Analysis
- max time kernel
96s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 11:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-23_2c38e6f61541edd1659da07c33beff24_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-23_2c38e6f61541edd1659da07c33beff24_elex_emotet_stop.exe
- Size 208KB
- Sample260924-nylvwada68
- SHA256 a490d33fc2183f8d3c78d3b1b60d44c29933d516c7534155d2ba91b876a5a2ab
- MD5 2c38e6f61541edd1659da07c33beff24
- SHA1 da1fa7c18022ccfa5bbca74c4cc0397f1a3f43de
- SHA512 a0f7029638b2b3e0aa18488f5f404c1edec90a658f45f1c24d7f7eca045b39bab540644a93ef22ea29d053b6d4adda693c4c1ca49686561b8b1626e07cbd03a4
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFleKL+LOf74pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFleS+LOTkEj1
- TLSH T114247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1872 XIBRE.exe 404 ARW.exe 5696 IRESCLQ.exe 2200 UHTSO.exe 988 MKXV.exe 1464 CFGAEO.exe 2296 WSL.exe 616 RGQTZ.exe 3000 IOSGCL.exe 904 OOAT.exe 5252 VEBLS.exe 824 YSFUCAH.exe 5472 HSHHG.exe 1188 NSHVP.exe 5760 IOMEZAZ.exe 3804 ROOKC.exe 2980 GJX.exe 4260 BECXY.exe 4892 CZOBLIA.exe 5816 WVLK.exe 4740 RIPUYI.exe 476 VQE.exe 5852 MYYHNF.exe 4092 UELOYE.exe 3896 JJQLFO.exe 1080 LXVUPNO.exe 1772 GKAD.exe 4232 UPYBHP.exe 4628 KGZSNKT.exe 2580 BTJKD.exe 4876 GWNQ.exe 4584 OJGFKLF.exe 2100 SRUF.exe 4272 OXSC.exe 4372 JKXLNF.exe 5648 SSZR.exe 6056 YTGE.exe 5544 ITIJLKX.exe 2060 KGNT.exe 5780 RJXFGXM.exe 2360 JKZ.exe 2156 PKGYTX.exe 3704 JXL.exe 964 GDREKGG.exe 2652 IBK.exe 1420 GBSUA.exe 5884 MORVEA.exe 5508 DCBN.exe 2948 RHZ.exe 4932 QSY.exe 2420 ZFISQY.exe 3752 FTHTVBC.exe 3556 UWRFG.exe 4556 WLKZMC.exe 3432 CWOGS.exe 5836 WKTPCU.exe 3364 NXDH.exe 5412 ZPYAS.exe 3240 VVEPZ.exe 5092 STKMGRJ.exe 6000 MQDOM.exe 5028 XJGHVVH.exe 2204 TOM.exe 4872 BZM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\ZJYTQKM.exe OQVAID.exe File opened for modification C:\windows\SysWOW64\VVEPZ.exe ZPYAS.exe File opened for modification C:\windows\SysWOW64\STKMGRJ.exe VVEPZ.exe File created C:\windows\SysWOW64\AHLOG.exe GUGE.exe File created C:\windows\SysWOW64\UELOYE.exe MYYHNF.exe File created C:\windows\SysWOW64\YMJBOG.exe SMBN.exe File opened for modification C:\windows\SysWOW64\WSL.exe CFGAEO.exe File created C:\windows\SysWOW64\VEBLS.exe OOAT.exe File created C:\windows\SysWOW64\QIWRCJT.exe.bat WURHA.exe File created C:\windows\SysWOW64\MORVEA.exe GBSUA.exe File opened for modification C:\windows\SysWOW64\MAOGO.exe AHLOG.exe File created C:\windows\SysWOW64\ZSYUI.exe VCS.exe File opened for modification C:\windows\SysWOW64\ZKEURKE.exe FXHKGK.exe File created C:\windows\SysWOW64\HSHHG.exe YSFUCAH.exe File opened for modification C:\windows\SysWOW64\YTGE.exe SSZR.exe File created C:\windows\SysWOW64\ZJYTQKM.exe.bat OQVAID.exe File created C:\windows\SysWOW64\VVEPZ.exe.bat ZPYAS.exe File created C:\windows\SysWOW64\MQDOM.exe.bat STKMGRJ.exe File opened for modification C:\windows\SysWOW64\BZM.exe TOM.exe File created C:\windows\SysWOW64\WURHA.exe BZM.exe File opened for modification C:\windows\SysWOW64\WDEGRIH.exe ZYZJKY.exe File created C:\windows\SysWOW64\LEOZLH.exe.bat VOF.exe File created C:\windows\SysWOW64\IXP.exe.bat ZKEURKE.exe File opened for modification C:\windows\SysWOW64\VEBLS.exe OOAT.exe File created C:\windows\SysWOW64\HTZ.exe.bat HNZYIDM.exe File opened for modification C:\windows\SysWOW64\HVLGZDT.exe YMJBOG.exe File created C:\windows\SysWOW64\STKMGRJ.exe.bat VVEPZ.exe File created C:\windows\SysWOW64\KGZSNKT.exe.bat UPYBHP.exe File created C:\windows\SysWOW64\SRUF.exe OJGFKLF.exe File created C:\windows\SysWOW64\WSL.exe CFGAEO.exe File created C:\windows\SysWOW64\VVEPZ.exe ZPYAS.exe File created C:\windows\SysWOW64\BZM.exe.bat TOM.exe File created C:\windows\SysWOW64\WURHA.exe.bat BZM.exe File created C:\windows\SysWOW64\GDREKGG.exe.bat JXL.exe File opened for modification C:\windows\SysWOW64\MQDOM.exe STKMGRJ.exe File opened for modification C:\windows\SysWOW64\YMJBOG.exe SMBN.exe File created C:\windows\SysWOW64\HVLGZDT.exe YMJBOG.exe File created C:\windows\SysWOW64\RIPUYI.exe WVLK.exe File opened for modification C:\windows\SysWOW64\JKZ.exe RJXFGXM.exe File created C:\windows\SysWOW64\BZM.exe TOM.exe File created C:\windows\SysWOW64\JJQLFO.exe UELOYE.exe File created C:\windows\SysWOW64\CWOGS.exe WLKZMC.exe File created C:\windows\SysWOW64\JKZ.exe.bat RJXFGXM.exe File created C:\windows\SysWOW64\MAOGO.exe.bat AHLOG.exe File created C:\windows\SysWOW64\SMBN.exe.bat QOI.exe File created C:\windows\SysWOW64\YMJBOG.exe.bat SMBN.exe File created C:\windows\SysWOW64\BECXY.exe GJX.exe File opened for modification C:\windows\SysWOW64\SQY.exe SFX.exe File opened for modification C:\windows\SysWOW64\AHLOG.exe GUGE.exe File created C:\windows\SysWOW64\HTZ.exe HNZYIDM.exe File created C:\windows\SysWOW64\RIPUYI.exe.bat WVLK.exe File created C:\windows\SysWOW64\QIWRCJT.exe WURHA.exe File opened for modification C:\windows\SysWOW64\ZSYUI.exe VCS.exe File created C:\windows\SysWOW64\VOF.exe WDEGRIH.exe File created C:\windows\SysWOW64\IWN.exe.bat HTKG.exe File created C:\windows\SysWOW64\YTGE.exe.bat SSZR.exe File opened for modification C:\windows\SysWOW64\GDREKGG.exe JXL.exe File opened for modification C:\windows\SysWOW64\QUOR.exe ICO.exe File created C:\windows\SysWOW64\MQDOM.exe STKMGRJ.exe File opened for modification C:\windows\SysWOW64\KGZSNKT.exe UPYBHP.exe File created C:\windows\SysWOW64\KGZSNKT.exe UPYBHP.exe File opened for modification C:\windows\SysWOW64\CWOGS.exe WLKZMC.exe File created C:\windows\SysWOW64\CWOGS.exe.bat WLKZMC.exe File opened for modification C:\windows\SysWOW64\UELOYE.exe MYYHNF.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\SSZR.exe JKXLNF.exe File created C:\windows\system\GUGE.exe.bat VBLLOBW.exe File created C:\windows\system\ARW.exe.bat XIBRE.exe File created C:\windows\OJGFKLF.exe.bat GWNQ.exe File opened for modification C:\windows\ITIJLKX.exe YTGE.exe File created C:\windows\NIEHWV.exe KUZX.exe File created C:\windows\system\ARW.exe XIBRE.exe File created C:\windows\VBLLOBW.exe VRDSI.exe File created C:\windows\IFUDVZ.exe MAOGO.exe File created C:\windows\QGKE.exe HTZ.exe File created C:\windows\IOSGCL.exe.bat RGQTZ.exe File created C:\windows\system\GKAD.exe.bat LXVUPNO.exe File opened for modification C:\windows\system\IBK.exe GDREKGG.exe File opened for modification C:\windows\system\JJY.exe IFUDVZ.exe File created C:\windows\system\LHS.exe LEOZLH.exe File created C:\windows\ANQRY.exe.bat LHS.exe File opened for modification C:\windows\ZFISQY.exe QSY.exe File opened for modification C:\windows\CFGAEO.exe MKXV.exe File opened for modification C:\windows\system\BTJKD.exe KGZSNKT.exe File created C:\windows\JKXLNF.exe OXSC.exe File opened for modification C:\windows\DCBN.exe MORVEA.exe File created C:\windows\YEHMMK.exe.bat JJY.exe File opened for modification C:\windows\system\VPFP.exe JWKWURJ.exe File created C:\windows\system\RGQTZ.exe.bat WSL.exe File opened for modification C:\windows\OJGFKLF.exe GWNQ.exe File opened for modification C:\windows\system\OXSC.exe SRUF.exe File opened for modification C:\windows\system\GUGE.exe VBLLOBW.exe File created C:\windows\FXHKGK.exe.bat TEER.exe File opened for modification C:\windows\OOAT.exe IOSGCL.exe File created C:\windows\VQE.exe RIPUYI.exe File created C:\windows\FTHTVBC.exe ZFISQY.exe File created C:\windows\WLKZMC.exe UWRFG.exe File created C:\windows\system\ICO.exe IWN.exe File opened for modification C:\windows\system\OQVAID.exe NDDMH.exe File created C:\windows\CWC.exe.bat IIYDSF.exe File opened for modification C:\windows\XGI.exe AACP.exe File created C:\windows\RHZ.exe DCBN.exe File created C:\windows\system\UPYBHP.exe GKAD.exe File opened for modification C:\windows\NXDH.exe WKTPCU.exe File created C:\windows\IRESCLQ.exe.bat ARW.exe File created C:\windows\system\IOMEZAZ.exe NSHVP.exe File opened for modification C:\windows\system\IOMEZAZ.exe NSHVP.exe File opened for modification C:\windows\GWNQ.exe BTJKD.exe File created C:\windows\SSZR.exe.bat JKXLNF.exe File created C:\windows\system\GBSUA.exe IBK.exe File created C:\windows\system\HTKG.exe.bat KTCSMSB.exe File created C:\windows\UHTSO.exe.bat IRESCLQ.exe File opened for modification C:\windows\PKGYTX.exe JKZ.exe File opened for modification C:\windows\IRESCLQ.exe ARW.exe File created C:\windows\NSHVP.exe.bat HSHHG.exe File created C:\windows\GJX.exe ROOKC.exe File created C:\windows\VQE.exe.bat RIPUYI.exe File created C:\windows\MYYHNF.exe VQE.exe File created C:\windows\PKGYTX.exe.bat JKZ.exe File created C:\windows\QSY.exe.bat RHZ.exe File created C:\windows\IFUDVZ.exe.bat MAOGO.exe File created C:\windows\ITIJLKX.exe.bat YTGE.exe File created C:\windows\ZFISQY.exe.bat QSY.exe File created C:\windows\system\VPFP.exe JWKWURJ.exe File created C:\windows\system\LHS.exe.bat LEOZLH.exe File created C:\windows\KTCSMSB.exe NVWVFIZ.exe File opened for modification C:\windows\KTCSMSB.exe NVWVFIZ.exe File created C:\windows\system\XLIA.exe XGI.exe File created C:\windows\system\EKSP.exe.bat PEM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5628 cmd.exe 2096 cmd.exe 5176 cmd.exe 3112 cmd.exe 364 cmd.exe 4444 cmd.exe 5416 cmd.exe 3908 cmd.exe 1616 cmd.exe 1020 cmd.exe 4236 cmd.exe 5688 cmd.exe 628 cmd.exe 2068 cmd.exe 1804 cmd.exe 1220 cmd.exe 2824 cmd.exe 1100 cmd.exe 3244 cmd.exe 688 cmd.exe 2768 cmd.exe 1500 cmd.exe 3548 cmd.exe 4696 cmd.exe 3380 cmd.exe 5484 cmd.exe 4564 cmd.exe 4680 cmd.exe 3044 cmd.exe 4356 cmd.exe 3264 cmd.exe 3504 cmd.exe 4440 cmd.exe 2032 cmd.exe 3084 cmd.exe 3436 cmd.exe 3860 cmd.exe 5124 cmd.exe 5260 cmd.exe 3132 cmd.exe 6072 cmd.exe 956 cmd.exe 1164 cmd.exe 5220 cmd.exe 6008 cmd.exe 2548 cmd.exe 4652 cmd.exe 2928 cmd.exe 3480 cmd.exe 6124 cmd.exe 5468 cmd.exe 1468 cmd.exe 4992 cmd.exe 4864 cmd.exe 5612 cmd.exe 2596 cmd.exe 1620 cmd.exe 5908 cmd.exe 4708 cmd.exe 4968 cmd.exe 3348 cmd.exe 2848 cmd.exe 6104 cmd.exe 6096 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1300 4512 WerFault.exe 89 5572 1872 WerFault.exe 94 2624 404 WerFault.exe 100 5768 5696 WerFault.exe 105 2352 2200 WerFault.exe 110 1704 988 WerFault.exe 115 3268 1464 WerFault.exe 120 5024 2296 WerFault.exe 125 5480 616 WerFault.exe 130 5752 3000 WerFault.exe 135 5556 904 WerFault.exe 140 5340 5252 WerFault.exe 145 5636 824 WerFault.exe 150 3992 5472 WerFault.exe 155 2532 1188 WerFault.exe 160 1600 5760 WerFault.exe 165 4420 3804 WerFault.exe 170 2012 2980 WerFault.exe 175 2096 4260 WerFault.exe 180 4568 4892 WerFault.exe 185 4932 5816 WerFault.exe 190 2156 4740 WerFault.exe 195 5312 476 WerFault.exe 200 252 5852 WerFault.exe 205 4144 4092 WerFault.exe 210 1612 3896 WerFault.exe 215 1600 1080 WerFault.exe 220 5848 1772 WerFault.exe 225 4180 4232 WerFault.exe 230 2688 4628 WerFault.exe 235 2852 2580 WerFault.exe 240 5552 4876 WerFault.exe 245 1656 4584 WerFault.exe 250 5572 2100 WerFault.exe 255 2204 4272 WerFault.exe 260 1404 4372 WerFault.exe 265 4976 5648 WerFault.exe 270 4580 6056 WerFault.exe 275 960 5544 WerFault.exe 280 2900 2060 WerFault.exe 286 3536 5780 WerFault.exe 291 5564 2360 WerFault.exe 296 5992 2156 WerFault.exe 301 2376 3704 WerFault.exe 306 3112 964 WerFault.exe 310 3032 2652 WerFault.exe 316 3132 1420 WerFault.exe 321 4500 5884 WerFault.exe 326 4964 5508 WerFault.exe 331 3360 2948 WerFault.exe 336 4440 4932 WerFault.exe 341 4664 2420 WerFault.exe 346 2644 3752 WerFault.exe 351 4392 3556 WerFault.exe 356 4872 4556 WerFault.exe 361 2056 3432 WerFault.exe 366 3272 5836 WerFault.exe 371 4708 3364 WerFault.exe 376 4388 5412 WerFault.exe 381 3816 3240 WerFault.exe 386 600 5092 WerFault.exe 391 2764 6000 WerFault.exe 396 2620 5028 WerFault.exe 401 1404 2204 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QIWRCJT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUOR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKSP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NIEHWV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WKTPCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRDSI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKXLNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XJGHVVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTHTVBC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IRESCLQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IFUDVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MYYHNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIPUYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBLLOBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEHCG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OXSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMBN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVLGZDT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LEOZLH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AACP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBSUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPYAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVWVFIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HTKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PBJWML.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XIBRE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IOSGCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGNT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSHVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WURHA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BECXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKJIXPS.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4512 2026-09-23_2c38e6f61541edd1659da07c33beff24_elex_emotet_stop.exe 4512 2026-09-23_2c38e6f61541edd1659da07c33beff24_elex_emotet_stop.exe 1872 XIBRE.exe 1872 XIBRE.exe 404 ARW.exe 404 ARW.exe 5696 IRESCLQ.exe 5696 IRESCLQ.exe 2200 UHTSO.exe 2200 UHTSO.exe 988 MKXV.exe 988 MKXV.exe 1464 CFGAEO.exe 1464 CFGAEO.exe 2296 WSL.exe 2296 WSL.exe 616 RGQTZ.exe 616 RGQTZ.exe 3000 IOSGCL.exe 3000 IOSGCL.exe 904 OOAT.exe 904 OOAT.exe 5252 VEBLS.exe 5252 VEBLS.exe 824 YSFUCAH.exe 824 YSFUCAH.exe 5472 HSHHG.exe 5472 HSHHG.exe 1188 NSHVP.exe 1188 NSHVP.exe 5760 IOMEZAZ.exe 5760 IOMEZAZ.exe 3804 ROOKC.exe 3804 ROOKC.exe 2980 GJX.exe 2980 GJX.exe 4260 BECXY.exe 4260 BECXY.exe 4892 CZOBLIA.exe 4892 CZOBLIA.exe 5816 WVLK.exe 5816 WVLK.exe 4740 RIPUYI.exe 4740 RIPUYI.exe 476 VQE.exe 476 VQE.exe 5852 MYYHNF.exe 5852 MYYHNF.exe 4092 UELOYE.exe 4092 UELOYE.exe 3896 JJQLFO.exe 3896 JJQLFO.exe 1080 LXVUPNO.exe 1080 LXVUPNO.exe 1772 GKAD.exe 1772 GKAD.exe 4232 UPYBHP.exe 4232 UPYBHP.exe 4628 KGZSNKT.exe 4628 KGZSNKT.exe 2580 BTJKD.exe 2580 BTJKD.exe 4876 GWNQ.exe 4876 GWNQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4512 2026-09-23_2c38e6f61541edd1659da07c33beff24_elex_emotet_stop.exe 4512 2026-09-23_2c38e6f61541edd1659da07c33beff24_elex_emotet_stop.exe 1872 XIBRE.exe 1872 XIBRE.exe 404 ARW.exe 404 ARW.exe 5696 IRESCLQ.exe 5696 IRESCLQ.exe 2200 UHTSO.exe 2200 UHTSO.exe 988 MKXV.exe 988 MKXV.exe 1464 CFGAEO.exe 1464 CFGAEO.exe 2296 WSL.exe 2296 WSL.exe 616 RGQTZ.exe 616 RGQTZ.exe 3000 IOSGCL.exe 3000 IOSGCL.exe 904 OOAT.exe 904 OOAT.exe 5252 VEBLS.exe 5252 VEBLS.exe 824 YSFUCAH.exe 824 YSFUCAH.exe 5472 HSHHG.exe 5472 HSHHG.exe 1188 NSHVP.exe 1188 NSHVP.exe 5760 IOMEZAZ.exe 5760 IOMEZAZ.exe 3804 ROOKC.exe 3804 ROOKC.exe 2980 GJX.exe 2980 GJX.exe 4260 BECXY.exe 4260 BECXY.exe 4892 CZOBLIA.exe 4892 CZOBLIA.exe 5816 WVLK.exe 5816 WVLK.exe 4740 RIPUYI.exe 4740 RIPUYI.exe 476 VQE.exe 476 VQE.exe 5852 MYYHNF.exe 5852 MYYHNF.exe 4092 UELOYE.exe 4092 UELOYE.exe 3896 JJQLFO.exe 3896 JJQLFO.exe 1080 LXVUPNO.exe 1080 LXVUPNO.exe 1772 GKAD.exe 1772 GKAD.exe 4232 UPYBHP.exe 4232 UPYBHP.exe 4628 KGZSNKT.exe 4628 KGZSNKT.exe 2580 BTJKD.exe 2580 BTJKD.exe 4876 GWNQ.exe 4876 GWNQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4512 wrote to memory of 4112 4512 2026-09-23_2c38e6f61541edd1659da07c33beff24_elex_emotet_stop.exe 90 PID 4112 wrote to memory of 1872 4112 cmd.exe 94 PID 1872 wrote to memory of 5428 1872 XIBRE.exe 96 PID 5428 wrote to memory of 404 5428 cmd.exe 100 PID 404 wrote to memory of 1228 404 ARW.exe 101 PID 1228 wrote to memory of 5696 1228 cmd.exe 105 PID 5696 wrote to memory of 2384 5696 IRESCLQ.exe 106 PID 2384 wrote to memory of 2200 2384 cmd.exe 110 PID 2200 wrote to memory of 1632 2200 UHTSO.exe 111 PID 1632 wrote to memory of 988 1632 cmd.exe 115 PID 988 wrote to memory of 1860 988 MKXV.exe 116 PID 1860 wrote to memory of 1464 1860 cmd.exe 120 PID 1464 wrote to memory of 4652 1464 CFGAEO.exe 121 PID 4652 wrote to memory of 2296 4652 cmd.exe 125 PID 2296 wrote to memory of 3728 2296 WSL.exe 126 PID 3728 wrote to memory of 616 3728 cmd.exe 130 PID 616 wrote to memory of 956 616 RGQTZ.exe 131 PID 956 wrote to memory of 3000 956 cmd.exe 135 PID 3000 wrote to memory of 4724 3000 IOSGCL.exe 136 PID 4724 wrote to memory of 904 4724 cmd.exe 140 PID 904 wrote to memory of 5596 904 OOAT.exe 141 PID 5596 wrote to memory of 5252 5596 cmd.exe 145 PID 5252 wrote to memory of 2928 5252 VEBLS.exe 146 PID 2928 wrote to memory of 824 2928 cmd.exe 150 PID 824 wrote to memory of 5304 824 YSFUCAH.exe 151 PID 5304 wrote to memory of 5472 5304 cmd.exe 155 PID 5472 wrote to memory of 2364 5472 HSHHG.exe 156 PID 2364 wrote to memory of 1188 2364 cmd.exe 160 PID 1188 wrote to memory of 5376 1188 NSHVP.exe 161 PID 5376 wrote to memory of 5760 5376 cmd.exe 165 PID 5760 wrote to memory of 2636 5760 IOMEZAZ.exe 166 PID 2636 wrote to memory of 3804 2636 cmd.exe 170 PID 3804 wrote to memory of 1524 3804 ROOKC.exe 171 PID 1524 wrote to memory of 2980 1524 cmd.exe 175 PID 2980 wrote to memory of 1100 2980 GJX.exe 176 PID 1100 wrote to memory of 4260 1100 cmd.exe 180 PID 4260 wrote to memory of 1964 4260 BECXY.exe 181 PID 1964 wrote to memory of 4892 1964 cmd.exe 185 PID 4892 wrote to memory of 3244 4892 CZOBLIA.exe 186 PID 3244 wrote to memory of 5816 3244 cmd.exe 190 PID 5816 wrote to memory of 2672 5816 WVLK.exe 191 PID 2672 wrote to memory of 4740 2672 cmd.exe 195 PID 4740 wrote to memory of 2412 4740 RIPUYI.exe 196 PID 476 wrote to memory of 3044 476 VQE.exe 201 PID 3044 wrote to memory of 5852 3044 cmd.exe 205 PID 5852 wrote to memory of 1020 5852 MYYHNF.exe 206 PID 1020 wrote to memory of 4092 1020 cmd.exe 210 PID 4092 wrote to memory of 5484 4092 UELOYE.exe 211 PID 5484 wrote to memory of 3896 5484 cmd.exe 215 PID 3896 wrote to memory of 1916 3896 JJQLFO.exe 216 PID 1916 wrote to memory of 1080 1916 cmd.exe 220 PID 1080 wrote to memory of 5344 1080 LXVUPNO.exe 221 PID 5344 wrote to memory of 1772 5344 cmd.exe 225 PID 1772 wrote to memory of 4356 1772 GKAD.exe 226 PID 4356 wrote to memory of 4232 4356 cmd.exe 230 PID 4232 wrote to memory of 5632 4232 UPYBHP.exe 231 PID 5632 wrote to memory of 4628 5632 cmd.exe 235 PID 4628 wrote to memory of 620 4628 KGZSNKT.exe 236 PID 620 wrote to memory of 2580 620 cmd.exe 240 PID 2580 wrote to memory of 1332 2580 BTJKD.exe 241 PID 1332 wrote to memory of 4876 1332 cmd.exe 245 PID 4876 wrote to memory of 4116 4876 GWNQ.exe 246 PID 4116 wrote to memory of 4584 4116 cmd.exe 250 PID 4584 wrote to memory of 1060 4584 OJGFKLF.exe 251
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_2c38e6f61541edd1659da07c33beff24_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_2c38e6f61541edd1659da07c33beff24_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XIBRE.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\windows\system\XIBRE.exeC:\windows\system\XIBRE.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ARW.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\windows\system\ARW.exeC:\windows\system\ARW.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IRESCLQ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\windows\IRESCLQ.exeC:\windows\IRESCLQ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UHTSO.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\windows\UHTSO.exeC:\windows\UHTSO.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKXV.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\windows\system\MKXV.exeC:\windows\system\MKXV.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CFGAEO.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\windows\CFGAEO.exeC:\windows\CFGAEO.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSL.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\windows\SysWOW64\WSL.exeC:\windows\system32\WSL.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGQTZ.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\windows\system\RGQTZ.exeC:\windows\system\RGQTZ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOSGCL.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:956 -
C:\windows\IOSGCL.exeC:\windows\IOSGCL.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OOAT.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\windows\OOAT.exeC:\windows\OOAT.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEBLS.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\windows\SysWOW64\VEBLS.exeC:\windows\system32\VEBLS.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YSFUCAH.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\windows\YSFUCAH.exeC:\windows\YSFUCAH.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HSHHG.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\windows\SysWOW64\HSHHG.exeC:\windows\system32\HSHHG.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NSHVP.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\windows\NSHVP.exeC:\windows\NSHVP.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOMEZAZ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\windows\system\IOMEZAZ.exeC:\windows\system\IOMEZAZ.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ROOKC.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\windows\ROOKC.exeC:\windows\ROOKC.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJX.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\windows\GJX.exeC:\windows\GJX.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BECXY.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\windows\SysWOW64\BECXY.exeC:\windows\system32\BECXY.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZOBLIA.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\windows\system\CZOBLIA.exeC:\windows\system\CZOBLIA.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WVLK.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\windows\system\WVLK.exeC:\windows\system\WVLK.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIPUYI.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\windows\SysWOW64\RIPUYI.exeC:\windows\system32\RIPUYI.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQE.exe.bat" "44⤵PID:2412
-
C:\windows\VQE.exeC:\windows\VQE.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYYHNF.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\windows\MYYHNF.exeC:\windows\MYYHNF.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UELOYE.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\windows\SysWOW64\UELOYE.exeC:\windows\system32\UELOYE.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JJQLFO.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\windows\SysWOW64\JJQLFO.exeC:\windows\system32\JJQLFO.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LXVUPNO.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\windows\SysWOW64\LXVUPNO.exeC:\windows\system32\LXVUPNO.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKAD.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\windows\system\GKAD.exeC:\windows\system\GKAD.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UPYBHP.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\windows\system\UPYBHP.exeC:\windows\system\UPYBHP.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGZSNKT.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\windows\SysWOW64\KGZSNKT.exeC:\windows\system32\KGZSNKT.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTJKD.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:620 -
C:\windows\system\BTJKD.exeC:\windows\system\BTJKD.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWNQ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\windows\GWNQ.exeC:\windows\GWNQ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJGFKLF.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\windows\OJGFKLF.exeC:\windows\OJGFKLF.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRUF.exe.bat" "66⤵PID:1060
-
C:\windows\SysWOW64\SRUF.exeC:\windows\system32\SRUF.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXSC.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3480 -
C:\windows\system\OXSC.exeC:\windows\system\OXSC.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JKXLNF.exe.bat" "70⤵PID:3880
-
C:\windows\JKXLNF.exeC:\windows\JKXLNF.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSZR.exe.bat" "72⤵PID:4772
-
C:\windows\SSZR.exeC:\windows\SSZR.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YTGE.exe.bat" "74⤵
- Executes a command shell one-liner
PID:1164 -
C:\windows\SysWOW64\YTGE.exeC:\windows\system32\YTGE.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ITIJLKX.exe.bat" "76⤵PID:1956
-
C:\windows\ITIJLKX.exeC:\windows\ITIJLKX.exe77⤵
- Executes dropped EXE
PID:5544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGNT.exe.bat" "78⤵PID:3052
-
C:\windows\SysWOW64\KGNT.exeC:\windows\system32\KGNT.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJXFGXM.exe.bat" "80⤵PID:5336
-
C:\windows\RJXFGXM.exeC:\windows\RJXFGXM.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JKZ.exe.bat" "82⤵
- Executes a command shell one-liner
PID:3860 -
C:\windows\SysWOW64\JKZ.exeC:\windows\system32\JKZ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PKGYTX.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4564 -
C:\windows\PKGYTX.exeC:\windows\PKGYTX.exe85⤵
- Executes dropped EXE
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXL.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:1656 -
C:\windows\JXL.exeC:\windows\JXL.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GDREKGG.exe.bat" "88⤵PID:5624
-
C:\windows\SysWOW64\GDREKGG.exeC:\windows\system32\GDREKGG.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBK.exe.bat" "90⤵
- Executes a command shell one-liner
PID:3348 -
C:\windows\system\IBK.exeC:\windows\system\IBK.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GBSUA.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:2656 -
C:\windows\system\GBSUA.exeC:\windows\system\GBSUA.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MORVEA.exe.bat" "94⤵
- Executes a command shell one-liner
PID:688 -
C:\windows\SysWOW64\MORVEA.exeC:\windows\system32\MORVEA.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DCBN.exe.bat" "96⤵PID:3460
-
C:\windows\DCBN.exeC:\windows\DCBN.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHZ.exe.bat" "98⤵PID:4692
-
C:\windows\RHZ.exeC:\windows\RHZ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSY.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5220 -
C:\windows\QSY.exeC:\windows\QSY.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZFISQY.exe.bat" "102⤵
- Executes a command shell one-liner
PID:6124 -
C:\windows\ZFISQY.exeC:\windows\ZFISQY.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTHTVBC.exe.bat" "104⤵PID:3688
-
C:\windows\FTHTVBC.exeC:\windows\FTHTVBC.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UWRFG.exe.bat" "106⤵
- Executes a command shell one-liner
PID:2068 -
C:\windows\UWRFG.exeC:\windows\UWRFG.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WLKZMC.exe.bat" "108⤵
- Executes a command shell one-liner
PID:6008 -
C:\windows\WLKZMC.exeC:\windows\WLKZMC.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWOGS.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5468 -
C:\windows\SysWOW64\CWOGS.exeC:\windows\system32\CWOGS.exe111⤵
- Executes dropped EXE
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WKTPCU.exe.bat" "112⤵
- Executes a command shell one-liner
PID:1804 -
C:\windows\system\WKTPCU.exeC:\windows\system\WKTPCU.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXDH.exe.bat" "114⤵PID:4788
-
C:\windows\NXDH.exeC:\windows\NXDH.exe115⤵
- Executes dropped EXE
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPYAS.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:4820 -
C:\windows\system\ZPYAS.exeC:\windows\system\ZPYAS.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VVEPZ.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5732 -
C:\windows\SysWOW64\VVEPZ.exeC:\windows\system32\VVEPZ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STKMGRJ.exe.bat" "120⤵
- Executes a command shell one-liner
PID:2768 -
C:\windows\SysWOW64\STKMGRJ.exeC:\windows\system32\STKMGRJ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-