Analysis
- max time kernel
94s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 02:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-12_47cc279bb9e08146d24dd56c9dcffe45_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-12_47cc279bb9e08146d24dd56c9dcffe45_elex_emotet_stop.exe
- Size 208KB
- Sample260913-cyd99asvd1
- SHA256 80292ce986b860aafb2160c1873a72be219d7ae263670fdbca214718e1c1e166
- MD5 47cc279bb9e08146d24dd56c9dcffe45
- SHA1 16c085092094227be47945f7df65de13f1b83fb1
- SHA512 a12e05690e00d5b99d7f951e86ace6eb9df506822ccefa224bca79dc4622bcfa1e3bf605c118a949a437e13b806a7b11a4bb859602bc17f9cfd0f5b4e340e345
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfC4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LO6QEj1
- TLSH T139247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5612 DQHYBK.exe 1272 LYY.exe 4800 IOLJY.exe 4884 WRU.exe 3296 ACSVMO.exe 4028 YSLQ.exe 4432 ENKYEWA.exe 4324 FQOU.exe 584 JYVCVE.exe 5108 YTEG.exe 3544 HCGMSWA.exe 4240 CPLV.exe 5456 BAOLDC.exe 1372 QVXX.exe 1480 ZDZCZUW.exe 1136 FDH.exe 5440 XEJVMU.exe 3732 RZO.exe 2052 AZQK.exe 5376 GAXXQT.exe 3320 WQY.exe 2472 CQGLG.exe 4200 FGNLSBD.exe 4764 PGPYWZ.exe 1736 JUTHGZU.exe 5588 PUB.exe 5024 KHGEZ.exe 3876 BPI.exe 5444 OAQIRJ.exe 5632 YBSNVGK.exe 1764 PJU.exe 1456 KWZCI.exe 5828 ZRJ.exe 5232 KKMZ.exe 3688 FXIQMG.exe 2084 LXQ.exe 1880 FTVNF.exe 836 LGU.exe 1848 UTEG.exe 4036 CZFU.exe 2624 MMPNJJY.exe 5772 DMRS.exe 1808 MVTXY.exe 4300 BQC.exe 5728 WDHS.exe 4312 FLJYXE.exe 4220 RTQYJ.exe 5604 RHIMKB.exe 4780 MUN.exe 1516 DIX.exe 4876 YVCXV.exe 444 YACLWK.exe 5880 NVMY.exe 4688 NJMMJ.exe 5012 ZRTM.exe 5620 RUWQAS.exe 4100 HPGU.exe 4692 HVGJ.exe 4176 SNBBDZ.exe 4104 EDQ.exe 4272 YRULS.exe 3224 WRCZBUK.exe 4024 ZEZI.exe 3856 DUOQXM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\ZRJ.exe.bat KWZCI.exe File created C:\windows\SysWOW64\JHRJDA.exe.bat DUOQXM.exe File created C:\windows\SysWOW64\PRJ.exe VEEQQCS.exe File opened for modification C:\windows\SysWOW64\QEY.exe XBUZDV.exe File opened for modification C:\windows\SysWOW64\RZO.exe XEJVMU.exe File created C:\windows\SysWOW64\RZO.exe.bat XEJVMU.exe File created C:\windows\SysWOW64\ZRJ.exe KWZCI.exe File created C:\windows\SysWOW64\NVMY.exe.bat YACLWK.exe File created C:\windows\SysWOW64\YRULS.exe.bat EDQ.exe File created C:\windows\SysWOW64\VKXXBA.exe KSCFT.exe File created C:\windows\SysWOW64\TUIR.exe ZGDIVLF.exe File created C:\windows\SysWOW64\AZQK.exe RZO.exe File created C:\windows\SysWOW64\WQY.exe.bat GAXXQT.exe File opened for modification C:\windows\SysWOW64\JUTHGZU.exe PGPYWZ.exe File opened for modification C:\windows\SysWOW64\KHGEZ.exe PUB.exe File opened for modification C:\windows\SysWOW64\WDHS.exe BQC.exe File created C:\windows\SysWOW64\YVCXV.exe DIX.exe File created C:\windows\SysWOW64\PRJ.exe.bat VEEQQCS.exe File created C:\windows\SysWOW64\RZO.exe XEJVMU.exe File created C:\windows\SysWOW64\KKMZ.exe ZRJ.exe File created C:\windows\SysWOW64\LGU.exe FTVNF.exe File created C:\windows\SysWOW64\FLJYXE.exe.bat WDHS.exe File created C:\windows\SysWOW64\NJMMJ.exe NVMY.exe File created C:\windows\SysWOW64\TUIR.exe.bat ZGDIVLF.exe File created C:\windows\SysWOW64\EMDKN.exe TUIR.exe File created C:\windows\SysWOW64\EKA.exe.bat DPWT.exe File opened for modification C:\windows\SysWOW64\DQHYBK.exe 2026-09-12_47cc279bb9e08146d24dd56c9dcffe45_elex_emotet_stop.exe File created C:\windows\SysWOW64\IOLJY.exe.bat LYY.exe File created C:\windows\SysWOW64\PGPYWZ.exe.bat FGNLSBD.exe File opened for modification C:\windows\SysWOW64\YRULS.exe EDQ.exe File created C:\windows\SysWOW64\FQOU.exe ENKYEWA.exe File opened for modification C:\windows\SysWOW64\XEJVMU.exe FDH.exe File opened for modification C:\windows\SysWOW64\PJU.exe YBSNVGK.exe File opened for modification C:\windows\SysWOW64\NJMMJ.exe NVMY.exe File created C:\windows\SysWOW64\VKXXBA.exe.bat KSCFT.exe File created C:\windows\SysWOW64\QVXX.exe.bat BAOLDC.exe File created C:\windows\SysWOW64\PJU.exe.bat YBSNVGK.exe File created C:\windows\SysWOW64\FTVNF.exe.bat LXQ.exe File created C:\windows\SysWOW64\RUWQAS.exe ZRTM.exe File created C:\windows\SysWOW64\DUOQXM.exe ZEZI.exe File opened for modification C:\windows\SysWOW64\LGU.exe FTVNF.exe File opened for modification C:\windows\SysWOW64\FLJYXE.exe WDHS.exe File created C:\windows\SysWOW64\PJU.exe YBSNVGK.exe File created C:\windows\SysWOW64\LGU.exe.bat FTVNF.exe File created C:\windows\SysWOW64\NVMY.exe YACLWK.exe File opened for modification C:\windows\SysWOW64\EDQ.exe SNBBDZ.exe File created C:\windows\SysWOW64\EKA.exe DPWT.exe File created C:\windows\SysWOW64\IOLJY.exe LYY.exe File opened for modification C:\windows\SysWOW64\IOLJY.exe LYY.exe File created C:\windows\SysWOW64\BAOLDC.exe CPLV.exe File created C:\windows\SysWOW64\ZDZCZUW.exe QVXX.exe File created C:\windows\SysWOW64\KKMZ.exe.bat ZRJ.exe File created C:\windows\SysWOW64\FXIQMG.exe.bat KKMZ.exe File created C:\windows\SysWOW64\PGPYWZ.exe FGNLSBD.exe File created C:\windows\SysWOW64\KHGEZ.exe.bat PUB.exe File created C:\windows\SysWOW64\PVZL.exe.bat FNX.exe File created C:\windows\SysWOW64\JUTHGZU.exe.bat PGPYWZ.exe File created C:\windows\SysWOW64\WDHS.exe.bat BQC.exe File opened for modification C:\windows\SysWOW64\YVCXV.exe DIX.exe File created C:\windows\SysWOW64\QEY.exe.bat XBUZDV.exe File created C:\windows\SysWOW64\BQC.exe.bat MVTXY.exe File opened for modification C:\windows\SysWOW64\HVGJ.exe HPGU.exe File opened for modification C:\windows\SysWOW64\EKA.exe DPWT.exe File opened for modification C:\windows\SysWOW64\FQOU.exe ENKYEWA.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\LXQ.exe FXIQMG.exe File created C:\windows\system\LSVG.exe.bat TSHA.exe File created C:\windows\system\SXT.exe EMDKN.exe File created C:\windows\system\XEUUTI.exe.bat XBQQ.exe File opened for modification C:\windows\RORFR.exe DLIGD.exe File created C:\windows\RORFR.exe.bat DLIGD.exe File created C:\windows\FDH.exe.bat ZDZCZUW.exe File created C:\windows\system\YBSNVGK.exe.bat OAQIRJ.exe File created C:\windows\system\EJFHD.exe EZWGP.exe File opened for modification C:\windows\MZMPAOA.exe VMBXLRM.exe File opened for modification C:\windows\GAXXQT.exe AZQK.exe File created C:\windows\system\FGNLSBD.exe.bat CQGLG.exe File created C:\windows\BKFL.exe VKXXBA.exe File opened for modification C:\windows\system\TSHA.exe VSHNGKF.exe File opened for modification C:\windows\system\LSVG.exe TSHA.exe File created C:\windows\GAXXQT.exe.bat AZQK.exe File created C:\windows\CQGLG.exe WQY.exe File created C:\windows\system\ZZY.exe.bat OHDCNHO.exe File opened for modification C:\windows\system\UTEG.exe LGU.exe File created C:\windows\system\DCYZKP.exe ZMR.exe File created C:\windows\system\TSHA.exe.bat VSHNGKF.exe File created C:\windows\WRU.exe.bat IOLJY.exe File created C:\windows\MVTXY.exe DMRS.exe File opened for modification C:\windows\system\ZRTM.exe NJMMJ.exe File created C:\windows\system\ZEZI.exe.bat WRCZBUK.exe File created C:\windows\XBQQ.exe.bat TTKQCAZ.exe File opened for modification C:\windows\system\VMBXLRM.exe RJDC.exe File opened for modification C:\windows\system\DCYZKP.exe ZMR.exe File created C:\windows\system\HQNNDJL.exe.bat WYKUU.exe File created C:\windows\system\VSHNGKF.exe EJFHD.exe File opened for modification C:\windows\ZGDIVLF.exe NOAPME.exe File created C:\windows\system\CTGU.exe CNF.exe File created C:\windows\system\VMBXLRM.exe.bat RJDC.exe File created C:\windows\system\DMRS.exe MMPNJJY.exe File created C:\windows\OHDCNHO.exe PRJ.exe File opened for modification C:\windows\system\WNG.exe DKUW.exe File created C:\windows\LYY.exe DQHYBK.exe File opened for modification C:\windows\ACSVMO.exe WRU.exe File opened for modification C:\windows\CQGLG.exe WQY.exe File opened for modification C:\windows\MMPNJJY.exe CZFU.exe File created C:\windows\WYKUU.exe.bat BKFL.exe File created C:\windows\system\VSHNGKF.exe.bat EJFHD.exe File opened for modification C:\windows\system\DXIS.exe OCZNJU.exe File opened for modification C:\windows\system\RJDC.exe WOYSAYN.exe File created C:\windows\system\ENKYEWA.exe YSLQ.exe File created C:\windows\system\KWZCI.exe PJU.exe File opened for modification C:\windows\XBUZDV.exe RBMM.exe File created C:\windows\WYKUU.exe BKFL.exe File created C:\windows\system\EJFHD.exe.bat EZWGP.exe File created C:\windows\system\CTGU.exe.bat CNF.exe File opened for modification C:\windows\CPLV.exe HCGMSWA.exe File created C:\windows\GIJ.exe LVEJJT.exe File created C:\windows\system\SXT.exe.bat EMDKN.exe File created C:\windows\CNF.exe WNG.exe File opened for modification C:\windows\PJL.exe JJEVGH.exe File created C:\windows\KMS.exe.bat HQNNDJL.exe File created C:\windows\system\HCGMSWA.exe.bat YTEG.exe File created C:\windows\OHDCNHO.exe.bat PRJ.exe File created C:\windows\GAXXQT.exe AZQK.exe File opened for modification C:\windows\system\LIYGTC.exe DCYZKP.exe File opened for modification C:\windows\RIAA.exe ZZY.exe File created C:\windows\OCZNJU.exe XCXIF.exe File created C:\windows\system\BLI.exe EKA.exe File opened for modification C:\windows\JYVCVE.exe FQOU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 364 cmd.exe 3712 cmd.exe 2312 cmd.exe 4232 cmd.exe 2872 cmd.exe 4708 cmd.exe 828 cmd.exe 2076 cmd.exe 3028 cmd.exe 4960 cmd.exe 4316 cmd.exe 4076 cmd.exe 2512 cmd.exe 5532 cmd.exe 5848 cmd.exe 3212 cmd.exe 2640 cmd.exe 5852 cmd.exe 6060 cmd.exe 5548 cmd.exe 944 cmd.exe 1568 cmd.exe 6136 cmd.exe 2908 cmd.exe 4624 cmd.exe 4460 cmd.exe 1072 cmd.exe 3844 cmd.exe 3464 cmd.exe 1416 cmd.exe 5768 cmd.exe 4984 cmd.exe 2636 cmd.exe 6096 cmd.exe 4216 cmd.exe 3400 cmd.exe 4756 cmd.exe 4084 cmd.exe 3184 cmd.exe 1792 cmd.exe 1836 cmd.exe 5316 cmd.exe 5244 cmd.exe 1760 cmd.exe 1124 cmd.exe 4804 cmd.exe 5784 cmd.exe 5936 cmd.exe 3644 cmd.exe 5592 cmd.exe 5712 cmd.exe 5304 cmd.exe 4528 cmd.exe 5056 cmd.exe 4892 cmd.exe 2372 cmd.exe 1772 cmd.exe 5716 cmd.exe 3056 cmd.exe 4068 cmd.exe 3228 cmd.exe 3372 cmd.exe 5396 cmd.exe 1312 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2564 5972 WerFault.exe 87 928 5612 WerFault.exe 92 5684 1272 WerFault.exe 98 4980 4800 WerFault.exe 103 4892 4884 WerFault.exe 108 2516 3296 WerFault.exe 113 5164 4028 WerFault.exe 118 1760 4432 WerFault.exe 123 3720 4324 WerFault.exe 128 1284 584 WerFault.exe 133 5068 5108 WerFault.exe 138 5312 3544 WerFault.exe 143 1984 4240 WerFault.exe 148 4636 5456 WerFault.exe 153 468 1372 WerFault.exe 158 5600 1480 WerFault.exe 163 4272 1136 WerFault.exe 168 6052 5440 WerFault.exe 173 4004 3732 WerFault.exe 178 4500 2052 WerFault.exe 183 2708 5376 WerFault.exe 188 2396 3320 WerFault.exe 193 4368 2472 WerFault.exe 198 2816 4200 WerFault.exe 203 5604 4764 WerFault.exe 208 4092 1736 WerFault.exe 213 5244 5588 WerFault.exe 218 4040 5024 WerFault.exe 223 5240 3876 WerFault.exe 228 1120 5444 WerFault.exe 233 5544 5632 WerFault.exe 238 2996 1764 WerFault.exe 243 4412 1456 WerFault.exe 248 4572 5828 WerFault.exe 253 5308 5232 WerFault.exe 258 3584 3688 WerFault.exe 263 3560 2084 WerFault.exe 268 5476 1880 WerFault.exe 273 3692 836 WerFault.exe 279 5732 1848 WerFault.exe 284 4544 4036 WerFault.exe 289 5660 2624 WerFault.exe 294 4972 5772 WerFault.exe 299 1200 1808 WerFault.exe 304 1416 4300 WerFault.exe 309 5916 5728 WerFault.exe 314 5704 4312 WerFault.exe 319 4788 4220 WerFault.exe 324 244 5604 WerFault.exe 329 1568 4780 WerFault.exe 334 3392 1516 WerFault.exe 339 3400 4876 WerFault.exe 344 5156 444 WerFault.exe 349 6060 5880 WerFault.exe 354 2172 4688 WerFault.exe 359 3116 5012 WerFault.exe 364 2168 5620 WerFault.exe 369 3496 4100 WerFault.exe 374 4092 4692 WerFault.exe 379 3192 4176 WerFault.exe 384 3780 4104 WerFault.exe 389 2068 4272 WerFault.exe 394 4752 3224 WerFault.exe 399 5496 4024 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTQYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZRTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAXXQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTKQCAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OAQIRJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HPGU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XEUUTI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DXIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FGNLSBD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DIX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVEJJT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBMM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IOLJY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQHYBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FQOU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPEX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOYSAYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVGJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HQNNDJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BQC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJEVGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBSNVGK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJNPMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZQK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DPWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEEQQCS.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5972 2026-09-12_47cc279bb9e08146d24dd56c9dcffe45_elex_emotet_stop.exe 5972 2026-09-12_47cc279bb9e08146d24dd56c9dcffe45_elex_emotet_stop.exe 5612 DQHYBK.exe 5612 DQHYBK.exe 1272 LYY.exe 1272 LYY.exe 4800 IOLJY.exe 4800 IOLJY.exe 4884 WRU.exe 4884 WRU.exe 3296 ACSVMO.exe 3296 ACSVMO.exe 4028 YSLQ.exe 4028 YSLQ.exe 4432 ENKYEWA.exe 4432 ENKYEWA.exe 4324 FQOU.exe 4324 FQOU.exe 584 JYVCVE.exe 584 JYVCVE.exe 5108 YTEG.exe 5108 YTEG.exe 3544 HCGMSWA.exe 3544 HCGMSWA.exe 4240 CPLV.exe 4240 CPLV.exe 5456 BAOLDC.exe 5456 BAOLDC.exe 1372 QVXX.exe 1372 QVXX.exe 1480 ZDZCZUW.exe 1480 ZDZCZUW.exe 1136 FDH.exe 1136 FDH.exe 5440 XEJVMU.exe 5440 XEJVMU.exe 3732 RZO.exe 3732 RZO.exe 2052 AZQK.exe 2052 AZQK.exe 5376 GAXXQT.exe 5376 GAXXQT.exe 3320 WQY.exe 3320 WQY.exe 2472 CQGLG.exe 2472 CQGLG.exe 4200 FGNLSBD.exe 4200 FGNLSBD.exe 4764 PGPYWZ.exe 4764 PGPYWZ.exe 1736 JUTHGZU.exe 1736 JUTHGZU.exe 5588 PUB.exe 5588 PUB.exe 5024 KHGEZ.exe 5024 KHGEZ.exe 3876 BPI.exe 3876 BPI.exe 5444 OAQIRJ.exe 5444 OAQIRJ.exe 5632 YBSNVGK.exe 5632 YBSNVGK.exe 1764 PJU.exe 1764 PJU.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5972 2026-09-12_47cc279bb9e08146d24dd56c9dcffe45_elex_emotet_stop.exe 5972 2026-09-12_47cc279bb9e08146d24dd56c9dcffe45_elex_emotet_stop.exe 5612 DQHYBK.exe 5612 DQHYBK.exe 1272 LYY.exe 1272 LYY.exe 4800 IOLJY.exe 4800 IOLJY.exe 4884 WRU.exe 4884 WRU.exe 3296 ACSVMO.exe 3296 ACSVMO.exe 4028 YSLQ.exe 4028 YSLQ.exe 4432 ENKYEWA.exe 4432 ENKYEWA.exe 4324 FQOU.exe 4324 FQOU.exe 584 JYVCVE.exe 584 JYVCVE.exe 5108 YTEG.exe 5108 YTEG.exe 3544 HCGMSWA.exe 3544 HCGMSWA.exe 4240 CPLV.exe 4240 CPLV.exe 5456 BAOLDC.exe 5456 BAOLDC.exe 1372 QVXX.exe 1372 QVXX.exe 1480 ZDZCZUW.exe 1480 ZDZCZUW.exe 1136 FDH.exe 1136 FDH.exe 5440 XEJVMU.exe 5440 XEJVMU.exe 3732 RZO.exe 3732 RZO.exe 2052 AZQK.exe 2052 AZQK.exe 5376 GAXXQT.exe 5376 GAXXQT.exe 3320 WQY.exe 3320 WQY.exe 2472 CQGLG.exe 2472 CQGLG.exe 4200 FGNLSBD.exe 4200 FGNLSBD.exe 4764 PGPYWZ.exe 4764 PGPYWZ.exe 1736 JUTHGZU.exe 1736 JUTHGZU.exe 5588 PUB.exe 5588 PUB.exe 5024 KHGEZ.exe 5024 KHGEZ.exe 3876 BPI.exe 3876 BPI.exe 5444 OAQIRJ.exe 5444 OAQIRJ.exe 5632 YBSNVGK.exe 5632 YBSNVGK.exe 1764 PJU.exe 1764 PJU.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5972 wrote to memory of 4912 5972 2026-09-12_47cc279bb9e08146d24dd56c9dcffe45_elex_emotet_stop.exe 88 PID 4912 wrote to memory of 5612 4912 cmd.exe 92 PID 5612 wrote to memory of 5788 5612 DQHYBK.exe 94 PID 5788 wrote to memory of 1272 5788 cmd.exe 98 PID 1272 wrote to memory of 5832 1272 LYY.exe 99 PID 5832 wrote to memory of 4800 5832 cmd.exe 103 PID 4800 wrote to memory of 364 4800 IOLJY.exe 104 PID 364 wrote to memory of 4884 364 cmd.exe 108 PID 4884 wrote to memory of 1548 4884 WRU.exe 109 PID 1548 wrote to memory of 3296 1548 cmd.exe 113 PID 3296 wrote to memory of 1680 3296 ACSVMO.exe 114 PID 1680 wrote to memory of 4028 1680 cmd.exe 118 PID 4028 wrote to memory of 3712 4028 YSLQ.exe 119 PID 3712 wrote to memory of 4432 3712 cmd.exe 123 PID 4432 wrote to memory of 5076 4432 ENKYEWA.exe 124 PID 5076 wrote to memory of 4324 5076 cmd.exe 128 PID 4324 wrote to memory of 4624 4324 FQOU.exe 129 PID 4624 wrote to memory of 584 4624 cmd.exe 133 PID 584 wrote to memory of 3388 584 JYVCVE.exe 134 PID 3388 wrote to memory of 5108 3388 cmd.exe 138 PID 5108 wrote to memory of 2644 5108 YTEG.exe 139 PID 2644 wrote to memory of 3544 2644 cmd.exe 143 PID 3544 wrote to memory of 1328 3544 HCGMSWA.exe 144 PID 1328 wrote to memory of 4240 1328 cmd.exe 148 PID 4240 wrote to memory of 860 4240 CPLV.exe 149 PID 860 wrote to memory of 5456 860 cmd.exe 153 PID 5456 wrote to memory of 4804 5456 BAOLDC.exe 154 PID 4804 wrote to memory of 1372 4804 cmd.exe 158 PID 1372 wrote to memory of 2672 1372 QVXX.exe 159 PID 2672 wrote to memory of 1480 2672 cmd.exe 163 PID 1480 wrote to memory of 5344 1480 ZDZCZUW.exe 164 PID 5344 wrote to memory of 1136 5344 cmd.exe 168 PID 1136 wrote to memory of 572 1136 FDH.exe 169 PID 572 wrote to memory of 5440 572 cmd.exe 173 PID 5440 wrote to memory of 4984 5440 XEJVMU.exe 174 PID 4984 wrote to memory of 3732 4984 cmd.exe 178 PID 3732 wrote to memory of 5276 3732 RZO.exe 179 PID 5276 wrote to memory of 2052 5276 cmd.exe 183 PID 2052 wrote to memory of 5220 2052 AZQK.exe 184 PID 5220 wrote to memory of 5376 5220 cmd.exe 188 PID 5376 wrote to memory of 4652 5376 GAXXQT.exe 189 PID 4652 wrote to memory of 3320 4652 cmd.exe 193 PID 3320 wrote to memory of 4496 3320 WQY.exe 194 PID 4496 wrote to memory of 2472 4496 cmd.exe 198 PID 2472 wrote to memory of 5784 2472 CQGLG.exe 199 PID 5784 wrote to memory of 4200 5784 cmd.exe 203 PID 4200 wrote to memory of 5332 4200 FGNLSBD.exe 204 PID 5332 wrote to memory of 4764 5332 cmd.exe 208 PID 4764 wrote to memory of 5756 4764 PGPYWZ.exe 209 PID 5756 wrote to memory of 1736 5756 cmd.exe 213 PID 1736 wrote to memory of 4532 1736 JUTHGZU.exe 214 PID 4532 wrote to memory of 5588 4532 cmd.exe 218 PID 5588 wrote to memory of 3028 5588 PUB.exe 219 PID 3028 wrote to memory of 5024 3028 cmd.exe 223 PID 5024 wrote to memory of 3184 5024 KHGEZ.exe 224 PID 3184 wrote to memory of 3876 3184 cmd.exe 228 PID 3876 wrote to memory of 4852 3876 BPI.exe 229 PID 4852 wrote to memory of 5444 4852 cmd.exe 233 PID 5444 wrote to memory of 436 5444 OAQIRJ.exe 234 PID 436 wrote to memory of 5632 436 cmd.exe 238 PID 5632 wrote to memory of 2636 5632 YBSNVGK.exe 239 PID 2636 wrote to memory of 1764 2636 cmd.exe 243 PID 1764 wrote to memory of 5624 1764 PJU.exe 244 PID 5624 wrote to memory of 1456 5624 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_47cc279bb9e08146d24dd56c9dcffe45_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_47cc279bb9e08146d24dd56c9dcffe45_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DQHYBK.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\windows\SysWOW64\DQHYBK.exeC:\windows\system32\DQHYBK.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LYY.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\windows\LYY.exeC:\windows\LYY.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IOLJY.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\windows\SysWOW64\IOLJY.exeC:\windows\system32\IOLJY.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WRU.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:364 -
C:\windows\WRU.exeC:\windows\WRU.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ACSVMO.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\windows\ACSVMO.exeC:\windows\ACSVMO.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSLQ.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\windows\system\YSLQ.exeC:\windows\system\YSLQ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ENKYEWA.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\windows\system\ENKYEWA.exeC:\windows\system\ENKYEWA.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FQOU.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\windows\SysWOW64\FQOU.exeC:\windows\system32\FQOU.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JYVCVE.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\windows\JYVCVE.exeC:\windows\JYVCVE.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YTEG.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\windows\system\YTEG.exeC:\windows\system\YTEG.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HCGMSWA.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\windows\system\HCGMSWA.exeC:\windows\system\HCGMSWA.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPLV.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\windows\CPLV.exeC:\windows\CPLV.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BAOLDC.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:860 -
C:\windows\SysWOW64\BAOLDC.exeC:\windows\system32\BAOLDC.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVXX.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\windows\SysWOW64\QVXX.exeC:\windows\system32\QVXX.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDZCZUW.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\windows\SysWOW64\ZDZCZUW.exeC:\windows\system32\ZDZCZUW.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FDH.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\windows\FDH.exeC:\windows\FDH.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XEJVMU.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:572 -
C:\windows\SysWOW64\XEJVMU.exeC:\windows\system32\XEJVMU.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RZO.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\windows\SysWOW64\RZO.exeC:\windows\system32\RZO.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZQK.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\windows\SysWOW64\AZQK.exeC:\windows\system32\AZQK.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GAXXQT.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\windows\GAXXQT.exeC:\windows\GAXXQT.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQY.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\windows\SysWOW64\WQY.exeC:\windows\system32\WQY.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CQGLG.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\windows\CQGLG.exeC:\windows\CQGLG.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FGNLSBD.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\windows\system\FGNLSBD.exeC:\windows\system\FGNLSBD.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PGPYWZ.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\windows\SysWOW64\PGPYWZ.exeC:\windows\system32\PGPYWZ.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUTHGZU.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\windows\SysWOW64\JUTHGZU.exeC:\windows\system32\JUTHGZU.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PUB.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\windows\system\PUB.exeC:\windows\system\PUB.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KHGEZ.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\windows\SysWOW64\KHGEZ.exeC:\windows\system32\KHGEZ.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BPI.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\windows\system\BPI.exeC:\windows\system\BPI.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OAQIRJ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\windows\OAQIRJ.exeC:\windows\OAQIRJ.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBSNVGK.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:436 -
C:\windows\system\YBSNVGK.exeC:\windows\system\YBSNVGK.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJU.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\windows\SysWOW64\PJU.exeC:\windows\system32\PJU.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWZCI.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\windows\system\KWZCI.exeC:\windows\system\KWZCI.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZRJ.exe.bat" "66⤵PID:3076
-
C:\windows\SysWOW64\ZRJ.exeC:\windows\system32\ZRJ.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKMZ.exe.bat" "68⤵PID:2396
-
C:\windows\SysWOW64\KKMZ.exeC:\windows\system32\KKMZ.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FXIQMG.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:488 -
C:\windows\SysWOW64\FXIQMG.exeC:\windows\system32\FXIQMG.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LXQ.exe.bat" "72⤵PID:5136
-
C:\windows\LXQ.exeC:\windows\LXQ.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FTVNF.exe.bat" "74⤵PID:4332
-
C:\windows\SysWOW64\FTVNF.exeC:\windows\system32\FTVNF.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGU.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5852 -
C:\windows\SysWOW64\LGU.exeC:\windows\system32\LGU.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTEG.exe.bat" "78⤵PID:2096
-
C:\windows\system\UTEG.exeC:\windows\system\UTEG.exe79⤵
- Executes dropped EXE
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZFU.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4960 -
C:\windows\CZFU.exeC:\windows\CZFU.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MMPNJJY.exe.bat" "82⤵PID:4264
-
C:\windows\MMPNJJY.exeC:\windows\MMPNJJY.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DMRS.exe.bat" "84⤵
- Executes a command shell one-liner
PID:5936 -
C:\windows\system\DMRS.exeC:\windows\system\DMRS.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MVTXY.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:1228 -
C:\windows\MVTXY.exeC:\windows\MVTXY.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BQC.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:3788 -
C:\windows\SysWOW64\BQC.exeC:\windows\system32\BQC.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WDHS.exe.bat" "90⤵
- Executes a command shell one-liner
PID:1792 -
C:\windows\SysWOW64\WDHS.exeC:\windows\system32\WDHS.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLJYXE.exe.bat" "92⤵PID:2968
-
C:\windows\SysWOW64\FLJYXE.exeC:\windows\system32\FLJYXE.exe93⤵
- Executes dropped EXE
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RTQYJ.exe.bat" "94⤵
- Executes a command shell one-liner
PID:1836 -
C:\windows\system\RTQYJ.exeC:\windows\system\RTQYJ.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHIMKB.exe.bat" "96⤵PID:5216
-
C:\windows\RHIMKB.exeC:\windows\RHIMKB.exe97⤵
- Executes dropped EXE
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MUN.exe.bat" "98⤵PID:5364
-
C:\windows\MUN.exeC:\windows\MUN.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DIX.exe.bat" "100⤵PID:952
-
C:\windows\DIX.exeC:\windows\DIX.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YVCXV.exe.bat" "102⤵PID:4192
-
C:\windows\SysWOW64\YVCXV.exeC:\windows\system32\YVCXV.exe103⤵
- Executes dropped EXE
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YACLWK.exe.bat" "104⤵
- Executes a command shell one-liner
PID:3644 -
C:\windows\system\YACLWK.exeC:\windows\system\YACLWK.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVMY.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4316 -
C:\windows\SysWOW64\NVMY.exeC:\windows\system32\NVMY.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJMMJ.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4792 -
C:\windows\SysWOW64\NJMMJ.exeC:\windows\system32\NJMMJ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRTM.exe.bat" "110⤵
- Executes a command shell one-liner
PID:2312 -
C:\windows\system\ZRTM.exeC:\windows\system\ZRTM.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUWQAS.exe.bat" "112⤵PID:1920
-
C:\windows\SysWOW64\RUWQAS.exeC:\windows\system32\RUWQAS.exe113⤵
- Executes dropped EXE
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HPGU.exe.bat" "114⤵
- Executes a command shell one-liner
PID:5592 -
C:\windows\SysWOW64\HPGU.exeC:\windows\system32\HPGU.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVGJ.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1312 -
C:\windows\SysWOW64\HVGJ.exeC:\windows\system32\HVGJ.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNBBDZ.exe.bat" "118⤵PID:5652
-
C:\windows\SNBBDZ.exeC:\windows\SNBBDZ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EDQ.exe.bat" "120⤵PID:5064
-
C:\windows\SysWOW64\EDQ.exeC:\windows\system32\EDQ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-