Analysis
- max time kernel
110s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 17:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_f5049f57e8e879469a047782bdd9a5ea_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-24_f5049f57e8e879469a047782bdd9a5ea_elex_emotet_stop.exe
- Size 208KB
- Sample260924-vsbahsxcrc
- SHA256 d7c90e1ae9aa9b4aa904cdd550a09c712bb650725dc84361547ebda662f7238c
- MD5 f5049f57e8e879469a047782bdd9a5ea
- SHA1 8e5675e54c773b4c3ba5fdb999c916aabfa507ea
- SHA512 0f605f09197cadf89d4bbb69b29801c901230c2ac7c6a0dc251139de6bd4d1729bbc27b84e49f92396203a95bc8c266b06772bf3fff47933192bee3c62fc0de8
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfJ4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOhQEj1
- TLSH T1E1247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5284 IJU.exe 4740 UUFWQ.exe 5960 OHWXJ.exe 1044 UCV.exe 3840 TSGBBOW.exe 5908 TGHQCBR.exe 4916 UBKT.exe 2192 OWPDSQ.exe 4836 YUVXHZ.exe 4616 RPZTNPA.exe 5468 LKDC.exe 2000 HNUB.exe 4924 QVWGP.exe 756 LJTPZWA.exe 5336 QJADI.exe 1236 LWFMSR.exe 1748 UFH.exe 5964 JAREHJ.exe 4252 KDCAMZD.exe 576 ATDZTU.exe 5788 SOH.exe 3396 WEODLCP.exe 3500 CEVQCFQ.exe 3084 XRAA.exe 5220 DNZBJZV.exe 4220 HVGJ.exe 4708 SNBBDZ.exe 908 MBGLFZV.exe 2300 CEXPY.exe 6040 WRCZBUK.exe 3648 ORW.exe 4400 KXCBT.exe 2884 TFEGXY.exe 2508 OSJ.exe 2140 DNSCST.exe 4928 HDZ.exe 1940 SWCUM.exe 5520 EPFNVA.exe 4572 VPHSYXJ.exe 2296 ECJ.exe 2672 BAPHV.exe 5772 VVURFD.exe 2576 VBUFHQI.exe 5856 KWDKS.exe 988 SBEYTQ.exe 5580 NXIIEQA.exe 2864 TXIVN.exe 4460 TCIKO.exe 5200 IXS.exe 704 TQVH.exe 1908 HBDGWCQ.exe 4272 PGD.exe 4640 TWKUJH.exe 244 PUQRYRI.exe 5636 PIQ.exe 4988 EDZKLR.exe 5876 BIXHSSO.exe 4316 PGDEHCQ.exe 944 XLD.exe 5592 JEYL.exe 2868 XJEAYG.exe 2760 UPKYF.exe 3852 FINQNXL.exe 1248 LIVE.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\IXP.exe.bat USR.exe File opened for modification C:\windows\SysWOW64\CEVQCFQ.exe WEODLCP.exe File created C:\windows\SysWOW64\VPHSYXJ.exe EPFNVA.exe File created C:\windows\SysWOW64\KWDKS.exe.bat VBUFHQI.exe File opened for modification C:\windows\SysWOW64\XULAW.exe APF.exe File opened for modification C:\windows\SysWOW64\RBTIYC.exe FIQQ.exe File opened for modification C:\windows\SysWOW64\LQED.exe RDZUUQI.exe File created C:\windows\SysWOW64\IWZHZDD.exe.bat AQZSYQJ.exe File created C:\windows\SysWOW64\OHWXJ.exe UUFWQ.exe File created C:\windows\SysWOW64\VFXXOX.exe.bat ESM.exe File opened for modification C:\windows\SysWOW64\SSHMSB.exe GZETR.exe File created C:\windows\SysWOW64\WAQXE.exe.bat LIVE.exe File created C:\windows\SysWOW64\TGVUL.exe.bat WAQXE.exe File created C:\windows\SysWOW64\KXCBT.exe ORW.exe File created C:\windows\SysWOW64\EPFNVA.exe SWCUM.exe File opened for modification C:\windows\SysWOW64\EPFNVA.exe SWCUM.exe File created C:\windows\SysWOW64\XULAW.exe.bat APF.exe File opened for modification C:\windows\SysWOW64\XSNXN.exe TCH.exe File created C:\windows\SysWOW64\OWPDSQ.exe UBKT.exe File created C:\windows\SysWOW64\RPZTNPA.exe.bat YUVXHZ.exe File created C:\windows\SysWOW64\QVWGP.exe.bat HNUB.exe File created C:\windows\SysWOW64\WEODLCP.exe SOH.exe File opened for modification C:\windows\SysWOW64\ECJ.exe VPHSYXJ.exe File opened for modification C:\windows\SysWOW64\VBUFHQI.exe VVURFD.exe File created C:\windows\SysWOW64\INGTWD.exe.bat XULAW.exe File opened for modification C:\windows\SysWOW64\IXP.exe USR.exe File created C:\windows\SysWOW64\CEVQCFQ.exe.bat WEODLCP.exe File opened for modification C:\windows\SysWOW64\HVGJ.exe DNZBJZV.exe File opened for modification C:\windows\SysWOW64\TFEGXY.exe KXCBT.exe File created C:\windows\SysWOW64\RBTIYC.exe FIQQ.exe File created C:\windows\SysWOW64\HRY.exe NETMZS.exe File created C:\windows\SysWOW64\CUQT.exe.bat IGMKKSX.exe File created C:\windows\SysWOW64\WEODLCP.exe.bat SOH.exe File created C:\windows\SysWOW64\TCIKO.exe TXIVN.exe File opened for modification C:\windows\SysWOW64\TWKUJH.exe PGD.exe File created C:\windows\SysWOW64\WAQXE.exe LIVE.exe File created C:\windows\SysWOW64\HVGJ.exe.bat DNZBJZV.exe File opened for modification C:\windows\SysWOW64\VPHSYXJ.exe EPFNVA.exe File created C:\windows\SysWOW64\SSHMSB.exe GZETR.exe File created C:\windows\SysWOW64\MGCLUW.exe CJO.exe File opened for modification C:\windows\SysWOW64\RPZTNPA.exe YUVXHZ.exe File created C:\windows\SysWOW64\CEVQCFQ.exe WEODLCP.exe File created C:\windows\SysWOW64\TXIVN.exe.bat NXIIEQA.exe File created C:\windows\SysWOW64\HBDGWCQ.exe TQVH.exe File opened for modification C:\windows\SysWOW64\VDOY.exe MVU.exe File created C:\windows\SysWOW64\CMAE.exe.bat TEY.exe File created C:\windows\SysWOW64\VHEQXUO.exe.bat MGCLUW.exe File created C:\windows\SysWOW64\IWZHZDD.exe AQZSYQJ.exe File created C:\windows\SysWOW64\RPZTNPA.exe YUVXHZ.exe File created C:\windows\SysWOW64\VHEQXUO.exe MGCLUW.exe File created C:\windows\SysWOW64\XSNXN.exe.bat TCH.exe File created C:\windows\SysWOW64\UPTUUGH.exe XSNXN.exe File created C:\windows\SysWOW64\QKQK.exe.bat KJIWBC.exe File created C:\windows\SysWOW64\TGHQCBR.exe.bat TSGBBOW.exe File created C:\windows\SysWOW64\TFEGXY.exe KXCBT.exe File created C:\windows\SysWOW64\ECJ.exe VPHSYXJ.exe File opened for modification C:\windows\SysWOW64\KWDKS.exe VBUFHQI.exe File opened for modification C:\windows\SysWOW64\TXIVN.exe NXIIEQA.exe File opened for modification C:\windows\SysWOW64\TQVH.exe IXS.exe File created C:\windows\SysWOW64\HBDGWCQ.exe.bat TQVH.exe File created C:\windows\SysWOW64\JEYL.exe.bat XLD.exe File created C:\windows\SysWOW64\XULAW.exe APF.exe File opened for modification C:\windows\SysWOW64\INGTWD.exe XULAW.exe File created C:\windows\SysWOW64\CMAE.exe TEY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\LPJA.exe.bat RCERFKX.exe File created C:\windows\system\UBKT.exe.bat TGHQCBR.exe File opened for modification C:\windows\HNUB.exe LKDC.exe File opened for modification C:\windows\OSJ.exe TFEGXY.exe File opened for modification C:\windows\PGDEHCQ.exe BIXHSSO.exe File created C:\windows\system\IIOW.exe OVJNYKW.exe File created C:\windows\CJO.exe.bat RQTYEHN.exe File created C:\windows\MUOIN.exe.bat VHEQXUO.exe File opened for modification C:\windows\TEER.exe LQED.exe File opened for modification C:\windows\system\LIVE.exe FINQNXL.exe File opened for modification C:\windows\ZRFDB.exe QEVLLQB.exe File created C:\windows\XRAA.exe.bat CEVQCFQ.exe File created C:\windows\system\BLWZZEV.exe PTB.exe File created C:\windows\system\FFAMB.exe.bat ZFSYS.exe File opened for modification C:\windows\system\RAZPFQ.exe GCOKS.exe File opened for modification C:\windows\system\APF.exe UOXQYK.exe File created C:\windows\DIE.exe.bat FIWMCW.exe File opened for modification C:\windows\UFH.exe LWFMSR.exe File opened for modification C:\windows\system\ATDZTU.exe KDCAMZD.exe File opened for modification C:\windows\system\MBGLFZV.exe SNBBDZ.exe File created C:\windows\HDZ.exe DNSCST.exe File opened for modification C:\windows\system\PGD.exe HBDGWCQ.exe File created C:\windows\FINQNXL.exe.bat UPKYF.exe File created C:\windows\system\ORW.exe.bat WRCZBUK.exe File opened for modification C:\windows\UPKYF.exe XJEAYG.exe File created C:\windows\FINQNXL.exe UPKYF.exe File created C:\windows\system\QQTIWT.exe VDOY.exe File opened for modification C:\windows\HIFKJMY.exe BMGBE.exe File created C:\windows\system\UBKT.exe TGHQCBR.exe File created C:\windows\ESM.exe CCL.exe File created C:\windows\KUYEC.exe.bat BLWZZEV.exe File created C:\windows\NVTTI.exe YSJPXLM.exe File created C:\windows\TCH.exe.bat ROCNRM.exe File created C:\windows\RCERFKX.exe.bat WOZHV.exe File opened for modification C:\windows\XRAA.exe CEVQCFQ.exe File opened for modification C:\windows\CEXPY.exe MBGLFZV.exe File opened for modification C:\windows\IXS.exe TCIKO.exe File opened for modification C:\windows\system\IIOW.exe OVJNYKW.exe File created C:\windows\BMGBE.exe CUQT.exe File created C:\windows\system\UQSE.exe IXP.exe File created C:\windows\AQZSYQJ.exe UQSE.exe File created C:\windows\TOUZ.exe.bat IWZHZDD.exe File opened for modification C:\windows\DNSCST.exe OSJ.exe File created C:\windows\YJRSRI.exe.bat TGVUL.exe File opened for modification C:\windows\KUYEC.exe BLWZZEV.exe File created C:\windows\ACINFF.exe SSHMSB.exe File created C:\windows\FIQQ.exe LVL.exe File opened for modification C:\windows\system\IUVP.exe FGRGFLI.exe File opened for modification C:\windows\system\ISEXF.exe TMYIY.exe File created C:\windows\system\IGMKKSX.exe OOWZTRP.exe File created C:\windows\BIXHSSO.exe EDZKLR.exe File created C:\windows\PGDEHCQ.exe BIXHSSO.exe File opened for modification C:\windows\FINQNXL.exe UPKYF.exe File created C:\windows\TMYIY.exe IUVP.exe File opened for modification C:\windows\BMGBE.exe CUQT.exe File opened for modification C:\windows\LPJA.exe RCERFKX.exe File opened for modification C:\windows\OVJNYKW.exe DCOUQU.exe File opened for modification C:\windows\DNZBJZV.exe XRAA.exe File created C:\windows\SBEYTQ.exe.bat KWDKS.exe File created C:\windows\system\PGD.exe HBDGWCQ.exe File created C:\windows\NETMZS.exe.bat DWZ.exe File created C:\windows\AQZSYQJ.exe.bat UQSE.exe File created C:\windows\DIE.exe FIWMCW.exe File created C:\windows\WOZHV.exe FGXC.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5028 cmd.exe 2728 cmd.exe 4128 cmd.exe 5232 cmd.exe 2820 cmd.exe 4648 cmd.exe 1916 cmd.exe 4608 cmd.exe 4800 cmd.exe 432 cmd.exe 3844 cmd.exe 1104 cmd.exe 4620 cmd.exe 4228 cmd.exe 5844 cmd.exe 2404 cmd.exe 2556 cmd.exe 6120 cmd.exe 3080 cmd.exe 2416 cmd.exe 3180 cmd.exe 4568 cmd.exe 5920 cmd.exe 6072 cmd.exe 4416 cmd.exe 4676 cmd.exe 5980 cmd.exe 5712 cmd.exe 5084 cmd.exe 4484 cmd.exe 5376 cmd.exe 5132 cmd.exe 3704 cmd.exe 4336 cmd.exe 2360 cmd.exe 4692 cmd.exe 2100 cmd.exe 620 cmd.exe 4588 cmd.exe 3224 cmd.exe 2808 cmd.exe 5096 cmd.exe 6088 cmd.exe 6100 cmd.exe 3836 cmd.exe 2364 cmd.exe 3388 cmd.exe 4912 cmd.exe 3228 cmd.exe 2340 cmd.exe 2948 cmd.exe 4148 cmd.exe 4188 cmd.exe 3136 cmd.exe 6008 cmd.exe 4944 cmd.exe 5080 cmd.exe 2148 cmd.exe 2620 cmd.exe 2976 cmd.exe 2896 cmd.exe 4828 cmd.exe 4768 cmd.exe 2216 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5856 4940 WerFault.exe 88 2820 5284 WerFault.exe 94 4276 4740 WerFault.exe 100 940 5960 WerFault.exe 105 1236 1044 WerFault.exe 110 2764 3840 WerFault.exe 115 6076 5908 WerFault.exe 120 4580 4916 WerFault.exe 125 2060 2192 WerFault.exe 130 5788 4836 WerFault.exe 135 1088 4616 WerFault.exe 140 484 5468 WerFault.exe 145 3084 2000 WerFault.exe 150 236 4924 WerFault.exe 155 5324 756 WerFault.exe 160 5028 5336 WerFault.exe 165 5892 1236 WerFault.exe 170 4456 1748 WerFault.exe 175 5424 5964 WerFault.exe 180 4212 4252 WerFault.exe 185 3200 576 WerFault.exe 190 4620 5788 WerFault.exe 195 2444 3396 WerFault.exe 200 4604 3500 WerFault.exe 205 1576 3084 WerFault.exe 210 4240 5220 WerFault.exe 215 2084 4220 WerFault.exe 220 2216 4708 WerFault.exe 225 5628 908 WerFault.exe 230 5864 2300 WerFault.exe 235 1132 6040 WerFault.exe 240 5812 3648 WerFault.exe 245 4272 4400 WerFault.exe 250 1192 2884 WerFault.exe 255 4336 2508 WerFault.exe 260 5752 2140 WerFault.exe 265 3288 4928 WerFault.exe 270 3088 1940 WerFault.exe 275 2784 5520 WerFault.exe 280 5668 4572 WerFault.exe 285 5652 2296 WerFault.exe 290 5408 2672 WerFault.exe 295 6108 5772 WerFault.exe 300 2820 2576 WerFault.exe 305 1824 5856 WerFault.exe 310 5712 988 WerFault.exe 315 2712 5580 WerFault.exe 320 1696 2864 WerFault.exe 325 2652 4460 WerFault.exe 330 4232 5200 WerFault.exe 335 3036 704 WerFault.exe 340 2164 1908 WerFault.exe 345 4492 4272 WerFault.exe 350 3852 4640 WerFault.exe 355 4428 244 WerFault.exe 360 712 5636 WerFault.exe 365 1484 4988 WerFault.exe 370 1292 5876 WerFault.exe 375 1268 4316 WerFault.exe 380 5784 944 WerFault.exe 385 4728 5592 WerFault.exe 390 2076 2868 WerFault.exe 395 4364 2760 WerFault.exe 400 1204 3852 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YUVXHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUOIN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPZTNPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FINQNXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPKYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QJADI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQTIWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJTPZWA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVGJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPTUUGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UUFWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACINFF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ISEXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RASTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LQLKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LQED.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-24_f5049f57e8e879469a047782bdd9a5ea_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDZKLR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGDEHCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSHMSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZFSYS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MGCLUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4940 2026-09-24_f5049f57e8e879469a047782bdd9a5ea_elex_emotet_stop.exe 4940 2026-09-24_f5049f57e8e879469a047782bdd9a5ea_elex_emotet_stop.exe 5284 IJU.exe 5284 IJU.exe 4740 UUFWQ.exe 4740 UUFWQ.exe 5960 OHWXJ.exe 5960 OHWXJ.exe 1044 UCV.exe 1044 UCV.exe 3840 TSGBBOW.exe 3840 TSGBBOW.exe 5908 TGHQCBR.exe 5908 TGHQCBR.exe 4916 UBKT.exe 4916 UBKT.exe 2192 OWPDSQ.exe 2192 OWPDSQ.exe 4836 YUVXHZ.exe 4836 YUVXHZ.exe 4616 RPZTNPA.exe 4616 RPZTNPA.exe 5468 LKDC.exe 5468 LKDC.exe 2000 HNUB.exe 2000 HNUB.exe 4924 QVWGP.exe 4924 QVWGP.exe 756 LJTPZWA.exe 756 LJTPZWA.exe 5336 QJADI.exe 5336 QJADI.exe 1236 LWFMSR.exe 1236 LWFMSR.exe 1748 UFH.exe 1748 UFH.exe 5964 JAREHJ.exe 5964 JAREHJ.exe 4252 KDCAMZD.exe 4252 KDCAMZD.exe 576 ATDZTU.exe 576 ATDZTU.exe 5788 SOH.exe 5788 SOH.exe 3396 WEODLCP.exe 3396 WEODLCP.exe 3500 CEVQCFQ.exe 3500 CEVQCFQ.exe 3084 XRAA.exe 3084 XRAA.exe 5220 DNZBJZV.exe 5220 DNZBJZV.exe 4220 HVGJ.exe 4220 HVGJ.exe 4708 SNBBDZ.exe 4708 SNBBDZ.exe 908 MBGLFZV.exe 908 MBGLFZV.exe 2300 CEXPY.exe 2300 CEXPY.exe 6040 WRCZBUK.exe 6040 WRCZBUK.exe 3648 ORW.exe 3648 ORW.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4940 2026-09-24_f5049f57e8e879469a047782bdd9a5ea_elex_emotet_stop.exe 4940 2026-09-24_f5049f57e8e879469a047782bdd9a5ea_elex_emotet_stop.exe 5284 IJU.exe 5284 IJU.exe 4740 UUFWQ.exe 4740 UUFWQ.exe 5960 OHWXJ.exe 5960 OHWXJ.exe 1044 UCV.exe 1044 UCV.exe 3840 TSGBBOW.exe 3840 TSGBBOW.exe 5908 TGHQCBR.exe 5908 TGHQCBR.exe 4916 UBKT.exe 4916 UBKT.exe 2192 OWPDSQ.exe 2192 OWPDSQ.exe 4836 YUVXHZ.exe 4836 YUVXHZ.exe 4616 RPZTNPA.exe 4616 RPZTNPA.exe 5468 LKDC.exe 5468 LKDC.exe 2000 HNUB.exe 2000 HNUB.exe 4924 QVWGP.exe 4924 QVWGP.exe 756 LJTPZWA.exe 756 LJTPZWA.exe 5336 QJADI.exe 5336 QJADI.exe 1236 LWFMSR.exe 1236 LWFMSR.exe 1748 UFH.exe 1748 UFH.exe 5964 JAREHJ.exe 5964 JAREHJ.exe 4252 KDCAMZD.exe 4252 KDCAMZD.exe 576 ATDZTU.exe 576 ATDZTU.exe 5788 SOH.exe 5788 SOH.exe 3396 WEODLCP.exe 3396 WEODLCP.exe 3500 CEVQCFQ.exe 3500 CEVQCFQ.exe 3084 XRAA.exe 3084 XRAA.exe 5220 DNZBJZV.exe 5220 DNZBJZV.exe 4220 HVGJ.exe 4220 HVGJ.exe 4708 SNBBDZ.exe 4708 SNBBDZ.exe 908 MBGLFZV.exe 908 MBGLFZV.exe 2300 CEXPY.exe 2300 CEXPY.exe 6040 WRCZBUK.exe 6040 WRCZBUK.exe 3648 ORW.exe 3648 ORW.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4940 wrote to memory of 856 4940 2026-09-24_f5049f57e8e879469a047782bdd9a5ea_elex_emotet_stop.exe 90 PID 856 wrote to memory of 5284 856 cmd.exe 94 PID 5284 wrote to memory of 3636 5284 IJU.exe 96 PID 3636 wrote to memory of 4740 3636 cmd.exe 100 PID 4740 wrote to memory of 5500 4740 UUFWQ.exe 101 PID 5500 wrote to memory of 5960 5500 cmd.exe 105 PID 5960 wrote to memory of 1920 5960 OHWXJ.exe 106 PID 1920 wrote to memory of 1044 1920 cmd.exe 110 PID 1044 wrote to memory of 1584 1044 UCV.exe 111 PID 1584 wrote to memory of 3840 1584 cmd.exe 115 PID 3840 wrote to memory of 4828 3840 TSGBBOW.exe 116 PID 4828 wrote to memory of 5908 4828 cmd.exe 120 PID 5908 wrote to memory of 4692 5908 TGHQCBR.exe 121 PID 4692 wrote to memory of 4916 4692 cmd.exe 125 PID 4916 wrote to memory of 4612 4916 UBKT.exe 126 PID 4612 wrote to memory of 2192 4612 cmd.exe 130 PID 2192 wrote to memory of 4464 2192 OWPDSQ.exe 131 PID 4464 wrote to memory of 4836 4464 cmd.exe 135 PID 4836 wrote to memory of 3228 4836 YUVXHZ.exe 136 PID 3228 wrote to memory of 4616 3228 cmd.exe 140 PID 4616 wrote to memory of 3660 4616 RPZTNPA.exe 141 PID 3660 wrote to memory of 5468 3660 cmd.exe 145 PID 5468 wrote to memory of 6032 5468 LKDC.exe 146 PID 6032 wrote to memory of 2000 6032 cmd.exe 150 PID 2000 wrote to memory of 432 2000 HNUB.exe 151 PID 432 wrote to memory of 4924 432 cmd.exe 155 PID 4924 wrote to memory of 3136 4924 QVWGP.exe 156 PID 3136 wrote to memory of 756 3136 cmd.exe 160 PID 756 wrote to memory of 5428 756 LJTPZWA.exe 161 PID 5428 wrote to memory of 5336 5428 cmd.exe 165 PID 5336 wrote to memory of 3844 5336 QJADI.exe 166 PID 3844 wrote to memory of 1236 3844 cmd.exe 170 PID 1236 wrote to memory of 6120 1236 LWFMSR.exe 171 PID 6120 wrote to memory of 1748 6120 cmd.exe 175 PID 1748 wrote to memory of 5196 1748 UFH.exe 176 PID 5196 wrote to memory of 5964 5196 cmd.exe 180 PID 5964 wrote to memory of 6100 5964 JAREHJ.exe 181 PID 6100 wrote to memory of 4252 6100 cmd.exe 185 PID 4252 wrote to memory of 3276 4252 KDCAMZD.exe 186 PID 3276 wrote to memory of 576 3276 cmd.exe 190 PID 576 wrote to memory of 3664 576 ATDZTU.exe 191 PID 3664 wrote to memory of 5788 3664 cmd.exe 195 PID 5788 wrote to memory of 3468 5788 SOH.exe 196 PID 3468 wrote to memory of 3396 3468 cmd.exe 200 PID 3396 wrote to memory of 2728 3396 WEODLCP.exe 201 PID 2728 wrote to memory of 3500 2728 cmd.exe 205 PID 3500 wrote to memory of 4636 3500 CEVQCFQ.exe 206 PID 4636 wrote to memory of 3084 4636 cmd.exe 210 PID 3084 wrote to memory of 3836 3084 XRAA.exe 211 PID 3836 wrote to memory of 5220 3836 cmd.exe 215 PID 5220 wrote to memory of 4416 5220 DNZBJZV.exe 216 PID 4416 wrote to memory of 4220 4416 cmd.exe 220 PID 4220 wrote to memory of 5472 4220 HVGJ.exe 221 PID 5472 wrote to memory of 4708 5472 cmd.exe 225 PID 4708 wrote to memory of 4676 4708 SNBBDZ.exe 226 PID 4676 wrote to memory of 908 4676 cmd.exe 230 PID 908 wrote to memory of 4768 908 MBGLFZV.exe 231 PID 4768 wrote to memory of 2300 4768 cmd.exe 235 PID 2300 wrote to memory of 2340 2300 CEXPY.exe 236 PID 2340 wrote to memory of 6040 2340 cmd.exe 240 PID 6040 wrote to memory of 5276 6040 WRCZBUK.exe 241 PID 5276 wrote to memory of 3648 5276 cmd.exe 245 PID 3648 wrote to memory of 3080 3648 ORW.exe 246 PID 3080 wrote to memory of 4400 3080 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_f5049f57e8e879469a047782bdd9a5ea_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_f5049f57e8e879469a047782bdd9a5ea_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IJU.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:856 -
C:\windows\IJU.exeC:\windows\IJU.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UUFWQ.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\windows\UUFWQ.exeC:\windows\UUFWQ.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHWXJ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\windows\SysWOW64\OHWXJ.exeC:\windows\system32\OHWXJ.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCV.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\windows\SysWOW64\UCV.exeC:\windows\system32\UCV.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSGBBOW.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\windows\TSGBBOW.exeC:\windows\TSGBBOW.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGHQCBR.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\windows\SysWOW64\TGHQCBR.exeC:\windows\system32\TGHQCBR.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBKT.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\windows\system\UBKT.exeC:\windows\system\UBKT.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWPDSQ.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\windows\SysWOW64\OWPDSQ.exeC:\windows\system32\OWPDSQ.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YUVXHZ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\windows\system\YUVXHZ.exeC:\windows\system\YUVXHZ.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RPZTNPA.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\windows\SysWOW64\RPZTNPA.exeC:\windows\system32\RPZTNPA.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LKDC.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\windows\system\LKDC.exeC:\windows\system\LKDC.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNUB.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\windows\HNUB.exeC:\windows\HNUB.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVWGP.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:432 -
C:\windows\SysWOW64\QVWGP.exeC:\windows\system32\QVWGP.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJTPZWA.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\windows\LJTPZWA.exeC:\windows\LJTPZWA.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QJADI.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\windows\QJADI.exeC:\windows\QJADI.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LWFMSR.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\windows\system\LWFMSR.exeC:\windows\system\LWFMSR.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFH.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\windows\UFH.exeC:\windows\UFH.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JAREHJ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\windows\system\JAREHJ.exeC:\windows\system\JAREHJ.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KDCAMZD.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\windows\KDCAMZD.exeC:\windows\KDCAMZD.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATDZTU.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\windows\system\ATDZTU.exeC:\windows\system\ATDZTU.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SOH.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\windows\SOH.exeC:\windows\SOH.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WEODLCP.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\windows\SysWOW64\WEODLCP.exeC:\windows\system32\WEODLCP.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CEVQCFQ.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\windows\SysWOW64\CEVQCFQ.exeC:\windows\system32\CEVQCFQ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRAA.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\windows\XRAA.exeC:\windows\XRAA.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNZBJZV.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\windows\DNZBJZV.exeC:\windows\DNZBJZV.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVGJ.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\windows\SysWOW64\HVGJ.exeC:\windows\system32\HVGJ.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNBBDZ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\windows\SNBBDZ.exeC:\windows\SNBBDZ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MBGLFZV.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\windows\system\MBGLFZV.exeC:\windows\system\MBGLFZV.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEXPY.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\windows\CEXPY.exeC:\windows\CEXPY.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRCZBUK.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\windows\system\WRCZBUK.exeC:\windows\system\WRCZBUK.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORW.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\windows\system\ORW.exeC:\windows\system\ORW.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXCBT.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\windows\SysWOW64\KXCBT.exeC:\windows\system32\KXCBT.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TFEGXY.exe.bat" "66⤵PID:3964
-
C:\windows\SysWOW64\TFEGXY.exeC:\windows\system32\TFEGXY.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OSJ.exe.bat" "68⤵PID:3016
-
C:\windows\OSJ.exeC:\windows\OSJ.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNSCST.exe.bat" "70⤵
- Executes a command shell one-liner
PID:2100 -
C:\windows\DNSCST.exeC:\windows\DNSCST.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HDZ.exe.bat" "72⤵PID:4304
-
C:\windows\HDZ.exeC:\windows\HDZ.exe73⤵
- Executes dropped EXE
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SWCUM.exe.bat" "74⤵PID:5324
-
C:\windows\SysWOW64\SWCUM.exeC:\windows\system32\SWCUM.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EPFNVA.exe.bat" "76⤵
- Executes a command shell one-liner
PID:6008 -
C:\windows\SysWOW64\EPFNVA.exeC:\windows\system32\EPFNVA.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPHSYXJ.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2416 -
C:\windows\SysWOW64\VPHSYXJ.exeC:\windows\system32\VPHSYXJ.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ECJ.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1104 -
C:\windows\SysWOW64\ECJ.exeC:\windows\system32\ECJ.exe81⤵
- Executes dropped EXE
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BAPHV.exe.bat" "82⤵PID:3140
-
C:\windows\system\BAPHV.exeC:\windows\system\BAPHV.exe83⤵
- Executes dropped EXE
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVURFD.exe.bat" "84⤵PID:5108
-
C:\windows\system\VVURFD.exeC:\windows\system\VVURFD.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VBUFHQI.exe.bat" "86⤵PID:1676
-
C:\windows\SysWOW64\VBUFHQI.exeC:\windows\system32\VBUFHQI.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWDKS.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3180 -
C:\windows\SysWOW64\KWDKS.exeC:\windows\system32\KWDKS.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBEYTQ.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4944 -
C:\windows\SBEYTQ.exeC:\windows\SBEYTQ.exe91⤵
- Executes dropped EXE
PID:988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXIIEQA.exe.bat" "92⤵PID:5088
-
C:\windows\NXIIEQA.exeC:\windows\NXIIEQA.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXIVN.exe.bat" "94⤵PID:2972
-
C:\windows\SysWOW64\TXIVN.exeC:\windows\system32\TXIVN.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TCIKO.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5376 -
C:\windows\SysWOW64\TCIKO.exeC:\windows\system32\TCIKO.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IXS.exe.bat" "98⤵
- Executes a command shell one-liner
PID:5080 -
C:\windows\IXS.exeC:\windows\IXS.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TQVH.exe.bat" "100⤵
- Executes a command shell one-liner
PID:2148 -
C:\windows\SysWOW64\TQVH.exeC:\windows\system32\TQVH.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBDGWCQ.exe.bat" "102⤵
- Executes a command shell one-liner
PID:5980 -
C:\windows\SysWOW64\HBDGWCQ.exeC:\windows\system32\HBDGWCQ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGD.exe.bat" "104⤵PID:4432
-
C:\windows\system\PGD.exeC:\windows\system\PGD.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TWKUJH.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3732 -
C:\windows\SysWOW64\TWKUJH.exeC:\windows\system32\TWKUJH.exe107⤵
- Executes dropped EXE
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUQRYRI.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:3776 -
C:\windows\PUQRYRI.exeC:\windows\PUQRYRI.exe109⤵
- Executes dropped EXE
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PIQ.exe.bat" "110⤵PID:5464
-
C:\windows\system\PIQ.exeC:\windows\system\PIQ.exe111⤵
- Executes dropped EXE
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EDZKLR.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2364 -
C:\windows\system\EDZKLR.exeC:\windows\system\EDZKLR.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BIXHSSO.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4568 -
C:\windows\BIXHSSO.exeC:\windows\BIXHSSO.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PGDEHCQ.exe.bat" "116⤵PID:1596
-
C:\windows\PGDEHCQ.exeC:\windows\PGDEHCQ.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XLD.exe.bat" "118⤵PID:2388
-
C:\windows\XLD.exeC:\windows\XLD.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JEYL.exe.bat" "120⤵
- Executes a command shell one-liner
PID:620 -
C:\windows\SysWOW64\JEYL.exeC:\windows\system32\JEYL.exe121⤵
- Executes dropped EXE
PID:5592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-