Analysis
- max time kernel
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/09/2026, 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-27_827b4694520bbe44df42cb610902663c_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-27_827b4694520bbe44df42cb610902663c_elex_emotet_stop.exe
- Size 208KB
- Sample260928-eckw1stw3m
- SHA256 e2afbc5a24c170bf5a394f553d99ffd25d8b6d58527020b6b866eab462f45fe2
- MD5 827b4694520bbe44df42cb610902663c
- SHA1 eb48f2c62f423ee29efeac4fcadc9d42bde3fbda
- SHA512 d0ef111f8b16a355f615a7cf4c28cf95a164cce2b801d90e782f73ed9a80f8178b4273081ab40b7b3f85ee71afd7d330d77bbffae645ff3f6af89ccc5475f83f
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlEdL+LOft4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlE5+LOlkEj1
- TLSH T1AB247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4908 WQJQCL.exe 4624 IBT.exe 1552 FUDGOUO.exe 992 CZB.exe 1408 HZJR.exe 4740 CNOAX.exe 1204 CAOPYL.exe 2308 TGYH.exe 3304 EYBZO.exe 3588 KYJNF.exe 4876 FUGW.exe 1888 FZGLR.exe 5304 LANZA.exe 2332 WSQRIF.exe 248 RFV.exe 5600 RIZXYVL.exe 1516 XJHKHXN.exe 2848 SWMC.exe 980 BEOHVVE.exe 5892 JPO.exe 2812 CSSE.exe 5252 CNE.exe 6076 NGZSC.exe 5952 ZYCLKJ.exe 4608 MJKK.exe 1264 SJSYHO.exe 1116 JUQNHJ.exe 960 DHV.exe 2816 SKEJCV.exe 5384 SQXYEI.exe 3280 YQELVDT.exe 2860 ERMZ.exe 1972 NROEH.exe 1652 VJX.exe 1224 GCAY.exe 3332 QCUDH.exe 1328 BVXWPA.exe 1628 YACLWK.exe 1816 NVMY.exe 3688 JBSNO.exe 4936 VUNGXWE.exe 2116 PHR.exe 1576 ZPTCK.exe 5140 TCYLVTK.exe 3812 ZDGZ.exe 4820 KVJSM.exe 4308 FJOBWDP.exe 4396 WRQ.exe 2904 TPN.exe 2656 LSRZMAV.exe 3940 IXXWBJ.exe 2696 XSHB.exe 2288 MYMYTG.exe 5464 OLR.exe 2852 ORR.exe 4560 JMWFP.exe 5088 FJUCWCI.exe 5888 RCX.exe 5692 APHN.exe 2660 YAYD.exe 600 INIVC.exe 4832 KLJXI.exe 4588 VEEQQCS.exe 5964 DONJEGG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\GRBCGXL.exe XQZPDZ.exe File created C:\windows\SysWOW64\RJBL.exe.bat BYLV.exe File created C:\windows\SysWOW64\OPHI.exe.bat RJBL.exe File created C:\windows\SysWOW64\UYP.exe.bat JFMLWNY.exe File created C:\windows\SysWOW64\WQJQCL.exe 2026-09-27_827b4694520bbe44df42cb610902663c_elex_emotet_stop.exe File created C:\windows\SysWOW64\NVMY.exe YACLWK.exe File created C:\windows\SysWOW64\GSPCCDY.exe JMRFVTW.exe File opened for modification C:\windows\SysWOW64\GRBCGXL.exe XQZPDZ.exe File created C:\windows\SysWOW64\FVEMOE.exe QAN.exe File opened for modification C:\windows\SysWOW64\OPHI.exe RJBL.exe File created C:\windows\SysWOW64\KLJXI.exe INIVC.exe File opened for modification C:\windows\SysWOW64\DONJEGG.exe VEEQQCS.exe File created C:\windows\SysWOW64\SWMC.exe.bat XJHKHXN.exe File opened for modification C:\windows\SysWOW64\NVMY.exe YACLWK.exe File created C:\windows\SysWOW64\RUT.exe.bat DONJEGG.exe File created C:\windows\SysWOW64\NWEDTPL.exe VJTLDS.exe File created C:\windows\SysWOW64\XGSKAXA.exe.bat WDOOU.exe File created C:\windows\SysWOW64\ZDGZ.exe TCYLVTK.exe File created C:\windows\SysWOW64\XSHB.exe.bat IXXWBJ.exe File opened for modification C:\windows\SysWOW64\FVEMOE.exe QAN.exe File created C:\windows\SysWOW64\YMJBOG.exe.bat BHLE.exe File opened for modification C:\windows\SysWOW64\ITAZLQ.exe MNDCEHK.exe File opened for modification C:\windows\SysWOW64\BQW.exe TXNLDB.exe File created C:\windows\SysWOW64\UQQG.exe UYP.exe File created C:\windows\SysWOW64\SWMC.exe XJHKHXN.exe File created C:\windows\SysWOW64\ERMZ.exe YQELVDT.exe File created C:\windows\SysWOW64\WKG.exe.bat UUMT.exe File created C:\windows\SysWOW64\XGSKAXA.exe WDOOU.exe File created C:\windows\SysWOW64\PUFFRDB.exe.bat NWEDTPL.exe File created C:\windows\SysWOW64\RJBL.exe BYLV.exe File created C:\windows\SysWOW64\BHLE.exe.bat RRYJZOG.exe File created C:\windows\SysWOW64\ZLSDHB.exe.bat DGMGA.exe File created C:\windows\SysWOW64\JUQNHJ.exe SJSYHO.exe File created C:\windows\SysWOW64\DONJEGG.exe VEEQQCS.exe File created C:\windows\SysWOW64\TWW.exe TQENZVT.exe File created C:\windows\SysWOW64\KOUALL.exe ZWRID.exe File created C:\windows\SysWOW64\UQQG.exe.bat UYP.exe File opened for modification C:\windows\SysWOW64\RIZXYVL.exe RFV.exe File created C:\windows\SysWOW64\GCAY.exe.bat VJX.exe File created C:\windows\SysWOW64\PUFFRDB.exe NWEDTPL.exe File created C:\windows\SysWOW64\JUQNHJ.exe.bat SJSYHO.exe File opened for modification C:\windows\SysWOW64\KOUALL.exe ZWRID.exe File created C:\windows\SysWOW64\ITAZLQ.exe MNDCEHK.exe File opened for modification C:\windows\SysWOW64\XGSKAXA.exe WDOOU.exe File opened for modification C:\windows\SysWOW64\YMJBOG.exe BHLE.exe File created C:\windows\SysWOW64\ZMI.exe.bat HMGHAFQ.exe File opened for modification C:\windows\SysWOW64\FUGW.exe KYJNF.exe File created C:\windows\SysWOW64\FUGW.exe.bat KYJNF.exe File opened for modification C:\windows\SysWOW64\VJX.exe NROEH.exe File created C:\windows\SysWOW64\OLR.exe.bat MYMYTG.exe File opened for modification C:\windows\SysWOW64\VSIT.exe FXZPFT.exe File opened for modification C:\windows\SysWOW64\NKT.exe REWMUJ.exe File created C:\windows\SysWOW64\CNE.exe CSSE.exe File created C:\windows\SysWOW64\WGKDMU.exe GVU.exe File opened for modification C:\windows\SysWOW64\JUQNHJ.exe SJSYHO.exe File opened for modification C:\windows\SysWOW64\ERMZ.exe YQELVDT.exe File opened for modification C:\windows\SysWOW64\ZDGZ.exe TCYLVTK.exe File created C:\windows\SysWOW64\FVEMOE.exe.bat QAN.exe File opened for modification C:\windows\SysWOW64\BHLE.exe RRYJZOG.exe File created C:\windows\SysWOW64\FUGW.exe KYJNF.exe File opened for modification C:\windows\SysWOW64\GCAY.exe VJX.exe File opened for modification C:\windows\SysWOW64\RJBL.exe BYLV.exe File opened for modification C:\windows\SysWOW64\DVDM.exe SDI.exe File created C:\windows\SysWOW64\XEMUW.exe GRBCGXL.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\PHR.exe VUNGXWE.exe File created C:\windows\system\VSWL.exe.bat ZMYOK.exe File opened for modification C:\windows\system\UZQPNAK.exe YBKSY.exe File opened for modification C:\windows\system\WDOOU.exe WKG.exe File created C:\windows\JFMLWNY.exe.bat YMJBOG.exe File created C:\windows\CGZW.exe.bat ROW.exe File created C:\windows\system\CZB.exe FUDGOUO.exe File created C:\windows\YLR.exe WVXI.exe File opened for modification C:\windows\system\JDUV.exe YLR.exe File created C:\windows\system\KDHN.exe ZKE.exe File created C:\windows\system\BYLV.exe LDBJEJ.exe File opened for modification C:\windows\KVPPQEQ.exe KDHN.exe File created C:\windows\system\ROW.exe.bat UQQG.exe File created C:\windows\SDI.exe.bat KXIFCTS.exe File opened for modification C:\windows\FZGLR.exe FUGW.exe File opened for modification C:\windows\system\BVXWPA.exe QCUDH.exe File created C:\windows\system\JBSNO.exe NVMY.exe File created C:\windows\system\WQATHQ.exe.bat QPSG.exe File opened for modification C:\windows\system\JMRFVTW.exe DMJRM.exe File opened for modification C:\windows\system\WVXI.exe APS.exe File created C:\windows\LDBJEJ.exe.bat PYWT.exe File opened for modification C:\windows\TZNEO.exe ZMI.exe File created C:\windows\system\IBT.exe.bat WQJQCL.exe File created C:\windows\CAOPYL.exe CNOAX.exe File created C:\windows\system\JBSNO.exe.bat NVMY.exe File opened for modification C:\windows\system\MNDCEHK.exe XPXNX.exe File created C:\windows\VJTLDS.exe FYDNDX.exe File created C:\windows\CAOPYL.exe.bat CNOAX.exe File created C:\windows\system\VSWL.exe ZMYOK.exe File opened for modification C:\windows\system\XPXNX.exe VSWL.exe File created C:\windows\system\RRYJZOG.exe.bat GZDQRG.exe File opened for modification C:\windows\YMELOZ.exe CGZW.exe File opened for modification C:\windows\FIU.exe KVPPQEQ.exe File created C:\windows\system\TGYH.exe CAOPYL.exe File created C:\windows\SJSYHO.exe MJKK.exe File opened for modification C:\windows\JMWFP.exe ORR.exe File created C:\windows\system\SVF.exe.bat WQATHQ.exe File created C:\windows\SRJDZTO.exe.bat XEMUW.exe File opened for modification C:\windows\system\ESIWWR.exe TZNEO.exe File opened for modification C:\windows\CAOPYL.exe CNOAX.exe File created C:\windows\system\XJHKHXN.exe.bat RIZXYVL.exe File created C:\windows\FJOBWDP.exe KVJSM.exe File created C:\windows\system\LSRZMAV.exe.bat TPN.exe File opened for modification C:\windows\system\BYLV.exe LDBJEJ.exe File created C:\windows\KYJNF.exe.bat EYBZO.exe File created C:\windows\system\WSQRIF.exe.bat LANZA.exe File created C:\windows\system\TCYLVTK.exe.bat ZPTCK.exe File opened for modification C:\windows\DGF.exe ITAZLQ.exe File created C:\windows\system\NROEH.exe.bat ERMZ.exe File created C:\windows\system\LSRZMAV.exe TPN.exe File created C:\windows\IXXWBJ.exe.bat LSRZMAV.exe File created C:\windows\JMWFP.exe.bat ORR.exe File created C:\windows\HMGHAFQ.exe.bat HTXOM.exe File created C:\windows\system\TXNLDB.exe.bat ESIWWR.exe File opened for modification C:\windows\system\TGYH.exe CAOPYL.exe File created C:\windows\system\RCX.exe.bat FJUCWCI.exe File created C:\windows\EZT.exe.bat WGKDMU.exe File created C:\windows\LDBJEJ.exe PYWT.exe File created C:\windows\QPSG.exe.bat CNWZT.exe File created C:\windows\system\JDUV.exe YLR.exe File created C:\windows\QVU.exe.bat OHQJJE.exe File created C:\windows\VJTLDS.exe.bat FYDNDX.exe File opened for modification C:\windows\JFMLWNY.exe YMJBOG.exe File created C:\windows\KVPPQEQ.exe.bat KDHN.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5988 cmd.exe 4488 cmd.exe 1160 cmd.exe 4212 cmd.exe 5036 cmd.exe 1096 cmd.exe 912 cmd.exe 3404 cmd.exe 5444 cmd.exe 4940 cmd.exe 2716 cmd.exe 4992 cmd.exe 1180 cmd.exe 3384 cmd.exe 3848 cmd.exe 2892 cmd.exe 1252 cmd.exe 484 cmd.exe 4108 cmd.exe 4408 cmd.exe 4428 cmd.exe 5900 cmd.exe 4004 cmd.exe 2788 cmd.exe 2112 cmd.exe 5696 cmd.exe 1744 cmd.exe 4644 cmd.exe 3008 cmd.exe 3104 cmd.exe 4524 cmd.exe 1848 cmd.exe 3888 cmd.exe 2488 cmd.exe 2088 cmd.exe 1700 cmd.exe 908 cmd.exe 800 cmd.exe 2856 cmd.exe 1216 cmd.exe 3232 cmd.exe 6020 cmd.exe 4116 cmd.exe 3248 cmd.exe 4380 cmd.exe 1128 cmd.exe 2584 cmd.exe 2264 cmd.exe 4980 cmd.exe 4724 cmd.exe 544 cmd.exe 3568 cmd.exe 1112 cmd.exe 2784 cmd.exe 4124 cmd.exe 3068 cmd.exe 3892 cmd.exe 3788 cmd.exe 5456 cmd.exe 5808 cmd.exe 3912 cmd.exe 4552 cmd.exe 3444 cmd.exe 2424 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4920 5168 WerFault.exe 88 5440 4908 WerFault.exe 93 2616 4624 WerFault.exe 100 3316 1552 WerFault.exe 105 1152 992 WerFault.exe 110 6080 1408 WerFault.exe 115 1808 4740 WerFault.exe 120 4808 1204 WerFault.exe 125 2196 2308 WerFault.exe 130 4240 3304 WerFault.exe 135 4752 3588 WerFault.exe 140 484 4876 WerFault.exe 145 5020 1888 WerFault.exe 150 4608 5304 WerFault.exe 155 120 2332 WerFault.exe 160 1116 248 WerFault.exe 165 4176 5600 WerFault.exe 170 4260 1516 WerFault.exe 175 5384 2848 WerFault.exe 180 4540 980 WerFault.exe 185 3324 5892 WerFault.exe 190 596 2812 WerFault.exe 195 4504 5252 WerFault.exe 200 4308 6076 WerFault.exe 205 5888 5952 WerFault.exe 210 4976 4608 WerFault.exe 215 1792 1264 WerFault.exe 220 3060 1116 WerFault.exe 225 1428 960 WerFault.exe 230 3392 2816 WerFault.exe 235 5924 5384 WerFault.exe 240 5464 3280 WerFault.exe 245 4636 2860 WerFault.exe 250 4172 1972 WerFault.exe 255 4820 1652 WerFault.exe 260 1344 1224 WerFault.exe 265 5908 3332 WerFault.exe 270 4664 1328 WerFault.exe 275 5720 1628 WerFault.exe 280 2928 1816 WerFault.exe 285 3116 3688 WerFault.exe 290 2212 4936 WerFault.exe 295 3000 2116 WerFault.exe 300 3136 1576 WerFault.exe 305 2548 5140 WerFault.exe 310 1108 3812 WerFault.exe 315 3380 4820 WerFault.exe 320 276 4308 WerFault.exe 325 4180 4396 WerFault.exe 330 3544 2904 WerFault.exe 335 4336 2656 WerFault.exe 340 5648 3940 WerFault.exe 345 1808 2696 WerFault.exe 350 5632 2288 WerFault.exe 355 2196 5464 WerFault.exe 360 5284 2852 WerFault.exe 365 5356 4560 WerFault.exe 370 5884 5088 WerFault.exe 375 2380 5888 WerFault.exe 380 3808 5692 WerFault.exe 385 3840 2660 WerFault.exe 390 2232 600 WerFault.exe 395 5444 4832 WerFault.exe 400 5160 4588 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SHDCZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXXWBJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIZXYVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUNGXWE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YACLWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLJXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PYWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XQZPDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KXIFCTS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGYH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEOHVVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGZSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REWMUJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NIXKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUDGOUO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUGW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5168 2026-09-27_827b4694520bbe44df42cb610902663c_elex_emotet_stop.exe 5168 2026-09-27_827b4694520bbe44df42cb610902663c_elex_emotet_stop.exe 4908 WQJQCL.exe 4908 WQJQCL.exe 4624 IBT.exe 4624 IBT.exe 1552 FUDGOUO.exe 1552 FUDGOUO.exe 992 CZB.exe 992 CZB.exe 1408 HZJR.exe 1408 HZJR.exe 4740 CNOAX.exe 4740 CNOAX.exe 1204 CAOPYL.exe 1204 CAOPYL.exe 2308 TGYH.exe 2308 TGYH.exe 3304 EYBZO.exe 3304 EYBZO.exe 3588 KYJNF.exe 3588 KYJNF.exe 4876 FUGW.exe 4876 FUGW.exe 1888 FZGLR.exe 1888 FZGLR.exe 5304 LANZA.exe 5304 LANZA.exe 2332 WSQRIF.exe 2332 WSQRIF.exe 248 RFV.exe 248 RFV.exe 5600 RIZXYVL.exe 5600 RIZXYVL.exe 1516 XJHKHXN.exe 1516 XJHKHXN.exe 2848 SWMC.exe 2848 SWMC.exe 980 BEOHVVE.exe 980 BEOHVVE.exe 5892 JPO.exe 5892 JPO.exe 2812 CSSE.exe 2812 CSSE.exe 5252 CNE.exe 5252 CNE.exe 6076 NGZSC.exe 6076 NGZSC.exe 5952 ZYCLKJ.exe 5952 ZYCLKJ.exe 4608 MJKK.exe 4608 MJKK.exe 1264 SJSYHO.exe 1264 SJSYHO.exe 1116 JUQNHJ.exe 1116 JUQNHJ.exe 960 DHV.exe 960 DHV.exe 2816 SKEJCV.exe 2816 SKEJCV.exe 5384 SQXYEI.exe 5384 SQXYEI.exe 3280 YQELVDT.exe 3280 YQELVDT.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5168 2026-09-27_827b4694520bbe44df42cb610902663c_elex_emotet_stop.exe 5168 2026-09-27_827b4694520bbe44df42cb610902663c_elex_emotet_stop.exe 4908 WQJQCL.exe 4908 WQJQCL.exe 4624 IBT.exe 4624 IBT.exe 1552 FUDGOUO.exe 1552 FUDGOUO.exe 992 CZB.exe 992 CZB.exe 1408 HZJR.exe 1408 HZJR.exe 4740 CNOAX.exe 4740 CNOAX.exe 1204 CAOPYL.exe 1204 CAOPYL.exe 2308 TGYH.exe 2308 TGYH.exe 3304 EYBZO.exe 3304 EYBZO.exe 3588 KYJNF.exe 3588 KYJNF.exe 4876 FUGW.exe 4876 FUGW.exe 1888 FZGLR.exe 1888 FZGLR.exe 5304 LANZA.exe 5304 LANZA.exe 2332 WSQRIF.exe 2332 WSQRIF.exe 248 RFV.exe 248 RFV.exe 5600 RIZXYVL.exe 5600 RIZXYVL.exe 1516 XJHKHXN.exe 1516 XJHKHXN.exe 2848 SWMC.exe 2848 SWMC.exe 980 BEOHVVE.exe 980 BEOHVVE.exe 5892 JPO.exe 5892 JPO.exe 2812 CSSE.exe 2812 CSSE.exe 5252 CNE.exe 5252 CNE.exe 6076 NGZSC.exe 6076 NGZSC.exe 5952 ZYCLKJ.exe 5952 ZYCLKJ.exe 4608 MJKK.exe 4608 MJKK.exe 1264 SJSYHO.exe 1264 SJSYHO.exe 1116 JUQNHJ.exe 1116 JUQNHJ.exe 960 DHV.exe 960 DHV.exe 2816 SKEJCV.exe 2816 SKEJCV.exe 5384 SQXYEI.exe 5384 SQXYEI.exe 3280 YQELVDT.exe 3280 YQELVDT.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5168 wrote to memory of 4468 5168 2026-09-27_827b4694520bbe44df42cb610902663c_elex_emotet_stop.exe 90 PID 4468 wrote to memory of 4908 4468 cmd.exe 93 PID 4908 wrote to memory of 4108 4908 WQJQCL.exe 96 PID 4108 wrote to memory of 4624 4108 cmd.exe 100 PID 4624 wrote to memory of 3712 4624 IBT.exe 101 PID 3712 wrote to memory of 1552 3712 cmd.exe 105 PID 1552 wrote to memory of 124 1552 FUDGOUO.exe 106 PID 124 wrote to memory of 992 124 cmd.exe 110 PID 992 wrote to memory of 4668 992 CZB.exe 111 PID 4668 wrote to memory of 1408 4668 cmd.exe 115 PID 1408 wrote to memory of 1316 1408 HZJR.exe 116 PID 1316 wrote to memory of 4740 1316 cmd.exe 120 PID 4740 wrote to memory of 1216 4740 CNOAX.exe 121 PID 1216 wrote to memory of 1204 1216 cmd.exe 125 PID 1204 wrote to memory of 3616 1204 CAOPYL.exe 126 PID 3616 wrote to memory of 2308 3616 cmd.exe 130 PID 2308 wrote to memory of 3448 2308 TGYH.exe 131 PID 3448 wrote to memory of 3304 3448 cmd.exe 135 PID 3304 wrote to memory of 3568 3304 EYBZO.exe 136 PID 3568 wrote to memory of 3588 3568 cmd.exe 140 PID 3588 wrote to memory of 5036 3588 KYJNF.exe 141 PID 5036 wrote to memory of 4876 5036 cmd.exe 145 PID 4876 wrote to memory of 5376 4876 FUGW.exe 146 PID 5376 wrote to memory of 1888 5376 cmd.exe 150 PID 1888 wrote to memory of 2348 1888 FZGLR.exe 151 PID 2348 wrote to memory of 5304 2348 cmd.exe 155 PID 5304 wrote to memory of 4552 5304 LANZA.exe 156 PID 4552 wrote to memory of 2332 4552 cmd.exe 160 PID 2332 wrote to memory of 3068 2332 WSQRIF.exe 161 PID 3068 wrote to memory of 248 3068 cmd.exe 165 PID 248 wrote to memory of 2756 248 RFV.exe 166 PID 2756 wrote to memory of 5600 2756 cmd.exe 170 PID 5600 wrote to memory of 2716 5600 RIZXYVL.exe 171 PID 2716 wrote to memory of 1516 2716 cmd.exe 175 PID 1516 wrote to memory of 4972 1516 XJHKHXN.exe 176 PID 4972 wrote to memory of 2848 4972 cmd.exe 180 PID 2848 wrote to memory of 1476 2848 SWMC.exe 181 PID 1476 wrote to memory of 980 1476 cmd.exe 185 PID 980 wrote to memory of 5092 980 BEOHVVE.exe 186 PID 5092 wrote to memory of 5892 5092 cmd.exe 190 PID 5892 wrote to memory of 1040 5892 JPO.exe 191 PID 1040 wrote to memory of 2812 1040 cmd.exe 195 PID 2812 wrote to memory of 464 2812 CSSE.exe 196 PID 464 wrote to memory of 5252 464 cmd.exe 200 PID 5252 wrote to memory of 3232 5252 CNE.exe 201 PID 6076 wrote to memory of 3848 6076 NGZSC.exe 206 PID 3848 wrote to memory of 5952 3848 cmd.exe 210 PID 5952 wrote to memory of 3592 5952 ZYCLKJ.exe 211 PID 3592 wrote to memory of 4608 3592 cmd.exe 215 PID 4608 wrote to memory of 4408 4608 MJKK.exe 216 PID 4408 wrote to memory of 1264 4408 cmd.exe 220 PID 1264 wrote to memory of 6020 1264 SJSYHO.exe 221 PID 6020 wrote to memory of 1116 6020 cmd.exe 225 PID 1116 wrote to memory of 2584 1116 JUQNHJ.exe 226 PID 2584 wrote to memory of 960 2584 cmd.exe 230 PID 960 wrote to memory of 1744 960 DHV.exe 231 PID 1744 wrote to memory of 2816 1744 cmd.exe 235 PID 2816 wrote to memory of 5620 2816 SKEJCV.exe 236 PID 5620 wrote to memory of 5384 5620 cmd.exe 240 PID 5384 wrote to memory of 2892 5384 SQXYEI.exe 241 PID 2892 wrote to memory of 3280 2892 cmd.exe 245 PID 3280 wrote to memory of 5660 3280 YQELVDT.exe 246 PID 5660 wrote to memory of 2860 5660 cmd.exe 250 PID 2860 wrote to memory of 4284 2860 ERMZ.exe 251
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-27_827b4694520bbe44df42cb610902663c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-27_827b4694520bbe44df42cb610902663c_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQJQCL.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\SysWOW64\WQJQCL.exeC:\windows\system32\WQJQCL.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBT.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\windows\system\IBT.exeC:\windows\system\IBT.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FUDGOUO.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\windows\system\FUDGOUO.exeC:\windows\system\FUDGOUO.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZB.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:124 -
C:\windows\system\CZB.exeC:\windows\system\CZB.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HZJR.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\windows\system\HZJR.exeC:\windows\system\HZJR.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CNOAX.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\windows\SysWOW64\CNOAX.exeC:\windows\system32\CNOAX.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAOPYL.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\windows\CAOPYL.exeC:\windows\CAOPYL.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGYH.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\windows\system\TGYH.exeC:\windows\system\TGYH.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EYBZO.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\windows\system\EYBZO.exeC:\windows\system\EYBZO.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KYJNF.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\windows\KYJNF.exeC:\windows\KYJNF.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FUGW.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\windows\SysWOW64\FUGW.exeC:\windows\system32\FUGW.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZGLR.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\windows\FZGLR.exeC:\windows\FZGLR.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LANZA.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\windows\SysWOW64\LANZA.exeC:\windows\system32\LANZA.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSQRIF.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\windows\system\WSQRIF.exeC:\windows\system\WSQRIF.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RFV.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\windows\RFV.exeC:\windows\RFV.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIZXYVL.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\windows\SysWOW64\RIZXYVL.exeC:\windows\system32\RIZXYVL.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XJHKHXN.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\windows\system\XJHKHXN.exeC:\windows\system\XJHKHXN.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SWMC.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\windows\SysWOW64\SWMC.exeC:\windows\system32\SWMC.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BEOHVVE.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\windows\BEOHVVE.exeC:\windows\BEOHVVE.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JPO.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\windows\JPO.exeC:\windows\JPO.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CSSE.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\windows\CSSE.exeC:\windows\CSSE.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CNE.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:464 -
C:\windows\SysWOW64\CNE.exeC:\windows\system32\CNE.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NGZSC.exe.bat" "46⤵
- Executes a command shell one-liner
PID:3232 -
C:\windows\SysWOW64\NGZSC.exeC:\windows\system32\NGZSC.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZYCLKJ.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\windows\system\ZYCLKJ.exeC:\windows\system\ZYCLKJ.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MJKK.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\windows\MJKK.exeC:\windows\MJKK.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SJSYHO.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\windows\SJSYHO.exeC:\windows\SJSYHO.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUQNHJ.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\windows\SysWOW64\JUQNHJ.exeC:\windows\system32\JUQNHJ.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DHV.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\windows\system\DHV.exeC:\windows\system\DHV.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SKEJCV.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\windows\system\SKEJCV.exeC:\windows\system\SKEJCV.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SQXYEI.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\windows\SQXYEI.exeC:\windows\SQXYEI.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQELVDT.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\system\YQELVDT.exeC:\windows\system\YQELVDT.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ERMZ.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\windows\SysWOW64\ERMZ.exeC:\windows\system32\ERMZ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NROEH.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:4284 -
C:\windows\system\NROEH.exeC:\windows\system\NROEH.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VJX.exe.bat" "68⤵PID:3312
-
C:\windows\SysWOW64\VJX.exeC:\windows\system32\VJX.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GCAY.exe.bat" "70⤵PID:4812
-
C:\windows\SysWOW64\GCAY.exeC:\windows\system32\GCAY.exe71⤵
- Executes dropped EXE
PID:1224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCUDH.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:2500 -
C:\windows\QCUDH.exeC:\windows\QCUDH.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BVXWPA.exe.bat" "74⤵PID:3052
-
C:\windows\system\BVXWPA.exeC:\windows\system\BVXWPA.exe75⤵
- Executes dropped EXE
PID:1328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YACLWK.exe.bat" "76⤵PID:4648
-
C:\windows\system\YACLWK.exeC:\windows\system\YACLWK.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVMY.exe.bat" "78⤵PID:5508
-
C:\windows\SysWOW64\NVMY.exeC:\windows\system32\NVMY.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBSNO.exe.bat" "80⤵PID:2732
-
C:\windows\system\JBSNO.exeC:\windows\system\JBSNO.exe81⤵
- Executes dropped EXE
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VUNGXWE.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:840 -
C:\windows\system\VUNGXWE.exeC:\windows\system\VUNGXWE.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHR.exe.bat" "84⤵PID:3464
-
C:\windows\system\PHR.exeC:\windows\system\PHR.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPTCK.exe.bat" "86⤵
- Executes a command shell one-liner
PID:1112 -
C:\windows\ZPTCK.exeC:\windows\ZPTCK.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TCYLVTK.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:3972 -
C:\windows\system\TCYLVTK.exeC:\windows\system\TCYLVTK.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDGZ.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2136 -
C:\windows\SysWOW64\ZDGZ.exeC:\windows\system32\ZDGZ.exe91⤵
- Executes dropped EXE
PID:3812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KVJSM.exe.bat" "92⤵PID:3596
-
C:\windows\KVJSM.exeC:\windows\KVJSM.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJOBWDP.exe.bat" "94⤵PID:2972
-
C:\windows\FJOBWDP.exeC:\windows\FJOBWDP.exe95⤵
- Executes dropped EXE
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRQ.exe.bat" "96⤵PID:3264
-
C:\windows\system\WRQ.exeC:\windows\system\WRQ.exe97⤵
- Executes dropped EXE
PID:4396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TPN.exe.bat" "98⤵PID:4404
-
C:\windows\system\TPN.exeC:\windows\system\TPN.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LSRZMAV.exe.bat" "100⤵PID:1624
-
C:\windows\system\LSRZMAV.exeC:\windows\system\LSRZMAV.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IXXWBJ.exe.bat" "102⤵PID:5192
-
C:\windows\IXXWBJ.exeC:\windows\IXXWBJ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSHB.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:3256 -
C:\windows\SysWOW64\XSHB.exeC:\windows\system32\XSHB.exe105⤵
- Executes dropped EXE
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYMYTG.exe.bat" "106⤵PID:3708
-
C:\windows\MYMYTG.exeC:\windows\MYMYTG.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OLR.exe.bat" "108⤵
- Executes a command shell one-liner
PID:4428 -
C:\windows\SysWOW64\OLR.exeC:\windows\system32\OLR.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORR.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4116 -
C:\windows\system\ORR.exeC:\windows\system\ORR.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMWFP.exe.bat" "112⤵PID:4748
-
C:\windows\JMWFP.exeC:\windows\JMWFP.exe113⤵
- Executes dropped EXE
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FJUCWCI.exe.bat" "114⤵PID:1176
-
C:\windows\system\FJUCWCI.exeC:\windows\system\FJUCWCI.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RCX.exe.bat" "116⤵
- Executes a command shell one-liner
PID:3248 -
C:\windows\system\RCX.exeC:\windows\system\RCX.exe117⤵
- Executes dropped EXE
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\APHN.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4644 -
C:\windows\APHN.exeC:\windows\APHN.exe119⤵
- Executes dropped EXE
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YAYD.exe.bat" "120⤵PID:3376
-
C:\windows\YAYD.exeC:\windows\YAYD.exe121⤵
- Executes dropped EXE
PID:2660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-