Analysis
- max time kernel
112s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/09/2026, 21:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-28_fea0b05345c6520e5018599440299afd_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-28_fea0b05345c6520e5018599440299afd_elex_emotet_stop.exe
- Size 208KB
- Sample260928-zza1jsvsfw
- SHA256 ccb8c7790e84ea56d485614c6d805a6e702f17ef8f13bab95c365a26f2f7eb22
- MD5 fea0b05345c6520e5018599440299afd
- SHA1 e1bc4eda99b6ce32f4c5284bd9819cb4654fe58d
- SHA512 83d3c28a5cab2f036532abf784acb979de5a6577e105b0d3cfd7c72f0b892f1a792bbec9190f9cceadabf7fbaee09fc3d97d21569ee83d3fb9bb8ec27d78ddff
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfM4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LO0kEj1
- TLSH T14E247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 204 CNERQGY.exe 5588 STDQC.exe 3504 ZJEPILJ.exe 844 CEJ.exe 1816 RZSDEY.exe 4440 RFTRFLB.exe 4644 GACVY.exe 1020 QIE.exe 4552 QDIEH.exe 2268 LYNORTC.exe 2252 YBVMF.exe 3320 ORW.exe 5932 DUOQXM.exe 4872 MVIVBJX.exe 5536 SVPJS.exe 4276 TYBNXBA.exe 5900 TDTTZGC.exe 3332 NRYKJG.exe 3068 CMHPUBA.exe 2876 MUJUX.exe 896 MXNYLOD.exe 3268 HKSH.exe 624 NLAVEQ.exe 1812 WLC.exe 3456 RGGJ.exe 5840 GBQODIT.exe 5124 BPVF.exe 2880 JUVLP.exe 1496 OVDZYPM.exe 1248 OIV.exe 1916 UICBQ.exe 3200 JGIYX.exe 4516 PGQMGIL.exe 2368 THSOSE.exe 456 VFFJZN.exe 3040 ZNM.exe 4420 BKFL.exe 2852 WYKUU.exe 5540 HQNNDJL.exe 108 NRUB.exe 3224 IMZKWD.exe 3360 TECDE.exe 2728 EXXWEA.exe 3708 VCIO.exe 6032 HVLHC.exe 3116 MVSUM.exe 5700 WEUA.exe 1052 HWP.exe 4788 DMRRJN.exe 2176 PFUJRVZ.exe 4712 VFCX.exe 4412 JLAUPH.exe 5384 GIGRWJ.exe 5068 XRIW.exe 4388 IJL.exe 1992 RWVHYS.exe 4684 OUTWFC.exe 5412 XCVB.exe 2564 DDDX.exe 6072 YQH.exe 4396 JIKRKJL.exe 1072 UBF.exe 2608 ABNYBS.exe 1196 AHNMDF.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\RFTRFLB.exe.bat RZSDEY.exe File created C:\windows\SysWOW64\MUJUX.exe CMHPUBA.exe File opened for modification C:\windows\SysWOW64\MXNYLOD.exe MUJUX.exe File created C:\windows\SysWOW64\DMRRJN.exe.bat HWP.exe File created C:\windows\SysWOW64\LFH.exe.bat ANEOHXB.exe File opened for modification C:\windows\SysWOW64\KFCMRI.exe VZFP.exe File created C:\windows\SysWOW64\LSCBL.exe WME.exe File created C:\windows\SysWOW64\BPVF.exe GBQODIT.exe File created C:\windows\SysWOW64\TECDE.exe.bat IMZKWD.exe File opened for modification C:\windows\SysWOW64\MVSUM.exe HVLHC.exe File opened for modification C:\windows\SysWOW64\IJL.exe XRIW.exe File created C:\windows\SysWOW64\OUTWFC.exe RWVHYS.exe File opened for modification C:\windows\SysWOW64\IFVZXX.exe LZXC.exe File created C:\windows\SysWOW64\IFVZXX.exe.bat LZXC.exe File opened for modification C:\windows\SysWOW64\IJGCPUZ.exe LDI.exe File created C:\windows\SysWOW64\DUOQXM.exe.bat ORW.exe File opened for modification C:\windows\SysWOW64\BPVF.exe GBQODIT.exe File created C:\windows\SysWOW64\THSOSE.exe.bat PGQMGIL.exe File opened for modification C:\windows\SysWOW64\OUTWFC.exe RWVHYS.exe File opened for modification C:\windows\SysWOW64\PYCQBA.exe NIBOVMU.exe File created C:\windows\SysWOW64\ABEBHX.exe XOZS.exe File created C:\windows\SysWOW64\AZXD.exe JUNLGX.exe File created C:\windows\SysWOW64\SCV.exe.bat YPRUUAD.exe File opened for modification C:\windows\SysWOW64\HHBAM.exe SCV.exe File created C:\windows\SysWOW64\TBJ.exe IJGCPUZ.exe File created C:\windows\SysWOW64\DVOGZ.exe XVOSI.exe File created C:\windows\SysWOW64\DUOQXM.exe ORW.exe File opened for modification C:\windows\SysWOW64\VFFJZN.exe THSOSE.exe File created C:\windows\SysWOW64\MVSUM.exe.bat HVLHC.exe File created C:\windows\SysWOW64\WEUA.exe.bat MVSUM.exe File created C:\windows\SysWOW64\PSXESJP.exe DZULK.exe File created C:\windows\SysWOW64\XJT.exe.bat VUADB.exe File created C:\windows\SysWOW64\HHBAM.exe.bat SCV.exe File opened for modification C:\windows\SysWOW64\LYNORTC.exe QDIEH.exe File created C:\windows\SysWOW64\MGSESSJ.exe.bat DTHMDO.exe File opened for modification C:\windows\SysWOW64\DSJVBY.exe JFEM.exe File created C:\windows\SysWOW64\QQIMFJ.exe KQI.exe File created C:\windows\SysWOW64\LDI.exe.bat PYCQBA.exe File opened for modification C:\windows\SysWOW64\HKSH.exe MXNYLOD.exe File opened for modification C:\windows\SysWOW64\TECDE.exe IMZKWD.exe File created C:\windows\SysWOW64\WEUA.exe MVSUM.exe File created C:\windows\SysWOW64\JSQ.exe DSJVBY.exe File opened for modification C:\windows\SysWOW64\MUJUX.exe CMHPUBA.exe File created C:\windows\SysWOW64\NRUB.exe.bat HQNNDJL.exe File created C:\windows\SysWOW64\QQIMFJ.exe.bat KQI.exe File created C:\windows\SysWOW64\JOOJX.exe MQQMQ.exe File created C:\windows\SysWOW64\VFFJZN.exe THSOSE.exe File created C:\windows\SysWOW64\IZWORJT.exe AHNMDF.exe File created C:\windows\SysWOW64\PYCQBA.exe NIBOVMU.exe File created C:\windows\SysWOW64\WME.exe CZZVUU.exe File created C:\windows\SysWOW64\MXNYLOD.exe.bat MUJUX.exe File opened for modification C:\windows\SysWOW64\ZNM.exe VFFJZN.exe File created C:\windows\SysWOW64\NRUB.exe HQNNDJL.exe File created C:\windows\SysWOW64\QIE.exe.bat GACVY.exe File created C:\windows\SysWOW64\WLC.exe.bat NLAVEQ.exe File created C:\windows\SysWOW64\OFWQ.exe IFOCSWO.exe File created C:\windows\SysWOW64\OTIN.exe KLBNIA.exe File created C:\windows\SysWOW64\XVOSI.exe.bat MDLZ.exe File created C:\windows\SysWOW64\DVOGZ.exe.bat XVOSI.exe File opened for modification C:\windows\SysWOW64\TDTTZGC.exe TYBNXBA.exe File created C:\windows\SysWOW64\ZNM.exe.bat VFFJZN.exe File opened for modification C:\windows\SysWOW64\MQQMQ.exe YLKO.exe File created C:\windows\SysWOW64\LYNORTC.exe.bat QDIEH.exe File created C:\windows\SysWOW64\HKSH.exe.bat MXNYLOD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\CMHPUBA.exe.bat NRYKJG.exe File created C:\windows\system\BKI.exe.bat MNCJSJ.exe File opened for modification C:\windows\RWVHYS.exe IJL.exe File created C:\windows\system\JHV.exe.bat YOALBAK.exe File created C:\windows\system\XAED.exe IFVZXX.exe File created C:\windows\system\RGGJ.exe WLC.exe File created C:\windows\PFUJRVZ.exe.bat DMRRJN.exe File opened for modification C:\windows\system\XCVB.exe OUTWFC.exe File opened for modification C:\windows\system\UBF.exe JIKRKJL.exe File created C:\windows\system\KLBNIA.exe OFWQ.exe File opened for modification C:\windows\MNCJSJ.exe XJT.exe File created C:\windows\system\NIBOVMU.exe.bat HHBAM.exe File created C:\windows\system\PXPIUC.exe EEMPM.exe File created C:\windows\system\GACVY.exe RFTRFLB.exe File created C:\windows\JIKRKJL.exe.bat YQH.exe File created C:\windows\JFEM.exe LEWYIWI.exe File opened for modification C:\windows\BJLFNQB.exe QQIMFJ.exe File opened for modification C:\windows\system\BJFWTYR.exe UZFVGU.exe File created C:\windows\system\YLKO.exe MSHWBID.exe File created C:\windows\system\GIGRWJ.exe JLAUPH.exe File created C:\windows\system\ZJEPILJ.exe STDQC.exe File created C:\windows\system\RZSDEY.exe.bat CEJ.exe File opened for modification C:\windows\TYBNXBA.exe SVPJS.exe File created C:\windows\system\VFCX.exe.bat PFUJRVZ.exe File opened for modification C:\windows\ANQRY.exe AZXD.exe File opened for modification C:\windows\system\DTHMDO.exe SBEUU.exe File opened for modification C:\windows\system\BKI.exe MNCJSJ.exe File opened for modification C:\windows\system\MVIVBJX.exe DUOQXM.exe File opened for modification C:\windows\GBQODIT.exe RGGJ.exe File created C:\windows\WYKUU.exe.bat BKFL.exe File opened for modification C:\windows\system\HQNNDJL.exe WYKUU.exe File created C:\windows\system\MHAMX.exe AZTELPL.exe File created C:\windows\system\KQI.exe.bat XFES.exe File created C:\windows\EEMPM.exe EUMOG.exe File created C:\windows\FUUYFLQ.exe JOOJX.exe File created C:\windows\CEJ.exe ZJEPILJ.exe File created C:\windows\system\GACVY.exe.bat RFTRFLB.exe File created C:\windows\system\UICBQ.exe.bat OIV.exe File opened for modification C:\windows\system\YQH.exe DDDX.exe File created C:\windows\VDY.exe BIBVDX.exe File created C:\windows\HVLHC.exe VCIO.exe File opened for modification C:\windows\JIKRKJL.exe YQH.exe File created C:\windows\system\UBF.exe JIKRKJL.exe File opened for modification C:\windows\AHNMDF.exe ABNYBS.exe File created C:\windows\LQLKN.exe JSYQG.exe File opened for modification C:\windows\XFES.exe XAED.exe File created C:\windows\system\IPBRF.exe NBW.exe File created C:\windows\system\YLKO.exe.bat MSHWBID.exe File created C:\windows\system\JLAUPH.exe VFCX.exe File opened for modification C:\windows\system\SBEUU.exe VDY.exe File created C:\windows\QDIEH.exe.bat QIE.exe File created C:\windows\system\JGIYX.exe.bat UICBQ.exe File created C:\windows\AHNMDF.exe ABNYBS.exe File opened for modification C:\windows\JUNLGX.exe ZLLGD.exe File opened for modification C:\windows\JFEM.exe LEWYIWI.exe File created C:\windows\BBSWW.exe.bat JSQ.exe File created C:\windows\system\JSYQG.exe MMASZM.exe File created C:\windows\system\OORYZRF.exe DVOGZ.exe File created C:\windows\GBSKFSC.exe.bat BBSWW.exe File created C:\windows\PTSPKFX.exe.bat TOMADV.exe File created C:\windows\system\IIBU.exe MDV.exe File created C:\windows\UYSNGOZ.exe JGPUY.exe File created C:\windows\GBQODIT.exe RGGJ.exe File created C:\windows\GLI.exe.bat PXXSTOK.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4364 cmd.exe 2172 cmd.exe 2484 cmd.exe 1368 cmd.exe 2432 cmd.exe 4560 cmd.exe 5692 cmd.exe 1548 cmd.exe 5868 cmd.exe 5128 cmd.exe 4768 cmd.exe 6024 cmd.exe 5376 cmd.exe 708 cmd.exe 4128 cmd.exe 1476 cmd.exe 4744 cmd.exe 3396 cmd.exe 4196 cmd.exe 5144 cmd.exe 2492 cmd.exe 1324 cmd.exe 1684 cmd.exe 4952 cmd.exe 3644 cmd.exe 4956 cmd.exe 5336 cmd.exe 4464 cmd.exe 1352 cmd.exe 1584 cmd.exe 5784 cmd.exe 2784 cmd.exe 1972 cmd.exe 1920 cmd.exe 1008 cmd.exe 1452 cmd.exe 4556 cmd.exe 6060 cmd.exe 2468 cmd.exe 5872 cmd.exe 5008 cmd.exe 2548 cmd.exe 2072 cmd.exe 5856 cmd.exe 2944 cmd.exe 2612 cmd.exe 1620 cmd.exe 1356 cmd.exe 1016 cmd.exe 5660 cmd.exe 4764 cmd.exe 2872 cmd.exe 5160 cmd.exe 5272 cmd.exe 5424 cmd.exe 3032 cmd.exe 5416 cmd.exe 5232 cmd.exe 3692 cmd.exe 2056 cmd.exe 5828 cmd.exe 2360 cmd.exe 1936 cmd.exe 4316 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 6024 3180 WerFault.exe 88 2728 204 WerFault.exe 94 4764 5588 WerFault.exe 100 5104 3504 WerFault.exe 105 3476 844 WerFault.exe 110 2988 1816 WerFault.exe 115 4916 4440 WerFault.exe 120 4632 4644 WerFault.exe 125 5116 1020 WerFault.exe 130 4192 4552 WerFault.exe 135 1916 2268 WerFault.exe 140 5848 2252 WerFault.exe 145 3360 3320 WerFault.exe 150 3920 5932 WerFault.exe 155 2408 4872 WerFault.exe 160 6124 5536 WerFault.exe 165 3244 4276 WerFault.exe 170 5912 5900 WerFault.exe 175 5144 3332 WerFault.exe 180 1200 3068 WerFault.exe 185 4964 2876 WerFault.exe 190 5848 896 WerFault.exe 195 820 3268 WerFault.exe 200 3012 624 WerFault.exe 205 3708 1812 WerFault.exe 210 3080 3456 WerFault.exe 215 4336 5840 WerFault.exe 220 5844 5124 WerFault.exe 225 3136 2880 WerFault.exe 230 5412 1496 WerFault.exe 235 4876 1248 WerFault.exe 240 1832 1916 WerFault.exe 245 2728 3200 WerFault.exe 250 3296 4516 WerFault.exe 255 4272 2368 WerFault.exe 260 3912 456 WerFault.exe 265 5564 3040 WerFault.exe 270 3692 4420 WerFault.exe 275 5108 2852 WerFault.exe 280 2648 5540 WerFault.exe 286 2748 108 WerFault.exe 291 5560 3224 WerFault.exe 296 4992 3360 WerFault.exe 301 3208 2728 WerFault.exe 306 3936 3708 WerFault.exe 311 4388 6032 WerFault.exe 316 2604 3116 WerFault.exe 321 5164 5700 WerFault.exe 326 4672 1052 WerFault.exe 331 292 4788 WerFault.exe 336 5784 2176 WerFault.exe 341 200 4712 WerFault.exe 346 5580 4412 WerFault.exe 351 5852 5384 WerFault.exe 356 3080 5068 WerFault.exe 361 2860 4388 WerFault.exe 366 4184 1992 WerFault.exe 371 3892 4684 WerFault.exe 376 3540 5412 WerFault.exe 381 3432 2564 WerFault.exe 386 4124 6072 WerFault.exe 391 3920 4396 WerFault.exe 396 1748 1072 WerFault.exe 401 2952 2608 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGQMGIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUUYFLQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVSUM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MDV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JGPUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RWYKNY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXXWEA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMRRJN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANQRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXNYLOD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AHNMDF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BJLFNQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UZFVGU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TYBNXBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMHPUBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TECDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TOMADV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLBNIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFES.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPRUUAD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIGRWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KFCMRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYKUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UOYM.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3180 2026-09-28_fea0b05345c6520e5018599440299afd_elex_emotet_stop.exe 3180 2026-09-28_fea0b05345c6520e5018599440299afd_elex_emotet_stop.exe 204 CNERQGY.exe 204 CNERQGY.exe 5588 STDQC.exe 5588 STDQC.exe 3504 ZJEPILJ.exe 3504 ZJEPILJ.exe 844 CEJ.exe 844 CEJ.exe 1816 RZSDEY.exe 1816 RZSDEY.exe 4440 RFTRFLB.exe 4440 RFTRFLB.exe 4644 GACVY.exe 4644 GACVY.exe 1020 QIE.exe 1020 QIE.exe 4552 QDIEH.exe 4552 QDIEH.exe 2268 LYNORTC.exe 2268 LYNORTC.exe 2252 YBVMF.exe 2252 YBVMF.exe 3320 ORW.exe 3320 ORW.exe 5932 DUOQXM.exe 5932 DUOQXM.exe 4872 MVIVBJX.exe 4872 MVIVBJX.exe 5536 SVPJS.exe 5536 SVPJS.exe 4276 TYBNXBA.exe 4276 TYBNXBA.exe 5900 TDTTZGC.exe 5900 TDTTZGC.exe 3332 NRYKJG.exe 3332 NRYKJG.exe 3068 CMHPUBA.exe 3068 CMHPUBA.exe 2876 MUJUX.exe 2876 MUJUX.exe 896 MXNYLOD.exe 896 MXNYLOD.exe 3268 HKSH.exe 3268 HKSH.exe 624 NLAVEQ.exe 624 NLAVEQ.exe 1812 WLC.exe 1812 WLC.exe 3456 RGGJ.exe 3456 RGGJ.exe 5840 GBQODIT.exe 5840 GBQODIT.exe 5124 BPVF.exe 5124 BPVF.exe 2880 JUVLP.exe 2880 JUVLP.exe 1496 OVDZYPM.exe 1496 OVDZYPM.exe 1248 OIV.exe 1248 OIV.exe 1916 UICBQ.exe 1916 UICBQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3180 2026-09-28_fea0b05345c6520e5018599440299afd_elex_emotet_stop.exe 3180 2026-09-28_fea0b05345c6520e5018599440299afd_elex_emotet_stop.exe 204 CNERQGY.exe 204 CNERQGY.exe 5588 STDQC.exe 5588 STDQC.exe 3504 ZJEPILJ.exe 3504 ZJEPILJ.exe 844 CEJ.exe 844 CEJ.exe 1816 RZSDEY.exe 1816 RZSDEY.exe 4440 RFTRFLB.exe 4440 RFTRFLB.exe 4644 GACVY.exe 4644 GACVY.exe 1020 QIE.exe 1020 QIE.exe 4552 QDIEH.exe 4552 QDIEH.exe 2268 LYNORTC.exe 2268 LYNORTC.exe 2252 YBVMF.exe 2252 YBVMF.exe 3320 ORW.exe 3320 ORW.exe 5932 DUOQXM.exe 5932 DUOQXM.exe 4872 MVIVBJX.exe 4872 MVIVBJX.exe 5536 SVPJS.exe 5536 SVPJS.exe 4276 TYBNXBA.exe 4276 TYBNXBA.exe 5900 TDTTZGC.exe 5900 TDTTZGC.exe 3332 NRYKJG.exe 3332 NRYKJG.exe 3068 CMHPUBA.exe 3068 CMHPUBA.exe 2876 MUJUX.exe 2876 MUJUX.exe 896 MXNYLOD.exe 896 MXNYLOD.exe 3268 HKSH.exe 3268 HKSH.exe 624 NLAVEQ.exe 624 NLAVEQ.exe 1812 WLC.exe 1812 WLC.exe 3456 RGGJ.exe 3456 RGGJ.exe 5840 GBQODIT.exe 5840 GBQODIT.exe 5124 BPVF.exe 5124 BPVF.exe 2880 JUVLP.exe 2880 JUVLP.exe 1496 OVDZYPM.exe 1496 OVDZYPM.exe 1248 OIV.exe 1248 OIV.exe 1916 UICBQ.exe 1916 UICBQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3180 wrote to memory of 5980 3180 2026-09-28_fea0b05345c6520e5018599440299afd_elex_emotet_stop.exe 90 PID 5980 wrote to memory of 204 5980 cmd.exe 94 PID 204 wrote to memory of 5420 204 CNERQGY.exe 96 PID 5420 wrote to memory of 5588 5420 cmd.exe 100 PID 5588 wrote to memory of 2724 5588 STDQC.exe 101 PID 2724 wrote to memory of 3504 2724 cmd.exe 105 PID 3504 wrote to memory of 4260 3504 ZJEPILJ.exe 106 PID 4260 wrote to memory of 844 4260 cmd.exe 110 PID 844 wrote to memory of 4624 844 CEJ.exe 111 PID 4624 wrote to memory of 1816 4624 cmd.exe 115 PID 1816 wrote to memory of 3192 1816 RZSDEY.exe 116 PID 3192 wrote to memory of 4440 3192 cmd.exe 120 PID 4440 wrote to memory of 4956 4440 RFTRFLB.exe 121 PID 4956 wrote to memory of 4644 4956 cmd.exe 125 PID 4644 wrote to memory of 1920 4644 GACVY.exe 126 PID 1920 wrote to memory of 1020 1920 cmd.exe 130 PID 1020 wrote to memory of 5128 1020 QIE.exe 131 PID 5128 wrote to memory of 4552 5128 cmd.exe 135 PID 4552 wrote to memory of 5424 4552 QDIEH.exe 136 PID 5424 wrote to memory of 2268 5424 cmd.exe 140 PID 2268 wrote to memory of 6016 2268 LYNORTC.exe 141 PID 6016 wrote to memory of 2252 6016 cmd.exe 145 PID 2252 wrote to memory of 6020 2252 YBVMF.exe 146 PID 6020 wrote to memory of 3320 6020 cmd.exe 150 PID 3320 wrote to memory of 4604 3320 ORW.exe 151 PID 4604 wrote to memory of 5932 4604 cmd.exe 155 PID 5932 wrote to memory of 3372 5932 DUOQXM.exe 156 PID 3372 wrote to memory of 4872 3372 cmd.exe 160 PID 4872 wrote to memory of 3756 4872 MVIVBJX.exe 161 PID 3756 wrote to memory of 5536 3756 cmd.exe 165 PID 5536 wrote to memory of 5896 5536 SVPJS.exe 166 PID 5896 wrote to memory of 4276 5896 cmd.exe 170 PID 4276 wrote to memory of 3368 4276 TYBNXBA.exe 171 PID 3368 wrote to memory of 5900 3368 cmd.exe 175 PID 5900 wrote to memory of 4560 5900 TDTTZGC.exe 176 PID 4560 wrote to memory of 3332 4560 cmd.exe 180 PID 3332 wrote to memory of 3396 3332 NRYKJG.exe 181 PID 3396 wrote to memory of 3068 3396 cmd.exe 185 PID 3068 wrote to memory of 1552 3068 CMHPUBA.exe 186 PID 1552 wrote to memory of 2876 1552 cmd.exe 190 PID 2876 wrote to memory of 4104 2876 MUJUX.exe 191 PID 4104 wrote to memory of 896 4104 cmd.exe 195 PID 896 wrote to memory of 4368 896 MXNYLOD.exe 196 PID 4368 wrote to memory of 3268 4368 cmd.exe 200 PID 3268 wrote to memory of 5660 3268 HKSH.exe 201 PID 5660 wrote to memory of 624 5660 cmd.exe 205 PID 624 wrote to memory of 4196 624 NLAVEQ.exe 206 PID 4196 wrote to memory of 1812 4196 cmd.exe 210 PID 1812 wrote to memory of 5304 1812 WLC.exe 211 PID 5304 wrote to memory of 3456 5304 cmd.exe 215 PID 3456 wrote to memory of 4768 3456 RGGJ.exe 216 PID 4768 wrote to memory of 5840 4768 cmd.exe 220 PID 5840 wrote to memory of 6004 5840 GBQODIT.exe 221 PID 6004 wrote to memory of 5124 6004 cmd.exe 225 PID 5124 wrote to memory of 4100 5124 BPVF.exe 226 PID 4100 wrote to memory of 2880 4100 cmd.exe 230 PID 2880 wrote to memory of 1008 2880 JUVLP.exe 231 PID 1008 wrote to memory of 1496 1008 cmd.exe 235 PID 1496 wrote to memory of 2300 1496 OVDZYPM.exe 236 PID 2300 wrote to memory of 1248 2300 cmd.exe 240 PID 1248 wrote to memory of 2732 1248 OIV.exe 241 PID 2732 wrote to memory of 1916 2732 cmd.exe 245 PID 1916 wrote to memory of 6024 1916 UICBQ.exe 246 PID 6024 wrote to memory of 3200 6024 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-28_fea0b05345c6520e5018599440299afd_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-28_fea0b05345c6520e5018599440299afd_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CNERQGY.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\windows\system\CNERQGY.exeC:\windows\system\CNERQGY.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STDQC.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\windows\system\STDQC.exeC:\windows\system\STDQC.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZJEPILJ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\windows\system\ZJEPILJ.exeC:\windows\system\ZJEPILJ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEJ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\windows\CEJ.exeC:\windows\CEJ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RZSDEY.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\windows\system\RZSDEY.exeC:\windows\system\RZSDEY.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RFTRFLB.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\windows\SysWOW64\RFTRFLB.exeC:\windows\system32\RFTRFLB.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GACVY.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\windows\system\GACVY.exeC:\windows\system\GACVY.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QIE.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\windows\SysWOW64\QIE.exeC:\windows\system32\QIE.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QDIEH.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\windows\QDIEH.exeC:\windows\QDIEH.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LYNORTC.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\windows\SysWOW64\LYNORTC.exeC:\windows\system32\LYNORTC.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBVMF.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\windows\system\YBVMF.exeC:\windows\system\YBVMF.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORW.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\windows\system\ORW.exeC:\windows\system\ORW.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DUOQXM.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\windows\SysWOW64\DUOQXM.exeC:\windows\system32\DUOQXM.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MVIVBJX.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\windows\system\MVIVBJX.exeC:\windows\system\MVIVBJX.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVPJS.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\windows\SVPJS.exeC:\windows\SVPJS.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TYBNXBA.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\windows\TYBNXBA.exeC:\windows\TYBNXBA.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TDTTZGC.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\windows\SysWOW64\TDTTZGC.exeC:\windows\system32\TDTTZGC.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NRYKJG.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\windows\NRYKJG.exeC:\windows\NRYKJG.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CMHPUBA.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\windows\system\CMHPUBA.exeC:\windows\system\CMHPUBA.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUJUX.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\windows\SysWOW64\MUJUX.exeC:\windows\system32\MUJUX.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MXNYLOD.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\windows\SysWOW64\MXNYLOD.exeC:\windows\system32\MXNYLOD.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKSH.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\windows\SysWOW64\HKSH.exeC:\windows\system32\HKSH.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLAVEQ.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\windows\system\NLAVEQ.exeC:\windows\system\NLAVEQ.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLC.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\windows\SysWOW64\WLC.exeC:\windows\system32\WLC.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGGJ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\windows\system\RGGJ.exeC:\windows\system\RGGJ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GBQODIT.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\windows\GBQODIT.exeC:\windows\GBQODIT.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BPVF.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\windows\SysWOW64\BPVF.exeC:\windows\system32\BPVF.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JUVLP.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\windows\JUVLP.exeC:\windows\JUVLP.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVDZYPM.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\windows\system\OVDZYPM.exeC:\windows\system\OVDZYPM.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OIV.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\windows\system\OIV.exeC:\windows\system\OIV.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UICBQ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\windows\system\UICBQ.exeC:\windows\system\UICBQ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JGIYX.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\windows\system\JGIYX.exeC:\windows\system\JGIYX.exe65⤵
- Executes dropped EXE
PID:3200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PGQMGIL.exe.bat" "66⤵PID:5132
-
C:\windows\SysWOW64\PGQMGIL.exeC:\windows\system32\PGQMGIL.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THSOSE.exe.bat" "68⤵
- Executes a command shell one-liner
PID:1936 -
C:\windows\SysWOW64\THSOSE.exeC:\windows\system32\THSOSE.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFFJZN.exe.bat" "70⤵PID:3476
-
C:\windows\SysWOW64\VFFJZN.exeC:\windows\system32\VFFJZN.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNM.exe.bat" "72⤵PID:6124
-
C:\windows\SysWOW64\ZNM.exeC:\windows\system32\ZNM.exe73⤵
- Executes dropped EXE
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKFL.exe.bat" "74⤵PID:1776
-
C:\windows\BKFL.exeC:\windows\BKFL.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WYKUU.exe.bat" "76⤵PID:3868
-
C:\windows\WYKUU.exeC:\windows\WYKUU.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HQNNDJL.exe.bat" "78⤵
- Executes a command shell one-liner
PID:5144 -
C:\windows\system\HQNNDJL.exeC:\windows\system\HQNNDJL.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NRUB.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4524 -
C:\windows\SysWOW64\NRUB.exeC:\windows\system32\NRUB.exe81⤵
- Executes dropped EXE
PID:108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMZKWD.exe.bat" "82⤵PID:4876
-
C:\windows\IMZKWD.exeC:\windows\IMZKWD.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TECDE.exe.bat" "84⤵
- Executes a command shell one-liner
PID:5336 -
C:\windows\SysWOW64\TECDE.exeC:\windows\system32\TECDE.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXXWEA.exe.bat" "86⤵PID:3900
-
C:\windows\SysWOW64\EXXWEA.exeC:\windows\system32\EXXWEA.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VCIO.exe.bat" "88⤵
- Executes a command shell one-liner
PID:5692 -
C:\windows\system\VCIO.exeC:\windows\system\VCIO.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HVLHC.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:5780 -
C:\windows\HVLHC.exeC:\windows\HVLHC.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVSUM.exe.bat" "92⤵PID:5712
-
C:\windows\SysWOW64\MVSUM.exeC:\windows\system32\MVSUM.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WEUA.exe.bat" "94⤵PID:3388
-
C:\windows\SysWOW64\WEUA.exeC:\windows\system32\WEUA.exe95⤵
- Executes dropped EXE
PID:5700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWP.exe.bat" "96⤵PID:5576
-
C:\windows\system\HWP.exeC:\windows\system\HWP.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DMRRJN.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3032 -
C:\windows\SysWOW64\DMRRJN.exeC:\windows\system32\DMRRJN.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFUJRVZ.exe.bat" "100⤵PID:2648
-
C:\windows\PFUJRVZ.exeC:\windows\PFUJRVZ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VFCX.exe.bat" "102⤵PID:5440
-
C:\windows\system\VFCX.exeC:\windows\system\VFCX.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLAUPH.exe.bat" "104⤵PID:6136
-
C:\windows\system\JLAUPH.exeC:\windows\system\JLAUPH.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GIGRWJ.exe.bat" "106⤵PID:3296
-
C:\windows\system\GIGRWJ.exeC:\windows\system\GIGRWJ.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRIW.exe.bat" "108⤵PID:3716
-
C:\windows\XRIW.exeC:\windows\XRIW.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IJL.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5416 -
C:\windows\SysWOW64\IJL.exeC:\windows\system32\IJL.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RWVHYS.exe.bat" "112⤵PID:1168
-
C:\windows\RWVHYS.exeC:\windows\RWVHYS.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUTWFC.exe.bat" "114⤵PID:3420
-
C:\windows\SysWOW64\OUTWFC.exeC:\windows\system32\OUTWFC.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCVB.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2492 -
C:\windows\system\XCVB.exeC:\windows\system\XCVB.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DDDX.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:2776 -
C:\windows\DDDX.exeC:\windows\DDDX.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQH.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4464 -
C:\windows\system\YQH.exeC:\windows\system\YQH.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-