Analysis
- max time kernel
109s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/09/2026, 02:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-27_91f1cac75b1a52b748e0aceca52a49c0_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-27_91f1cac75b1a52b748e0aceca52a49c0_elex_emotet_stop.exe
- Size 208KB
- Sample260928-dd4j3stdkh
- SHA256 fb4f16d63a0a278c60ec164cb7071a83481bd581630ca619c82e92b1adcc03d7
- MD5 91f1cac75b1a52b748e0aceca52a49c0
- SHA1 342b44d88a47984dab70098d5301f8e809dc32ff
- SHA512 bf88260fdbf7341a7d6f02d65292f67065b1e46b4a9bac388f809acc7efbe783af338369e17fdf331d3b6bab37d3ff7e17a3bf6899828344d0b16a747810e436
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfT4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LO7kEj1
- TLSH T108247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5188 JAREHJ.exe 3260 FFL.exe 3816 JIJDSH.exe 4524 RTKWGL.exe 1420 KWWAL.exe 2604 EJSJVBK.exe 2492 KKAXMDM.exe 2612 SPA.exe 2008 NKFV.exe 3604 KLNJHKF.exe 5620 QLUW.exe 5360 YRULS.exe 2036 WRCZBUK.exe 5056 XUGC.exe 1612 GUIHS.exe 1712 JIFRCHK.exe 4168 DDKA.exe 1104 HLY.exe 2696 LTFIDR.exe 3772 VRK.exe 4428 TMKDPD.exe 3052 OZO.exe 1000 QVTW.exe 4516 LIYGTC.exe 3976 ADHS.exe 5852 VQMBPP.exe 1980 XOFWNM.exe 2732 GBQODIT.exe 3512 OHQ.exe 3952 HKUGSLX.exe 2280 YXE.exe 1764 SLJH.exe 5904 SQBWL.exe 4476 NDGFWMR.exe 4088 JJMC.exe 5304 EWRMN.exe 1520 BCXJU.exe 4268 VPBSEFZ.exe 2444 GIW.exe 3028 KYLLZ.exe 4676 QYL.exe 264 AYNELF.exe 2172 FZURUH.exe 4332 TKYYHYB.exe 1156 NXDH.exe 4280 XXFMVW.exe 3888 IQAFVDI.exe 2120 OQIT.exe 2352 ILNCPF.exe 4872 OMUQGZ.exe 4604 FWLOFU.exe 2472 WCVG.exe 5308 THBV.exe 4460 TNBJ.exe 4320 EFWCMU.exe 6068 KGE.exe 1820 JYM.exe 1160 QULSFE.exe 3004 HZWKVAW.exe 5028 JXPMBXM.exe 6108 DKUW.exe 2468 HAJWQI.exe 4900 EYG.exe 2448 YTLCH.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\JIJDSH.exe FFL.exe File created C:\windows\SysWOW64\YBO.exe YNNVUUH.exe File opened for modification C:\windows\SysWOW64\WKKU.exe NCI.exe File opened for modification C:\windows\SysWOW64\KYLLZ.exe GIW.exe File created C:\windows\SysWOW64\QYL.exe KYLLZ.exe File created C:\windows\SysWOW64\KGE.exe.bat EFWCMU.exe File created C:\windows\SysWOW64\EJSJVBK.exe.bat KWWAL.exe File created C:\windows\SysWOW64\TKYYHYB.exe FZURUH.exe File opened for modification C:\windows\SysWOW64\KGE.exe EFWCMU.exe File opened for modification C:\windows\SysWOW64\VPSHMSR.exe GJUSXI.exe File opened for modification C:\windows\SysWOW64\BUAJW.exe GHVA.exe File created C:\windows\SysWOW64\MJHZ.exe.bat OIZ.exe File opened for modification C:\windows\SysWOW64\YNNVUUH.exe JSER.exe File created C:\windows\SysWOW64\CMFCR.exe UHMO.exe File opened for modification C:\windows\SysWOW64\JLLU.exe UQBHHJ.exe File opened for modification C:\windows\SysWOW64\UNTDZ.exe UHTP.exe File created C:\windows\SysWOW64\WCVLYIO.exe.bat FPKT.exe File created C:\windows\SysWOW64\WWZXTP.exe QVSJ.exe File created C:\windows\SysWOW64\AYNELF.exe QYL.exe File created C:\windows\SysWOW64\VPSHMSR.exe.bat GJUSXI.exe File opened for modification C:\windows\SysWOW64\ODG.exe RGAYPQ.exe File created C:\windows\SysWOW64\WKKU.exe NCI.exe File created C:\windows\SysWOW64\QYL.exe.bat KYLLZ.exe File created C:\windows\SysWOW64\KGE.exe EFWCMU.exe File created C:\windows\SysWOW64\HAJWQI.exe DKUW.exe File created C:\windows\SysWOW64\BUAJW.exe.bat GHVA.exe File opened for modification C:\windows\SysWOW64\OCVE.exe ICO.exe File opened for modification C:\windows\SysWOW64\ZECCX.exe CYEFHH.exe File created C:\windows\SysWOW64\MFLAG.exe KHRYIF.exe File opened for modification C:\windows\SysWOW64\AYNELF.exe QYL.exe File created C:\windows\SysWOW64\OIZ.exe.bat SDCXAFX.exe File created C:\windows\SysWOW64\LSS.exe.bat FRL.exe File opened for modification C:\windows\SysWOW64\JTLZ.exe SOB.exe File created C:\windows\SysWOW64\YVZDMUO.exe UNTDZ.exe File opened for modification C:\windows\SysWOW64\YVZDMUO.exe UNTDZ.exe File created C:\windows\SysWOW64\JIJDSH.exe.bat FFL.exe File opened for modification C:\windows\SysWOW64\EJSJVBK.exe KWWAL.exe File created C:\windows\SysWOW64\TKYYHYB.exe.bat FZURUH.exe File opened for modification C:\windows\SysWOW64\TDOJN.exe ODG.exe File created C:\windows\SysWOW64\FDX.exe WCVLYIO.exe File opened for modification C:\windows\SysWOW64\LTFIDR.exe HLY.exe File created C:\windows\SysWOW64\MJHZ.exe OIZ.exe File created C:\windows\SysWOW64\YNNVUUH.exe JSER.exe File opened for modification C:\windows\SysWOW64\EYG.exe HAJWQI.exe File created C:\windows\SysWOW64\NIHP.exe.bat QDBSR.exe File opened for modification C:\windows\SysWOW64\VQMBPP.exe ADHS.exe File created C:\windows\SysWOW64\OMUQGZ.exe ILNCPF.exe File created C:\windows\SysWOW64\ODG.exe RGAYPQ.exe File opened for modification C:\windows\SysWOW64\WWZXTP.exe QVSJ.exe File created C:\windows\SysWOW64\UNTDZ.exe UHTP.exe File opened for modification C:\windows\SysWOW64\MFLAG.exe KHRYIF.exe File created C:\windows\SysWOW64\ISRCRVW.exe WKKU.exe File opened for modification C:\windows\SysWOW64\TKYYHYB.exe FZURUH.exe File created C:\windows\SysWOW64\CMFCR.exe.bat UHMO.exe File created C:\windows\SysWOW64\ZECCX.exe CYEFHH.exe File created C:\windows\SysWOW64\FDX.exe.bat WCVLYIO.exe File opened for modification C:\windows\SysWOW64\KKAXMDM.exe EJSJVBK.exe File created C:\windows\SysWOW64\DDKA.exe JIFRCHK.exe File created C:\windows\SysWOW64\JTLZ.exe.bat SOB.exe File created C:\windows\SysWOW64\VQMBPP.exe.bat ADHS.exe File created C:\windows\SysWOW64\AYNELF.exe.bat QYL.exe File created C:\windows\SysWOW64\NIHP.exe QDBSR.exe File created C:\windows\SysWOW64\EYG.exe.bat HAJWQI.exe File created C:\windows\SysWOW64\UHMO.exe YBO.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\LEPNVRQ.exe VJYJ.exe File opened for modification C:\windows\system\SPA.exe KKAXMDM.exe File created C:\windows\OZO.exe.bat TMKDPD.exe File created C:\windows\system\LIYGTC.exe QVTW.exe File created C:\windows\GJBYXD.exe.bat GDJKW.exe File created C:\windows\system\RTKWGL.exe.bat JIJDSH.exe File created C:\windows\system\XOFWNM.exe.bat VQMBPP.exe File created C:\windows\system\JJMC.exe NDGFWMR.exe File created C:\windows\system\EWRMN.exe.bat JJMC.exe File created C:\windows\system\LEPNVRQ.exe.bat VJYJ.exe File created C:\windows\JXPMBXM.exe HZWKVAW.exe File created C:\windows\system\UZQPNAK.exe.bat YBKSY.exe File opened for modification C:\windows\system\KOEZM.exe TDOJN.exe File created C:\windows\SOB.exe.bat SAB.exe File created C:\windows\RCERFKX.exe GJBYXD.exe File opened for modification C:\windows\system\FPKT.exe KCGKYDM.exe File created C:\windows\system\ADHS.exe.bat LIYGTC.exe File created C:\windows\GIW.exe.bat VPBSEFZ.exe File created C:\windows\system\FZURUH.exe.bat AYNELF.exe File created C:\windows\RGAYPQ.exe XKVP.exe File created C:\windows\system\TER.exe VGYPU.exe File created C:\windows\system\FPKT.exe KCGKYDM.exe File opened for modification C:\windows\OZO.exe TMKDPD.exe File created C:\windows\VPBSEFZ.exe BCXJU.exe File created C:\windows\SDCXAFX.exe.bat BUAJW.exe File opened for modification C:\windows\system\WSMUE.exe IVPXX.exe File created C:\windows\system\VRK.exe.bat LTFIDR.exe File opened for modification C:\windows\NDGFWMR.exe SQBWL.exe File opened for modification C:\windows\RGAYPQ.exe XKVP.exe File created C:\windows\system\NDV.exe.bat ISRCRVW.exe File created C:\windows\SLJH.exe YXE.exe File opened for modification C:\windows\QOMMW.exe KOEZM.exe File created C:\windows\system\OHQ.exe.bat GBQODIT.exe File opened for modification C:\windows\JXPMBXM.exe HZWKVAW.exe File created C:\windows\system\DKUW.exe.bat JXPMBXM.exe File opened for modification C:\windows\system\YBKSY.exe MJHZ.exe File created C:\windows\system\SSC.exe OCVE.exe File created C:\windows\system\KWFVXZ.exe.bat ZECCX.exe File created C:\windows\system\GHVA.exe VPSHMSR.exe File created C:\windows\QOMMW.exe KOEZM.exe File created C:\windows\QOMMW.exe.bat KOEZM.exe File opened for modification C:\windows\system\QVSJ.exe FDX.exe File created C:\windows\QVTW.exe.bat OZO.exe File created C:\windows\system\XOFWNM.exe VQMBPP.exe File created C:\windows\system\UQBHHJ.exe SSANJ.exe File created C:\windows\IMMQIEJ.exe CMFCR.exe File opened for modification C:\windows\GJBYXD.exe GDJKW.exe File created C:\windows\system\KCGKYDM.exe.bat KWFVXZ.exe File created C:\windows\system\NKFV.exe.bat SPA.exe File created C:\windows\OLXB.exe.bat ZNREODW.exe File created C:\windows\ZEAMD.exe OLXB.exe File opened for modification C:\windows\system\CYEFHH.exe NDV.exe File created C:\windows\system\RTKWGL.exe JIJDSH.exe File created C:\windows\JIFRCHK.exe.bat GUIHS.exe File created C:\windows\system\SQBWL.exe SLJH.exe File created C:\windows\system\BCXJU.exe.bat EWRMN.exe File opened for modification C:\windows\HZWKVAW.exe QULSFE.exe File opened for modification C:\windows\system\GJUSXI.exe NQRZWBH.exe File created C:\windows\RGAYPQ.exe.bat XKVP.exe File opened for modification C:\windows\SSANJ.exe WNUQUD.exe File created C:\windows\WNUQUD.exe BAPH.exe File opened for modification C:\windows\SOB.exe SAB.exe File created C:\windows\JYDMH.exe.bat MSXX.exe File opened for modification C:\windows\OLXB.exe ZNREODW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2308 cmd.exe 6040 cmd.exe 1064 cmd.exe 4492 cmd.exe 3020 cmd.exe 3284 cmd.exe 4436 cmd.exe 5728 cmd.exe 1296 cmd.exe 1424 cmd.exe 1696 cmd.exe 4800 cmd.exe 2272 cmd.exe 124 cmd.exe 4212 cmd.exe 956 cmd.exe 6004 cmd.exe 4344 cmd.exe 5580 cmd.exe 4664 cmd.exe 1988 cmd.exe 5440 cmd.exe 4908 cmd.exe 4712 cmd.exe 4216 cmd.exe 240 cmd.exe 1236 cmd.exe 4292 cmd.exe 6128 cmd.exe 5616 cmd.exe 3024 cmd.exe 5764 cmd.exe 1264 cmd.exe 3892 cmd.exe 3708 cmd.exe 4772 cmd.exe 4276 cmd.exe 5888 cmd.exe 4716 cmd.exe 4916 cmd.exe 2976 cmd.exe 1352 cmd.exe 1028 cmd.exe 4364 cmd.exe 2592 cmd.exe 4520 cmd.exe 2180 cmd.exe 2056 cmd.exe 4816 cmd.exe 5180 cmd.exe 2064 cmd.exe 4360 cmd.exe 1812 cmd.exe 6056 cmd.exe 4112 cmd.exe 3016 cmd.exe 972 cmd.exe 5748 cmd.exe 5476 cmd.exe 4992 cmd.exe 2876 cmd.exe 3356 cmd.exe 5968 cmd.exe 2032 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 124 1984 WerFault.exe 87 5432 5188 WerFault.exe 92 2292 3260 WerFault.exe 99 2728 3816 WerFault.exe 104 4832 4524 WerFault.exe 109 1888 1420 WerFault.exe 113 1980 2604 WerFault.exe 119 2412 2492 WerFault.exe 124 3316 2612 WerFault.exe 129 1524 2008 WerFault.exe 134 5632 3604 WerFault.exe 139 2672 5620 WerFault.exe 144 4796 5360 WerFault.exe 149 4708 2036 WerFault.exe 154 1344 5056 WerFault.exe 159 4768 1612 WerFault.exe 164 5052 1712 WerFault.exe 169 6064 4168 WerFault.exe 174 5180 1104 WerFault.exe 179 3964 2696 WerFault.exe 184 1544 3772 WerFault.exe 189 2808 4428 WerFault.exe 194 4812 3052 WerFault.exe 199 2644 1000 WerFault.exe 204 624 4516 WerFault.exe 209 5040 3976 WerFault.exe 214 2216 5852 WerFault.exe 219 6068 1980 WerFault.exe 224 5944 2732 WerFault.exe 229 2352 3512 WerFault.exe 234 824 3952 WerFault.exe 239 4380 2280 WerFault.exe 244 4812 1764 WerFault.exe 249 1204 5904 WerFault.exe 254 2868 4476 WerFault.exe 259 2080 4088 WerFault.exe 264 2740 5304 WerFault.exe 269 1536 1520 WerFault.exe 274 3040 4268 WerFault.exe 279 2964 2444 WerFault.exe 284 3492 3028 WerFault.exe 290 5152 4676 WerFault.exe 295 3924 264 WerFault.exe 300 2164 2172 WerFault.exe 305 5560 4332 WerFault.exe 310 3016 1156 WerFault.exe 315 3224 4280 WerFault.exe 320 4236 3888 WerFault.exe 325 3796 2120 WerFault.exe 330 1544 2352 WerFault.exe 335 124 4872 WerFault.exe 340 2524 4604 WerFault.exe 345 5356 2472 WerFault.exe 350 1412 5308 WerFault.exe 355 5004 4460 WerFault.exe 360 4788 4320 WerFault.exe 365 4860 6068 WerFault.exe 370 5048 1820 WerFault.exe 375 3340 1160 WerFault.exe 380 5280 3004 WerFault.exe 385 2524 5028 WerFault.exe 390 432 6108 WerFault.exe 395 4936 2468 WerFault.exe 400 5136 4900 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWFVXZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIFRCHK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TKYYHYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNREODW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XXFMVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIJDSH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILNCPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KOOPGM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KOEZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KCGKYDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZEAMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NUSJDBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTLZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCVLYIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OMUQGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZECCX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSER.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRCZBUK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1984 2026-09-27_91f1cac75b1a52b748e0aceca52a49c0_elex_emotet_stop.exe 1984 2026-09-27_91f1cac75b1a52b748e0aceca52a49c0_elex_emotet_stop.exe 5188 JAREHJ.exe 5188 JAREHJ.exe 3260 FFL.exe 3260 FFL.exe 3816 JIJDSH.exe 3816 JIJDSH.exe 4524 RTKWGL.exe 4524 RTKWGL.exe 1420 KWWAL.exe 1420 KWWAL.exe 2604 EJSJVBK.exe 2604 EJSJVBK.exe 2492 KKAXMDM.exe 2492 KKAXMDM.exe 2612 SPA.exe 2612 SPA.exe 2008 NKFV.exe 2008 NKFV.exe 3604 KLNJHKF.exe 3604 KLNJHKF.exe 5620 QLUW.exe 5620 QLUW.exe 5360 YRULS.exe 5360 YRULS.exe 2036 WRCZBUK.exe 2036 WRCZBUK.exe 5056 XUGC.exe 5056 XUGC.exe 1612 GUIHS.exe 1612 GUIHS.exe 1712 JIFRCHK.exe 1712 JIFRCHK.exe 4168 DDKA.exe 4168 DDKA.exe 1104 HLY.exe 1104 HLY.exe 2696 LTFIDR.exe 2696 LTFIDR.exe 3772 VRK.exe 3772 VRK.exe 4428 TMKDPD.exe 4428 TMKDPD.exe 3052 OZO.exe 3052 OZO.exe 1000 QVTW.exe 1000 QVTW.exe 4516 LIYGTC.exe 4516 LIYGTC.exe 3976 ADHS.exe 3976 ADHS.exe 5852 VQMBPP.exe 5852 VQMBPP.exe 1980 XOFWNM.exe 1980 XOFWNM.exe 2732 GBQODIT.exe 2732 GBQODIT.exe 3512 OHQ.exe 3512 OHQ.exe 3952 HKUGSLX.exe 3952 HKUGSLX.exe 2280 YXE.exe 2280 YXE.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1984 2026-09-27_91f1cac75b1a52b748e0aceca52a49c0_elex_emotet_stop.exe 1984 2026-09-27_91f1cac75b1a52b748e0aceca52a49c0_elex_emotet_stop.exe 5188 JAREHJ.exe 5188 JAREHJ.exe 3260 FFL.exe 3260 FFL.exe 3816 JIJDSH.exe 3816 JIJDSH.exe 4524 RTKWGL.exe 4524 RTKWGL.exe 1420 KWWAL.exe 1420 KWWAL.exe 2604 EJSJVBK.exe 2604 EJSJVBK.exe 2492 KKAXMDM.exe 2492 KKAXMDM.exe 2612 SPA.exe 2612 SPA.exe 2008 NKFV.exe 2008 NKFV.exe 3604 KLNJHKF.exe 3604 KLNJHKF.exe 5620 QLUW.exe 5620 QLUW.exe 5360 YRULS.exe 5360 YRULS.exe 2036 WRCZBUK.exe 2036 WRCZBUK.exe 5056 XUGC.exe 5056 XUGC.exe 1612 GUIHS.exe 1612 GUIHS.exe 1712 JIFRCHK.exe 1712 JIFRCHK.exe 4168 DDKA.exe 4168 DDKA.exe 1104 HLY.exe 1104 HLY.exe 2696 LTFIDR.exe 2696 LTFIDR.exe 3772 VRK.exe 3772 VRK.exe 4428 TMKDPD.exe 4428 TMKDPD.exe 3052 OZO.exe 3052 OZO.exe 1000 QVTW.exe 1000 QVTW.exe 4516 LIYGTC.exe 4516 LIYGTC.exe 3976 ADHS.exe 3976 ADHS.exe 5852 VQMBPP.exe 5852 VQMBPP.exe 1980 XOFWNM.exe 1980 XOFWNM.exe 2732 GBQODIT.exe 2732 GBQODIT.exe 3512 OHQ.exe 3512 OHQ.exe 3952 HKUGSLX.exe 3952 HKUGSLX.exe 2280 YXE.exe 2280 YXE.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2032 1984 2026-09-27_91f1cac75b1a52b748e0aceca52a49c0_elex_emotet_stop.exe 89 PID 2032 wrote to memory of 5188 2032 cmd.exe 92 PID 5188 wrote to memory of 4908 5188 JAREHJ.exe 95 PID 4908 wrote to memory of 3260 4908 cmd.exe 99 PID 3260 wrote to memory of 4472 3260 FFL.exe 100 PID 4472 wrote to memory of 3816 4472 cmd.exe 104 PID 3816 wrote to memory of 4364 3816 JIJDSH.exe 105 PID 4364 wrote to memory of 4524 4364 cmd.exe 109 PID 4524 wrote to memory of 1080 4524 RTKWGL.exe 110 PID 1080 wrote to memory of 1420 1080 cmd.exe 113 PID 1420 wrote to memory of 1320 1420 KWWAL.exe 115 PID 1320 wrote to memory of 2604 1320 cmd.exe 119 PID 2604 wrote to memory of 1424 2604 EJSJVBK.exe 120 PID 1424 wrote to memory of 2492 1424 cmd.exe 124 PID 2492 wrote to memory of 1900 2492 KKAXMDM.exe 125 PID 1900 wrote to memory of 2612 1900 cmd.exe 129 PID 2612 wrote to memory of 2844 2612 SPA.exe 130 PID 2844 wrote to memory of 2008 2844 cmd.exe 134 PID 2008 wrote to memory of 4076 2008 NKFV.exe 135 PID 4076 wrote to memory of 3604 4076 cmd.exe 139 PID 3604 wrote to memory of 2888 3604 KLNJHKF.exe 140 PID 2888 wrote to memory of 5620 2888 cmd.exe 144 PID 5620 wrote to memory of 2592 5620 QLUW.exe 145 PID 2592 wrote to memory of 5360 2592 cmd.exe 149 PID 5360 wrote to memory of 1088 5360 YRULS.exe 150 PID 1088 wrote to memory of 2036 1088 cmd.exe 154 PID 2036 wrote to memory of 5476 2036 WRCZBUK.exe 155 PID 5476 wrote to memory of 5056 5476 cmd.exe 159 PID 5056 wrote to memory of 4992 5056 XUGC.exe 160 PID 4992 wrote to memory of 1612 4992 cmd.exe 164 PID 1612 wrote to memory of 4316 1612 GUIHS.exe 165 PID 4316 wrote to memory of 1712 4316 cmd.exe 169 PID 1712 wrote to memory of 4920 1712 JIFRCHK.exe 170 PID 4920 wrote to memory of 4168 4920 cmd.exe 174 PID 4168 wrote to memory of 4492 4168 DDKA.exe 175 PID 4492 wrote to memory of 1104 4492 cmd.exe 179 PID 1104 wrote to memory of 6104 1104 HLY.exe 180 PID 6104 wrote to memory of 2696 6104 cmd.exe 184 PID 2696 wrote to memory of 2484 2696 LTFIDR.exe 185 PID 2484 wrote to memory of 3772 2484 cmd.exe 189 PID 3772 wrote to memory of 4896 3772 VRK.exe 190 PID 4896 wrote to memory of 4428 4896 cmd.exe 194 PID 4428 wrote to memory of 2276 4428 TMKDPD.exe 195 PID 2276 wrote to memory of 3052 2276 cmd.exe 199 PID 3052 wrote to memory of 4412 3052 OZO.exe 200 PID 4412 wrote to memory of 1000 4412 cmd.exe 204 PID 1000 wrote to memory of 2856 1000 QVTW.exe 205 PID 2856 wrote to memory of 4516 2856 cmd.exe 209 PID 4516 wrote to memory of 4888 4516 LIYGTC.exe 210 PID 4888 wrote to memory of 3976 4888 cmd.exe 214 PID 3976 wrote to memory of 1680 3976 ADHS.exe 215 PID 1680 wrote to memory of 5852 1680 cmd.exe 219 PID 5852 wrote to memory of 4212 5852 VQMBPP.exe 220 PID 4212 wrote to memory of 1980 4212 cmd.exe 224 PID 1980 wrote to memory of 3860 1980 XOFWNM.exe 225 PID 3860 wrote to memory of 2732 3860 cmd.exe 229 PID 2732 wrote to memory of 5692 2732 GBQODIT.exe 230 PID 5692 wrote to memory of 3512 5692 cmd.exe 234 PID 3512 wrote to memory of 3780 3512 OHQ.exe 235 PID 3780 wrote to memory of 3952 3780 cmd.exe 239 PID 3952 wrote to memory of 2972 3952 HKUGSLX.exe 240 PID 2972 wrote to memory of 2280 2972 cmd.exe 244 PID 2280 wrote to memory of 1696 2280 YXE.exe 245 PID 1696 wrote to memory of 1764 1696 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-27_91f1cac75b1a52b748e0aceca52a49c0_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-27_91f1cac75b1a52b748e0aceca52a49c0_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JAREHJ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\windows\system\JAREHJ.exeC:\windows\system\JAREHJ.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FFL.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\windows\system\FFL.exeC:\windows\system\FFL.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JIJDSH.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\windows\SysWOW64\JIJDSH.exeC:\windows\system32\JIJDSH.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RTKWGL.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\windows\system\RTKWGL.exeC:\windows\system\RTKWGL.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWWAL.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\windows\SysWOW64\KWWAL.exeC:\windows\system32\KWWAL.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EJSJVBK.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\windows\SysWOW64\EJSJVBK.exeC:\windows\system32\EJSJVBK.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKAXMDM.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\windows\SysWOW64\KKAXMDM.exeC:\windows\system32\KKAXMDM.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SPA.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\windows\system\SPA.exeC:\windows\system\SPA.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NKFV.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\windows\system\NKFV.exeC:\windows\system\NKFV.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KLNJHKF.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\windows\system\KLNJHKF.exeC:\windows\system\KLNJHKF.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QLUW.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\windows\QLUW.exeC:\windows\QLUW.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YRULS.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\windows\SysWOW64\YRULS.exeC:\windows\system32\YRULS.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRCZBUK.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\windows\system\WRCZBUK.exeC:\windows\system\WRCZBUK.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUGC.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\windows\system\XUGC.exeC:\windows\system\XUGC.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GUIHS.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\windows\SysWOW64\GUIHS.exeC:\windows\system32\GUIHS.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JIFRCHK.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\windows\JIFRCHK.exeC:\windows\JIFRCHK.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDKA.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\windows\SysWOW64\DDKA.exeC:\windows\system32\DDKA.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLY.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\windows\HLY.exeC:\windows\HLY.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LTFIDR.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\windows\SysWOW64\LTFIDR.exeC:\windows\system32\LTFIDR.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VRK.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\windows\system\VRK.exeC:\windows\system\VRK.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TMKDPD.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\windows\TMKDPD.exeC:\windows\TMKDPD.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OZO.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\windows\OZO.exeC:\windows\OZO.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVTW.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\QVTW.exeC:\windows\QVTW.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIYGTC.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\windows\system\LIYGTC.exeC:\windows\system\LIYGTC.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADHS.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\windows\system\ADHS.exeC:\windows\system\ADHS.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VQMBPP.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\windows\SysWOW64\VQMBPP.exeC:\windows\system32\VQMBPP.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOFWNM.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\windows\system\XOFWNM.exeC:\windows\system\XOFWNM.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GBQODIT.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\windows\GBQODIT.exeC:\windows\GBQODIT.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHQ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\windows\system\OHQ.exeC:\windows\system\OHQ.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKUGSLX.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\windows\system\HKUGSLX.exeC:\windows\system\HKUGSLX.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YXE.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\windows\system\YXE.exeC:\windows\system\YXE.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SLJH.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\windows\SLJH.exeC:\windows\SLJH.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQBWL.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5888 -
C:\windows\system\SQBWL.exeC:\windows\system\SQBWL.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDGFWMR.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3300 -
C:\windows\NDGFWMR.exeC:\windows\NDGFWMR.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJMC.exe.bat" "70⤵PID:4840
-
C:\windows\system\JJMC.exeC:\windows\system\JJMC.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWRMN.exe.bat" "72⤵PID:1388
-
C:\windows\system\EWRMN.exeC:\windows\system\EWRMN.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BCXJU.exe.bat" "74⤵PID:1968
-
C:\windows\system\BCXJU.exeC:\windows\system\BCXJU.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPBSEFZ.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4716 -
C:\windows\VPBSEFZ.exeC:\windows\VPBSEFZ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIW.exe.bat" "78⤵PID:3268
-
C:\windows\GIW.exeC:\windows\GIW.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYLLZ.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:3296 -
C:\windows\SysWOW64\KYLLZ.exeC:\windows\system32\KYLLZ.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QYL.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:824 -
C:\windows\SysWOW64\QYL.exeC:\windows\system32\QYL.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AYNELF.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4360 -
C:\windows\SysWOW64\AYNELF.exeC:\windows\system32\AYNELF.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZURUH.exe.bat" "86⤵PID:5632
-
C:\windows\system\FZURUH.exeC:\windows\system\FZURUH.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKYYHYB.exe.bat" "88⤵PID:3400
-
C:\windows\SysWOW64\TKYYHYB.exeC:\windows\system32\TKYYHYB.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXDH.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4712 -
C:\windows\NXDH.exeC:\windows\NXDH.exe91⤵
- Executes dropped EXE
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XXFMVW.exe.bat" "92⤵PID:468
-
C:\windows\XXFMVW.exeC:\windows\XXFMVW.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQAFVDI.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4800 -
C:\windows\IQAFVDI.exeC:\windows\IQAFVDI.exe95⤵
- Executes dropped EXE
PID:3888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQIT.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1812 -
C:\windows\OQIT.exeC:\windows\OQIT.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILNCPF.exe.bat" "98⤵PID:1116
-
C:\windows\system\ILNCPF.exeC:\windows\system\ILNCPF.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OMUQGZ.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2876 -
C:\windows\SysWOW64\OMUQGZ.exeC:\windows\system32\OMUQGZ.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWLOFU.exe.bat" "102⤵PID:5232
-
C:\windows\system\FWLOFU.exeC:\windows\system\FWLOFU.exe103⤵
- Executes dropped EXE
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WCVG.exe.bat" "104⤵PID:1292
-
C:\windows\system\WCVG.exeC:\windows\system\WCVG.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THBV.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2688 -
C:\windows\THBV.exeC:\windows\THBV.exe107⤵
- Executes dropped EXE
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TNBJ.exe.bat" "108⤵PID:4824
-
C:\windows\TNBJ.exeC:\windows\TNBJ.exe109⤵
- Executes dropped EXE
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EFWCMU.exe.bat" "110⤵
- Executes a command shell one-liner
PID:956 -
C:\windows\EFWCMU.exeC:\windows\EFWCMU.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGE.exe.bat" "112⤵PID:4904
-
C:\windows\SysWOW64\KGE.exeC:\windows\system32\KGE.exe113⤵
- Executes dropped EXE
PID:6068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JYM.exe.bat" "114⤵PID:760
-
C:\windows\system\JYM.exeC:\windows\system\JYM.exe115⤵
- Executes dropped EXE
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QULSFE.exe.bat" "116⤵PID:2872
-
C:\windows\QULSFE.exeC:\windows\QULSFE.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HZWKVAW.exe.bat" "118⤵PID:5936
-
C:\windows\HZWKVAW.exeC:\windows\HZWKVAW.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXPMBXM.exe.bat" "120⤵PID:5176
-
C:\windows\JXPMBXM.exeC:\windows\JXPMBXM.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-