Analysis
- max time kernel
88s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 11:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-16_8888038ff04b32655a59bde8113d9d79_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-16_8888038ff04b32655a59bde8113d9d79_elex_emotet_stop.exe
- Size 208KB
- Sample260916-m6ldmsxtdz
- SHA256 9f5f325fbf70aedb9441f904e587eb9386851f9bc546a7e1659ca7b2aac2982f
- MD5 8888038ff04b32655a59bde8113d9d79
- SHA1 ace47708a029728f0f9305a8580c93ae188f6f06
- SHA512 e60414ce72bf929f4398f605c16ff2df236adfdd585b39c8f321784e59b30aff2252321e094bf2b5d4e52077c58c003b9ddf9542b59b8f045d94dfd592e4ade2
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfA4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOYQEj1
- TLSH T11B247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1452 QFGDNH.exe 1860 YSFBH.exe 2868 TQF.exe 3380 XGLNVV.exe 2788 BOS.exe 4012 QETNOB.exe 1944 LRY.exe 3556 YCOVFM.exe 4360 CKVV.exe 4640 KYNJSJ.exe 3656 OGCR.exe 1424 HJGNKR.exe 4500 TRM.exe 4720 XHTVICE.exe 5536 DUS.exe 1020 VXWZT.exe 3512 QLBJDVK.exe 3052 UBHJPN.exe 568 VEL.exe 5604 IGBLJG.exe 908 ZPDQ.exe 3032 SSHMSB.exe 4240 SNLQF.exe 5276 IIVUQE.exe 3712 CDZEA.exe 2732 KTADHZ.exe 3280 VBHD.exe 2028 FKJIXPS.exe 2916 DZULK.exe 1184 YNZUUUP.exe 4784 ZQDY.exe 3364 XLCZENO.exe 5096 CLKNNPP.exe 4236 DGNQTF.exe 1204 MXQLSN.exe 3956 SSPU.exe 4948 UQVGEYM.exe 5112 ODA.exe 3128 YBO.exe 6100 MEWIKJ.exe 3408 WBCDZ.exe 1692 UXBDWV.exe 1396 AXIR.exe 4364 AAMVSNG.exe 2372 VNRE.exe 5812 IYHVRXQ.exe 5104 ZZB.exe 976 SCNEALU.exe 3344 NPKN.exe 6032 IAAMYVE.exe 2756 CNFV.exe 4856 DTXKK.exe 5244 ITFXTCX.exe 3412 MJUX.exe 2784 SELGKYA.exe 5912 GHBXQ.exe 5364 AUGOAAK.exe 4284 LNB.exe 2024 PDQHV.exe 236 XIIVWN.exe 1328 BYPW.exe 5524 UUSZOVO.exe 1380 VXEV.exe 760 PKJEEL.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\AVR.exe NKJYT.exe File opened for modification C:\windows\SysWOW64\AVR.exe NKJYT.exe File opened for modification C:\windows\SysWOW64\KYNJSJ.exe CKVV.exe File created C:\windows\SysWOW64\CLKNNPP.exe XLCZENO.exe File created C:\windows\SysWOW64\ZZB.exe.bat IYHVRXQ.exe File created C:\windows\SysWOW64\SZMHFS.exe.bat FWW.exe File created C:\windows\SysWOW64\QFGDNH.exe.bat 2026-09-16_8888038ff04b32655a59bde8113d9d79_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\SSHMSB.exe ZPDQ.exe File created C:\windows\SysWOW64\IIVUQE.exe.bat SNLQF.exe File opened for modification C:\windows\SysWOW64\YBO.exe ODA.exe File created C:\windows\SysWOW64\PDQHV.exe.bat LNB.exe File created C:\windows\SysWOW64\SNLQF.exe SSHMSB.exe File created C:\windows\SysWOW64\YBO.exe ODA.exe File created C:\windows\SysWOW64\BYPW.exe XIIVWN.exe File created C:\windows\SysWOW64\PKJEEL.exe.bat VXEV.exe File created C:\windows\SysWOW64\SZMHFS.exe FWW.exe File created C:\windows\SysWOW64\LFH.exe.bat ANEOHXB.exe File created C:\windows\SysWOW64\AVR.exe.bat NKJYT.exe File created C:\windows\SysWOW64\VNRE.exe AAMVSNG.exe File created C:\windows\SysWOW64\XIIVWN.exe.bat PDQHV.exe File created C:\windows\SysWOW64\XAD.exe.bat RFDTE.exe File created C:\windows\SysWOW64\BIJUN.exe XAD.exe File created C:\windows\SysWOW64\OGCR.exe KYNJSJ.exe File opened for modification C:\windows\SysWOW64\SNLQF.exe SSHMSB.exe File created C:\windows\SysWOW64\YNZUUUP.exe DZULK.exe File opened for modification C:\windows\SysWOW64\IAAMYVE.exe NPKN.exe File created C:\windows\SysWOW64\LFH.exe ANEOHXB.exe File opened for modification C:\windows\SysWOW64\LFH.exe ANEOHXB.exe File created C:\windows\SysWOW64\KTADHZ.exe CDZEA.exe File created C:\windows\SysWOW64\ODA.exe UQVGEYM.exe File opened for modification C:\windows\SysWOW64\VNRE.exe AAMVSNG.exe File created C:\windows\SysWOW64\VNRE.exe.bat AAMVSNG.exe File created C:\windows\SysWOW64\ZZB.exe IYHVRXQ.exe File opened for modification C:\windows\SysWOW64\PKJEEL.exe VXEV.exe File opened for modification C:\windows\SysWOW64\NECJKTK.exe BMNY.exe File created C:\windows\SysWOW64\GCK.exe.bat EEWONZ.exe File created C:\windows\SysWOW64\IGBLJG.exe.bat VEL.exe File created C:\windows\SysWOW64\ODA.exe.bat UQVGEYM.exe File created C:\windows\SysWOW64\XAD.exe RFDTE.exe File created C:\windows\SysWOW64\NECJKTK.exe.bat BMNY.exe File created C:\windows\SysWOW64\SBHS.exe.bat UQWCW.exe File created C:\windows\SysWOW64\ZPDQ.exe.bat IGBLJG.exe File created C:\windows\SysWOW64\SSHMSB.exe.bat ZPDQ.exe File opened for modification C:\windows\SysWOW64\YNZUUUP.exe DZULK.exe File created C:\windows\SysWOW64\WQFQ.exe.bat DXXF.exe File created C:\windows\SysWOW64\GCK.exe EEWONZ.exe File created C:\windows\SysWOW64\OGCR.exe.bat KYNJSJ.exe File opened for modification C:\windows\SysWOW64\ZPDQ.exe IGBLJG.exe File opened for modification C:\windows\SysWOW64\DZULK.exe FKJIXPS.exe File created C:\windows\SysWOW64\PDQHV.exe LNB.exe File created C:\windows\SysWOW64\XIIVWN.exe PDQHV.exe File created C:\windows\SysWOW64\PKJEEL.exe VXEV.exe File opened for modification C:\windows\SysWOW64\XAD.exe RFDTE.exe File created C:\windows\SysWOW64\KYNJSJ.exe CKVV.exe File created C:\windows\SysWOW64\KYNJSJ.exe.bat CKVV.exe File created C:\windows\SysWOW64\DHB.exe UYHSTFC.exe File created C:\windows\SysWOW64\IAAMYVE.exe.bat NPKN.exe File opened for modification C:\windows\SysWOW64\XIIVWN.exe PDQHV.exe File created C:\windows\SysWOW64\SBHS.exe UQWCW.exe File created C:\windows\SysWOW64\QFGDNH.exe 2026-09-16_8888038ff04b32655a59bde8113d9d79_elex_emotet_stop.exe File created C:\windows\SysWOW64\IIVUQE.exe SNLQF.exe File created C:\windows\SysWOW64\YBO.exe.bat ODA.exe File created C:\windows\SysWOW64\BYPW.exe.bat XIIVWN.exe File opened for modification C:\windows\SysWOW64\WQFQ.exe DXXF.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\CDZEA.exe IIVUQE.exe File created C:\windows\IYHVRXQ.exe.bat VNRE.exe File opened for modification C:\windows\DIE.exe ZAXAZY.exe File created C:\windows\system\BOS.exe XGLNVV.exe File opened for modification C:\windows\system\BOS.exe XGLNVV.exe File opened for modification C:\windows\DGNQTF.exe CLKNNPP.exe File created C:\windows\system\RFDTE.exe.bat UAYWP.exe File created C:\windows\system\MDYXMB.exe AVR.exe File opened for modification C:\windows\MRYLNO.exe MDYXMB.exe File created C:\windows\DGNQTF.exe.bat CLKNNPP.exe File created C:\windows\system\INLFOC.exe.bat PKI.exe File opened for modification C:\windows\system\ITFXTCX.exe DTXKK.exe File created C:\windows\VTQ.exe.bat AYTQYM.exe File opened for modification C:\windows\system\LRY.exe QETNOB.exe File created C:\windows\XHTVICE.exe TRM.exe File created C:\windows\GDJKW.exe.bat DIE.exe File created C:\windows\PELPZV.exe GDJKW.exe File opened for modification C:\windows\TDVPG.exe GTMQR.exe File opened for modification C:\windows\YCOVFM.exe LRY.exe File opened for modification C:\windows\system\TRM.exe HJGNKR.exe File created C:\windows\SSPU.exe MXQLSN.exe File created C:\windows\SSPU.exe.bat MXQLSN.exe File created C:\windows\AXIR.exe UXBDWV.exe File opened for modification C:\windows\BGPBFP.exe VTQ.exe File opened for modification C:\windows\AXIR.exe UXBDWV.exe File created C:\windows\SCNEALU.exe ZZB.exe File created C:\windows\system\LRY.exe.bat QETNOB.exe File opened for modification C:\windows\system\MEWIKJ.exe YBO.exe File created C:\windows\CNFV.exe.bat IAAMYVE.exe File created C:\windows\system\DTXKK.exe CNFV.exe File created C:\windows\system\YSFBH.exe.bat QFGDNH.exe File created C:\windows\system\UBHJPN.exe QLBJDVK.exe File opened for modification C:\windows\VEL.exe UBHJPN.exe File opened for modification C:\windows\system\UAYWP.exe QSR.exe File created C:\windows\system\DUS.exe.bat XHTVICE.exe File opened for modification C:\windows\system\AAMVSNG.exe AXIR.exe File created C:\windows\system\QSR.exe.bat DHB.exe File opened for modification C:\windows\system\QLBJDVK.exe VXWZT.exe File created C:\windows\system\ITFXTCX.exe DTXKK.exe File created C:\windows\AUGOAAK.exe.bat GHBXQ.exe File created C:\windows\GTMQR.exe.bat LFH.exe File opened for modification C:\windows\EEWONZ.exe NECJKTK.exe File created C:\windows\system\XLCZENO.exe.bat ZQDY.exe File created C:\windows\MXQLSN.exe DGNQTF.exe File created C:\windows\BMNY.exe BIJUN.exe File created C:\windows\TQF.exe YSFBH.exe File created C:\windows\HJGNKR.exe OGCR.exe File created C:\windows\FVHQ.exe.bat DXCD.exe File created C:\windows\ZQDY.exe YNZUUUP.exe File opened for modification C:\windows\PELPZV.exe GDJKW.exe File opened for modification C:\windows\TQF.exe YSFBH.exe File created C:\windows\ZKX.exe.bat CENBOBS.exe File created C:\windows\QETNOB.exe.bat BOS.exe File opened for modification C:\windows\GTMQR.exe LFH.exe File created C:\windows\UQVGEYM.exe.bat SSPU.exe File opened for modification C:\windows\system\UUSZOVO.exe BYPW.exe File created C:\windows\UQWCW.exe XKMN.exe File created C:\windows\FVHQ.exe DXCD.exe File opened for modification C:\windows\VBHD.exe KTADHZ.exe File created C:\windows\DGNQTF.exe CLKNNPP.exe File created C:\windows\UQVGEYM.exe SSPU.exe File created C:\windows\system\NKJYT.exe.bat MPFCGQ.exe File created C:\windows\system\DGSGSB.exe FVHQ.exe File created C:\windows\IYHVRXQ.exe VNRE.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4560 cmd.exe 1608 cmd.exe 1664 cmd.exe 1628 cmd.exe 5920 cmd.exe 1620 cmd.exe 4932 cmd.exe 2740 cmd.exe 3984 cmd.exe 1832 cmd.exe 4176 cmd.exe 4424 cmd.exe 6020 cmd.exe 3696 cmd.exe 3980 cmd.exe 1732 cmd.exe 5840 cmd.exe 4604 cmd.exe 924 cmd.exe 4380 cmd.exe 3440 cmd.exe 2508 cmd.exe 5792 cmd.exe 2472 cmd.exe 5640 cmd.exe 916 cmd.exe 4044 cmd.exe 1028 cmd.exe 3524 cmd.exe 5336 cmd.exe 5588 cmd.exe 2016 cmd.exe 3728 cmd.exe 1752 cmd.exe 4596 cmd.exe 4748 cmd.exe 4400 cmd.exe 1660 cmd.exe 3312 cmd.exe 504 cmd.exe 5696 cmd.exe 8 cmd.exe 1108 cmd.exe 4112 cmd.exe 4116 cmd.exe 4872 cmd.exe 2684 cmd.exe 5576 cmd.exe 5692 cmd.exe 5752 cmd.exe 2380 cmd.exe 52 cmd.exe 5036 cmd.exe 2752 cmd.exe 2524 cmd.exe 3492 cmd.exe 4124 cmd.exe 5352 cmd.exe 3744 cmd.exe 2484 cmd.exe 3700 cmd.exe 1104 cmd.exe 5180 cmd.exe 3024 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4248 6016 WerFault.exe 86 2380 1452 WerFault.exe 91 4328 1860 WerFault.exe 97 3604 2868 WerFault.exe 102 2260 3380 WerFault.exe 107 3208 2788 WerFault.exe 112 1140 4012 WerFault.exe 117 4260 1944 WerFault.exe 122 1300 3556 WerFault.exe 127 4656 4360 WerFault.exe 132 4160 4640 WerFault.exe 137 4928 3656 WerFault.exe 142 3696 1424 WerFault.exe 147 5712 4500 WerFault.exe 152 2740 4720 WerFault.exe 157 972 5536 WerFault.exe 162 1840 1020 WerFault.exe 167 1064 3512 WerFault.exe 172 2392 3052 WerFault.exe 177 4016 568 WerFault.exe 182 5632 5604 WerFault.exe 187 3480 908 WerFault.exe 192 5216 3032 WerFault.exe 197 724 4240 WerFault.exe 202 696 5276 WerFault.exe 207 5272 3712 WerFault.exe 212 1648 2732 WerFault.exe 217 2260 3280 WerFault.exe 222 3608 2028 WerFault.exe 227 4136 2916 WerFault.exe 232 1752 1184 WerFault.exe 237 4888 4784 WerFault.exe 242 5864 3364 WerFault.exe 247 3372 5096 WerFault.exe 252 5076 4236 WerFault.exe 257 4288 1204 WerFault.exe 262 3948 3956 WerFault.exe 267 4380 4948 WerFault.exe 273 4176 5112 WerFault.exe 278 2696 3128 WerFault.exe 283 2856 6100 WerFault.exe 288 5576 3408 WerFault.exe 293 2176 1692 WerFault.exe 298 5840 1396 WerFault.exe 303 1624 4364 WerFault.exe 308 5964 2372 WerFault.exe 313 4132 5812 WerFault.exe 318 3440 5104 WerFault.exe 323 800 976 WerFault.exe 328 4664 3344 WerFault.exe 333 4180 6032 WerFault.exe 338 1380 2756 WerFault.exe 343 1536 4856 WerFault.exe 348 5092 5244 WerFault.exe 353 3744 3412 WerFault.exe 358 6044 2784 WerFault.exe 363 2380 5912 WerFault.exe 368 4152 5364 WerFault.exe 373 8 4284 WerFault.exe 378 6072 2024 WerFault.exe 383 3852 236 WerFault.exe 388 2864 1328 WerFault.exe 393 2092 5524 WerFault.exe 398 2392 1380 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KFG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UYHSTFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDZEA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZULK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLCZENO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMCPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UBHJPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PKJEEL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BYPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZAXAZY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INLFOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SELGKYA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEWONZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGCR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SNLQF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIVUQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UXBDWV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKJIXPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQDY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XIIVWN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VTQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DGNQTF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQWCW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MPFCGQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MDYXMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FVHQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QETNOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNZUUUP.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6016 2026-09-16_8888038ff04b32655a59bde8113d9d79_elex_emotet_stop.exe 6016 2026-09-16_8888038ff04b32655a59bde8113d9d79_elex_emotet_stop.exe 1452 QFGDNH.exe 1452 QFGDNH.exe 1860 YSFBH.exe 1860 YSFBH.exe 2868 TQF.exe 2868 TQF.exe 3380 XGLNVV.exe 3380 XGLNVV.exe 2788 BOS.exe 2788 BOS.exe 4012 QETNOB.exe 4012 QETNOB.exe 1944 LRY.exe 1944 LRY.exe 3556 YCOVFM.exe 3556 YCOVFM.exe 4360 CKVV.exe 4360 CKVV.exe 4640 KYNJSJ.exe 4640 KYNJSJ.exe 3656 OGCR.exe 3656 OGCR.exe 1424 HJGNKR.exe 1424 HJGNKR.exe 4500 TRM.exe 4500 TRM.exe 4720 XHTVICE.exe 4720 XHTVICE.exe 5536 DUS.exe 5536 DUS.exe 1020 VXWZT.exe 1020 VXWZT.exe 3512 QLBJDVK.exe 3512 QLBJDVK.exe 3052 UBHJPN.exe 3052 UBHJPN.exe 568 VEL.exe 568 VEL.exe 5604 IGBLJG.exe 5604 IGBLJG.exe 908 ZPDQ.exe 908 ZPDQ.exe 3032 SSHMSB.exe 3032 SSHMSB.exe 4240 SNLQF.exe 4240 SNLQF.exe 5276 IIVUQE.exe 5276 IIVUQE.exe 3712 CDZEA.exe 3712 CDZEA.exe 2732 KTADHZ.exe 2732 KTADHZ.exe 3280 VBHD.exe 3280 VBHD.exe 2028 FKJIXPS.exe 2028 FKJIXPS.exe 2916 DZULK.exe 2916 DZULK.exe 1184 YNZUUUP.exe 1184 YNZUUUP.exe 4784 ZQDY.exe 4784 ZQDY.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 6016 2026-09-16_8888038ff04b32655a59bde8113d9d79_elex_emotet_stop.exe 6016 2026-09-16_8888038ff04b32655a59bde8113d9d79_elex_emotet_stop.exe 1452 QFGDNH.exe 1452 QFGDNH.exe 1860 YSFBH.exe 1860 YSFBH.exe 2868 TQF.exe 2868 TQF.exe 3380 XGLNVV.exe 3380 XGLNVV.exe 2788 BOS.exe 2788 BOS.exe 4012 QETNOB.exe 4012 QETNOB.exe 1944 LRY.exe 1944 LRY.exe 3556 YCOVFM.exe 3556 YCOVFM.exe 4360 CKVV.exe 4360 CKVV.exe 4640 KYNJSJ.exe 4640 KYNJSJ.exe 3656 OGCR.exe 3656 OGCR.exe 1424 HJGNKR.exe 1424 HJGNKR.exe 4500 TRM.exe 4500 TRM.exe 4720 XHTVICE.exe 4720 XHTVICE.exe 5536 DUS.exe 5536 DUS.exe 1020 VXWZT.exe 1020 VXWZT.exe 3512 QLBJDVK.exe 3512 QLBJDVK.exe 3052 UBHJPN.exe 3052 UBHJPN.exe 568 VEL.exe 568 VEL.exe 5604 IGBLJG.exe 5604 IGBLJG.exe 908 ZPDQ.exe 908 ZPDQ.exe 3032 SSHMSB.exe 3032 SSHMSB.exe 4240 SNLQF.exe 4240 SNLQF.exe 5276 IIVUQE.exe 5276 IIVUQE.exe 3712 CDZEA.exe 3712 CDZEA.exe 2732 KTADHZ.exe 2732 KTADHZ.exe 3280 VBHD.exe 3280 VBHD.exe 2028 FKJIXPS.exe 2028 FKJIXPS.exe 2916 DZULK.exe 2916 DZULK.exe 1184 YNZUUUP.exe 1184 YNZUUUP.exe 4784 ZQDY.exe 4784 ZQDY.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6016 wrote to memory of 2520 6016 2026-09-16_8888038ff04b32655a59bde8113d9d79_elex_emotet_stop.exe 87 PID 2520 wrote to memory of 1452 2520 cmd.exe 91 PID 1452 wrote to memory of 916 1452 QFGDNH.exe 93 PID 916 wrote to memory of 1860 916 cmd.exe 97 PID 1860 wrote to memory of 4936 1860 YSFBH.exe 98 PID 4936 wrote to memory of 2868 4936 cmd.exe 102 PID 2868 wrote to memory of 2468 2868 TQF.exe 103 PID 2468 wrote to memory of 3380 2468 cmd.exe 107 PID 3380 wrote to memory of 1432 3380 XGLNVV.exe 108 PID 1432 wrote to memory of 2788 1432 cmd.exe 112 PID 2788 wrote to memory of 3676 2788 BOS.exe 113 PID 3676 wrote to memory of 4012 3676 cmd.exe 117 PID 4012 wrote to memory of 1488 4012 QETNOB.exe 118 PID 1488 wrote to memory of 1944 1488 cmd.exe 122 PID 1944 wrote to memory of 2152 1944 LRY.exe 123 PID 2152 wrote to memory of 3556 2152 cmd.exe 127 PID 3556 wrote to memory of 2968 3556 YCOVFM.exe 128 PID 2968 wrote to memory of 4360 2968 cmd.exe 132 PID 4360 wrote to memory of 5352 4360 CKVV.exe 133 PID 5352 wrote to memory of 4640 5352 cmd.exe 137 PID 4640 wrote to memory of 3024 4640 KYNJSJ.exe 138 PID 3024 wrote to memory of 3656 3024 cmd.exe 142 PID 3656 wrote to memory of 5588 3656 OGCR.exe 143 PID 5588 wrote to memory of 1424 5588 cmd.exe 147 PID 1424 wrote to memory of 2956 1424 HJGNKR.exe 148 PID 2956 wrote to memory of 4500 2956 cmd.exe 152 PID 4500 wrote to memory of 4604 4500 TRM.exe 153 PID 4604 wrote to memory of 4720 4604 cmd.exe 157 PID 4720 wrote to memory of 924 4720 XHTVICE.exe 158 PID 924 wrote to memory of 5536 924 cmd.exe 162 PID 5536 wrote to memory of 4544 5536 DUS.exe 163 PID 4544 wrote to memory of 1020 4544 cmd.exe 167 PID 1020 wrote to memory of 5520 1020 VXWZT.exe 168 PID 5520 wrote to memory of 3512 5520 cmd.exe 172 PID 3512 wrote to memory of 3208 3512 QLBJDVK.exe 173 PID 3208 wrote to memory of 3052 3208 cmd.exe 177 PID 3052 wrote to memory of 5348 3052 UBHJPN.exe 178 PID 5348 wrote to memory of 568 5348 cmd.exe 182 PID 568 wrote to memory of 3980 568 VEL.exe 183 PID 3980 wrote to memory of 5604 3980 cmd.exe 187 PID 5604 wrote to memory of 4044 5604 IGBLJG.exe 188 PID 4044 wrote to memory of 908 4044 cmd.exe 192 PID 908 wrote to memory of 2764 908 ZPDQ.exe 193 PID 2764 wrote to memory of 3032 2764 cmd.exe 197 PID 3032 wrote to memory of 1796 3032 SSHMSB.exe 198 PID 1796 wrote to memory of 4240 1796 cmd.exe 202 PID 4240 wrote to memory of 5460 4240 SNLQF.exe 203 PID 5460 wrote to memory of 5276 5460 cmd.exe 207 PID 5276 wrote to memory of 5360 5276 IIVUQE.exe 208 PID 5360 wrote to memory of 3712 5360 cmd.exe 212 PID 3712 wrote to memory of 3320 3712 CDZEA.exe 213 PID 3320 wrote to memory of 2732 3320 cmd.exe 217 PID 2732 wrote to memory of 2076 2732 KTADHZ.exe 218 PID 2076 wrote to memory of 3280 2076 cmd.exe 222 PID 3280 wrote to memory of 4036 3280 VBHD.exe 223 PID 4036 wrote to memory of 2028 4036 cmd.exe 227 PID 2028 wrote to memory of 5768 2028 FKJIXPS.exe 228 PID 5768 wrote to memory of 2916 5768 cmd.exe 232 PID 2916 wrote to memory of 3304 2916 DZULK.exe 233 PID 3304 wrote to memory of 1184 3304 cmd.exe 237 PID 1184 wrote to memory of 5760 1184 YNZUUUP.exe 238 PID 5760 wrote to memory of 4784 5760 cmd.exe 242 PID 4784 wrote to memory of 4276 4784 ZQDY.exe 243 PID 4276 wrote to memory of 3364 4276 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_8888038ff04b32655a59bde8113d9d79_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_8888038ff04b32655a59bde8113d9d79_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QFGDNH.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\windows\SysWOW64\QFGDNH.exeC:\windows\system32\QFGDNH.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSFBH.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:916 -
C:\windows\system\YSFBH.exeC:\windows\system\YSFBH.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TQF.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\windows\TQF.exeC:\windows\TQF.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XGLNVV.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\windows\XGLNVV.exeC:\windows\XGLNVV.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BOS.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\windows\system\BOS.exeC:\windows\system\BOS.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QETNOB.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\windows\QETNOB.exeC:\windows\QETNOB.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LRY.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\windows\system\LRY.exeC:\windows\system\LRY.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCOVFM.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\windows\YCOVFM.exeC:\windows\YCOVFM.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKVV.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\windows\CKVV.exeC:\windows\CKVV.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYNJSJ.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\windows\SysWOW64\KYNJSJ.exeC:\windows\system32\KYNJSJ.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OGCR.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\windows\SysWOW64\OGCR.exeC:\windows\system32\OGCR.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HJGNKR.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\windows\HJGNKR.exeC:\windows\HJGNKR.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRM.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\windows\system\TRM.exeC:\windows\system\TRM.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHTVICE.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\windows\XHTVICE.exeC:\windows\XHTVICE.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DUS.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:924 -
C:\windows\system\DUS.exeC:\windows\system\DUS.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VXWZT.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\windows\system\VXWZT.exeC:\windows\system\VXWZT.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QLBJDVK.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\windows\system\QLBJDVK.exeC:\windows\system\QLBJDVK.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBHJPN.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\windows\system\UBHJPN.exeC:\windows\system\UBHJPN.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEL.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\windows\VEL.exeC:\windows\VEL.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IGBLJG.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\windows\SysWOW64\IGBLJG.exeC:\windows\system32\IGBLJG.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZPDQ.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\windows\SysWOW64\ZPDQ.exeC:\windows\system32\ZPDQ.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSHMSB.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\windows\SysWOW64\SSHMSB.exeC:\windows\system32\SSHMSB.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SNLQF.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\windows\SysWOW64\SNLQF.exeC:\windows\system32\SNLQF.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IIVUQE.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\windows\SysWOW64\IIVUQE.exeC:\windows\system32\IIVUQE.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDZEA.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\windows\system\CDZEA.exeC:\windows\system\CDZEA.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KTADHZ.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\windows\SysWOW64\KTADHZ.exeC:\windows\system32\KTADHZ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VBHD.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\windows\VBHD.exeC:\windows\VBHD.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FKJIXPS.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\windows\FKJIXPS.exeC:\windows\FKJIXPS.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DZULK.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\windows\SysWOW64\DZULK.exeC:\windows\system32\DZULK.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNZUUUP.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\windows\SysWOW64\YNZUUUP.exeC:\windows\system32\YNZUUUP.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQDY.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\windows\ZQDY.exeC:\windows\ZQDY.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XLCZENO.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\windows\system\XLCZENO.exeC:\windows\system\XLCZENO.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CLKNNPP.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4116 -
C:\windows\SysWOW64\CLKNNPP.exeC:\windows\system32\CLKNNPP.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DGNQTF.exe.bat" "68⤵PID:3936
-
C:\windows\DGNQTF.exeC:\windows\DGNQTF.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXQLSN.exe.bat" "70⤵PID:4648
-
C:\windows\MXQLSN.exeC:\windows\MXQLSN.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSPU.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:724 -
C:\windows\SSPU.exeC:\windows\SSPU.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UQVGEYM.exe.bat" "74⤵PID:776
-
C:\windows\UQVGEYM.exeC:\windows\UQVGEYM.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ODA.exe.bat" "76⤵PID:2664
-
C:\windows\SysWOW64\ODA.exeC:\windows\system32\ODA.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YBO.exe.bat" "78⤵PID:1132
-
C:\windows\SysWOW64\YBO.exeC:\windows\system32\YBO.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEWIKJ.exe.bat" "80⤵PID:4020
-
C:\windows\system\MEWIKJ.exeC:\windows\system\MEWIKJ.exe81⤵
- Executes dropped EXE
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WBCDZ.exe.bat" "82⤵PID:3584
-
C:\windows\system\WBCDZ.exeC:\windows\system\WBCDZ.exe83⤵
- Executes dropped EXE
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UXBDWV.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4872 -
C:\windows\UXBDWV.exeC:\windows\UXBDWV.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AXIR.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:3252 -
C:\windows\AXIR.exeC:\windows\AXIR.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AAMVSNG.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2016 -
C:\windows\system\AAMVSNG.exeC:\windows\system\AAMVSNG.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNRE.exe.bat" "90⤵PID:2736
-
C:\windows\SysWOW64\VNRE.exeC:\windows\system32\VNRE.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYHVRXQ.exe.bat" "92⤵
- Executes a command shell one-liner
PID:5792 -
C:\windows\IYHVRXQ.exeC:\windows\IYHVRXQ.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZZB.exe.bat" "94⤵PID:4288
-
C:\windows\SysWOW64\ZZB.exeC:\windows\system32\ZZB.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SCNEALU.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:2824 -
C:\windows\SCNEALU.exeC:\windows\SCNEALU.exe97⤵
- Executes dropped EXE
PID:976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NPKN.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:3604 -
C:\windows\system\NPKN.exeC:\windows\system\NPKN.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAAMYVE.exe.bat" "100⤵PID:3988
-
C:\windows\SysWOW64\IAAMYVE.exeC:\windows\system32\IAAMYVE.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNFV.exe.bat" "102⤵
- Executes a command shell one-liner
PID:2684 -
C:\windows\CNFV.exeC:\windows\CNFV.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DTXKK.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:2856 -
C:\windows\system\DTXKK.exeC:\windows\system\DTXKK.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ITFXTCX.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5576 -
C:\windows\system\ITFXTCX.exeC:\windows\system\ITFXTCX.exe107⤵
- Executes dropped EXE
PID:5244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MJUX.exe.bat" "108⤵PID:716
-
C:\windows\MJUX.exeC:\windows\MJUX.exe109⤵
- Executes dropped EXE
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SELGKYA.exe.bat" "110⤵
- Executes a command shell one-liner
PID:1628 -
C:\windows\system\SELGKYA.exeC:\windows\system\SELGKYA.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GHBXQ.exe.bat" "112⤵PID:5676
-
C:\windows\system\GHBXQ.exeC:\windows\system\GHBXQ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AUGOAAK.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:3392 -
C:\windows\AUGOAAK.exeC:\windows\AUGOAAK.exe115⤵
- Executes dropped EXE
PID:5364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LNB.exe.bat" "116⤵PID:3212
-
C:\windows\system\LNB.exeC:\windows\system\LNB.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDQHV.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5844 -
C:\windows\SysWOW64\PDQHV.exeC:\windows\system32\PDQHV.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XIIVWN.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5920 -
C:\windows\SysWOW64\XIIVWN.exeC:\windows\system32\XIIVWN.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-