Analysis
- max time kernel
83s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 12:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_3070a40de63cd1d7fe83ea138693a3e5_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-24_3070a40de63cd1d7fe83ea138693a3e5_elex_emotet_stop.exe
- Size 208KB
- Sample260925-pre97awdqe
- SHA256 0d70cce3f567cda3da27d9b69b81d64728cc63587be3977602e775a47a974df3
- MD5 3070a40de63cd1d7fe83ea138693a3e5
- SHA1 04ef630f72a79fb1b41af9d000c940ada6283433
- SHA512 b98b439410c4cea01e759b4dcfdfe29c8f962ee1209f710eb1fa7db39fddb3c0fe06fd291de4b7b1bfce96054ed4d38d4287d50d1b6a0410d34c97ad054883e6
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlOdL+LOf74pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlO5+LOTkEj1
- TLSH T1DF247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1636 VUTH.exe 672 IKPCGD.exe 4916 QQUIR.exe 4616 LLLKKV.exe 720 CLZPXM.exe 1368 YRZTZ.exe 4380 OCKJ.exe 3532 YAQDPM.exe 5160 BNHFIXY.exe 760 MBGLFZV.exe 4848 ILWCU.exe 4984 XBXB.exe 3268 XPC.exe 4536 FUP.exe 5872 AFXNKN.exe 1512 ZQIDS.exe 712 MBQ.exe 4284 SWCUM.exe 2200 IED.exe 2804 IHTI.exe 4952 UXAQMI.exe 1876 NAD.exe 6136 TNDUWB.exe 4840 IQMZ.exe 4260 KGA.exe 4976 JZCJF.exe 1468 YPDA.exe 3380 OKNFXS.exe 5036 GNZ.exe 3448 SVF.exe 960 QRFR.exe 3132 LBNIHGY.exe 1332 VCPVL.exe 1196 IMX.exe 2072 HXICIUS.exe 2008 FILSQI.exe 4932 GLP.exe 5824 RDE.exe 3092 QOHOOFU.exe 2980 AMNJ.exe 4880 TPQ.exe 5028 DNEZQM.exe 5716 QYNXEW.exe 1844 QDNMGB.exe 4888 UJXBW.exe 5360 COKI.exe 4640 OCRGM.exe 2112 RXAPXQ.exe 3812 ZDMWI.exe 2116 ZGQSNNK.exe 5044 UTVJ.exe 5364 DTXOBKB.exe 5404 AZDLQUV.exe 4852 YKGTZA.exe 3312 RNJ.exe 908 VDQXQIP.exe 3492 WYUB.exe 5464 OBYWBW.exe 4332 AJMEO.exe 4660 EZT.exe 932 OZVK.exe 1440 OCZNJU.exe 5936 DXIS.exe 4328 NFKXFMY.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\JIUYMM.exe OVQO.exe File created C:\windows\SysWOW64\BKNHTS.exe LUMPM.exe File created C:\windows\SysWOW64\EAUPF.exe.bat BKNHTS.exe File opened for modification C:\windows\SysWOW64\ZWL.exe HVJHCO.exe File opened for modification C:\windows\SysWOW64\IHTI.exe IED.exe File created C:\windows\SysWOW64\YPDA.exe.bat JZCJF.exe File created C:\windows\SysWOW64\AMNJ.exe QOHOOFU.exe File opened for modification C:\windows\SysWOW64\YKGTZA.exe AZDLQUV.exe File created C:\windows\SysWOW64\DEXFEOI.exe NJOA.exe File created C:\windows\SysWOW64\KFJGPCD.exe.bat AHVU.exe File created C:\windows\SysWOW64\ZWL.exe.bat HVJHCO.exe File created C:\windows\SysWOW64\IHTI.exe.bat IED.exe File created C:\windows\SysWOW64\HXICIUS.exe IMX.exe File opened for modification C:\windows\SysWOW64\VDQXQIP.exe RNJ.exe File created C:\windows\SysWOW64\HJO.exe.bat YBMHLJP.exe File opened for modification C:\windows\SysWOW64\BWDC.exe XTEPTR.exe File opened for modification C:\windows\SysWOW64\SWCUM.exe MBQ.exe File created C:\windows\SysWOW64\IHTI.exe IED.exe File opened for modification C:\windows\SysWOW64\YPDA.exe JZCJF.exe File created C:\windows\SysWOW64\COKI.exe.bat UJXBW.exe File created C:\windows\SysWOW64\NJOA.exe.bat NFKXFMY.exe File created C:\windows\SysWOW64\BWDC.exe.bat XTEPTR.exe File opened for modification C:\windows\SysWOW64\LLLKKV.exe QQUIR.exe File created C:\windows\SysWOW64\YKGTZA.exe AZDLQUV.exe File created C:\windows\SysWOW64\RNJ.exe YKGTZA.exe File created C:\windows\SysWOW64\AJMEO.exe.bat OBYWBW.exe File created C:\windows\SysWOW64\EBLZLX.exe DEXFEOI.exe File created C:\windows\SysWOW64\EAUPF.exe BKNHTS.exe File created C:\windows\SysWOW64\TSD.exe JUQK.exe File created C:\windows\SysWOW64\HXICIUS.exe.bat IMX.exe File created C:\windows\SysWOW64\WYUB.exe VDQXQIP.exe File created C:\windows\SysWOW64\WYUB.exe.bat VDQXQIP.exe File created C:\windows\SysWOW64\EPSLZBG.exe LPCAQAY.exe File opened for modification C:\windows\SysWOW64\EPSLZBG.exe LPCAQAY.exe File created C:\windows\SysWOW64\ZWL.exe HVJHCO.exe File opened for modification C:\windows\SysWOW64\EBLZLX.exe DEXFEOI.exe File created C:\windows\SysWOW64\AMNJ.exe.bat QOHOOFU.exe File created C:\windows\SysWOW64\TPQ.exe.bat AMNJ.exe File opened for modification C:\windows\SysWOW64\GLP.exe FILSQI.exe File created C:\windows\SysWOW64\YKGTZA.exe.bat AZDLQUV.exe File created C:\windows\SysWOW64\EBLZLX.exe.bat DEXFEOI.exe File created C:\windows\SysWOW64\SWCUM.exe MBQ.exe File opened for modification C:\windows\SysWOW64\DEXFEOI.exe NJOA.exe File created C:\windows\SysWOW64\JIUYMM.exe OVQO.exe File opened for modification C:\windows\SysWOW64\TSD.exe JUQK.exe File created C:\windows\SysWOW64\TSD.exe.bat JUQK.exe File created C:\windows\SysWOW64\YPDA.exe JZCJF.exe File created C:\windows\SysWOW64\VDQXQIP.exe.bat RNJ.exe File created C:\windows\SysWOW64\IXYTL.exe EPSLZBG.exe File created C:\windows\SysWOW64\JIUYMM.exe.bat OVQO.exe File created C:\windows\SysWOW64\LUMPM.exe.bat HMGHAFQ.exe File created C:\windows\SysWOW64\BKNHTS.exe.bat LUMPM.exe File created C:\windows\SysWOW64\SWCUM.exe.bat MBQ.exe File created C:\windows\SysWOW64\GLP.exe.bat FILSQI.exe File created C:\windows\SysWOW64\COKI.exe UJXBW.exe File opened for modification C:\windows\SysWOW64\KFJGPCD.exe AHVU.exe File created C:\windows\SysWOW64\LUMPM.exe HMGHAFQ.exe File opened for modification C:\windows\SysWOW64\EAUPF.exe BKNHTS.exe File created C:\windows\SysWOW64\FEJKFC.exe BWDC.exe File created C:\windows\SysWOW64\QDNMGB.exe QYNXEW.exe File created C:\windows\SysWOW64\YAQDPM.exe OCKJ.exe File created C:\windows\SysWOW64\YAQDPM.exe.bat OCKJ.exe File opened for modification C:\windows\SysWOW64\AMNJ.exe QOHOOFU.exe File opened for modification C:\windows\SysWOW64\COKI.exe UJXBW.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\ELYXH.exe.bat TSD.exe File created C:\windows\AFXNKN.exe.bat FUP.exe File created C:\windows\MBQ.exe ZQIDS.exe File opened for modification C:\windows\RDE.exe GLP.exe File created C:\windows\system\ZGQSNNK.exe.bat ZDMWI.exe File opened for modification C:\windows\DTXOBKB.exe UTVJ.exe File created C:\windows\system\DXIS.exe.bat OCZNJU.exe File created C:\windows\system\LVGY.exe NFUDHQ.exe File created C:\windows\system\SWP.exe.bat ELYXH.exe File created C:\windows\system\XPC.exe.bat XBXB.exe File opened for modification C:\windows\NAD.exe UXAQMI.exe File created C:\windows\VCPVL.exe LBNIHGY.exe File opened for modification C:\windows\system\ZDMWI.exe RXAPXQ.exe File created C:\windows\DTXOBKB.exe.bat UTVJ.exe File opened for modification C:\windows\RGAYPQ.exe IXYTL.exe File created C:\windows\HMGHAFQ.exe.bat DWZ.exe File opened for modification C:\windows\system\HVJHCO.exe PSF.exe File opened for modification C:\windows\IKPCGD.exe VUTH.exe File created C:\windows\system\YRZTZ.exe.bat CLZPXM.exe File opened for modification C:\windows\OKNFXS.exe YPDA.exe File created C:\windows\RGAYPQ.exe.bat IXYTL.exe File created C:\windows\system\YBMHLJP.exe IGCD.exe File opened for modification C:\windows\system\XSDYLT.exe ZUS.exe File created C:\windows\system\ELYXH.exe TSD.exe File created C:\windows\system\SWP.exe ELYXH.exe File created C:\windows\BNHFIXY.exe YAQDPM.exe File created C:\windows\system\XPC.exe XBXB.exe File opened for modification C:\windows\TNDUWB.exe NAD.exe File created C:\windows\IMX.exe VCPVL.exe File created C:\windows\system\DXIS.exe OCZNJU.exe File created C:\windows\UDILXA.exe.bat LVGY.exe File created C:\windows\ZUS.exe GROA.exe File created C:\windows\MBQ.exe.bat ZQIDS.exe File created C:\windows\HMGHAFQ.exe DWZ.exe File created C:\windows\system\HVJHCO.exe.bat PSF.exe File created C:\windows\system\XTEPTR.exe ZWL.exe File opened for modification C:\windows\system\XTEPTR.exe ZWL.exe File created C:\windows\MJUX.exe.bat SWP.exe File created C:\windows\system\MBGLFZV.exe.bat BNHFIXY.exe File opened for modification C:\windows\system\GNZ.exe OKNFXS.exe File created C:\windows\system\GNZ.exe.bat OKNFXS.exe File created C:\windows\system\LBNIHGY.exe.bat QRFR.exe File created C:\windows\AHVU.exe.bat UUWLDR.exe File created C:\windows\UDILXA.exe LVGY.exe File opened for modification C:\windows\JUQK.exe FEJKFC.exe File opened for modification C:\windows\system\ELYXH.exe TSD.exe File created C:\windows\QQUIR.exe IKPCGD.exe File opened for modification C:\windows\system\MBGLFZV.exe BNHFIXY.exe File opened for modification C:\windows\ZQIDS.exe AFXNKN.exe File created C:\windows\IED.exe.bat SWCUM.exe File created C:\windows\NFKXFMY.exe.bat DXIS.exe File created C:\windows\IKPCGD.exe.bat VUTH.exe File opened for modification C:\windows\ILWCU.exe MBGLFZV.exe File created C:\windows\KGA.exe IQMZ.exe File created C:\windows\FILSQI.exe.bat HXICIUS.exe File created C:\windows\system\OZVK.exe.bat EZT.exe File created C:\windows\VUTH.exe 2026-09-24_3070a40de63cd1d7fe83ea138693a3e5_elex_emotet_stop.exe File created C:\windows\IED.exe SWCUM.exe File created C:\windows\system\GNZ.exe OKNFXS.exe File created C:\windows\EZT.exe AJMEO.exe File created C:\windows\UUWLDR.exe.bat HJO.exe File opened for modification C:\windows\ZUS.exe GROA.exe File created C:\windows\VUTH.exe.bat 2026-09-24_3070a40de63cd1d7fe83ea138693a3e5_elex_emotet_stop.exe File opened for modification C:\windows\system\XBXB.exe ILWCU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4296 cmd.exe 4688 cmd.exe 4288 cmd.exe 5880 cmd.exe 952 cmd.exe 4268 cmd.exe 916 cmd.exe 4212 cmd.exe 4512 cmd.exe 988 cmd.exe 5172 cmd.exe 1424 cmd.exe 4144 cmd.exe 6044 cmd.exe 1536 cmd.exe 1852 cmd.exe 1008 cmd.exe 3876 cmd.exe 3360 cmd.exe 5672 cmd.exe 2028 cmd.exe 3732 cmd.exe 5728 cmd.exe 2828 cmd.exe 4636 cmd.exe 2304 cmd.exe 5460 cmd.exe 4156 cmd.exe 1472 cmd.exe 1496 cmd.exe 5944 cmd.exe 4796 cmd.exe 5268 cmd.exe 5348 cmd.exe 3424 cmd.exe 4460 cmd.exe 2832 cmd.exe 5168 cmd.exe 4944 cmd.exe 4376 cmd.exe 716 cmd.exe 3488 cmd.exe 4896 cmd.exe 1248 cmd.exe 4256 cmd.exe 4336 cmd.exe 4504 cmd.exe 2724 cmd.exe 2468 cmd.exe 5892 cmd.exe 4780 cmd.exe 5972 cmd.exe 4868 cmd.exe 5512 cmd.exe 3096 cmd.exe 2076 cmd.exe 5820 cmd.exe 3032 cmd.exe 1556 cmd.exe 1168 cmd.exe 1284 cmd.exe 5096 cmd.exe 1756 cmd.exe 5232 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4988 4372 WerFault.exe 87 3488 1636 WerFault.exe 93 5800 672 WerFault.exe 99 3524 4916 WerFault.exe 104 4304 4616 WerFault.exe 109 1004 720 WerFault.exe 113 1744 1368 WerFault.exe 119 2556 4380 WerFault.exe 124 1000 3532 WerFault.exe 129 3620 5160 WerFault.exe 134 1440 760 WerFault.exe 139 3264 4848 WerFault.exe 144 3500 4984 WerFault.exe 149 4588 3268 WerFault.exe 154 2856 4536 WerFault.exe 159 1860 5872 WerFault.exe 164 2800 1512 WerFault.exe 169 5932 712 WerFault.exe 174 1116 4284 WerFault.exe 179 4760 2200 WerFault.exe 184 5560 2804 WerFault.exe 189 2196 4952 WerFault.exe 194 2420 1876 WerFault.exe 199 5512 6136 WerFault.exe 204 2756 4840 WerFault.exe 209 4744 4260 WerFault.exe 214 2020 4976 WerFault.exe 219 6048 1468 WerFault.exe 223 1896 3380 WerFault.exe 229 5032 5036 WerFault.exe 234 3392 3448 WerFault.exe 239 2760 960 WerFault.exe 244 4164 3132 WerFault.exe 249 4092 1332 WerFault.exe 254 4888 1196 WerFault.exe 259 2300 2072 WerFault.exe 264 4640 2008 WerFault.exe 269 2528 4932 WerFault.exe 274 6024 5824 WerFault.exe 279 5236 3092 WerFault.exe 284 4844 2980 WerFault.exe 289 2296 4880 WerFault.exe 294 5632 5028 WerFault.exe 299 4668 5716 WerFault.exe 303 4924 1844 WerFault.exe 309 2308 4888 WerFault.exe 314 800 5360 WerFault.exe 319 1012 4640 WerFault.exe 324 3676 2112 WerFault.exe 329 5236 3812 WerFault.exe 334 5944 2116 WerFault.exe 339 3420 5044 WerFault.exe 344 2196 5364 WerFault.exe 349 5936 5404 WerFault.exe 354 1212 4852 WerFault.exe 359 2916 3312 WerFault.exe 364 2212 908 WerFault.exe 369 4396 3492 WerFault.exe 374 2556 5464 WerFault.exe 379 5016 4332 WerFault.exe 384 4652 4660 WerFault.exe 389 2792 932 WerFault.exe 394 1344 1440 WerFault.exe 399 3516 5936 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IED.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YKGTZA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EPSLZBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXYTL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDMWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYUB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UXAQMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFKXFMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DWZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QOHOOFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OCRGM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNDUWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDQXQIP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVJHCO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IGCD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUMPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KFJGPCD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELYXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILWCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LPCAQAY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFUDHQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YAQDPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UJXBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZGQSNNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQIDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4372 2026-09-24_3070a40de63cd1d7fe83ea138693a3e5_elex_emotet_stop.exe 4372 2026-09-24_3070a40de63cd1d7fe83ea138693a3e5_elex_emotet_stop.exe 1636 VUTH.exe 1636 VUTH.exe 672 IKPCGD.exe 672 IKPCGD.exe 4916 QQUIR.exe 4916 QQUIR.exe 4616 LLLKKV.exe 4616 LLLKKV.exe 720 CLZPXM.exe 720 CLZPXM.exe 1368 YRZTZ.exe 1368 YRZTZ.exe 4380 OCKJ.exe 4380 OCKJ.exe 3532 YAQDPM.exe 3532 YAQDPM.exe 5160 BNHFIXY.exe 5160 BNHFIXY.exe 760 MBGLFZV.exe 760 MBGLFZV.exe 4848 ILWCU.exe 4848 ILWCU.exe 4984 XBXB.exe 4984 XBXB.exe 3268 XPC.exe 3268 XPC.exe 4536 FUP.exe 4536 FUP.exe 5872 AFXNKN.exe 5872 AFXNKN.exe 1512 ZQIDS.exe 1512 ZQIDS.exe 712 MBQ.exe 712 MBQ.exe 4284 SWCUM.exe 4284 SWCUM.exe 2200 IED.exe 2200 IED.exe 2804 IHTI.exe 2804 IHTI.exe 4952 UXAQMI.exe 4952 UXAQMI.exe 1876 NAD.exe 1876 NAD.exe 6136 TNDUWB.exe 6136 TNDUWB.exe 4840 IQMZ.exe 4840 IQMZ.exe 4260 KGA.exe 4260 KGA.exe 4976 JZCJF.exe 4976 JZCJF.exe 1468 YPDA.exe 1468 YPDA.exe 3380 OKNFXS.exe 3380 OKNFXS.exe 5036 GNZ.exe 5036 GNZ.exe 3448 SVF.exe 3448 SVF.exe 960 QRFR.exe 960 QRFR.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4372 2026-09-24_3070a40de63cd1d7fe83ea138693a3e5_elex_emotet_stop.exe 4372 2026-09-24_3070a40de63cd1d7fe83ea138693a3e5_elex_emotet_stop.exe 1636 VUTH.exe 1636 VUTH.exe 672 IKPCGD.exe 672 IKPCGD.exe 4916 QQUIR.exe 4916 QQUIR.exe 4616 LLLKKV.exe 4616 LLLKKV.exe 720 CLZPXM.exe 720 CLZPXM.exe 1368 YRZTZ.exe 1368 YRZTZ.exe 4380 OCKJ.exe 4380 OCKJ.exe 3532 YAQDPM.exe 3532 YAQDPM.exe 5160 BNHFIXY.exe 5160 BNHFIXY.exe 760 MBGLFZV.exe 760 MBGLFZV.exe 4848 ILWCU.exe 4848 ILWCU.exe 4984 XBXB.exe 4984 XBXB.exe 3268 XPC.exe 3268 XPC.exe 4536 FUP.exe 4536 FUP.exe 5872 AFXNKN.exe 5872 AFXNKN.exe 1512 ZQIDS.exe 1512 ZQIDS.exe 712 MBQ.exe 712 MBQ.exe 4284 SWCUM.exe 4284 SWCUM.exe 2200 IED.exe 2200 IED.exe 2804 IHTI.exe 2804 IHTI.exe 4952 UXAQMI.exe 4952 UXAQMI.exe 1876 NAD.exe 1876 NAD.exe 6136 TNDUWB.exe 6136 TNDUWB.exe 4840 IQMZ.exe 4840 IQMZ.exe 4260 KGA.exe 4260 KGA.exe 4976 JZCJF.exe 4976 JZCJF.exe 1468 YPDA.exe 1468 YPDA.exe 3380 OKNFXS.exe 3380 OKNFXS.exe 5036 GNZ.exe 5036 GNZ.exe 3448 SVF.exe 3448 SVF.exe 960 QRFR.exe 960 QRFR.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4372 wrote to memory of 3800 4372 2026-09-24_3070a40de63cd1d7fe83ea138693a3e5_elex_emotet_stop.exe 89 PID 3800 wrote to memory of 1636 3800 cmd.exe 93 PID 1636 wrote to memory of 5248 1636 VUTH.exe 95 PID 5248 wrote to memory of 672 5248 cmd.exe 99 PID 672 wrote to memory of 3212 672 IKPCGD.exe 100 PID 3212 wrote to memory of 4916 3212 cmd.exe 104 PID 4916 wrote to memory of 4468 4916 QQUIR.exe 105 PID 4468 wrote to memory of 4616 4468 cmd.exe 109 PID 4616 wrote to memory of 3404 4616 LLLKKV.exe 110 PID 3404 wrote to memory of 720 3404 cmd.exe 113 PID 720 wrote to memory of 5228 720 CLZPXM.exe 115 PID 5228 wrote to memory of 1368 5228 cmd.exe 119 PID 1368 wrote to memory of 2068 1368 YRZTZ.exe 120 PID 2068 wrote to memory of 4380 2068 cmd.exe 124 PID 4380 wrote to memory of 5244 4380 OCKJ.exe 125 PID 5244 wrote to memory of 3532 5244 cmd.exe 129 PID 3532 wrote to memory of 4512 3532 YAQDPM.exe 130 PID 4512 wrote to memory of 5160 4512 cmd.exe 134 PID 5160 wrote to memory of 6044 5160 BNHFIXY.exe 135 PID 6044 wrote to memory of 760 6044 cmd.exe 139 PID 760 wrote to memory of 4220 760 MBGLFZV.exe 140 PID 4220 wrote to memory of 4848 4220 cmd.exe 144 PID 4848 wrote to memory of 5348 4848 ILWCU.exe 145 PID 5348 wrote to memory of 4984 5348 cmd.exe 149 PID 4984 wrote to memory of 2892 4984 XBXB.exe 150 PID 2892 wrote to memory of 3268 2892 cmd.exe 154 PID 3268 wrote to memory of 4492 3268 XPC.exe 155 PID 4492 wrote to memory of 4536 4492 cmd.exe 159 PID 4536 wrote to memory of 5724 4536 FUP.exe 160 PID 5724 wrote to memory of 5872 5724 cmd.exe 164 PID 5872 wrote to memory of 3348 5872 AFXNKN.exe 165 PID 3348 wrote to memory of 1512 3348 cmd.exe 169 PID 1512 wrote to memory of 1740 1512 ZQIDS.exe 170 PID 1740 wrote to memory of 712 1740 cmd.exe 174 PID 712 wrote to memory of 1536 712 MBQ.exe 175 PID 1536 wrote to memory of 4284 1536 cmd.exe 179 PID 4284 wrote to memory of 1452 4284 SWCUM.exe 180 PID 1452 wrote to memory of 2200 1452 cmd.exe 184 PID 2200 wrote to memory of 1232 2200 IED.exe 185 PID 1232 wrote to memory of 2804 1232 cmd.exe 189 PID 2804 wrote to memory of 3096 2804 IHTI.exe 190 PID 3096 wrote to memory of 4952 3096 cmd.exe 194 PID 4952 wrote to memory of 1472 4952 UXAQMI.exe 195 PID 1472 wrote to memory of 1876 1472 cmd.exe 199 PID 1876 wrote to memory of 1852 1876 NAD.exe 200 PID 1852 wrote to memory of 6136 1852 cmd.exe 204 PID 6136 wrote to memory of 4344 6136 TNDUWB.exe 205 PID 4344 wrote to memory of 4840 4344 cmd.exe 209 PID 4840 wrote to memory of 4296 4840 IQMZ.exe 210 PID 4296 wrote to memory of 4260 4296 cmd.exe 214 PID 4260 wrote to memory of 4152 4260 KGA.exe 215 PID 4152 wrote to memory of 4976 4152 cmd.exe 219 PID 4976 wrote to memory of 2724 4976 JZCJF.exe 220 PID 2724 wrote to memory of 1468 2724 cmd.exe 223 PID 1468 wrote to memory of 1756 1468 YPDA.exe 225 PID 1756 wrote to memory of 3380 1756 cmd.exe 229 PID 3380 wrote to memory of 2608 3380 OKNFXS.exe 230 PID 2608 wrote to memory of 5036 2608 cmd.exe 234 PID 5036 wrote to memory of 5848 5036 GNZ.exe 235 PID 5848 wrote to memory of 3448 5848 cmd.exe 239 PID 3448 wrote to memory of 1352 3448 SVF.exe 240 PID 1352 wrote to memory of 960 1352 cmd.exe 244 PID 960 wrote to memory of 3376 960 QRFR.exe 245 PID 3376 wrote to memory of 3132 3376 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_3070a40de63cd1d7fe83ea138693a3e5_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_3070a40de63cd1d7fe83ea138693a3e5_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUTH.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\windows\VUTH.exeC:\windows\VUTH.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IKPCGD.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\windows\IKPCGD.exeC:\windows\IKPCGD.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QQUIR.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\windows\QQUIR.exeC:\windows\QQUIR.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LLLKKV.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\SysWOW64\LLLKKV.exeC:\windows\system32\LLLKKV.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLZPXM.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\windows\system\CLZPXM.exeC:\windows\system\CLZPXM.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YRZTZ.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\windows\system\YRZTZ.exeC:\windows\system\YRZTZ.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OCKJ.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\windows\system\OCKJ.exeC:\windows\system\OCKJ.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAQDPM.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\windows\SysWOW64\YAQDPM.exeC:\windows\system32\YAQDPM.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNHFIXY.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\windows\BNHFIXY.exeC:\windows\BNHFIXY.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MBGLFZV.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\windows\system\MBGLFZV.exeC:\windows\system\MBGLFZV.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ILWCU.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\windows\ILWCU.exeC:\windows\ILWCU.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XBXB.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\windows\system\XBXB.exeC:\windows\system\XBXB.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPC.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\system\XPC.exeC:\windows\system\XPC.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FUP.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\windows\system\FUP.exeC:\windows\system\FUP.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFXNKN.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\windows\AFXNKN.exeC:\windows\AFXNKN.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQIDS.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\windows\ZQIDS.exeC:\windows\ZQIDS.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MBQ.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\windows\MBQ.exeC:\windows\MBQ.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SWCUM.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\windows\SysWOW64\SWCUM.exeC:\windows\system32\SWCUM.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IED.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\windows\IED.exeC:\windows\IED.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHTI.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\windows\SysWOW64\IHTI.exeC:\windows\system32\IHTI.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UXAQMI.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\windows\system\UXAQMI.exeC:\windows\system\UXAQMI.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NAD.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\windows\NAD.exeC:\windows\NAD.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TNDUWB.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\windows\TNDUWB.exeC:\windows\TNDUWB.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IQMZ.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\system\IQMZ.exeC:\windows\system\IQMZ.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGA.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\windows\KGA.exeC:\windows\KGA.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZCJF.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\windows\JZCJF.exeC:\windows\JZCJF.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YPDA.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\windows\SysWOW64\YPDA.exeC:\windows\system32\YPDA.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OKNFXS.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\windows\OKNFXS.exeC:\windows\OKNFXS.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GNZ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\windows\system\GNZ.exeC:\windows\system\GNZ.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SVF.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\windows\system\SVF.exeC:\windows\system\SVF.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QRFR.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\windows\system\QRFR.exeC:\windows\system\QRFR.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LBNIHGY.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\windows\system\LBNIHGY.exeC:\windows\system\LBNIHGY.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VCPVL.exe.bat" "66⤵
- Executes a command shell one-liner
PID:3424 -
C:\windows\VCPVL.exeC:\windows\VCPVL.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMX.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4688 -
C:\windows\IMX.exeC:\windows\IMX.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXICIUS.exe.bat" "70⤵PID:5312
-
C:\windows\SysWOW64\HXICIUS.exeC:\windows\system32\HXICIUS.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FILSQI.exe.bat" "72⤵PID:556
-
C:\windows\FILSQI.exeC:\windows\FILSQI.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GLP.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4288 -
C:\windows\SysWOW64\GLP.exeC:\windows\system32\GLP.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDE.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2076 -
C:\windows\RDE.exeC:\windows\RDE.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QOHOOFU.exe.bat" "78⤵PID:3048
-
C:\windows\system\QOHOOFU.exeC:\windows\system\QOHOOFU.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AMNJ.exe.bat" "80⤵PID:4788
-
C:\windows\SysWOW64\AMNJ.exeC:\windows\system32\AMNJ.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TPQ.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4780 -
C:\windows\SysWOW64\TPQ.exeC:\windows\system32\TPQ.exe83⤵
- Executes dropped EXE
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNEZQM.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4460 -
C:\windows\system\DNEZQM.exeC:\windows\system\DNEZQM.exe85⤵
- Executes dropped EXE
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYNXEW.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2832 -
C:\windows\QYNXEW.exeC:\windows\QYNXEW.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QDNMGB.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3732 -
C:\windows\SysWOW64\QDNMGB.exeC:\windows\system32\QDNMGB.exe89⤵
- Executes dropped EXE
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UJXBW.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3488 -
C:\windows\UJXBW.exeC:\windows\UJXBW.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COKI.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:3836 -
C:\windows\SysWOW64\COKI.exeC:\windows\system32\COKI.exe93⤵
- Executes dropped EXE
PID:5360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OCRGM.exe.bat" "94⤵PID:1828
-
C:\windows\system\OCRGM.exeC:\windows\system\OCRGM.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RXAPXQ.exe.bat" "96⤵PID:1924
-
C:\windows\system\RXAPXQ.exeC:\windows\system\RXAPXQ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZDMWI.exe.bat" "98⤵PID:2032
-
C:\windows\system\ZDMWI.exeC:\windows\system\ZDMWI.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGQSNNK.exe.bat" "100⤵
- Executes a command shell one-liner
PID:1008 -
C:\windows\system\ZGQSNNK.exeC:\windows\system\ZGQSNNK.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTVJ.exe.bat" "102⤵PID:2912
-
C:\windows\system\UTVJ.exeC:\windows\system\UTVJ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DTXOBKB.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4896 -
C:\windows\DTXOBKB.exeC:\windows\DTXOBKB.exe105⤵
- Executes dropped EXE
PID:5364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AZDLQUV.exe.bat" "106⤵PID:1348
-
C:\windows\AZDLQUV.exeC:\windows\AZDLQUV.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YKGTZA.exe.bat" "108⤵PID:6104
-
C:\windows\SysWOW64\YKGTZA.exeC:\windows\system32\YKGTZA.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RNJ.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5728 -
C:\windows\SysWOW64\RNJ.exeC:\windows\system32\RNJ.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDQXQIP.exe.bat" "112⤵
- Executes a command shell one-liner
PID:1496 -
C:\windows\SysWOW64\VDQXQIP.exeC:\windows\system32\VDQXQIP.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYUB.exe.bat" "114⤵PID:1780
-
C:\windows\SysWOW64\WYUB.exeC:\windows\system32\WYUB.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OBYWBW.exe.bat" "116⤵PID:1012
-
C:\windows\system\OBYWBW.exeC:\windows\system\OBYWBW.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJMEO.exe.bat" "118⤵PID:2736
-
C:\windows\SysWOW64\AJMEO.exeC:\windows\system32\AJMEO.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EZT.exe.bat" "120⤵PID:2800
-
C:\windows\EZT.exeC:\windows\EZT.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-