Analysis
- max time kernel
93s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 10:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_4e16c9cae453044c847fe1c8d51665a4_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-24_4e16c9cae453044c847fe1c8d51665a4_elex_emotet_stop.exe
- Size 208KB
- Sample260925-mbm9razsav
- SHA256 1cffc3631cd43e79d3dccc9128f6ca7b0e59371f55675166ef1254d40a17bfc4
- MD5 4e16c9cae453044c847fe1c8d51665a4
- SHA1 b6a01559cc2f4329da05cd74040816c7906fa5a2
- SHA512 a0f077e3686fab05f279455977e0c2c96e832501b6e18cb92a41695d2eeee98c2d9d119e8a4e805748b22f46065e7d243853fdc01cb96c7bb65623ccc1a25153
- SSDEEP 3072:7tLQaL9tbLkRIgd1Lye9yjE2hWAN5XbslcdL+LOfG4pLthEjQT6j:7NlZtbLWIgd1LZ9oECZbslc5+LOukEj1
- TLSH T13A247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4240 VRMPC.exe 3556 GZHEK.exe 4256 ONYD.exe 3460 UAYD.exe 612 PWCVTK.exe 1100 CYLLZV.exe 4764 THNQKSK.exe 1712 JCEDV.exe 2424 HMHT.exe 1268 RVJYIY.exe 5996 VDQ.exe 3472 PQVHE.exe 1624 BGBPIBH.exe 4960 ZBAQN.exe 5476 OWK.exe 2896 PZOYL.exe 2068 TIUYYZD.exe 2832 CQWLB.exe 5600 XDBVLEU.exe 3140 JLIVQ.exe 1160 LJVPFXQ.exe 5508 EWU.exe 2356 UMI.exe 2528 UQMAXDE.exe 4680 TFFDS.exe 1512 RYIT.exe 5512 TWNOIXJ.exe 1392 SHYERL.exe 5172 KHAJ.exe 1544 GMK.exe 1656 BAPHV.exe 3704 OGP.exe 4104 DBGYIK.exe 1128 GJHUPWE.exe 3732 BEME.exe 1288 LCAYHE.exe 1864 NSFKWN.exe 4856 CIGK.exe 5364 EGUEKRI.exe 5100 ZQCVYTD.exe 3464 BOIP.exe 1316 CRM.exe 3500 LROY.exe 4368 MUSTCN.exe 2708 FYDXI.exe 2492 FTHTVBC.exe 5764 HQNNDJL.exe 1240 ITR.exe 5084 CHVAS.exe 2900 SKF.exe 2688 HAGEKHZ.exe 1788 WVXI.exe 5896 YTDDKCI.exe 4836 TGIM.exe 4576 IWJETYU.exe 5920 MEPM.exe 1520 PZUVQI.exe 2484 THBV.exe 5992 JSZT.exe 2888 IQKWPAW.exe 2600 GBNMXO.exe 2444 STQXFVZ.exe 2508 KOUALL.exe 1080 JHX.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\STQXFVZ.exe.bat GBNMXO.exe File created C:\windows\SysWOW64\GVTQRX.exe VDQXQIP.exe File created C:\windows\SysWOW64\SHYERL.exe TWNOIXJ.exe File opened for modification C:\windows\SysWOW64\SHYERL.exe TWNOIXJ.exe File created C:\windows\SysWOW64\NSFKWN.exe LCAYHE.exe File opened for modification C:\windows\SysWOW64\UMI.exe EWU.exe File created C:\windows\SysWOW64\MEPM.exe IWJETYU.exe File opened for modification C:\windows\SysWOW64\GJHUPWE.exe DBGYIK.exe File opened for modification C:\windows\SysWOW64\NSFKWN.exe LCAYHE.exe File created C:\windows\SysWOW64\NSFKWN.exe.bat LCAYHE.exe File created C:\windows\SysWOW64\BEME.exe.bat GJHUPWE.exe File created C:\windows\SysWOW64\LPFJKT.exe MUOIN.exe File created C:\windows\SysWOW64\WAJMK.exe.bat SSC.exe File created C:\windows\SysWOW64\GZHEK.exe VRMPC.exe File created C:\windows\SysWOW64\GJHUPWE.exe.bat DBGYIK.exe File opened for modification C:\windows\SysWOW64\WAJMK.exe SSC.exe File opened for modification C:\windows\SysWOW64\TFFDS.exe UQMAXDE.exe File created C:\windows\SysWOW64\KOUALL.exe.bat STQXFVZ.exe File opened for modification C:\windows\SysWOW64\GZHEK.exe VRMPC.exe File created C:\windows\SysWOW64\CYLLZV.exe.bat PWCVTK.exe File created C:\windows\SysWOW64\ZPYI.exe FCTZQMG.exe File created C:\windows\SysWOW64\DBGYIK.exe.bat OGP.exe File created C:\windows\SysWOW64\IUATOE.exe.bat GXMHGV.exe File created C:\windows\SysWOW64\EZPDDW.exe YYI.exe File opened for modification C:\windows\SysWOW64\ZPYI.exe FCTZQMG.exe File created C:\windows\SysWOW64\ZPYI.exe.bat FCTZQMG.exe File created C:\windows\SysWOW64\LHYTW.exe.bat SEUQJQ.exe File opened for modification C:\windows\SysWOW64\EZPDDW.exe YYI.exe File created C:\windows\SysWOW64\FCTZQMG.exe.bat EZPDDW.exe File created C:\windows\SysWOW64\LPFJKT.exe.bat MUOIN.exe File created C:\windows\SysWOW64\DBGYIK.exe OGP.exe File created C:\windows\SysWOW64\RNJ.exe.bat JHX.exe File opened for modification C:\windows\SysWOW64\HMHT.exe JCEDV.exe File created C:\windows\SysWOW64\CQWLB.exe TIUYYZD.exe File created C:\windows\SysWOW64\SHYERL.exe.bat TWNOIXJ.exe File created C:\windows\SysWOW64\KHAJ.exe.bat SHYERL.exe File opened for modification C:\windows\SysWOW64\DBGYIK.exe OGP.exe File opened for modification C:\windows\SysWOW64\KOUALL.exe STQXFVZ.exe File created C:\windows\SysWOW64\VOHYB.exe.bat TQBMUA.exe File created C:\windows\SysWOW64\LHYTW.exe SEUQJQ.exe File created C:\windows\SysWOW64\IFVZXX.exe.bat BJV.exe File created C:\windows\SysWOW64\TWNOIXJ.exe.bat RYIT.exe File created C:\windows\SysWOW64\KHAJ.exe SHYERL.exe File opened for modification C:\windows\SysWOW64\IWJETYU.exe TGIM.exe File created C:\windows\SysWOW64\IQKWPAW.exe.bat JSZT.exe File opened for modification C:\windows\SysWOW64\VDQXQIP.exe RNJ.exe File opened for modification C:\windows\SysWOW64\MVBE.exe GVTQRX.exe File opened for modification C:\windows\SysWOW64\LORRF.exe LIZCE.exe File opened for modification C:\windows\SysWOW64\LPFJKT.exe MUOIN.exe File created C:\windows\SysWOW64\GZHEK.exe.bat VRMPC.exe File opened for modification C:\windows\SysWOW64\VDQ.exe RVJYIY.exe File created C:\windows\SysWOW64\MVBE.exe GVTQRX.exe File created C:\windows\SysWOW64\FCTZQMG.exe EZPDDW.exe File created C:\windows\SysWOW64\HMHT.exe JCEDV.exe File opened for modification C:\windows\SysWOW64\LEDP.exe XBUY.exe File opened for modification C:\windows\SysWOW64\GVTQRX.exe VDQXQIP.exe File created C:\windows\SysWOW64\MVBE.exe.bat GVTQRX.exe File created C:\windows\SysWOW64\EZPDDW.exe.bat YYI.exe File created C:\windows\SysWOW64\WAJMK.exe SSC.exe File created C:\windows\SysWOW64\LEDP.exe XBUY.exe File created C:\windows\SysWOW64\THNQKSK.exe CYLLZV.exe File created C:\windows\SysWOW64\VDQ.exe RVJYIY.exe File created C:\windows\SysWOW64\UMI.exe EWU.exe File created C:\windows\SysWOW64\STQXFVZ.exe GBNMXO.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\ONYD.exe GZHEK.exe File created C:\windows\system\SSC.exe ZPYI.exe File created C:\windows\CVIVPX.exe WAJMK.exe File created C:\windows\system\VCQJVN.exe LEDP.exe File created C:\windows\system\JMZABGG.exe GZDQRG.exe File opened for modification C:\windows\system\MQNDO.exe XAED.exe File opened for modification C:\windows\system\BOIP.exe ZQCVYTD.exe File created C:\windows\system\WVXI.exe.bat HAGEKHZ.exe File created C:\windows\system\BJV.exe YBPQG.exe File created C:\windows\system\CIGK.exe.bat NSFKWN.exe File created C:\windows\UFQWLMW.exe UCNSG.exe File opened for modification C:\windows\system\ANARIEB.exe GAWHYE.exe File opened for modification C:\windows\system\VRMPC.exe 2026-09-24_4e16c9cae453044c847fe1c8d51665a4_elex_emotet_stop.exe File created C:\windows\XIA.exe QSZXLDE.exe File created C:\windows\XDBVLEU.exe CQWLB.exe File created C:\windows\system\WVXI.exe HAGEKHZ.exe File opened for modification C:\windows\system\GBNMXO.exe IQKWPAW.exe File opened for modification C:\windows\system\YYI.exe LORRF.exe File created C:\windows\EVHRV.exe ANARIEB.exe File opened for modification C:\windows\system\JCEDV.exe THNQKSK.exe File created C:\windows\LROY.exe.bat CRM.exe File created C:\windows\system\HYJC.exe.bat MVBE.exe File opened for modification C:\windows\system\QSZXLDE.exe EKSP.exe File created C:\windows\system\XAED.exe IFVZXX.exe File created C:\windows\OWK.exe ZBAQN.exe File created C:\windows\ZQCVYTD.exe EGUEKRI.exe File created C:\windows\LROY.exe CRM.exe File created C:\windows\system\TGIM.exe.bat YTDDKCI.exe File created C:\windows\system\LIZCE.exe ZATCS.exe File opened for modification C:\windows\system\PZUVQI.exe MEPM.exe File created C:\windows\system\LIZCE.exe.bat ZATCS.exe File created C:\windows\system\JCEDV.exe THNQKSK.exe File created C:\windows\RVJYIY.exe.bat HMHT.exe File created C:\windows\system\BOIP.exe.bat ZQCVYTD.exe File created C:\windows\CHVAS.exe ITR.exe File created C:\windows\ZAKL.exe IUATOE.exe File created C:\windows\system\MKCPCW.exe.bat LHYTW.exe File opened for modification C:\windows\system\VCQJVN.exe LEDP.exe File opened for modification C:\windows\system\EKSP.exe VCQJVN.exe File opened for modification C:\windows\system\HQNNDJL.exe FTHTVBC.exe File created C:\windows\JSZT.exe THBV.exe File created C:\windows\system\UAYD.exe.bat ONYD.exe File created C:\windows\PWCVTK.exe UAYD.exe File opened for modification C:\windows\system\GXMHGV.exe POKUV.exe File opened for modification C:\windows\YBPQG.exe WEJEYU.exe File created C:\windows\system\HQNNDJL.exe FTHTVBC.exe File created C:\windows\JHX.exe KOUALL.exe File created C:\windows\JHX.exe.bat KOUALL.exe File created C:\windows\system\TIUYYZD.exe PZOYL.exe File created C:\windows\XDBVLEU.exe.bat CQWLB.exe File created C:\windows\OGP.exe BAPHV.exe File opened for modification C:\windows\JSZT.exe THBV.exe File created C:\windows\system\ANARIEB.exe.bat GAWHYE.exe File opened for modification C:\windows\system\EGUEKRI.exe CIGK.exe File created C:\windows\system\SKF.exe CHVAS.exe File created C:\windows\system\PZUVQI.exe MEPM.exe File opened for modification C:\windows\XIA.exe QSZXLDE.exe File created C:\windows\system\PQVHE.exe.bat VDQ.exe File created C:\windows\BGBPIBH.exe.bat PQVHE.exe File created C:\windows\UQMAXDE.exe.bat UMI.exe File opened for modification C:\windows\system\GMK.exe KHAJ.exe File created C:\windows\system\POKUV.exe.bat HYJC.exe File opened for modification C:\windows\system\MKCPCW.exe LHYTW.exe File opened for modification C:\windows\EFO.exe MKCPCW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6024 cmd.exe 2920 cmd.exe 260 cmd.exe 5260 cmd.exe 2916 cmd.exe 5964 cmd.exe 1468 cmd.exe 2588 cmd.exe 1764 cmd.exe 4552 cmd.exe 1196 cmd.exe 1172 cmd.exe 3584 cmd.exe 596 cmd.exe 2280 cmd.exe 2364 cmd.exe 5720 cmd.exe 2568 cmd.exe 5864 cmd.exe 2576 cmd.exe 2984 cmd.exe 6012 cmd.exe 2236 cmd.exe 1276 cmd.exe 3160 cmd.exe 1540 cmd.exe 3340 cmd.exe 1884 cmd.exe 1536 cmd.exe 456 cmd.exe 2372 cmd.exe 3028 cmd.exe 3392 cmd.exe 4084 cmd.exe 1976 cmd.exe 3700 cmd.exe 5808 cmd.exe 4568 cmd.exe 3868 cmd.exe 3104 cmd.exe 2732 cmd.exe 5560 cmd.exe 6116 cmd.exe 3216 cmd.exe 3528 cmd.exe 4140 cmd.exe 5008 cmd.exe 4072 cmd.exe 3048 cmd.exe 3308 cmd.exe 2348 cmd.exe 5248 cmd.exe 5060 cmd.exe 4076 cmd.exe 2828 cmd.exe 4532 cmd.exe 3432 cmd.exe 4628 cmd.exe 4196 cmd.exe 5724 cmd.exe 4992 cmd.exe 4908 cmd.exe 2452 cmd.exe 4512 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5296 2552 WerFault.exe 89 3212 4240 WerFault.exe 94 2452 3556 WerFault.exe 100 3668 4256 WerFault.exe 105 5288 3460 WerFault.exe 110 3200 612 WerFault.exe 115 4624 1100 WerFault.exe 120 4084 4764 WerFault.exe 125 2040 1712 WerFault.exe 130 4324 2424 WerFault.exe 135 4172 1268 WerFault.exe 140 4584 5996 WerFault.exe 145 5828 3472 WerFault.exe 150 1884 1624 WerFault.exe 155 2892 4960 WerFault.exe 160 4916 5476 WerFault.exe 165 2280 2896 WerFault.exe 170 1444 2068 WerFault.exe 175 1700 2832 WerFault.exe 180 2644 5600 WerFault.exe 185 1400 3140 WerFault.exe 190 3748 1160 WerFault.exe 195 3596 5508 WerFault.exe 200 3968 2356 WerFault.exe 205 4464 2528 WerFault.exe 210 5500 4680 WerFault.exe 215 2768 1512 WerFault.exe 220 4208 5512 WerFault.exe 225 5956 1392 WerFault.exe 230 3632 5172 WerFault.exe 235 2236 1544 WerFault.exe 240 2648 1656 WerFault.exe 245 1448 3704 WerFault.exe 250 1204 4104 WerFault.exe 255 3528 1128 WerFault.exe 260 2260 3732 WerFault.exe 265 5636 1288 WerFault.exe 270 1604 1864 WerFault.exe 275 3200 4856 WerFault.exe 280 5728 5364 WerFault.exe 285 4736 5100 WerFault.exe 290 1788 3464 WerFault.exe 295 2328 1316 WerFault.exe 300 1764 3500 WerFault.exe 305 6012 4368 WerFault.exe 310 3440 2708 WerFault.exe 315 1884 2492 WerFault.exe 320 1060 5764 WerFault.exe 325 2076 1240 WerFault.exe 330 5424 5084 WerFault.exe 335 2996 2900 WerFault.exe 340 3368 2688 WerFault.exe 345 2040 1788 WerFault.exe 350 1764 5896 WerFault.exe 355 1388 4836 WerFault.exe 360 5384 4576 WerFault.exe 365 2256 5920 WerFault.exe 370 3436 1520 WerFault.exe 375 4796 2484 WerFault.exe 380 5536 5992 WerFault.exe 384 2624 2888 WerFault.exe 390 5448 2600 WerFault.exe 395 760 2444 WerFault.exe 400 2288 2508 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UVHCG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAJMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRMPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STQXFVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UAYD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RYIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUSTCN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYLLZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBNMXO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TLKZQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCNSG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIZCE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJVPFXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFFDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCAYHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ONYD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GJHUPWE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQBMUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDQXQIP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQCVYTD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BOIP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CVIVPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQWLB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KHAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBGYIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVJYIY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IWJETYU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BJV.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2552 2026-09-24_4e16c9cae453044c847fe1c8d51665a4_elex_emotet_stop.exe 2552 2026-09-24_4e16c9cae453044c847fe1c8d51665a4_elex_emotet_stop.exe 4240 VRMPC.exe 4240 VRMPC.exe 3556 GZHEK.exe 3556 GZHEK.exe 4256 ONYD.exe 4256 ONYD.exe 3460 UAYD.exe 3460 UAYD.exe 612 PWCVTK.exe 612 PWCVTK.exe 1100 CYLLZV.exe 1100 CYLLZV.exe 4764 THNQKSK.exe 4764 THNQKSK.exe 1712 JCEDV.exe 1712 JCEDV.exe 2424 HMHT.exe 2424 HMHT.exe 1268 RVJYIY.exe 1268 RVJYIY.exe 5996 VDQ.exe 5996 VDQ.exe 3472 PQVHE.exe 3472 PQVHE.exe 1624 BGBPIBH.exe 1624 BGBPIBH.exe 4960 ZBAQN.exe 4960 ZBAQN.exe 5476 OWK.exe 5476 OWK.exe 2896 PZOYL.exe 2896 PZOYL.exe 2068 TIUYYZD.exe 2068 TIUYYZD.exe 2832 CQWLB.exe 2832 CQWLB.exe 5600 XDBVLEU.exe 5600 XDBVLEU.exe 3140 JLIVQ.exe 3140 JLIVQ.exe 1160 LJVPFXQ.exe 1160 LJVPFXQ.exe 5508 EWU.exe 5508 EWU.exe 2356 UMI.exe 2356 UMI.exe 2528 UQMAXDE.exe 2528 UQMAXDE.exe 4680 TFFDS.exe 4680 TFFDS.exe 1512 RYIT.exe 1512 RYIT.exe 5512 TWNOIXJ.exe 5512 TWNOIXJ.exe 1392 SHYERL.exe 1392 SHYERL.exe 5172 KHAJ.exe 5172 KHAJ.exe 1544 GMK.exe 1544 GMK.exe 1656 BAPHV.exe 1656 BAPHV.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2552 2026-09-24_4e16c9cae453044c847fe1c8d51665a4_elex_emotet_stop.exe 2552 2026-09-24_4e16c9cae453044c847fe1c8d51665a4_elex_emotet_stop.exe 4240 VRMPC.exe 4240 VRMPC.exe 3556 GZHEK.exe 3556 GZHEK.exe 4256 ONYD.exe 4256 ONYD.exe 3460 UAYD.exe 3460 UAYD.exe 612 PWCVTK.exe 612 PWCVTK.exe 1100 CYLLZV.exe 1100 CYLLZV.exe 4764 THNQKSK.exe 4764 THNQKSK.exe 1712 JCEDV.exe 1712 JCEDV.exe 2424 HMHT.exe 2424 HMHT.exe 1268 RVJYIY.exe 1268 RVJYIY.exe 5996 VDQ.exe 5996 VDQ.exe 3472 PQVHE.exe 3472 PQVHE.exe 1624 BGBPIBH.exe 1624 BGBPIBH.exe 4960 ZBAQN.exe 4960 ZBAQN.exe 5476 OWK.exe 5476 OWK.exe 2896 PZOYL.exe 2896 PZOYL.exe 2068 TIUYYZD.exe 2068 TIUYYZD.exe 2832 CQWLB.exe 2832 CQWLB.exe 5600 XDBVLEU.exe 5600 XDBVLEU.exe 3140 JLIVQ.exe 3140 JLIVQ.exe 1160 LJVPFXQ.exe 1160 LJVPFXQ.exe 5508 EWU.exe 5508 EWU.exe 2356 UMI.exe 2356 UMI.exe 2528 UQMAXDE.exe 2528 UQMAXDE.exe 4680 TFFDS.exe 4680 TFFDS.exe 1512 RYIT.exe 1512 RYIT.exe 5512 TWNOIXJ.exe 5512 TWNOIXJ.exe 1392 SHYERL.exe 1392 SHYERL.exe 5172 KHAJ.exe 5172 KHAJ.exe 1544 GMK.exe 1544 GMK.exe 1656 BAPHV.exe 1656 BAPHV.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2552 wrote to memory of 3628 2552 2026-09-24_4e16c9cae453044c847fe1c8d51665a4_elex_emotet_stop.exe 90 PID 3628 wrote to memory of 4240 3628 cmd.exe 94 PID 4240 wrote to memory of 2296 4240 VRMPC.exe 96 PID 2296 wrote to memory of 3556 2296 cmd.exe 100 PID 3556 wrote to memory of 3392 3556 GZHEK.exe 101 PID 3392 wrote to memory of 4256 3392 cmd.exe 105 PID 4256 wrote to memory of 1172 4256 ONYD.exe 106 PID 1172 wrote to memory of 3460 1172 cmd.exe 110 PID 3460 wrote to memory of 3432 3460 UAYD.exe 111 PID 3432 wrote to memory of 612 3432 cmd.exe 115 PID 612 wrote to memory of 5008 612 PWCVTK.exe 116 PID 5008 wrote to memory of 1100 5008 cmd.exe 120 PID 1100 wrote to memory of 4380 1100 CYLLZV.exe 121 PID 4380 wrote to memory of 4764 4380 cmd.exe 125 PID 4764 wrote to memory of 1696 4764 THNQKSK.exe 126 PID 1696 wrote to memory of 1712 1696 cmd.exe 130 PID 1712 wrote to memory of 2384 1712 JCEDV.exe 131 PID 2384 wrote to memory of 2424 2384 cmd.exe 135 PID 2424 wrote to memory of 4524 2424 HMHT.exe 136 PID 4524 wrote to memory of 1268 4524 cmd.exe 140 PID 1268 wrote to memory of 3236 1268 RVJYIY.exe 141 PID 3236 wrote to memory of 5996 3236 cmd.exe 145 PID 5996 wrote to memory of 5304 5996 VDQ.exe 146 PID 5304 wrote to memory of 3472 5304 cmd.exe 150 PID 3472 wrote to memory of 4936 3472 PQVHE.exe 151 PID 4936 wrote to memory of 1624 4936 cmd.exe 155 PID 1624 wrote to memory of 4532 1624 BGBPIBH.exe 156 PID 4532 wrote to memory of 4960 4532 cmd.exe 160 PID 4960 wrote to memory of 2452 4960 ZBAQN.exe 161 PID 2452 wrote to memory of 5476 2452 cmd.exe 165 PID 5476 wrote to memory of 2916 5476 OWK.exe 166 PID 2916 wrote to memory of 2896 2916 cmd.exe 170 PID 2896 wrote to memory of 5756 2896 PZOYL.exe 171 PID 5756 wrote to memory of 2068 5756 cmd.exe 175 PID 2068 wrote to memory of 1540 2068 TIUYYZD.exe 176 PID 1540 wrote to memory of 2832 1540 cmd.exe 180 PID 2832 wrote to memory of 3584 2832 CQWLB.exe 181 PID 3584 wrote to memory of 5600 3584 cmd.exe 185 PID 5600 wrote to memory of 2732 5600 XDBVLEU.exe 186 PID 2732 wrote to memory of 3140 2732 cmd.exe 190 PID 3140 wrote to memory of 2724 3140 JLIVQ.exe 191 PID 2724 wrote to memory of 1160 2724 cmd.exe 195 PID 1160 wrote to memory of 5964 1160 LJVPFXQ.exe 196 PID 5964 wrote to memory of 5508 5964 cmd.exe 200 PID 5508 wrote to memory of 5888 5508 EWU.exe 201 PID 5888 wrote to memory of 2356 5888 cmd.exe 205 PID 2356 wrote to memory of 4296 2356 UMI.exe 206 PID 4296 wrote to memory of 2528 4296 cmd.exe 210 PID 2528 wrote to memory of 3160 2528 UQMAXDE.exe 211 PID 3160 wrote to memory of 4680 3160 cmd.exe 215 PID 4680 wrote to memory of 4352 4680 TFFDS.exe 216 PID 4352 wrote to memory of 1512 4352 cmd.exe 220 PID 1512 wrote to memory of 5704 1512 RYIT.exe 221 PID 5704 wrote to memory of 5512 5704 cmd.exe 225 PID 5512 wrote to memory of 5560 5512 TWNOIXJ.exe 226 PID 5560 wrote to memory of 1392 5560 cmd.exe 230 PID 1392 wrote to memory of 3060 1392 SHYERL.exe 231 PID 3060 wrote to memory of 5172 3060 cmd.exe 235 PID 5172 wrote to memory of 5796 5172 KHAJ.exe 236 PID 5796 wrote to memory of 1544 5796 cmd.exe 240 PID 1544 wrote to memory of 4340 1544 GMK.exe 241 PID 4340 wrote to memory of 1656 4340 cmd.exe 245 PID 1656 wrote to memory of 2568 1656 BAPHV.exe 246 PID 2568 wrote to memory of 3704 2568 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_4e16c9cae453044c847fe1c8d51665a4_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_4e16c9cae453044c847fe1c8d51665a4_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VRMPC.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\windows\system\VRMPC.exeC:\windows\system\VRMPC.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GZHEK.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\windows\SysWOW64\GZHEK.exeC:\windows\system32\GZHEK.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ONYD.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\windows\system\ONYD.exeC:\windows\system\ONYD.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UAYD.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\windows\system\UAYD.exeC:\windows\system\UAYD.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWCVTK.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\windows\PWCVTK.exeC:\windows\PWCVTK.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYLLZV.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\windows\SysWOW64\CYLLZV.exeC:\windows\system32\CYLLZV.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THNQKSK.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\windows\SysWOW64\THNQKSK.exeC:\windows\system32\THNQKSK.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JCEDV.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\windows\system\JCEDV.exeC:\windows\system\JCEDV.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HMHT.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\windows\SysWOW64\HMHT.exeC:\windows\system32\HMHT.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RVJYIY.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\windows\RVJYIY.exeC:\windows\RVJYIY.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDQ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\windows\SysWOW64\VDQ.exeC:\windows\system32\VDQ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQVHE.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\windows\system\PQVHE.exeC:\windows\system\PQVHE.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BGBPIBH.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\windows\BGBPIBH.exeC:\windows\BGBPIBH.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZBAQN.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\windows\system\ZBAQN.exeC:\windows\system\ZBAQN.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OWK.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\OWK.exeC:\windows\OWK.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PZOYL.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\windows\system\PZOYL.exeC:\windows\system\PZOYL.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TIUYYZD.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\windows\system\TIUYYZD.exeC:\windows\system\TIUYYZD.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQWLB.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\windows\SysWOW64\CQWLB.exeC:\windows\system32\CQWLB.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XDBVLEU.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\windows\XDBVLEU.exeC:\windows\XDBVLEU.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLIVQ.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\windows\JLIVQ.exeC:\windows\JLIVQ.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LJVPFXQ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\windows\system\LJVPFXQ.exeC:\windows\system\LJVPFXQ.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EWU.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\windows\EWU.exeC:\windows\EWU.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UMI.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\windows\SysWOW64\UMI.exeC:\windows\system32\UMI.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UQMAXDE.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\windows\UQMAXDE.exeC:\windows\UQMAXDE.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TFFDS.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\windows\SysWOW64\TFFDS.exeC:\windows\system32\TFFDS.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RYIT.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\windows\system\RYIT.exeC:\windows\system\RYIT.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TWNOIXJ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\windows\SysWOW64\TWNOIXJ.exeC:\windows\system32\TWNOIXJ.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SHYERL.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\windows\SysWOW64\SHYERL.exeC:\windows\system32\SHYERL.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KHAJ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\windows\SysWOW64\KHAJ.exeC:\windows\system32\KHAJ.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GMK.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\windows\system\GMK.exeC:\windows\system\GMK.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BAPHV.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\windows\system\BAPHV.exeC:\windows\system\BAPHV.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OGP.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\windows\OGP.exeC:\windows\OGP.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBGYIK.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4072 -
C:\windows\SysWOW64\DBGYIK.exeC:\windows\system32\DBGYIK.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GJHUPWE.exe.bat" "68⤵PID:3452
-
C:\windows\SysWOW64\GJHUPWE.exeC:\windows\system32\GJHUPWE.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEME.exe.bat" "70⤵PID:2120
-
C:\windows\SysWOW64\BEME.exeC:\windows\system32\BEME.exe71⤵
- Executes dropped EXE
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LCAYHE.exe.bat" "72⤵
- Executes a command shell one-liner
PID:3048 -
C:\windows\SysWOW64\LCAYHE.exeC:\windows\system32\LCAYHE.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NSFKWN.exe.bat" "74⤵PID:3212
-
C:\windows\SysWOW64\NSFKWN.exeC:\windows\system32\NSFKWN.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CIGK.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:4176 -
C:\windows\system\CIGK.exeC:\windows\system\CIGK.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EGUEKRI.exe.bat" "78⤵PID:2960
-
C:\windows\system\EGUEKRI.exeC:\windows\system\EGUEKRI.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQCVYTD.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5864 -
C:\windows\ZQCVYTD.exeC:\windows\ZQCVYTD.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BOIP.exe.bat" "82⤵PID:4092
-
C:\windows\system\BOIP.exeC:\windows\system\BOIP.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CRM.exe.bat" "84⤵
- Executes a command shell one-liner
PID:6116 -
C:\windows\CRM.exeC:\windows\CRM.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LROY.exe.bat" "86⤵PID:1140
-
C:\windows\LROY.exeC:\windows\LROY.exe87⤵
- Executes dropped EXE
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUSTCN.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:5276 -
C:\windows\SysWOW64\MUSTCN.exeC:\windows\system32\MUSTCN.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYDXI.exe.bat" "90⤵PID:4148
-
C:\windows\FYDXI.exeC:\windows\FYDXI.exe91⤵
- Executes dropped EXE
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTHTVBC.exe.bat" "92⤵PID:4228
-
C:\windows\FTHTVBC.exeC:\windows\FTHTVBC.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HQNNDJL.exe.bat" "94⤵
- Executes a command shell one-liner
PID:2828 -
C:\windows\system\HQNNDJL.exeC:\windows\system\HQNNDJL.exe95⤵
- Executes dropped EXE
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ITR.exe.bat" "96⤵
- Executes a command shell one-liner
PID:3308 -
C:\windows\SysWOW64\ITR.exeC:\windows\system32\ITR.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CHVAS.exe.bat" "98⤵PID:3860
-
C:\windows\CHVAS.exeC:\windows\CHVAS.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SKF.exe.bat" "100⤵
- Executes a command shell one-liner
PID:2588 -
C:\windows\system\SKF.exeC:\windows\system\SKF.exe101⤵
- Executes dropped EXE
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAGEKHZ.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4084 -
C:\windows\HAGEKHZ.exeC:\windows\HAGEKHZ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WVXI.exe.bat" "104⤵PID:3548
-
C:\windows\system\WVXI.exeC:\windows\system\WVXI.exe105⤵
- Executes dropped EXE
PID:1788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YTDDKCI.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:768 -
C:\windows\SysWOW64\YTDDKCI.exeC:\windows\system32\YTDDKCI.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGIM.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:3596 -
C:\windows\system\TGIM.exeC:\windows\system\TGIM.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IWJETYU.exe.bat" "110⤵PID:1916
-
C:\windows\SysWOW64\IWJETYU.exeC:\windows\system32\IWJETYU.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MEPM.exe.bat" "112⤵PID:3696
-
C:\windows\SysWOW64\MEPM.exeC:\windows\system32\MEPM.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PZUVQI.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1976 -
C:\windows\system\PZUVQI.exeC:\windows\system\PZUVQI.exe115⤵
- Executes dropped EXE
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THBV.exe.bat" "116⤵PID:980
-
C:\windows\THBV.exeC:\windows\THBV.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JSZT.exe.bat" "118⤵
- Executes a command shell one-liner
PID:6024 -
C:\windows\JSZT.exeC:\windows\JSZT.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IQKWPAW.exe.bat" "120⤵PID:4696
-
C:\windows\SysWOW64\IQKWPAW.exeC:\windows\system32\IQKWPAW.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-