6f22053f75989c06ceb8957569cb2203276330a90cf67b3344ea31023dcb8925a323cb13c872d68
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfM4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOEkEj1
- TLSH T124247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5480 WSX.exe 1160 DYQCT.exe 4112 LLVQE.exe 5752 RLCEVBD.exe 5196 PWFM.exe 6840 IZR.exe 2968 DCAOXI.exe 4208 UNCEY.exe 5152 UQGALEU.exe 1080 YGVAYW.exe 2592 ZBZ.exe 6940 MHZQFYB.exe 6316 ARHO.exe 2952 TKWZD.exe 6412 SVZH.exe 4536 ZLAHSDP.exe 4104 SDQSBEY.exe 3312 PEZUNI.exe 2824 SRJDZTO.exe 2060 JZL.exe 4892 CUOEP.exe 7068 RXG.exe 2384 QIJHJPW.exe 3696 ILNCPF.exe 2160 JGQ.exe 2840 CJUCI.exe 952 REMGTGR.exe 4852 VHKBA.exe 6076 KKT.exe 2612 YITRNXE.exe 7084 JYAZAP.exe 3132 ZTJELCA.exe 5404 MRRPUOK.exe 5592 XKZAEG.exe 6976 NAAA.exe 5164 VNMG.exe 4344 OGCR.exe 2948 SWIRRU.exe 5504 ABNYBS.exe 1680 UPUE.exe 5488 QUMTX.exe 3692 GKN.exe 1140 HITFLT.exe 6220 DLBEZW.exe 2436 HWZR.exe 5784 WRRD.exe 6392 LHS.exe 5284 PPYCD.exe 4516 KKDMNPX.exe 3828 OSKMRI.exe 2032 OYKABVN.exe 5236 UYSOKPP.exe 3172 AZRCT.exe 5016 UUWLDR.exe 7088 PHB.exe 6516 AAEN.exe 1184 VNJXYY.exe 6164 OGYIPZ.exe 5396 ZYT.exe 6572 LRWTYNK.exe 5612 CZYYB.exe 4648 PCH.exe 3040 KXLGA.exe 1632 VQOZAD.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\LRWTYNK.exe.bat ZYT.exe File created C:\windows\SysWOW64\LTME.exe CKK.exe File opened for modification C:\windows\SysWOW64\CJUCI.exe JGQ.exe File created C:\windows\SysWOW64\PPYCD.exe LHS.exe File created C:\windows\SysWOW64\JSAPMET.exe.bat ZUN.exe File opened for modification C:\windows\SysWOW64\MHZQFYB.exe ZBZ.exe File opened for modification C:\windows\SysWOW64\AAEN.exe PHB.exe File opened for modification C:\windows\SysWOW64\UOGLZ.exe KFEG.exe File created C:\windows\SysWOW64\YGVAYW.exe UQGALEU.exe File created C:\windows\SysWOW64\YEHAZ.exe AQHSD.exe File created C:\windows\SysWOW64\YEHAZ.exe.bat AQHSD.exe File created C:\windows\SysWOW64\GAAF.exe.bat DNWWERI.exe File created C:\windows\SysWOW64\OSKMRI.exe.bat KKDMNPX.exe File created C:\windows\SysWOW64\ARHO.exe MHZQFYB.exe File opened for modification C:\windows\SysWOW64\WSX.exe 2026-09-09_a3a7805c0a1e1ef7f302afb2370b3b72_elex_emotet_stop.exe File created C:\windows\SysWOW64\MRRPUOK.exe ZTJELCA.exe File created C:\windows\SysWOW64\VNMG.exe.bat NAAA.exe File created C:\windows\SysWOW64\VNJXYY.exe AAEN.exe File created C:\windows\SysWOW64\JPN.exe PBJWML.exe File created C:\windows\SysWOW64\DCAOXI.exe IZR.exe File created C:\windows\SysWOW64\YITRNXE.exe KKT.exe File created C:\windows\SysWOW64\ZTJELCA.exe JYAZAP.exe File opened for modification C:\windows\SysWOW64\KRTIZ.exe SRRC.exe File created C:\windows\SysWOW64\OYKABVN.exe.bat OSKMRI.exe File opened for modification C:\windows\SysWOW64\YITRNXE.exe KKT.exe File created C:\windows\SysWOW64\KXLGA.exe.bat PCH.exe File created C:\windows\SysWOW64\LTCWAA.exe KQYSV.exe File opened for modification C:\windows\SysWOW64\MRRPUOK.exe ZTJELCA.exe File created C:\windows\SysWOW64\NAAA.exe XKZAEG.exe File created C:\windows\SysWOW64\AAEN.exe.bat PHB.exe File created C:\windows\SysWOW64\JJP.exe.bat UOGLZ.exe File created C:\windows\SysWOW64\IWMZIO.exe ENFZ.exe File created C:\windows\SysWOW64\BKSFBXM.exe NHKO.exe File opened for modification C:\windows\SysWOW64\BKSFBXM.exe NHKO.exe File created C:\windows\SysWOW64\CXRERQL.exe.bat TOXRN.exe File created C:\windows\SysWOW64\MHZQFYB.exe ZBZ.exe File created C:\windows\SysWOW64\VQOZAD.exe KXLGA.exe File created C:\windows\SysWOW64\LTME.exe.bat CKK.exe File created C:\windows\SysWOW64\CXRERQL.exe TOXRN.exe File opened for modification C:\windows\SysWOW64\LDDFOLV.exe RQYWML.exe File opened for modification C:\windows\SysWOW64\OYKABVN.exe OSKMRI.exe File created C:\windows\SysWOW64\BQW.exe VQOZAD.exe File opened for modification C:\windows\SysWOW64\BQW.exe VQOZAD.exe File created C:\windows\SysWOW64\HTU.exe NGPVNY.exe File opened for modification C:\windows\SysWOW64\RTTSMUK.exe LTME.exe File opened for modification C:\windows\SysWOW64\NAAA.exe XKZAEG.exe File opened for modification C:\windows\SysWOW64\PPYCD.exe LHS.exe File created C:\windows\SysWOW64\RQYWML.exe NIR.exe File opened for modification C:\windows\SysWOW64\GAAF.exe DNWWERI.exe File created C:\windows\SysWOW64\SDQSBEY.exe ZLAHSDP.exe File opened for modification C:\windows\SysWOW64\OSKMRI.exe KKDMNPX.exe File opened for modification C:\windows\SysWOW64\QATEZ.exe BKSFBXM.exe File opened for modification C:\windows\SysWOW64\YEHAZ.exe AQHSD.exe File created C:\windows\SysWOW64\YITRNXE.exe.bat KKT.exe File opened for modification C:\windows\SysWOW64\KXLGA.exe PCH.exe File created C:\windows\SysWOW64\VQOZAD.exe.bat KXLGA.exe File created C:\windows\SysWOW64\DCAOXI.exe.bat IZR.exe File opened for modification C:\windows\SysWOW64\RXG.exe CUOEP.exe File created C:\windows\SysWOW64\CJUCI.exe.bat JGQ.exe File created C:\windows\SysWOW64\OSKMRI.exe KKDMNPX.exe File created C:\windows\SysWOW64\LTCWAA.exe.bat KQYSV.exe File created C:\windows\SysWOW64\UOGLZ.exe KFEG.exe File created C:\windows\SysWOW64\WSX.exe.bat 2026-09-09_a3a7805c0a1e1ef7f302afb2370b3b72_elex_emotet_stop.exe File created C:\windows\SysWOW64\ARHO.exe.bat MHZQFYB.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\SRJDZTO.exe PEZUNI.exe File opened for modification C:\windows\DLBEZW.exe HITFLT.exe File created C:\windows\system\KKDMNPX.exe.bat PPYCD.exe File opened for modification C:\windows\UUWLDR.exe AZRCT.exe File created C:\windows\system\ZYT.exe.bat OGYIPZ.exe File created C:\windows\system\OCDLQGG.exe MPZCO.exe File created C:\windows\IZR.exe PWFM.exe File created C:\windows\REMGTGR.exe.bat CJUCI.exe File created C:\windows\CJR.exe IWMZIO.exe File created C:\windows\system\AQHSD.exe LNYNKSX.exe File opened for modification C:\windows\system\TXH.exe PPBAW.exe File created C:\windows\system\JSRNTR.exe TXH.exe File opened for modification C:\windows\JGQ.exe ILNCPF.exe File opened for modification C:\windows\JYAZAP.exe YITRNXE.exe File created C:\windows\WRRD.exe.bat HWZR.exe File created C:\windows\system\LHS.exe WRRD.exe File created C:\windows\system\PHB.exe.bat UUWLDR.exe File created C:\windows\system\MMW.exe.bat IEIRPR.exe File created C:\windows\system\VWSN.exe RTTSMUK.exe File created C:\windows\system\GKN.exe.bat QUMTX.exe File created C:\windows\system\HITFLT.exe.bat GKN.exe File opened for modification C:\windows\system\EKSP.exe JPN.exe File opened for modification C:\windows\system\MMW.exe IEIRPR.exe File created C:\windows\NIR.exe HIJIRY.exe File opened for modification C:\windows\system\RLCEVBD.exe LLVQE.exe File created C:\windows\system\UQGALEU.exe.bat UNCEY.exe File created C:\windows\QUMTX.exe UPUE.exe File created C:\windows\system\HITFLT.exe GKN.exe File opened for modification C:\windows\system\LHS.exe WRRD.exe File created C:\windows\system\OCDLQGG.exe.bat MPZCO.exe File created C:\windows\system\FUXH.exe.bat VWSN.exe File created C:\windows\SRJDZTO.exe.bat PEZUNI.exe File opened for modification C:\windows\system\JZL.exe SRJDZTO.exe File created C:\windows\JGQ.exe.bat ILNCPF.exe File opened for modification C:\windows\ABNYBS.exe SWIRRU.exe File created C:\windows\system\KKDMNPX.exe PPYCD.exe File opened for modification C:\windows\system\AZRCT.exe UYSOKPP.exe File opened for modification C:\windows\NIR.exe HIJIRY.exe File created C:\windows\ZLAHSDP.exe.bat SVZH.exe File created C:\windows\KKT.exe VHKBA.exe File created C:\windows\system\GKN.exe QUMTX.exe File created C:\windows\system\ZYT.exe OGYIPZ.exe File created C:\windows\PBJWML.exe.bat LTCWAA.exe File created C:\windows\system\VKUCKQ.exe EKSP.exe File opened for modification C:\windows\system\KFEG.exe VKUCKQ.exe File created C:\windows\system\MMW.exe IEIRPR.exe File opened for modification C:\windows\system\PEZUNI.exe SDQSBEY.exe File opened for modification C:\windows\KKT.exe VHKBA.exe File created C:\windows\JYAZAP.exe.bat YITRNXE.exe File created C:\windows\system\UPUE.exe ABNYBS.exe File created C:\windows\system\HWZR.exe.bat DLBEZW.exe File opened for modification C:\windows\JYI.exe OCDLQGG.exe File opened for modification C:\windows\AWYICOG.exe HTU.exe File created C:\windows\LNYNKSX.exe.bat QATEZ.exe File created C:\windows\system\QIJHJPW.exe RXG.exe File opened for modification C:\windows\system\HWZR.exe DLBEZW.exe File opened for modification C:\windows\system\PCH.exe CZYYB.exe File created C:\windows\AWYICOG.exe HTU.exe File created C:\windows\system\ZUN.exe VMGVS.exe File created C:\windows\TOXRN.exe YEHAZ.exe File opened for modification C:\windows\WPGPIRT.exe CXRERQL.exe File created C:\windows\DYQCT.exe.bat WSX.exe File created C:\windows\UNCEY.exe.bat DCAOXI.exe File created C:\windows\system\QIJHJPW.exe.bat RXG.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4108 cmd.exe 4548 cmd.exe 4740 cmd.exe 3324 cmd.exe 3432 cmd.exe 2280 cmd.exe 3228 cmd.exe 6272 cmd.exe 6836 cmd.exe 6488 cmd.exe 4616 cmd.exe 4300 cmd.exe 1112 cmd.exe 2652 cmd.exe 7144 cmd.exe 5400 cmd.exe 5688 cmd.exe 1356 cmd.exe 1584 cmd.exe 604 cmd.exe 6684 cmd.exe 5780 cmd.exe 6920 cmd.exe 6748 cmd.exe 5836 cmd.exe 2432 cmd.exe 6244 cmd.exe 4668 cmd.exe 7072 cmd.exe 2688 cmd.exe 3064 cmd.exe 1280 cmd.exe 1760 cmd.exe 6468 cmd.exe 3048 cmd.exe 4168 cmd.exe 3380 cmd.exe 1752 cmd.exe 3416 cmd.exe 6760 cmd.exe 2728 cmd.exe 3436 cmd.exe 4152 cmd.exe 1136 cmd.exe 6672 cmd.exe 4884 cmd.exe 1512 cmd.exe 5020 cmd.exe 4736 cmd.exe 6512 cmd.exe 4476 cmd.exe 2404 cmd.exe 5832 cmd.exe 4352 cmd.exe 7092 cmd.exe 1152 cmd.exe 3668 cmd.exe 5644 cmd.exe 5816 cmd.exe 1832 cmd.exe 4752 cmd.exe 6992 cmd.exe 3672 cmd.exe 936 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 6880 4824 WerFault.exe 86 4448 5480 WerFault.exe 92 4656 1160 WerFault.exe 98 1892 4112 WerFault.exe 103 1396 5752 WerFault.exe 108 2688 5196 WerFault.exe 113 5696 6840 WerFault.exe 118 6616 2968 WerFault.exe 123 6664 4208 WerFault.exe 128 5048 5152 WerFault.exe 133 4524 1080 WerFault.exe 138 7112 2592 WerFault.exe 143 3584 6940 WerFault.exe 148 5792 6316 WerFault.exe 153 7024 2952 WerFault.exe 158 5328 6412 WerFault.exe 163 3196 4536 WerFault.exe 168 5976 4104 WerFault.exe 173 5028 3312 WerFault.exe 178 3468 2824 WerFault.exe 183 1000 2060 WerFault.exe 188 264 4892 WerFault.exe 193 4304 7068 WerFault.exe 198 3424 2384 WerFault.exe 203 7036 3696 WerFault.exe 208 3388 2160 WerFault.exe 213 4796 2840 WerFault.exe 218 3380 952 WerFault.exe 223 2680 4852 WerFault.exe 228 6960 6076 WerFault.exe 233 1628 2612 WerFault.exe 238 3408 7084 WerFault.exe 243 5032 3132 WerFault.exe 248 2604 5404 WerFault.exe 253 3020 5592 WerFault.exe 258 2024 6976 WerFault.exe 263 2076 5164 WerFault.exe 268 5448 4344 WerFault.exe 273 6808 2948 WerFault.exe 278 4436 5504 WerFault.exe 283 6704 1680 WerFault.exe 288 2556 5488 WerFault.exe 293 4616 3692 WerFault.exe 298 6524 1140 WerFault.exe 303 4052 6220 WerFault.exe 308 964 2436 WerFault.exe 313 4332 5784 WerFault.exe 318 5468 6392 WerFault.exe 323 1632 5284 WerFault.exe 328 1876 4516 WerFault.exe 333 1124 3828 WerFault.exe 338 2816 2032 WerFault.exe 343 3832 5236 WerFault.exe 348 5808 3172 WerFault.exe 353 2164 5016 WerFault.exe 358 6388 7088 WerFault.exe 363 6168 6516 WerFault.exe 368 4736 1184 WerFault.exe 373 7072 6164 WerFault.exe 378 2852 5396 WerFault.exe 383 5876 6572 WerFault.exe 388 4820 5612 WerFault.exe 393 4060 4648 WerFault.exe 398 1484 3040 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXRERQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKDMNPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HITFLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KFEG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSAPMET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQOZAD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UUWLDR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OCDLQGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LTME.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRRD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJUCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UYSOKPP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HTU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VWSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSRNTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQYWML.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZRCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KRTIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWIRRU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGPVNY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGYIPZ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4824 2026-09-09_a3a7805c0a1e1ef7f302afb2370b3b72_elex_emotet_stop.exe 4824 2026-09-09_a3a7805c0a1e1ef7f302afb2370b3b72_elex_emotet_stop.exe 5480 WSX.exe 5480 WSX.exe 1160 DYQCT.exe 1160 DYQCT.exe 4112 LLVQE.exe 4112 LLVQE.exe 5752 RLCEVBD.exe 5752 RLCEVBD.exe 5196 PWFM.exe 5196 PWFM.exe 6840 IZR.exe 6840 IZR.exe 2968 DCAOXI.exe 2968 DCAOXI.exe 4208 UNCEY.exe 4208 UNCEY.exe 5152 UQGALEU.exe 5152 UQGALEU.exe 1080 YGVAYW.exe 1080 YGVAYW.exe 2592 ZBZ.exe 2592 ZBZ.exe 6940 MHZQFYB.exe 6940 MHZQFYB.exe 6316 ARHO.exe 6316 ARHO.exe 2952 TKWZD.exe 2952 TKWZD.exe 6412 SVZH.exe 6412 SVZH.exe 4536 ZLAHSDP.exe 4536 ZLAHSDP.exe 4104 SDQSBEY.exe 4104 SDQSBEY.exe 3312 PEZUNI.exe 3312 PEZUNI.exe 2824 SRJDZTO.exe 2824 SRJDZTO.exe 2060 JZL.exe 2060 JZL.exe 4892 CUOEP.exe 4892 CUOEP.exe 7068 RXG.exe 7068 RXG.exe 2384 QIJHJPW.exe 2384 QIJHJPW.exe 3696 ILNCPF.exe 3696 ILNCPF.exe 2160 JGQ.exe 2160 JGQ.exe 2840 CJUCI.exe 2840 CJUCI.exe 952 REMGTGR.exe 952 REMGTGR.exe 4852 VHKBA.exe 4852 VHKBA.exe 6076 KKT.exe 6076 KKT.exe 2612 YITRNXE.exe 2612 YITRNXE.exe 7084 JYAZAP.exe 7084 JYAZAP.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4824 2026-09-09_a3a7805c0a1e1ef7f302afb2370b3b72_elex_emotet_stop.exe 4824 2026-09-09_a3a7805c0a1e1ef7f302afb2370b3b72_elex_emotet_stop.exe 5480 WSX.exe 5480 WSX.exe 1160 DYQCT.exe 1160 DYQCT.exe 4112 LLVQE.exe 4112 LLVQE.exe 5752 RLCEVBD.exe 5752 RLCEVBD.exe 5196 PWFM.exe 5196 PWFM.exe 6840 IZR.exe 6840 IZR.exe 2968 DCAOXI.exe 2968 DCAOXI.exe 4208 UNCEY.exe 4208 UNCEY.exe 5152 UQGALEU.exe 5152 UQGALEU.exe 1080 YGVAYW.exe 1080 YGVAYW.exe 2592 ZBZ.exe 2592 ZBZ.exe 6940 MHZQFYB.exe 6940 MHZQFYB.exe 6316 ARHO.exe 6316 ARHO.exe 2952 TKWZD.exe 2952 TKWZD.exe 6412 SVZH.exe 6412 SVZH.exe 4536 ZLAHSDP.exe 4536 ZLAHSDP.exe 4104 SDQSBEY.exe 4104 SDQSBEY.exe 3312 PEZUNI.exe 3312 PEZUNI.exe 2824 SRJDZTO.exe 2824 SRJDZTO.exe 2060 JZL.exe 2060 JZL.exe 4892 CUOEP.exe 4892 CUOEP.exe 7068 RXG.exe 7068 RXG.exe 2384 QIJHJPW.exe 2384 QIJHJPW.exe 3696 ILNCPF.exe 3696 ILNCPF.exe 2160 JGQ.exe 2160 JGQ.exe 2840 CJUCI.exe 2840 CJUCI.exe 952 REMGTGR.exe 952 REMGTGR.exe 4852 VHKBA.exe 4852 VHKBA.exe 6076 KKT.exe 6076 KKT.exe 2612 YITRNXE.exe 2612 YITRNXE.exe 7084 JYAZAP.exe 7084 JYAZAP.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4824 wrote to memory of 6512 4824 2026-09-09_a3a7805c0a1e1ef7f302afb2370b3b72_elex_emotet_stop.exe 88 PID 6512 wrote to memory of 5480 6512 cmd.exe 92 PID 5480 wrote to memory of 6272 5480 WSX.exe 94 PID 6272 wrote to memory of 1160 6272 cmd.exe 98 PID 1160 wrote to memory of 4352 1160 DYQCT.exe 99 PID 4352 wrote to memory of 4112 4352 cmd.exe 103 PID 4112 wrote to memory of 7092 4112 LLVQE.exe 104 PID 7092 wrote to memory of 5752 7092 cmd.exe 108 PID 5752 wrote to memory of 1288 5752 RLCEVBD.exe 109 PID 1288 wrote to memory of 5196 1288 cmd.exe 113 PID 5196 wrote to memory of 2328 5196 PWFM.exe 114 PID 2328 wrote to memory of 6840 2328 cmd.exe 118 PID 6840 wrote to memory of 3168 6840 IZR.exe 119 PID 3168 wrote to memory of 2968 3168 cmd.exe 123 PID 2968 wrote to memory of 3324 2968 DCAOXI.exe 124 PID 3324 wrote to memory of 4208 3324 cmd.exe 128 PID 4208 wrote to memory of 6684 4208 UNCEY.exe 129 PID 6684 wrote to memory of 5152 6684 cmd.exe 133 PID 5152 wrote to memory of 6760 5152 UQGALEU.exe 134 PID 6760 wrote to memory of 1080 6760 cmd.exe 138 PID 1080 wrote to memory of 6872 1080 YGVAYW.exe 139 PID 6872 wrote to memory of 2592 6872 cmd.exe 143 PID 2592 wrote to memory of 2728 2592 ZBZ.exe 144 PID 2728 wrote to memory of 6940 2728 cmd.exe 148 PID 6940 wrote to memory of 1760 6940 MHZQFYB.exe 149 PID 1760 wrote to memory of 6316 1760 cmd.exe 153 PID 6316 wrote to memory of 6780 6316 ARHO.exe 154 PID 6780 wrote to memory of 2952 6780 cmd.exe 158 PID 2952 wrote to memory of 5780 2952 TKWZD.exe 159 PID 5780 wrote to memory of 6412 5780 cmd.exe 163 PID 6412 wrote to memory of 1616 6412 SVZH.exe 164 PID 1616 wrote to memory of 4536 1616 cmd.exe 168 PID 4536 wrote to memory of 6468 4536 ZLAHSDP.exe 169 PID 6468 wrote to memory of 4104 6468 cmd.exe 173 PID 4104 wrote to memory of 1428 4104 SDQSBEY.exe 174 PID 1428 wrote to memory of 3312 1428 cmd.exe 178 PID 3312 wrote to memory of 5996 3312 PEZUNI.exe 179 PID 5996 wrote to memory of 2824 5996 cmd.exe 183 PID 2824 wrote to memory of 1536 2824 SRJDZTO.exe 184 PID 1536 wrote to memory of 2060 1536 cmd.exe 188 PID 2060 wrote to memory of 6244 2060 JZL.exe 189 PID 6244 wrote to memory of 4892 6244 cmd.exe 193 PID 4892 wrote to memory of 2420 4892 CUOEP.exe 194 PID 2420 wrote to memory of 7068 2420 cmd.exe 198 PID 7068 wrote to memory of 6504 7068 RXG.exe 199 PID 6504 wrote to memory of 2384 6504 cmd.exe 203 PID 2384 wrote to memory of 7020 2384 QIJHJPW.exe 204 PID 7020 wrote to memory of 3696 7020 cmd.exe 208 PID 3696 wrote to memory of 6672 3696 ILNCPF.exe 209 PID 6672 wrote to memory of 2160 6672 cmd.exe 213 PID 2160 wrote to memory of 428 2160 JGQ.exe 214 PID 428 wrote to memory of 2840 428 cmd.exe 218 PID 2840 wrote to memory of 1148 2840 CJUCI.exe 219 PID 1148 wrote to memory of 952 1148 cmd.exe 223 PID 952 wrote to memory of 4276 952 REMGTGR.exe 224 PID 4276 wrote to memory of 4852 4276 cmd.exe 228 PID 4852 wrote to memory of 5456 4852 VHKBA.exe 229 PID 5456 wrote to memory of 6076 5456 cmd.exe 233 PID 6076 wrote to memory of 5188 6076 KKT.exe 234 PID 5188 wrote to memory of 2612 5188 cmd.exe 238 PID 2612 wrote to memory of 5600 2612 YITRNXE.exe 239 PID 5600 wrote to memory of 7084 5600 cmd.exe 243 PID 7084 wrote to memory of 3564 7084 JYAZAP.exe 244 PID 3564 wrote to memory of 3132 3564 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_a3a7805c0a1e1ef7f302afb2370b3b72_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-09_a3a7805c0a1e1ef7f302afb2370b3b72_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSX.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6512 -
C:\windows\SysWOW64\WSX.exeC:\windows\system32\WSX.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYQCT.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6272 -
C:\windows\DYQCT.exeC:\windows\DYQCT.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LLVQE.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\windows\system\LLVQE.exeC:\windows\system\LLVQE.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLCEVBD.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:7092 -
C:\windows\system\RLCEVBD.exeC:\windows\system\RLCEVBD.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWFM.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\windows\PWFM.exeC:\windows\PWFM.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZR.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\windows\IZR.exeC:\windows\IZR.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCAOXI.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\windows\SysWOW64\DCAOXI.exeC:\windows\system32\DCAOXI.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UNCEY.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\windows\UNCEY.exeC:\windows\UNCEY.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UQGALEU.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6684 -
C:\windows\system\UQGALEU.exeC:\windows\system\UQGALEU.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YGVAYW.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6760 -
C:\windows\SysWOW64\YGVAYW.exeC:\windows\system32\YGVAYW.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBZ.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6872 -
C:\windows\ZBZ.exeC:\windows\ZBZ.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MHZQFYB.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\windows\SysWOW64\MHZQFYB.exeC:\windows\system32\MHZQFYB.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ARHO.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\windows\SysWOW64\ARHO.exeC:\windows\system32\ARHO.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TKWZD.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6780 -
C:\windows\system\TKWZD.exeC:\windows\system\TKWZD.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVZH.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\windows\SVZH.exeC:\windows\SVZH.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLAHSDP.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\windows\ZLAHSDP.exeC:\windows\ZLAHSDP.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDQSBEY.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6468 -
C:\windows\SysWOW64\SDQSBEY.exeC:\windows\system32\SDQSBEY.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEZUNI.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\windows\system\PEZUNI.exeC:\windows\system\PEZUNI.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SRJDZTO.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\windows\SRJDZTO.exeC:\windows\SRJDZTO.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JZL.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\windows\system\JZL.exeC:\windows\system\JZL.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CUOEP.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6244 -
C:\windows\SysWOW64\CUOEP.exeC:\windows\system32\CUOEP.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RXG.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\windows\SysWOW64\RXG.exeC:\windows\system32\RXG.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:7068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIJHJPW.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:6504 -
C:\windows\system\QIJHJPW.exeC:\windows\system\QIJHJPW.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILNCPF.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:7020 -
C:\windows\system\ILNCPF.exeC:\windows\system\ILNCPF.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JGQ.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6672 -
C:\windows\JGQ.exeC:\windows\JGQ.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CJUCI.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:428 -
C:\windows\SysWOW64\CJUCI.exeC:\windows\system32\CJUCI.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REMGTGR.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\windows\REMGTGR.exeC:\windows\REMGTGR.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VHKBA.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\windows\VHKBA.exeC:\windows\VHKBA.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KKT.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\windows\KKT.exeC:\windows\KKT.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YITRNXE.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\windows\SysWOW64\YITRNXE.exeC:\windows\system32\YITRNXE.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JYAZAP.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\windows\JYAZAP.exeC:\windows\JYAZAP.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:7084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZTJELCA.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\windows\SysWOW64\ZTJELCA.exeC:\windows\system32\ZTJELCA.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MRRPUOK.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4476 -
C:\windows\SysWOW64\MRRPUOK.exeC:\windows\system32\MRRPUOK.exe67⤵
- Executes dropped EXE
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XKZAEG.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3724 -
C:\windows\XKZAEG.exeC:\windows\XKZAEG.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NAAA.exe.bat" "70⤵PID:7128
-
C:\windows\SysWOW64\NAAA.exeC:\windows\system32\NAAA.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNMG.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2404 -
C:\windows\SysWOW64\VNMG.exeC:\windows\system32\VNMG.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OGCR.exe.bat" "74⤵PID:5128
-
C:\windows\SysWOW64\OGCR.exeC:\windows\system32\OGCR.exe75⤵
- Executes dropped EXE
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SWIRRU.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4668 -
C:\windows\system\SWIRRU.exeC:\windows\system\SWIRRU.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ABNYBS.exe.bat" "78⤵PID:2936
-
C:\windows\ABNYBS.exeC:\windows\ABNYBS.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UPUE.exe.bat" "80⤵PID:3700
-
C:\windows\system\UPUE.exeC:\windows\system\UPUE.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUMTX.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:4836 -
C:\windows\QUMTX.exeC:\windows\QUMTX.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKN.exe.bat" "84⤵PID:260
-
C:\windows\system\GKN.exeC:\windows\system\GKN.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HITFLT.exe.bat" "86⤵PID:5112
-
C:\windows\system\HITFLT.exeC:\windows\system\HITFLT.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DLBEZW.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:5004 -
C:\windows\DLBEZW.exeC:\windows\DLBEZW.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWZR.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6836 -
C:\windows\system\HWZR.exeC:\windows\system\HWZR.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WRRD.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:5668 -
C:\windows\WRRD.exeC:\windows\WRRD.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LHS.exe.bat" "94⤵PID:2108
-
C:\windows\system\LHS.exeC:\windows\system\LHS.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PPYCD.exe.bat" "96⤵
- Executes a command shell one-liner
PID:6920 -
C:\windows\SysWOW64\PPYCD.exeC:\windows\system32\PPYCD.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KKDMNPX.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3048 -
C:\windows\system\KKDMNPX.exeC:\windows\system\KKDMNPX.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OSKMRI.exe.bat" "100⤵
- Executes a command shell one-liner
PID:3436 -
C:\windows\SysWOW64\OSKMRI.exeC:\windows\system32\OSKMRI.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OYKABVN.exe.bat" "102⤵
- Executes a command shell one-liner
PID:5400 -
C:\windows\SysWOW64\OYKABVN.exeC:\windows\system32\OYKABVN.exe103⤵
- Executes dropped EXE
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UYSOKPP.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5688 -
C:\windows\UYSOKPP.exeC:\windows\UYSOKPP.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZRCT.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2072 -
C:\windows\system\AZRCT.exeC:\windows\system\AZRCT.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UUWLDR.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:2640 -
C:\windows\UUWLDR.exeC:\windows\UUWLDR.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHB.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1152 -
C:\windows\system\PHB.exeC:\windows\system\PHB.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:7088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAEN.exe.bat" "112⤵PID:5012
-
C:\windows\SysWOW64\AAEN.exeC:\windows\system32\AAEN.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNJXYY.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:3536 -
C:\windows\SysWOW64\VNJXYY.exeC:\windows\system32\VNJXYY.exe115⤵
- Executes dropped EXE
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGYIPZ.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:6584 -
C:\windows\system\OGYIPZ.exeC:\windows\system\OGYIPZ.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZYT.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5056 -
C:\windows\system\ZYT.exeC:\windows\system\ZYT.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LRWTYNK.exe.bat" "120⤵PID:1144
-
C:\windows\SysWOW64\LRWTYNK.exeC:\windows\system32\LRWTYNK.exe121⤵
- Executes dropped EXE
PID:6572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-