Analysis
- max time kernel
68s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/09/2026, 16:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_c5a749d88e350b0fcb2548a590530544_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-29_c5a749d88e350b0fcb2548a590530544_elex_emotet_stop.exe
- Size 208KB
- Sample260929-vg3kmaycle
- SHA256 1c378fdffbae4b62d4363fd79d63860affb5f9212ed3dce18113a9e1e5eb18e2
- MD5 c5a749d88e350b0fcb2548a590530544
- SHA1 071ff188a3b4665267579bb0a956ed26b45d21db
- SHA512 0c4146d57b3fb261f1dcc652bb9ca63dd82d512253f86c8506216d033549c69e1cab8a4aac792b47053c446864f825d316a73790a69df4208b81597a465285ab
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5Xb8lcdL+LOfc4pLthEjQT6j:MlZtbLWIgd1LZ9oECZb8lc5+LOkkEj1
- TLSH T1C3247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2012 YEJZHD.exe 4592 DPNO.exe 2640 YXNK.exe 5940 FQLTUJW.exe 5920 NWPZEI.exe 5096 OZGV.exe 3172 QHO.exe 5112 CZE.exe 4164 ASHLSSU.exe 4140 IYLRDQX.exe 3312 FYVCHN.exe 4100 ZRKNYN.exe 5912 HWPTBM.exe 5036 AXEESN.exe 1084 NVEQ.exe 5092 BFNPIBP.exe 6088 KDABQKY.exe 620 TJFQAI.exe 2548 LMR.exe 5436 QMTOSCL.exe 5800 YSFUCAH.exe 4268 LCOTQLC.exe 5428 XQVRV.exe 3156 BVFGEI.exe 3976 AGQWM.exe 5456 FHE.exe 4536 VSHPISN.exe 3396 UCSXRG.exe 6108 PNAV.exe 4544 UQYQFCH.exe 3300 SGRLA.exe 4900 HWSL.exe 5000 JUYFOL.exe 3268 DUOQXM.exe 3912 QSOCZ.exe 3756 AQTO.exe 2820 TTXSUW.exe 1660 SEIID.exe 5032 FOQ.exe 4212 PMW.exe 5360 NXHJHBD.exe 5640 MIJZPH.exe 5708 BDTDBB.exe 5728 UGXHG.exe 5660 DGZMRPD.exe 4836 PWFM.exe 3284 RUT.exe 1864 SXXKR.exe 3768 KSBG.exe 5616 GDREKGG.exe 1348 TBRQUS.exe 4628 XRY.exe 6132 DRFEP.exe 1508 BME.exe 3456 LKKZBQ.exe 5764 GXPIMQS.exe 4872 ALUA.exe 3668 BOX.exe 4796 DBPX.exe 4892 DHPMO.exe 5416 NEUGEMK.exe 1112 VSHNGKF.exe 3272 DNRZZ.exe 6096 FAVIKF.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\DHPMO.exe DBPX.exe File opened for modification C:\windows\SysWOW64\TSJZUCL.exe VRBL.exe File created C:\windows\SysWOW64\YXNK.exe.bat DPNO.exe File created C:\windows\SysWOW64\FQLTUJW.exe YXNK.exe File created C:\windows\SysWOW64\PMW.exe FOQ.exe File created C:\windows\SysWOW64\NEUGEMK.exe DHPMO.exe File created C:\windows\SysWOW64\BDTDBB.exe MIJZPH.exe File opened for modification C:\windows\SysWOW64\GDREKGG.exe KSBG.exe File created C:\windows\SysWOW64\TBRQUS.exe.bat GDREKGG.exe File created C:\windows\SysWOW64\DBPX.exe BOX.exe File created C:\windows\SysWOW64\NRDIQ.exe WRBV.exe File created C:\windows\SysWOW64\FFPVI.exe WFNQ.exe File opened for modification C:\windows\SysWOW64\FQLTUJW.exe YXNK.exe File created C:\windows\SysWOW64\BFNPIBP.exe.bat NVEQ.exe File created C:\windows\SysWOW64\LCOTQLC.exe YSFUCAH.exe File created C:\windows\SysWOW64\DUOQXM.exe.bat JUYFOL.exe File opened for modification C:\windows\SysWOW64\FOQ.exe SEIID.exe File opened for modification C:\windows\SysWOW64\DGZMRPD.exe UGXHG.exe File opened for modification C:\windows\SysWOW64\DBPX.exe BOX.exe File created C:\windows\SysWOW64\DBPX.exe.bat BOX.exe File opened for modification C:\windows\SysWOW64\YXNK.exe DPNO.exe File created C:\windows\SysWOW64\BVFGEI.exe.bat XQVRV.exe File created C:\windows\SysWOW64\PNAV.exe.bat UCSXRG.exe File created C:\windows\SysWOW64\DUOQXM.exe JUYFOL.exe File opened for modification C:\windows\SysWOW64\MIJZPH.exe NXHJHBD.exe File opened for modification C:\windows\SysWOW64\RUT.exe PWFM.exe File created C:\windows\SysWOW64\SXXKR.exe.bat RUT.exe File created C:\windows\SysWOW64\NEUGEMK.exe.bat DHPMO.exe File created C:\windows\SysWOW64\FQLTUJW.exe.bat YXNK.exe File created C:\windows\SysWOW64\LCOTQLC.exe.bat YSFUCAH.exe File created C:\windows\SysWOW64\JUYFOL.exe.bat HWSL.exe File opened for modification C:\windows\SysWOW64\NRDIQ.exe WRBV.exe File opened for modification C:\windows\SysWOW64\KFZ.exe ZNWPNJT.exe File created C:\windows\SysWOW64\YXNK.exe DPNO.exe File created C:\windows\SysWOW64\XQVRV.exe LCOTQLC.exe File opened for modification C:\windows\SysWOW64\PNAV.exe UCSXRG.exe File created C:\windows\SysWOW64\JUYFOL.exe HWSL.exe File opened for modification C:\windows\SysWOW64\JUYFOL.exe HWSL.exe File opened for modification C:\windows\SysWOW64\TTXSUW.exe AQTO.exe File created C:\windows\SysWOW64\FOQ.exe.bat SEIID.exe File opened for modification C:\windows\SysWOW64\BDTDBB.exe MIJZPH.exe File opened for modification C:\windows\SysWOW64\XQVRV.exe LCOTQLC.exe File created C:\windows\SysWOW64\RUT.exe PWFM.exe File created C:\windows\SysWOW64\GDREKGG.exe.bat KSBG.exe File created C:\windows\SysWOW64\TBRQUS.exe GDREKGG.exe File opened for modification C:\windows\SysWOW64\TBRQUS.exe GDREKGG.exe File opened for modification C:\windows\SysWOW64\DHPMO.exe DBPX.exe File created C:\windows\SysWOW64\TSJZUCL.exe.bat VRBL.exe File created C:\windows\SysWOW64\WFNQ.exe TSJZUCL.exe File created C:\windows\SysWOW64\PNAV.exe UCSXRG.exe File created C:\windows\SysWOW64\UQYQFCH.exe PNAV.exe File created C:\windows\SysWOW64\TTXSUW.exe AQTO.exe File created C:\windows\SysWOW64\PMW.exe.bat FOQ.exe File created C:\windows\SysWOW64\DGZMRPD.exe UGXHG.exe File created C:\windows\SysWOW64\WFNQ.exe.bat TSJZUCL.exe File created C:\windows\SysWOW64\KFZ.exe ZNWPNJT.exe File created C:\windows\SysWOW64\KFZ.exe.bat ZNWPNJT.exe File opened for modification C:\windows\SysWOW64\LCOTQLC.exe YSFUCAH.exe File created C:\windows\SysWOW64\XQVRV.exe.bat LCOTQLC.exe File created C:\windows\SysWOW64\DHPMO.exe.bat DBPX.exe File opened for modification C:\windows\SysWOW64\NEUGEMK.exe DHPMO.exe File created C:\windows\SysWOW64\TSJZUCL.exe VRBL.exe File opened for modification C:\windows\SysWOW64\WFNQ.exe TSJZUCL.exe File created C:\windows\SysWOW64\YRSTA.exe NRDIQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\KDABQKY.exe BFNPIBP.exe File created C:\windows\system\SGRLA.exe UQYQFCH.exe File created C:\windows\PWFM.exe DGZMRPD.exe File created C:\windows\PWFM.exe.bat DGZMRPD.exe File created C:\windows\system\BME.exe DRFEP.exe File opened for modification C:\windows\system\CZE.exe QHO.exe File created C:\windows\YSFUCAH.exe QMTOSCL.exe File opened for modification C:\windows\VSHPISN.exe FHE.exe File created C:\windows\KSBG.exe SXXKR.exe File opened for modification C:\windows\system\TJFQAI.exe KDABQKY.exe File created C:\windows\UCSXRG.exe.bat VSHPISN.exe File opened for modification C:\windows\system\AQTO.exe QSOCZ.exe File created C:\windows\SEIID.exe TTXSUW.exe File created C:\windows\system\DRFEP.exe XRY.exe File created C:\windows\system\VSHNGKF.exe.bat NEUGEMK.exe File created C:\windows\DNRZZ.exe VSHNGKF.exe File opened for modification C:\windows\system\ZNWPNJT.exe YRSTA.exe File created C:\windows\system\YEJZHD.exe.bat 2026-09-29_c5a749d88e350b0fcb2548a590530544_elex_emotet_stop.exe File created C:\windows\system\TJFQAI.exe.bat KDABQKY.exe File created C:\windows\system\AGQWM.exe.bat BVFGEI.exe File created C:\windows\AVA.exe FAVIKF.exe File opened for modification C:\windows\system\UNBN.exe KFZ.exe File opened for modification C:\windows\system\IHANM.exe TMQATEX.exe File created C:\windows\system\AGQWM.exe BVFGEI.exe File created C:\windows\FHE.exe AGQWM.exe File opened for modification C:\windows\system\HWSL.exe SGRLA.exe File created C:\windows\KSBG.exe.bat SXXKR.exe File created C:\windows\DPNO.exe YEJZHD.exe File created C:\windows\system\IYLRDQX.exe ASHLSSU.exe File created C:\windows\system\AQTO.exe QSOCZ.exe File opened for modification C:\windows\UJXBW.exe AVA.exe File created C:\windows\system\HLDGYLG.exe.bat LGXJRBE.exe File opened for modification C:\windows\system\YEJZHD.exe 2026-09-29_c5a749d88e350b0fcb2548a590530544_elex_emotet_stop.exe File created C:\windows\system\NWPZEI.exe FQLTUJW.exe File created C:\windows\FYVCHN.exe.bat IYLRDQX.exe File created C:\windows\SEIID.exe.bat TTXSUW.exe File created C:\windows\system\NXHJHBD.exe PMW.exe File created C:\windows\system\GXPIMQS.exe LKKZBQ.exe File created C:\windows\system\YTLCH.exe.bat UNBN.exe File opened for modification C:\windows\system\TGQMSRU.exe YTLCH.exe File opened for modification C:\windows\system\LMR.exe TJFQAI.exe File opened for modification C:\windows\system\QSOCZ.exe DUOQXM.exe File created C:\windows\system\NXHJHBD.exe.bat PMW.exe File created C:\windows\system\XRY.exe TBRQUS.exe File created C:\windows\system\DRFEP.exe.bat XRY.exe File created C:\windows\system\VRBL.exe.bat EJZ.exe File created C:\windows\BOX.exe ALUA.exe File created C:\windows\system\LKKZBQ.exe BME.exe File opened for modification C:\windows\OZGV.exe NWPZEI.exe File opened for modification C:\windows\system\IYLRDQX.exe ASHLSSU.exe File created C:\windows\FYVCHN.exe IYLRDQX.exe File opened for modification C:\windows\FYVCHN.exe IYLRDQX.exe File created C:\windows\QMTOSCL.exe LMR.exe File opened for modification C:\windows\KSBG.exe SXXKR.exe File created C:\windows\system\QHO.exe OZGV.exe File created C:\windows\ZRKNYN.exe FYVCHN.exe File created C:\windows\system\QSOCZ.exe DUOQXM.exe File created C:\windows\UJXBW.exe.bat AVA.exe File created C:\windows\system\UNBN.exe KFZ.exe File opened for modification C:\windows\system\QHO.exe OZGV.exe File created C:\windows\system\ASHLSSU.exe.bat CZE.exe File opened for modification C:\windows\YSFUCAH.exe QMTOSCL.exe File opened for modification C:\windows\UGXHG.exe BDTDBB.exe File created C:\windows\system\TGQMSRU.exe.bat YTLCH.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3824 cmd.exe 1732 cmd.exe 5716 cmd.exe 3464 cmd.exe 5712 cmd.exe 1740 cmd.exe 5760 cmd.exe 3644 cmd.exe 3352 cmd.exe 1104 cmd.exe 5648 cmd.exe 468 cmd.exe 4332 cmd.exe 4356 cmd.exe 3368 cmd.exe 2416 cmd.exe 2044 cmd.exe 800 cmd.exe 5372 cmd.exe 2908 cmd.exe 2552 cmd.exe 5508 cmd.exe 2376 cmd.exe 4752 cmd.exe 1240 cmd.exe 3204 cmd.exe 5884 cmd.exe 4984 cmd.exe 3744 cmd.exe 4660 cmd.exe 2092 cmd.exe 1284 cmd.exe 4284 cmd.exe 432 cmd.exe 5340 cmd.exe 5304 cmd.exe 3032 cmd.exe 2352 cmd.exe 4424 cmd.exe 1600 cmd.exe 5468 cmd.exe 4444 cmd.exe 3400 cmd.exe 2180 cmd.exe 2740 cmd.exe 896 cmd.exe 2916 cmd.exe 4816 cmd.exe 5076 cmd.exe 5932 cmd.exe 4084 cmd.exe 1232 cmd.exe 5632 cmd.exe 3720 cmd.exe 4760 cmd.exe 248 cmd.exe 5836 cmd.exe 6036 cmd.exe 460 cmd.exe 2556 cmd.exe 2912 cmd.exe 6080 cmd.exe 204 cmd.exe 4132 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2812 4392 WerFault.exe 87 4356 2012 WerFault.exe 93 5468 4592 WerFault.exe 99 3552 2640 WerFault.exe 104 4712 5940 WerFault.exe 109 1988 5920 WerFault.exe 114 2796 5096 WerFault.exe 119 2220 3172 WerFault.exe 124 2476 5112 WerFault.exe 129 4884 4164 WerFault.exe 134 1128 4140 WerFault.exe 139 2916 3312 WerFault.exe 144 52 4100 WerFault.exe 149 2812 5912 WerFault.exe 154 364 5036 WerFault.exe 159 4536 1084 WerFault.exe 164 3428 5092 WerFault.exe 169 4412 6088 WerFault.exe 174 5776 620 WerFault.exe 179 2156 2548 WerFault.exe 184 4108 5436 WerFault.exe 189 4992 5800 WerFault.exe 194 5060 4268 WerFault.exe 199 4176 5428 WerFault.exe 204 260 3156 WerFault.exe 209 3532 3976 WerFault.exe 214 1796 5456 WerFault.exe 219 4296 4536 WerFault.exe 224 5564 3396 WerFault.exe 229 2220 6108 WerFault.exe 234 4220 4544 WerFault.exe 239 4708 3300 WerFault.exe 244 5052 4900 WerFault.exe 249 2676 5000 WerFault.exe 254 4948 3268 WerFault.exe 260 2436 3912 WerFault.exe 265 924 3756 WerFault.exe 270 2972 2820 WerFault.exe 275 4752 1660 WerFault.exe 280 3772 5032 WerFault.exe 285 5356 4212 WerFault.exe 290 5180 5360 WerFault.exe 295 5108 5640 WerFault.exe 300 6124 5708 WerFault.exe 305 2268 5728 WerFault.exe 310 4588 5660 WerFault.exe 315 1828 4836 WerFault.exe 320 4744 3284 WerFault.exe 325 2476 1864 WerFault.exe 330 3332 3768 WerFault.exe 335 3876 5616 WerFault.exe 340 2020 1348 WerFault.exe 345 1276 4628 WerFault.exe 350 2264 6132 WerFault.exe 355 5592 1508 WerFault.exe 360 5264 3456 WerFault.exe 365 4852 5764 WerFault.exe 370 1468 4872 WerFault.exe 375 2224 3668 WerFault.exe 380 1004 4796 WerFault.exe 385 3464 4892 WerFault.exe 390 4768 5416 WerFault.exe 395 3112 1112 WerFault.exe 400 5984 3272 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNRZZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DHPMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KDABQKY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MIJZPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AGQWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCOTQLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZRKNYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWPZEI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BME.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNWPNJT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_c5a749d88e350b0fcb2548a590530544_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFNPIBP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXHJHBD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FQLTUJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSFUCAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWSL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGQMSRU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DRFEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DUOQXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GDREKGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXPIMQS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWPTBM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YRSTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4392 2026-09-29_c5a749d88e350b0fcb2548a590530544_elex_emotet_stop.exe 4392 2026-09-29_c5a749d88e350b0fcb2548a590530544_elex_emotet_stop.exe 2012 YEJZHD.exe 2012 YEJZHD.exe 4592 DPNO.exe 4592 DPNO.exe 2640 YXNK.exe 2640 YXNK.exe 5940 FQLTUJW.exe 5940 FQLTUJW.exe 5920 NWPZEI.exe 5920 NWPZEI.exe 5096 OZGV.exe 5096 OZGV.exe 3172 QHO.exe 3172 QHO.exe 5112 CZE.exe 5112 CZE.exe 4164 ASHLSSU.exe 4164 ASHLSSU.exe 4140 IYLRDQX.exe 4140 IYLRDQX.exe 3312 FYVCHN.exe 3312 FYVCHN.exe 4100 ZRKNYN.exe 4100 ZRKNYN.exe 5912 HWPTBM.exe 5912 HWPTBM.exe 5036 AXEESN.exe 5036 AXEESN.exe 1084 NVEQ.exe 1084 NVEQ.exe 5092 BFNPIBP.exe 5092 BFNPIBP.exe 6088 KDABQKY.exe 6088 KDABQKY.exe 620 TJFQAI.exe 620 TJFQAI.exe 2548 LMR.exe 2548 LMR.exe 5436 QMTOSCL.exe 5436 QMTOSCL.exe 5800 YSFUCAH.exe 5800 YSFUCAH.exe 4268 LCOTQLC.exe 4268 LCOTQLC.exe 5428 XQVRV.exe 5428 XQVRV.exe 3156 BVFGEI.exe 3156 BVFGEI.exe 3976 AGQWM.exe 3976 AGQWM.exe 5456 FHE.exe 5456 FHE.exe 4536 VSHPISN.exe 4536 VSHPISN.exe 3396 UCSXRG.exe 3396 UCSXRG.exe 6108 PNAV.exe 6108 PNAV.exe 4544 UQYQFCH.exe 4544 UQYQFCH.exe 3300 SGRLA.exe 3300 SGRLA.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4392 2026-09-29_c5a749d88e350b0fcb2548a590530544_elex_emotet_stop.exe 4392 2026-09-29_c5a749d88e350b0fcb2548a590530544_elex_emotet_stop.exe 2012 YEJZHD.exe 2012 YEJZHD.exe 4592 DPNO.exe 4592 DPNO.exe 2640 YXNK.exe 2640 YXNK.exe 5940 FQLTUJW.exe 5940 FQLTUJW.exe 5920 NWPZEI.exe 5920 NWPZEI.exe 5096 OZGV.exe 5096 OZGV.exe 3172 QHO.exe 3172 QHO.exe 5112 CZE.exe 5112 CZE.exe 4164 ASHLSSU.exe 4164 ASHLSSU.exe 4140 IYLRDQX.exe 4140 IYLRDQX.exe 3312 FYVCHN.exe 3312 FYVCHN.exe 4100 ZRKNYN.exe 4100 ZRKNYN.exe 5912 HWPTBM.exe 5912 HWPTBM.exe 5036 AXEESN.exe 5036 AXEESN.exe 1084 NVEQ.exe 1084 NVEQ.exe 5092 BFNPIBP.exe 5092 BFNPIBP.exe 6088 KDABQKY.exe 6088 KDABQKY.exe 620 TJFQAI.exe 620 TJFQAI.exe 2548 LMR.exe 2548 LMR.exe 5436 QMTOSCL.exe 5436 QMTOSCL.exe 5800 YSFUCAH.exe 5800 YSFUCAH.exe 4268 LCOTQLC.exe 4268 LCOTQLC.exe 5428 XQVRV.exe 5428 XQVRV.exe 3156 BVFGEI.exe 3156 BVFGEI.exe 3976 AGQWM.exe 3976 AGQWM.exe 5456 FHE.exe 5456 FHE.exe 4536 VSHPISN.exe 4536 VSHPISN.exe 3396 UCSXRG.exe 3396 UCSXRG.exe 6108 PNAV.exe 6108 PNAV.exe 4544 UQYQFCH.exe 4544 UQYQFCH.exe 3300 SGRLA.exe 3300 SGRLA.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4392 wrote to memory of 1560 4392 2026-09-29_c5a749d88e350b0fcb2548a590530544_elex_emotet_stop.exe 89 PID 1560 wrote to memory of 2012 1560 cmd.exe 93 PID 2012 wrote to memory of 3824 2012 YEJZHD.exe 95 PID 3824 wrote to memory of 4592 3824 cmd.exe 99 PID 4592 wrote to memory of 5680 4592 DPNO.exe 100 PID 5680 wrote to memory of 2640 5680 cmd.exe 104 PID 2640 wrote to memory of 4600 2640 YXNK.exe 105 PID 4600 wrote to memory of 5940 4600 cmd.exe 109 PID 5940 wrote to memory of 460 5940 FQLTUJW.exe 110 PID 460 wrote to memory of 5920 460 cmd.exe 114 PID 5920 wrote to memory of 1240 5920 NWPZEI.exe 115 PID 1240 wrote to memory of 5096 1240 cmd.exe 119 PID 5096 wrote to memory of 3204 5096 OZGV.exe 120 PID 3204 wrote to memory of 3172 3204 cmd.exe 124 PID 3172 wrote to memory of 3460 3172 QHO.exe 125 PID 3460 wrote to memory of 5112 3460 cmd.exe 129 PID 5112 wrote to memory of 2160 5112 CZE.exe 130 PID 2160 wrote to memory of 4164 2160 cmd.exe 134 PID 4164 wrote to memory of 2740 4164 ASHLSSU.exe 135 PID 2740 wrote to memory of 4140 2740 cmd.exe 139 PID 4140 wrote to memory of 1564 4140 IYLRDQX.exe 140 PID 1564 wrote to memory of 3312 1564 cmd.exe 144 PID 3312 wrote to memory of 4660 3312 FYVCHN.exe 145 PID 4660 wrote to memory of 4100 4660 cmd.exe 149 PID 4100 wrote to memory of 5104 4100 ZRKNYN.exe 150 PID 5104 wrote to memory of 5912 5104 cmd.exe 154 PID 5912 wrote to memory of 1848 5912 HWPTBM.exe 155 PID 1848 wrote to memory of 5036 1848 cmd.exe 159 PID 5036 wrote to memory of 4308 5036 AXEESN.exe 160 PID 4308 wrote to memory of 1084 4308 cmd.exe 164 PID 1084 wrote to memory of 2092 1084 NVEQ.exe 165 PID 2092 wrote to memory of 5092 2092 cmd.exe 169 PID 5092 wrote to memory of 920 5092 BFNPIBP.exe 170 PID 920 wrote to memory of 6088 920 cmd.exe 174 PID 6088 wrote to memory of 944 6088 KDABQKY.exe 175 PID 944 wrote to memory of 620 944 cmd.exe 179 PID 620 wrote to memory of 2084 620 TJFQAI.exe 180 PID 2084 wrote to memory of 2548 2084 cmd.exe 184 PID 2548 wrote to memory of 3420 2548 LMR.exe 185 PID 3420 wrote to memory of 5436 3420 cmd.exe 189 PID 5436 wrote to memory of 2556 5436 QMTOSCL.exe 190 PID 2556 wrote to memory of 5800 2556 cmd.exe 194 PID 5800 wrote to memory of 2136 5800 YSFUCAH.exe 195 PID 2136 wrote to memory of 4268 2136 cmd.exe 199 PID 4268 wrote to memory of 1128 4268 LCOTQLC.exe 200 PID 1128 wrote to memory of 5428 1128 cmd.exe 204 PID 5428 wrote to memory of 5392 5428 XQVRV.exe 205 PID 5392 wrote to memory of 3156 5392 cmd.exe 209 PID 3156 wrote to memory of 2904 3156 BVFGEI.exe 210 PID 2904 wrote to memory of 3976 2904 cmd.exe 214 PID 3976 wrote to memory of 2280 3976 AGQWM.exe 215 PID 2280 wrote to memory of 5456 2280 cmd.exe 219 PID 5456 wrote to memory of 724 5456 FHE.exe 220 PID 724 wrote to memory of 4536 724 cmd.exe 224 PID 4536 wrote to memory of 2168 4536 VSHPISN.exe 225 PID 2168 wrote to memory of 3396 2168 cmd.exe 229 PID 3396 wrote to memory of 4216 3396 UCSXRG.exe 230 PID 4216 wrote to memory of 6108 4216 cmd.exe 234 PID 6108 wrote to memory of 4388 6108 PNAV.exe 235 PID 4388 wrote to memory of 4544 4388 cmd.exe 239 PID 4544 wrote to memory of 3644 4544 UQYQFCH.exe 240 PID 3644 wrote to memory of 3300 3644 cmd.exe 244 PID 3300 wrote to memory of 4856 3300 SGRLA.exe 245 PID 4856 wrote to memory of 4900 4856 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_c5a749d88e350b0fcb2548a590530544_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_c5a749d88e350b0fcb2548a590530544_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YEJZHD.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\windows\system\YEJZHD.exeC:\windows\system\YEJZHD.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DPNO.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\windows\DPNO.exeC:\windows\DPNO.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXNK.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\windows\SysWOW64\YXNK.exeC:\windows\system32\YXNK.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FQLTUJW.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\windows\SysWOW64\FQLTUJW.exeC:\windows\system32\FQLTUJW.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NWPZEI.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:460 -
C:\windows\system\NWPZEI.exeC:\windows\system\NWPZEI.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OZGV.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\windows\OZGV.exeC:\windows\OZGV.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHO.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\windows\system\QHO.exeC:\windows\system\QHO.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZE.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\windows\system\CZE.exeC:\windows\system\CZE.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASHLSSU.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\windows\system\ASHLSSU.exeC:\windows\system\ASHLSSU.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IYLRDQX.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\windows\system\IYLRDQX.exeC:\windows\system\IYLRDQX.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYVCHN.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\windows\FYVCHN.exeC:\windows\FYVCHN.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZRKNYN.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\windows\ZRKNYN.exeC:\windows\ZRKNYN.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWPTBM.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\windows\system\HWPTBM.exeC:\windows\system\HWPTBM.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AXEESN.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\windows\system\AXEESN.exeC:\windows\system\AXEESN.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NVEQ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\windows\system\NVEQ.exeC:\windows\system\NVEQ.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BFNPIBP.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\windows\SysWOW64\BFNPIBP.exeC:\windows\system32\BFNPIBP.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDABQKY.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:920 -
C:\windows\system\KDABQKY.exeC:\windows\system\KDABQKY.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJFQAI.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:944 -
C:\windows\system\TJFQAI.exeC:\windows\system\TJFQAI.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMR.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\windows\system\LMR.exeC:\windows\system\LMR.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QMTOSCL.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\windows\QMTOSCL.exeC:\windows\QMTOSCL.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YSFUCAH.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\windows\YSFUCAH.exeC:\windows\YSFUCAH.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LCOTQLC.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\windows\SysWOW64\LCOTQLC.exeC:\windows\system32\LCOTQLC.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQVRV.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\windows\SysWOW64\XQVRV.exeC:\windows\system32\XQVRV.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BVFGEI.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\windows\SysWOW64\BVFGEI.exeC:\windows\system32\BVFGEI.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AGQWM.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\windows\system\AGQWM.exeC:\windows\system\AGQWM.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHE.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\windows\FHE.exeC:\windows\FHE.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSHPISN.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:724 -
C:\windows\VSHPISN.exeC:\windows\VSHPISN.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCSXRG.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\windows\UCSXRG.exeC:\windows\UCSXRG.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PNAV.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\SysWOW64\PNAV.exeC:\windows\system32\PNAV.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UQYQFCH.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\windows\SysWOW64\UQYQFCH.exeC:\windows\system32\UQYQFCH.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGRLA.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\windows\system\SGRLA.exeC:\windows\system\SGRLA.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWSL.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\windows\system\HWSL.exeC:\windows\system\HWSL.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUYFOL.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3032 -
C:\windows\SysWOW64\JUYFOL.exeC:\windows\system32\JUYFOL.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DUOQXM.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5884 -
C:\windows\SysWOW64\DUOQXM.exeC:\windows\system32\DUOQXM.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QSOCZ.exe.bat" "70⤵PID:1928
-
C:\windows\system\QSOCZ.exeC:\windows\system\QSOCZ.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQTO.exe.bat" "72⤵PID:4700
-
C:\windows\system\AQTO.exeC:\windows\system\AQTO.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTXSUW.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:1388 -
C:\windows\SysWOW64\TTXSUW.exeC:\windows\system32\TTXSUW.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SEIID.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5372 -
C:\windows\SEIID.exeC:\windows\SEIID.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FOQ.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2352 -
C:\windows\SysWOW64\FOQ.exeC:\windows\system32\FOQ.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMW.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3352 -
C:\windows\SysWOW64\PMW.exeC:\windows\system32\PMW.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NXHJHBD.exe.bat" "82⤵
- Executes a command shell one-liner
PID:1732 -
C:\windows\system\NXHJHBD.exeC:\windows\system\NXHJHBD.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIJZPH.exe.bat" "84⤵
- Executes a command shell one-liner
PID:5716 -
C:\windows\SysWOW64\MIJZPH.exeC:\windows\system32\MIJZPH.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDTDBB.exe.bat" "86⤵
- Executes a command shell one-liner
PID:1104 -
C:\windows\SysWOW64\BDTDBB.exeC:\windows\system32\BDTDBB.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UGXHG.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:3016 -
C:\windows\UGXHG.exeC:\windows\UGXHG.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DGZMRPD.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:988 -
C:\windows\SysWOW64\DGZMRPD.exeC:\windows\system32\DGZMRPD.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWFM.exe.bat" "92⤵PID:4476
-
C:\windows\PWFM.exeC:\windows\PWFM.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUT.exe.bat" "94⤵
- Executes a command shell one-liner
PID:2908 -
C:\windows\SysWOW64\RUT.exeC:\windows\system32\RUT.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SXXKR.exe.bat" "96⤵PID:2744
-
C:\windows\SysWOW64\SXXKR.exeC:\windows\system32\SXXKR.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KSBG.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:2960 -
C:\windows\KSBG.exeC:\windows\KSBG.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GDREKGG.exe.bat" "100⤵
- Executes a command shell one-liner
PID:2552 -
C:\windows\SysWOW64\GDREKGG.exeC:\windows\system32\GDREKGG.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TBRQUS.exe.bat" "102⤵PID:5816
-
C:\windows\SysWOW64\TBRQUS.exeC:\windows\system32\TBRQUS.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XRY.exe.bat" "104⤵PID:4708
-
C:\windows\system\XRY.exeC:\windows\system\XRY.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DRFEP.exe.bat" "106⤵PID:3888
-
C:\windows\system\DRFEP.exeC:\windows\system\DRFEP.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BME.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4316 -
C:\windows\system\BME.exeC:\windows\system\BME.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LKKZBQ.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4424 -
C:\windows\system\LKKZBQ.exeC:\windows\system\LKKZBQ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXPIMQS.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1284 -
C:\windows\system\GXPIMQS.exeC:\windows\system\GXPIMQS.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ALUA.exe.bat" "114⤵PID:2412
-
C:\windows\ALUA.exeC:\windows\ALUA.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOX.exe.bat" "116⤵PID:2920
-
C:\windows\BOX.exeC:\windows\BOX.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBPX.exe.bat" "118⤵PID:4292
-
C:\windows\SysWOW64\DBPX.exeC:\windows\system32\DBPX.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DHPMO.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:1060 -
C:\windows\SysWOW64\DHPMO.exeC:\windows\system32\DHPMO.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-