Analysis
- max time kernel
90s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 07:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-12_08109caa37cda333f8b378b5a2e8fc9a_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-12_08109caa37cda333f8b378b5a2e8fc9a_elex_emotet_stop.exe
- Size 208KB
- Sample260913-hs9f4adn8w
- SHA256 0454f086af0c4e397ded014c628b8770fe8db15ef5b994ac021202f277d95574
- MD5 08109caa37cda333f8b378b5a2e8fc9a
- SHA1 7d581c2d413a6f7aa185b81ba6d7b1a15cf65378
- SHA512 fc422bf66ef00f0bda00719cd8b6f0afc43ca8cc343ded83e731e642b2c62c294cd1a155c9637af552e3f658e8fe4f5cc6a1364d52fbfa960935741a51ae4807
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfd4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOVkEj1
- TLSH T151247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4460 IRPIV.exe 4084 BFIZBDU.exe 4224 QVQFMM.exe 2732 TDWN.exe 1088 UGI.exe 4628 AGQWM.exe 3184 JHKBYU.exe 2148 KKW.exe 1996 OSCFPCH.exe 5496 NKFV.exe 4256 FGJ.exe 2496 EDCURLN.exe 5784 VEW.exe 1160 XBK.exe 1772 UCLVNVH.exe 2344 GKAD.exe 3400 PSUJD.exe 4216 ZQIDS.exe 3808 OLR.exe 2228 MGQQIJ.exe 5212 WEW.exe 1644 LZFPBE.exe 2340 LFGDCRQ.exe 2660 XXJ.exe 4664 VVURFD.exe 4720 VBUFHQI.exe 5392 YOZP.exe 5192 SBEYTQ.exe 3188 IEN.exe 5660 IKFR.exe 2268 OKNFXS.exe 4076 DAOEE.exe 5348 HIDEQYB.exe 4124 LYJMU.exe 620 FMOWEQ.exe 3492 GPS.exe 5560 PPUEVDP.exe 2388 QSY.exe 2720 LFCJL.exe 2172 AAM.exe 1212 HQNNDJL.exe 4964 TGTV.exe 2452 RHBJYW.exe 5604 UUG.exe 4980 DCIX.exe 6004 MDKDPY.exe 2768 YLR.exe 2064 TGVUL.exe 1752 NTADWQT.exe 4656 ZMD.exe 5960 TZAGG.exe 768 SXT.exe 5352 YKSJYG.exe 4744 NNCO.exe 5540 UDDNQOS.exe 5452 XRIW.exe 2536 IJL.exe 1624 KHQ.exe 460 QHYPZ.exe 3956 LUDZJGN.exe 3020 QVKUSAO.exe 3548 JYOQFQ.exe 5820 AYQVJVA.exe 4852 KGS.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\IJL.exe XRIW.exe File created C:\windows\SysWOW64\IJL.exe.bat XRIW.exe File created C:\windows\SysWOW64\JYBOKRF.exe DYTAB.exe File created C:\windows\SysWOW64\XBK.exe.bat VEW.exe File created C:\windows\SysWOW64\VBUFHQI.exe VVURFD.exe File created C:\windows\SysWOW64\TGVUL.exe YLR.exe File opened for modification C:\windows\SysWOW64\YBO.exe ODA.exe File created C:\windows\SysWOW64\IKFR.exe.bat IEN.exe File opened for modification C:\windows\SysWOW64\TEATYQ.exe EOZCSDT.exe File created C:\windows\SysWOW64\ALYYW.exe RLWL.exe File created C:\windows\SysWOW64\AWWJ.exe.bat GJRAWZN.exe File opened for modification C:\windows\SysWOW64\CHFGZUK.exe TZDB.exe File created C:\windows\SysWOW64\MGQQIJ.exe OLR.exe File created C:\windows\SysWOW64\FMOWEQ.exe LYJMU.exe File opened for modification C:\windows\SysWOW64\STI.exe HANUYUH.exe File opened for modification C:\windows\SysWOW64\OLR.exe ZQIDS.exe File created C:\windows\SysWOW64\LZFPBE.exe.bat WEW.exe File opened for modification C:\windows\SysWOW64\JYBOKRF.exe DYTAB.exe File opened for modification C:\windows\SysWOW64\QVQFMM.exe BFIZBDU.exe File opened for modification C:\windows\SysWOW64\XBK.exe VEW.exe File opened for modification C:\windows\SysWOW64\KGS.exe AYQVJVA.exe File created C:\windows\SysWOW64\LJKLOND.exe TEATYQ.exe File created C:\windows\SysWOW64\CJUSI.exe YBO.exe File created C:\windows\SysWOW64\ODA.exe.bat UQVGEYM.exe File opened for modification C:\windows\SysWOW64\LZFPBE.exe WEW.exe File created C:\windows\SysWOW64\PPUEVDP.exe GPS.exe File opened for modification C:\windows\SysWOW64\TGTV.exe HQNNDJL.exe File opened for modification C:\windows\SysWOW64\PFPJ.exe LXIBTL.exe File opened for modification C:\windows\SysWOW64\WCU.exe NUSJDBG.exe File opened for modification C:\windows\SysWOW64\ZVQXC.exe ZPYI.exe File opened for modification C:\windows\SysWOW64\TGVUL.exe YLR.exe File created C:\windows\SysWOW64\NTADWQT.exe.bat TGVUL.exe File opened for modification C:\windows\SysWOW64\NNCO.exe YKSJYG.exe File created C:\windows\SysWOW64\LXDBZL.exe WCU.exe File created C:\windows\SysWOW64\CJUSI.exe.bat YBO.exe File created C:\windows\SysWOW64\CHFGZUK.exe TZDB.exe File created C:\windows\SysWOW64\CHFGZUK.exe.bat TZDB.exe File created C:\windows\SysWOW64\UCLVNVH.exe XBK.exe File created C:\windows\SysWOW64\UCLVNVH.exe.bat XBK.exe File created C:\windows\SysWOW64\QHAODV.exe.bat KGS.exe File opened for modification C:\windows\SysWOW64\LXDBZL.exe WCU.exe File created C:\windows\SysWOW64\STI.exe.bat HANUYUH.exe File created C:\windows\SysWOW64\JYBOKRF.exe.bat DYTAB.exe File created C:\windows\SysWOW64\VBUFHQI.exe.bat VVURFD.exe File created C:\windows\SysWOW64\FMOWEQ.exe.bat LYJMU.exe File created C:\windows\SysWOW64\LZFPBE.exe WEW.exe File created C:\windows\SysWOW64\IKFR.exe IEN.exe File created C:\windows\SysWOW64\ZPYI.exe.bat FCTZQMG.exe File created C:\windows\SysWOW64\YBO.exe ODA.exe File opened for modification C:\windows\SysWOW64\FCTZQMG.exe ZBMLZ.exe File opened for modification C:\windows\SysWOW64\MSCYTWS.exe MNCJSJ.exe File opened for modification C:\windows\SysWOW64\IKFR.exe IEN.exe File created C:\windows\SysWOW64\KGS.exe.bat AYQVJVA.exe File created C:\windows\SysWOW64\QHAODV.exe KGS.exe File created C:\windows\SysWOW64\TEATYQ.exe EOZCSDT.exe File created C:\windows\SysWOW64\QVQFMM.exe.bat BFIZBDU.exe File opened for modification C:\windows\SysWOW64\VBUFHQI.exe VVURFD.exe File created C:\windows\SysWOW64\TGTV.exe HQNNDJL.exe File created C:\windows\SysWOW64\PFPJ.exe.bat LXIBTL.exe File created C:\windows\SysWOW64\KTADHZ.exe ALYYW.exe File created C:\windows\SysWOW64\UGI.exe TDWN.exe File created C:\windows\SysWOW64\WCU.exe.bat NUSJDBG.exe File opened for modification C:\windows\SysWOW64\FMOWEQ.exe LYJMU.exe File created C:\windows\SysWOW64\KGS.exe AYQVJVA.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\DCIX.exe UUG.exe File created C:\windows\TVWJKN.exe PFPJ.exe File opened for modification C:\windows\system\HUKWU.exe PTI.exe File opened for modification C:\windows\ZBMLZ.exe OJJSZC.exe File created C:\windows\JHKBYU.exe.bat AGQWM.exe File created C:\windows\system\WEW.exe.bat MGQQIJ.exe File created C:\windows\system\GKAD.exe UCLVNVH.exe File created C:\windows\system\MDKDPY.exe DCIX.exe File created C:\windows\OKNFXS.exe IKFR.exe File created C:\windows\system\DAOEE.exe.bat OKNFXS.exe File created C:\windows\system\DJINKY.exe QHAODV.exe File created C:\windows\system\HUKWU.exe PTI.exe File created C:\windows\system\LXIBTL.exe.bat DJINKY.exe File created C:\windows\EOZCSDT.exe TVWJKN.exe File opened for modification C:\windows\OKNFXS.exe IKFR.exe File opened for modification C:\windows\system\DJINKY.exe QHAODV.exe File created C:\windows\system\BFIZBDU.exe.bat IRPIV.exe File opened for modification C:\windows\SBEYTQ.exe YOZP.exe File created C:\windows\system\LUDZJGN.exe.bat QHYPZ.exe File created C:\windows\TVWJKN.exe.bat PFPJ.exe File created C:\windows\system\XJVEEL.exe FJTYS.exe File created C:\windows\system\LFCJL.exe.bat QSY.exe File created C:\windows\system\WPSBIWJ.exe UCNSG.exe File created C:\windows\system\WPSBIWJ.exe.bat UCNSG.exe File opened for modification C:\windows\TZDB.exe JYBOKRF.exe File opened for modification C:\windows\system\BFIZBDU.exe IRPIV.exe File opened for modification C:\windows\UCNSG.exe LPCAQAY.exe File opened for modification C:\windows\system\NKFV.exe OSCFPCH.exe File created C:\windows\system\UUG.exe RHBJYW.exe File opened for modification C:\windows\system\ZMD.exe NTADWQT.exe File opened for modification C:\windows\MNCJSJ.exe AWWJ.exe File created C:\windows\system\BFIZBDU.exe IRPIV.exe File opened for modification C:\windows\FGJ.exe NKFV.exe File created C:\windows\system\MDKDPY.exe.bat DCIX.exe File created C:\windows\system\NUSJDBG.exe HUKWU.exe File opened for modification C:\windows\system\NUSJDBG.exe HUKWU.exe File opened for modification C:\windows\system\IDJ.exe LXDBZL.exe File opened for modification C:\windows\SCVLNRN.exe XPQCD.exe File opened for modification C:\windows\system\DYTAB.exe SGYHTH.exe File created C:\windows\system\UDDNQOS.exe.bat NNCO.exe File opened for modification C:\windows\system\QVKUSAO.exe LUDZJGN.exe File created C:\windows\system\LXIBTL.exe DJINKY.exe File created C:\windows\UQVGEYM.exe.bat ZVQXC.exe File created C:\windows\FGJ.exe.bat NKFV.exe File created C:\windows\OKNFXS.exe.bat IKFR.exe File created C:\windows\QSY.exe PPUEVDP.exe File created C:\windows\system\QVKUSAO.exe LUDZJGN.exe File created C:\windows\JYOQFQ.exe QVKUSAO.exe File created C:\windows\BNMKF.exe MSCYTWS.exe File created C:\windows\OSCFPCH.exe.bat KKW.exe File opened for modification C:\windows\VEW.exe EDCURLN.exe File created C:\windows\system\TZAGG.exe ZMD.exe File created C:\windows\UCXY.exe.bat OCPKQGN.exe File created C:\windows\system\FUAJH.exe.bat UCXY.exe File created C:\windows\system\GWFWMII.exe XJVEEL.exe File opened for modification C:\windows\system\QHYPZ.exe KHQ.exe File opened for modification C:\windows\system\WPSBIWJ.exe UCNSG.exe File created C:\windows\ZBMLZ.exe OJJSZC.exe File created C:\windows\WBXVST.exe.bat STI.exe File opened for modification C:\windows\system\XPQCD.exe AKKF.exe File opened for modification C:\windows\YOZP.exe VBUFHQI.exe File opened for modification C:\windows\system\LUDZJGN.exe QHYPZ.exe File opened for modification C:\windows\TVWJKN.exe PFPJ.exe File opened for modification C:\windows\EDCURLN.exe FGJ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1728 cmd.exe 3468 cmd.exe 4168 cmd.exe 3088 cmd.exe 2916 cmd.exe 2772 cmd.exe 2752 cmd.exe 4796 cmd.exe 5996 cmd.exe 5404 cmd.exe 4620 cmd.exe 3004 cmd.exe 1920 cmd.exe 2240 cmd.exe 1016 cmd.exe 1268 cmd.exe 1252 cmd.exe 3892 cmd.exe 4388 cmd.exe 4944 cmd.exe 6032 cmd.exe 1964 cmd.exe 3040 cmd.exe 3244 cmd.exe 3268 cmd.exe 2408 cmd.exe 1324 cmd.exe 5628 cmd.exe 1592 cmd.exe 1952 cmd.exe 1400 cmd.exe 4968 cmd.exe 5344 cmd.exe 3700 cmd.exe 2196 cmd.exe 1724 cmd.exe 1672 cmd.exe 1880 cmd.exe 4300 cmd.exe 1896 cmd.exe 3060 cmd.exe 4704 cmd.exe 1528 cmd.exe 4136 cmd.exe 3828 cmd.exe 5648 cmd.exe 3164 cmd.exe 5332 cmd.exe 2992 cmd.exe 728 cmd.exe 4572 cmd.exe 5336 cmd.exe 3756 cmd.exe 4872 cmd.exe 4916 cmd.exe 1152 cmd.exe 3464 cmd.exe 4120 cmd.exe 1948 cmd.exe 908 cmd.exe 2784 cmd.exe 5236 cmd.exe 5148 cmd.exe 4320 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2292 4748 WerFault.exe 87 5564 4460 WerFault.exe 91 3204 4084 WerFault.exe 98 2656 4224 WerFault.exe 103 712 2732 WerFault.exe 108 3400 1088 WerFault.exe 113 4560 4628 WerFault.exe 118 4392 3184 WerFault.exe 123 3956 2148 WerFault.exe 128 4308 1996 WerFault.exe 133 3068 5496 WerFault.exe 138 5828 4256 WerFault.exe 143 4672 2496 WerFault.exe 148 6004 5784 WerFault.exe 153 3492 1160 WerFault.exe 158 5620 1772 WerFault.exe 163 3772 2344 WerFault.exe 168 3376 3400 WerFault.exe 173 2584 4216 WerFault.exe 178 5960 3808 WerFault.exe 183 4516 2228 WerFault.exe 188 1372 5212 WerFault.exe 193 2716 1644 WerFault.exe 198 1324 2340 WerFault.exe 203 3060 2660 WerFault.exe 208 4364 4664 WerFault.exe 213 1668 4720 WerFault.exe 218 1812 5392 WerFault.exe 223 2480 5192 WerFault.exe 228 5020 3188 WerFault.exe 233 5408 5660 WerFault.exe 238 1416 2268 WerFault.exe 243 5228 4076 WerFault.exe 248 908 5348 WerFault.exe 253 4680 4124 WerFault.exe 258 4848 620 WerFault.exe 263 1448 3492 WerFault.exe 268 4832 5560 WerFault.exe 273 3396 2388 WerFault.exe 279 4684 2720 WerFault.exe 284 5960 2172 WerFault.exe 289 3020 1212 WerFault.exe 294 5124 4964 WerFault.exe 299 3596 2452 WerFault.exe 304 4812 5604 WerFault.exe 309 5816 4980 WerFault.exe 314 4888 6004 WerFault.exe 319 4144 2768 WerFault.exe 324 3376 2064 WerFault.exe 329 1952 1752 WerFault.exe 334 5600 4656 WerFault.exe 339 2704 5960 WerFault.exe 344 5124 768 WerFault.exe 349 5820 5352 WerFault.exe 354 4812 4744 WerFault.exe 359 2844 5540 WerFault.exe 364 4508 5452 WerFault.exe 369 6132 2536 WerFault.exe 374 836 1624 WerFault.exe 379 3604 460 WerFault.exe 384 4436 3956 WerFault.exe 389 5568 3020 WerFault.exe 394 1928 3548 WerFault.exe 399 5852 5820 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XJVEEL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCVLNRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXDBZL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDDNQOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFPJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNMKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBUFHQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUKWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MGQQIJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LZFPBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZBMLZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AKKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAOEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSCFPCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKNFXS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDCURLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHYPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJUSI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NKFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYQVJVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYJMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPQCD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCLVNVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MDKDPY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEATYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4748 2026-09-12_08109caa37cda333f8b378b5a2e8fc9a_elex_emotet_stop.exe 4748 2026-09-12_08109caa37cda333f8b378b5a2e8fc9a_elex_emotet_stop.exe 4460 IRPIV.exe 4460 IRPIV.exe 4084 BFIZBDU.exe 4084 BFIZBDU.exe 4224 QVQFMM.exe 4224 QVQFMM.exe 2732 TDWN.exe 2732 TDWN.exe 1088 UGI.exe 1088 UGI.exe 4628 AGQWM.exe 4628 AGQWM.exe 3184 JHKBYU.exe 3184 JHKBYU.exe 2148 KKW.exe 2148 KKW.exe 1996 OSCFPCH.exe 1996 OSCFPCH.exe 5496 NKFV.exe 5496 NKFV.exe 4256 FGJ.exe 4256 FGJ.exe 2496 EDCURLN.exe 2496 EDCURLN.exe 5784 VEW.exe 5784 VEW.exe 1160 XBK.exe 1160 XBK.exe 1772 UCLVNVH.exe 1772 UCLVNVH.exe 2344 GKAD.exe 2344 GKAD.exe 3400 PSUJD.exe 3400 PSUJD.exe 4216 ZQIDS.exe 4216 ZQIDS.exe 3808 OLR.exe 3808 OLR.exe 2228 MGQQIJ.exe 2228 MGQQIJ.exe 5212 WEW.exe 5212 WEW.exe 1644 LZFPBE.exe 1644 LZFPBE.exe 2340 LFGDCRQ.exe 2340 LFGDCRQ.exe 2660 XXJ.exe 2660 XXJ.exe 4664 VVURFD.exe 4664 VVURFD.exe 4720 VBUFHQI.exe 4720 VBUFHQI.exe 5392 YOZP.exe 5392 YOZP.exe 5192 SBEYTQ.exe 5192 SBEYTQ.exe 3188 IEN.exe 3188 IEN.exe 5660 IKFR.exe 5660 IKFR.exe 2268 OKNFXS.exe 2268 OKNFXS.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4748 2026-09-12_08109caa37cda333f8b378b5a2e8fc9a_elex_emotet_stop.exe 4748 2026-09-12_08109caa37cda333f8b378b5a2e8fc9a_elex_emotet_stop.exe 4460 IRPIV.exe 4460 IRPIV.exe 4084 BFIZBDU.exe 4084 BFIZBDU.exe 4224 QVQFMM.exe 4224 QVQFMM.exe 2732 TDWN.exe 2732 TDWN.exe 1088 UGI.exe 1088 UGI.exe 4628 AGQWM.exe 4628 AGQWM.exe 3184 JHKBYU.exe 3184 JHKBYU.exe 2148 KKW.exe 2148 KKW.exe 1996 OSCFPCH.exe 1996 OSCFPCH.exe 5496 NKFV.exe 5496 NKFV.exe 4256 FGJ.exe 4256 FGJ.exe 2496 EDCURLN.exe 2496 EDCURLN.exe 5784 VEW.exe 5784 VEW.exe 1160 XBK.exe 1160 XBK.exe 1772 UCLVNVH.exe 1772 UCLVNVH.exe 2344 GKAD.exe 2344 GKAD.exe 3400 PSUJD.exe 3400 PSUJD.exe 4216 ZQIDS.exe 4216 ZQIDS.exe 3808 OLR.exe 3808 OLR.exe 2228 MGQQIJ.exe 2228 MGQQIJ.exe 5212 WEW.exe 5212 WEW.exe 1644 LZFPBE.exe 1644 LZFPBE.exe 2340 LFGDCRQ.exe 2340 LFGDCRQ.exe 2660 XXJ.exe 2660 XXJ.exe 4664 VVURFD.exe 4664 VVURFD.exe 4720 VBUFHQI.exe 4720 VBUFHQI.exe 5392 YOZP.exe 5392 YOZP.exe 5192 SBEYTQ.exe 5192 SBEYTQ.exe 3188 IEN.exe 3188 IEN.exe 5660 IKFR.exe 5660 IKFR.exe 2268 OKNFXS.exe 2268 OKNFXS.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4748 wrote to memory of 1016 4748 2026-09-12_08109caa37cda333f8b378b5a2e8fc9a_elex_emotet_stop.exe 88 PID 1016 wrote to memory of 4460 1016 cmd.exe 91 PID 4460 wrote to memory of 1060 4460 IRPIV.exe 94 PID 1060 wrote to memory of 4084 1060 cmd.exe 98 PID 4084 wrote to memory of 4572 4084 BFIZBDU.exe 99 PID 4572 wrote to memory of 4224 4572 cmd.exe 103 PID 4224 wrote to memory of 5272 4224 QVQFMM.exe 104 PID 5272 wrote to memory of 2732 5272 cmd.exe 108 PID 2732 wrote to memory of 6128 2732 TDWN.exe 109 PID 6128 wrote to memory of 1088 6128 cmd.exe 113 PID 1088 wrote to memory of 5888 1088 UGI.exe 114 PID 5888 wrote to memory of 4628 5888 cmd.exe 118 PID 4628 wrote to memory of 1020 4628 AGQWM.exe 119 PID 1020 wrote to memory of 3184 1020 cmd.exe 123 PID 3184 wrote to memory of 2892 3184 JHKBYU.exe 124 PID 2892 wrote to memory of 2148 2892 cmd.exe 128 PID 2148 wrote to memory of 1948 2148 KKW.exe 129 PID 1948 wrote to memory of 1996 1948 cmd.exe 133 PID 1996 wrote to memory of 5336 1996 OSCFPCH.exe 134 PID 5336 wrote to memory of 5496 5336 cmd.exe 138 PID 5496 wrote to memory of 2872 5496 NKFV.exe 139 PID 2872 wrote to memory of 4256 2872 cmd.exe 143 PID 4256 wrote to memory of 1672 4256 FGJ.exe 144 PID 1672 wrote to memory of 2496 1672 cmd.exe 148 PID 2496 wrote to memory of 4092 2496 EDCURLN.exe 149 PID 4092 wrote to memory of 5784 4092 cmd.exe 153 PID 5784 wrote to memory of 3468 5784 VEW.exe 154 PID 3468 wrote to memory of 1160 3468 cmd.exe 158 PID 1160 wrote to memory of 2208 1160 XBK.exe 159 PID 2208 wrote to memory of 1772 2208 cmd.exe 163 PID 1772 wrote to memory of 4488 1772 UCLVNVH.exe 164 PID 4488 wrote to memory of 2344 4488 cmd.exe 168 PID 2344 wrote to memory of 1268 2344 GKAD.exe 169 PID 1268 wrote to memory of 3400 1268 cmd.exe 173 PID 3400 wrote to memory of 2188 3400 PSUJD.exe 174 PID 2188 wrote to memory of 4216 2188 cmd.exe 178 PID 4216 wrote to memory of 4356 4216 ZQIDS.exe 179 PID 4356 wrote to memory of 3808 4356 cmd.exe 183 PID 3808 wrote to memory of 3508 3808 OLR.exe 184 PID 3508 wrote to memory of 2228 3508 cmd.exe 188 PID 2228 wrote to memory of 5996 2228 MGQQIJ.exe 189 PID 5996 wrote to memory of 5212 5996 cmd.exe 193 PID 5212 wrote to memory of 4728 5212 WEW.exe 194 PID 4728 wrote to memory of 1644 4728 cmd.exe 198 PID 1644 wrote to memory of 4612 1644 LZFPBE.exe 199 PID 4612 wrote to memory of 2340 4612 cmd.exe 203 PID 2340 wrote to memory of 2852 2340 LFGDCRQ.exe 204 PID 2852 wrote to memory of 2660 2852 cmd.exe 208 PID 2660 wrote to memory of 4692 2660 XXJ.exe 209 PID 4692 wrote to memory of 4664 4692 cmd.exe 213 PID 4664 wrote to memory of 4272 4664 VVURFD.exe 214 PID 4272 wrote to memory of 4720 4272 cmd.exe 218 PID 4720 wrote to memory of 1680 4720 VBUFHQI.exe 219 PID 1680 wrote to memory of 5392 1680 cmd.exe 223 PID 5392 wrote to memory of 4912 5392 YOZP.exe 224 PID 4912 wrote to memory of 5192 4912 cmd.exe 228 PID 5192 wrote to memory of 6040 5192 SBEYTQ.exe 229 PID 6040 wrote to memory of 3188 6040 cmd.exe 233 PID 3188 wrote to memory of 3756 3188 IEN.exe 234 PID 3756 wrote to memory of 5660 3756 cmd.exe 238 PID 5660 wrote to memory of 1252 5660 IKFR.exe 239 PID 1252 wrote to memory of 2268 1252 cmd.exe 243 PID 2268 wrote to memory of 4868 2268 OKNFXS.exe 244 PID 4868 wrote to memory of 4076 4868 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_08109caa37cda333f8b378b5a2e8fc9a_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_08109caa37cda333f8b378b5a2e8fc9a_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IRPIV.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\windows\IRPIV.exeC:\windows\IRPIV.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BFIZBDU.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\windows\system\BFIZBDU.exeC:\windows\system\BFIZBDU.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVQFMM.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\windows\SysWOW64\QVQFMM.exeC:\windows\system32\QVQFMM.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDWN.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\windows\system\TDWN.exeC:\windows\system\TDWN.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UGI.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\windows\SysWOW64\UGI.exeC:\windows\system32\UGI.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AGQWM.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\windows\system\AGQWM.exeC:\windows\system\AGQWM.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JHKBYU.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\windows\JHKBYU.exeC:\windows\JHKBYU.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKW.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\SysWOW64\KKW.exeC:\windows\system32\KKW.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OSCFPCH.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\windows\OSCFPCH.exeC:\windows\OSCFPCH.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NKFV.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\windows\system\NKFV.exeC:\windows\system\NKFV.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FGJ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\windows\FGJ.exeC:\windows\FGJ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDCURLN.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\windows\EDCURLN.exeC:\windows\EDCURLN.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEW.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\windows\VEW.exeC:\windows\VEW.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XBK.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\windows\SysWOW64\XBK.exeC:\windows\system32\XBK.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCLVNVH.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\windows\SysWOW64\UCLVNVH.exeC:\windows\system32\UCLVNVH.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKAD.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\windows\system\GKAD.exeC:\windows\system\GKAD.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PSUJD.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\windows\system\PSUJD.exeC:\windows\system\PSUJD.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQIDS.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\windows\ZQIDS.exeC:\windows\ZQIDS.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OLR.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\windows\SysWOW64\OLR.exeC:\windows\system32\OLR.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MGQQIJ.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\windows\SysWOW64\MGQQIJ.exeC:\windows\system32\MGQQIJ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WEW.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\windows\system\WEW.exeC:\windows\system\WEW.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LZFPBE.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\windows\SysWOW64\LZFPBE.exeC:\windows\system32\LZFPBE.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFGDCRQ.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\windows\LFGDCRQ.exeC:\windows\LFGDCRQ.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXJ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\windows\system\XXJ.exeC:\windows\system\XXJ.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVURFD.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\windows\system\VVURFD.exeC:\windows\system\VVURFD.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VBUFHQI.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\windows\SysWOW64\VBUFHQI.exeC:\windows\system32\VBUFHQI.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOZP.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\windows\YOZP.exeC:\windows\YOZP.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBEYTQ.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\windows\SBEYTQ.exeC:\windows\SBEYTQ.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IEN.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\windows\system\IEN.exeC:\windows\system\IEN.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IKFR.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\windows\SysWOW64\IKFR.exeC:\windows\system32\IKFR.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OKNFXS.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\windows\OKNFXS.exeC:\windows\OKNFXS.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAOEE.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\windows\system\DAOEE.exeC:\windows\system\DAOEE.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIDEQYB.exe.bat" "66⤵
- Executes a command shell one-liner
PID:2916 -
C:\windows\HIDEQYB.exeC:\windows\HIDEQYB.exe67⤵
- Executes dropped EXE
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYJMU.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:4836 -
C:\windows\system\LYJMU.exeC:\windows\system\LYJMU.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FMOWEQ.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3892 -
C:\windows\SysWOW64\FMOWEQ.exeC:\windows\system32\FMOWEQ.exe71⤵
- Executes dropped EXE
PID:620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GPS.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5404 -
C:\windows\SysWOW64\GPS.exeC:\windows\system32\GPS.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PPUEVDP.exe.bat" "74⤵PID:2884
-
C:\windows\SysWOW64\PPUEVDP.exeC:\windows\system32\PPUEVDP.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSY.exe.bat" "76⤵
- Executes a command shell one-liner
PID:4620 -
C:\windows\QSY.exeC:\windows\QSY.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFCJL.exe.bat" "78⤵PID:5992
-
C:\windows\system\LFCJL.exeC:\windows\system\LFCJL.exe79⤵
- Executes dropped EXE
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AAM.exe.bat" "80⤵PID:4368
-
C:\windows\AAM.exeC:\windows\AAM.exe81⤵
- Executes dropped EXE
PID:2172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HQNNDJL.exe.bat" "82⤵PID:4780
-
C:\windows\system\HQNNDJL.exeC:\windows\system\HQNNDJL.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGTV.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3004 -
C:\windows\SysWOW64\TGTV.exeC:\windows\system32\TGTV.exe85⤵
- Executes dropped EXE
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHBJYW.exe.bat" "86⤵PID:5508
-
C:\windows\RHBJYW.exeC:\windows\RHBJYW.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UUG.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4872 -
C:\windows\system\UUG.exeC:\windows\system\UUG.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DCIX.exe.bat" "90⤵PID:2112
-
C:\windows\DCIX.exeC:\windows\DCIX.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MDKDPY.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:3844 -
C:\windows\system\MDKDPY.exeC:\windows\system\MDKDPY.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YLR.exe.bat" "94⤵
- Executes a command shell one-liner
PID:1400 -
C:\windows\YLR.exeC:\windows\YLR.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGVUL.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:2796 -
C:\windows\SysWOW64\TGVUL.exeC:\windows\system32\TGVUL.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NTADWQT.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:3512 -
C:\windows\SysWOW64\NTADWQT.exeC:\windows\system32\NTADWQT.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMD.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:820 -
C:\windows\system\ZMD.exeC:\windows\system\ZMD.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TZAGG.exe.bat" "102⤵PID:6020
-
C:\windows\system\TZAGG.exeC:\windows\system\TZAGG.exe103⤵
- Executes dropped EXE
PID:5960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SXT.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4388 -
C:\windows\system\SXT.exeC:\windows\system\SXT.exe105⤵
- Executes dropped EXE
PID:768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YKSJYG.exe.bat" "106⤵PID:1372
-
C:\windows\system\YKSJYG.exeC:\windows\system\YKSJYG.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NNCO.exe.bat" "108⤵PID:5956
-
C:\windows\SysWOW64\NNCO.exeC:\windows\system32\NNCO.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDDNQOS.exe.bat" "110⤵PID:4680
-
C:\windows\system\UDDNQOS.exeC:\windows\system\UDDNQOS.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRIW.exe.bat" "112⤵PID:2260
-
C:\windows\XRIW.exeC:\windows\XRIW.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IJL.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4916 -
C:\windows\SysWOW64\IJL.exeC:\windows\system32\IJL.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KHQ.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:4832 -
C:\windows\SysWOW64\KHQ.exeC:\windows\system32\KHQ.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHYPZ.exe.bat" "118⤵PID:2804
-
C:\windows\system\QHYPZ.exeC:\windows\system\QHYPZ.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LUDZJGN.exe.bat" "120⤵PID:4180
-
C:\windows\system\LUDZJGN.exeC:\windows\system\LUDZJGN.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-