Analysis
- max time kernel
77s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 22:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_31078bbe220c5d13fd50507a594ae650_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-29_31078bbe220c5d13fd50507a594ae650_elex_emotet_stop.exe
- Size 208KB
- Sample260930-2fgebstbjh
- SHA256 57fe6236b33c22128015b26b0d8a6bb1dc81ada274d42180aa8482e649331ea3
- MD5 31078bbe220c5d13fd50507a594ae650
- SHA1 70fc8067919abe31520f49700288aca12e096038
- SHA512 aeab9f360412355e74d9ad1dc82c576cf3bfd3af93cd12b40c51cabe48024da81db4b34612cb3d180834d74bc6de49a22ed895aa324678067e04d07a3650c7f5
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfL4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOzkEj1
- TLSH T122247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5020 RJMNXBH.exe 1596 VKAHK.exe 4372 HCPSC.exe 1668 BPUBMSN.exe 1780 HLL.exe 1180 BDB.exe 416 VRGF.exe 5976 BRNSTQB.exe 4820 WMS.exe 5136 FMUHH.exe 5528 AAZQRNG.exe 1100 RIT.exe 4324 VQIDH.exe 3492 PDMNJCT.exe 2712 ZBSHZLC.exe 4428 LCHSIMK.exe 460 RPZTNPA.exe 1060 RSCXSF.exe 764 QIWRN.exe 3556 JLZVTAS.exe 4936 JODRYY.exe 2516 CRHVENV.exe 4716 WEME.exe 1088 OFOJRL.exe 4292 GISN.exe 4752 QFFZMJE.exe 1876 UNMH.exe 3888 IYUY.exe 2804 ZGWLQK.exe 724 UUBUAJF.exe 2156 OHGE.exe 3608 SXNEPCP.exe 676 NKR.exe 3196 HYWFJ.exe 908 SQZPSJ.exe 760 EGGX.exe 2192 QZBQE.exe 6064 KMGAPIA.exe 200 FZLJ.exe 3660 UQMAXDE.exe 4792 TFFDS.exe 4384 COHIWGO.exe 3528 GWNQ.exe 4608 ROIJQ.exe 5476 XOQ.exe 4308 FCQ.exe 5044 UXAQMI.exe 5032 SSZR.exe 5880 NGEABL.exe 2948 CBNM.exe 3524 SROET.exe 5364 METNDTN.exe 1380 QUZV.exe 2868 RPD.exe 2144 VFSZH.exe 3404 EGUEKRI.exe 716 KGUS.exe 1920 WWISFD.exe 3132 NHLIO.exe 1588 YXS.exe 4456 GCEWLIL.exe 3452 LFCJL.exe 2352 NDIES.exe 2360 QTPEFUK.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\AAZQRNG.exe FMUHH.exe File created C:\windows\SysWOW64\VDOY.exe DAK.exe File opened for modification C:\windows\SysWOW64\HLL.exe BPUBMSN.exe File opened for modification C:\windows\SysWOW64\BDB.exe HLL.exe File created C:\windows\SysWOW64\BDB.exe.bat HLL.exe File created C:\windows\SysWOW64\PDMNJCT.exe.bat VQIDH.exe File opened for modification C:\windows\SysWOW64\OFOJRL.exe WEME.exe File opened for modification C:\windows\SysWOW64\FCQ.exe XOQ.exe File opened for modification C:\windows\SysWOW64\VDOY.exe DAK.exe File opened for modification C:\windows\SysWOW64\RIT.exe AAZQRNG.exe File created C:\windows\SysWOW64\FCQ.exe.bat XOQ.exe File created C:\windows\SysWOW64\VRDSI.exe.bat WYA.exe File created C:\windows\SysWOW64\NIA.exe.bat TNJRICL.exe File created C:\windows\SysWOW64\RIT.exe.bat AAZQRNG.exe File created C:\windows\SysWOW64\QZBQE.exe EGGX.exe File created C:\windows\SysWOW64\TFFDS.exe.bat UQMAXDE.exe File opened for modification C:\windows\SysWOW64\OMUQGZ.exe ZJL.exe File created C:\windows\SysWOW64\ZKE.exe.bat JCDDVXX.exe File created C:\windows\SysWOW64\VOF.exe.bat NIA.exe File created C:\windows\SysWOW64\ZGWLQK.exe IYUY.exe File created C:\windows\SysWOW64\ZGWLQK.exe.bat IYUY.exe File created C:\windows\SysWOW64\WCBHQB.exe SXJ.exe File created C:\windows\SysWOW64\OMUQGZ.exe ZJL.exe File created C:\windows\SysWOW64\OMUQGZ.exe.bat ZJL.exe File created C:\windows\SysWOW64\OUTWFC.exe PEIBKWW.exe File opened for modification C:\windows\SysWOW64\RPZTNPA.exe LCHSIMK.exe File created C:\windows\SysWOW64\WWISFD.exe.bat KGUS.exe File opened for modification C:\windows\SysWOW64\HCPSC.exe VKAHK.exe File created C:\windows\SysWOW64\RPZTNPA.exe.bat LCHSIMK.exe File opened for modification C:\windows\SysWOW64\QZBQE.exe EGGX.exe File opened for modification C:\windows\SysWOW64\COHIWGO.exe TFFDS.exe File created C:\windows\SysWOW64\FCQ.exe XOQ.exe File created C:\windows\SysWOW64\QUZV.exe.bat METNDTN.exe File created C:\windows\SysWOW64\VRDSI.exe WYA.exe File created C:\windows\SysWOW64\ZAPB.exe FII.exe File created C:\windows\SysWOW64\VKAHK.exe RJMNXBH.exe File opened for modification C:\windows\SysWOW64\VKAHK.exe RJMNXBH.exe File created C:\windows\SysWOW64\HCPSC.exe VKAHK.exe File created C:\windows\SysWOW64\AAZQRNG.exe.bat FMUHH.exe File created C:\windows\SysWOW64\RIT.exe AAZQRNG.exe File created C:\windows\SysWOW64\RPZTNPA.exe LCHSIMK.exe File opened for modification C:\windows\SysWOW64\GISN.exe OFOJRL.exe File opened for modification C:\windows\SysWOW64\ZKE.exe JCDDVXX.exe File created C:\windows\SysWOW64\HLL.exe BPUBMSN.exe File opened for modification C:\windows\SysWOW64\PDMNJCT.exe VQIDH.exe File created C:\windows\SysWOW64\TFFDS.exe UQMAXDE.exe File created C:\windows\SysWOW64\COHIWGO.exe TFFDS.exe File created C:\windows\SysWOW64\ZAPB.exe.bat FII.exe File created C:\windows\SysWOW64\NIA.exe TNJRICL.exe File created C:\windows\SysWOW64\HCPSC.exe.bat VKAHK.exe File opened for modification C:\windows\SysWOW64\WCBHQB.exe SXJ.exe File opened for modification C:\windows\SysWOW64\VRDSI.exe WYA.exe File opened for modification C:\windows\SysWOW64\ZAPB.exe FII.exe File opened for modification C:\windows\SysWOW64\VOF.exe NIA.exe File opened for modification C:\windows\SysWOW64\ZGWLQK.exe IYUY.exe File created C:\windows\SysWOW64\EGGX.exe SQZPSJ.exe File created C:\windows\SysWOW64\WWISFD.exe KGUS.exe File created C:\windows\SysWOW64\BDB.exe HLL.exe File created C:\windows\SysWOW64\GISN.exe OFOJRL.exe File opened for modification C:\windows\SysWOW64\EGGX.exe SQZPSJ.exe File opened for modification C:\windows\SysWOW64\QUZV.exe METNDTN.exe File created C:\windows\SysWOW64\VOF.exe NIA.exe File created C:\windows\SysWOW64\QZBQE.exe.bat EGGX.exe File opened for modification C:\windows\SysWOW64\TFFDS.exe UQMAXDE.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\SXNEPCP.exe.bat OHGE.exe File created C:\windows\system\EGUEKRI.exe.bat VFSZH.exe File created C:\windows\WYA.exe VDOY.exe File created C:\windows\system\CKDCWTR.exe WPSBIWJ.exe File created C:\windows\system\BRNSTQB.exe VRGF.exe File created C:\windows\system\LCHSIMK.exe ZBSHZLC.exe File opened for modification C:\windows\system\QFFZMJE.exe GISN.exe File created C:\windows\CRHVENV.exe JODRYY.exe File opened for modification C:\windows\system\SQZPSJ.exe HYWFJ.exe File opened for modification C:\windows\KMGAPIA.exe QZBQE.exe File opened for modification C:\windows\system\FZLJ.exe KMGAPIA.exe File opened for modification C:\windows\system\NGEABL.exe SSZR.exe File opened for modification C:\windows\KRE.exe ROSI.exe File created C:\windows\system\JCDDVXX.exe GMWV.exe File created C:\windows\system\OHGE.exe.bat UUBUAJF.exe File created C:\windows\system\QTPEFUK.exe NDIES.exe File created C:\windows\system\QTPEFUK.exe.bat NDIES.exe File created C:\windows\system\ROSI.exe.bat QTPEFUK.exe File created C:\windows\system\ZJL.exe.bat QIJHJPW.exe File opened for modification C:\windows\system\DKUW.exe OUTWFC.exe File opened for modification C:\windows\system\BPUBMSN.exe HCPSC.exe File created C:\windows\system\BPUBMSN.exe.bat HCPSC.exe File opened for modification C:\windows\system\JODRYY.exe JLZVTAS.exe File created C:\windows\WEME.exe.bat CRHVENV.exe File created C:\windows\KMGAPIA.exe.bat QZBQE.exe File created C:\windows\system\GCEWLIL.exe.bat YXS.exe File opened for modification C:\windows\system\GMWV.exe OMUQGZ.exe File created C:\windows\system\DKUW.exe OUTWFC.exe File opened for modification C:\windows\JLZVTAS.exe QIWRN.exe File created C:\windows\system\QFFZMJE.exe.bat GISN.exe File created C:\windows\system\ROIJQ.exe GWNQ.exe File opened for modification C:\windows\SSZR.exe UXAQMI.exe File created C:\windows\VFSZH.exe.bat RPD.exe File created C:\windows\NHLIO.exe WWISFD.exe File created C:\windows\NHLIO.exe.bat WWISFD.exe File created C:\windows\NDIES.exe.bat LFCJL.exe File opened for modification C:\windows\IYUY.exe UNMH.exe File opened for modification C:\windows\NKR.exe SXNEPCP.exe File created C:\windows\GWNQ.exe COHIWGO.exe File opened for modification C:\windows\FII.exe DKUW.exe File created C:\windows\FZEYW.exe.bat KOWZIAO.exe File created C:\windows\system\CZOAAH.exe.bat FZEYW.exe File opened for modification C:\windows\system\LCHSIMK.exe ZBSHZLC.exe File created C:\windows\NKR.exe SXNEPCP.exe File created C:\windows\HYWFJ.exe.bat NKR.exe File created C:\windows\KMGAPIA.exe QZBQE.exe File created C:\windows\XOQ.exe.bat ROIJQ.exe File created C:\windows\SSZR.exe UXAQMI.exe File created C:\windows\system\NGEABL.exe SSZR.exe File created C:\windows\system\CZOAAH.exe FZEYW.exe File created C:\windows\system\BPUBMSN.exe HCPSC.exe File opened for modification C:\windows\UQMAXDE.exe FZLJ.exe File created C:\windows\SXJ.exe.bat KRE.exe File created C:\windows\system\CKDCWTR.exe.bat WPSBIWJ.exe File opened for modification C:\windows\system\VQIDH.exe RIT.exe File created C:\windows\system\SQZPSJ.exe.bat HYWFJ.exe File opened for modification C:\windows\GWNQ.exe COHIWGO.exe File created C:\windows\GWNQ.exe.bat COHIWGO.exe File opened for modification C:\windows\system\ROIJQ.exe GWNQ.exe File created C:\windows\SSZR.exe.bat UXAQMI.exe File created C:\windows\system\WMS.exe.bat BRNSTQB.exe File created C:\windows\system\VQIDH.exe RIT.exe File created C:\windows\ZBSHZLC.exe PDMNJCT.exe File created C:\windows\NDIES.exe LFCJL.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5632 cmd.exe 5468 cmd.exe 1860 cmd.exe 1872 cmd.exe 1320 cmd.exe 1960 cmd.exe 5840 cmd.exe 1096 cmd.exe 4492 cmd.exe 6020 cmd.exe 4656 cmd.exe 252 cmd.exe 6092 cmd.exe 5624 cmd.exe 3904 cmd.exe 864 cmd.exe 3264 cmd.exe 4764 cmd.exe 3280 cmd.exe 5900 cmd.exe 4816 cmd.exe 2604 cmd.exe 1104 cmd.exe 4288 cmd.exe 6052 cmd.exe 4680 cmd.exe 3344 cmd.exe 3416 cmd.exe 3872 cmd.exe 3284 cmd.exe 2792 cmd.exe 2316 cmd.exe 1676 cmd.exe 5328 cmd.exe 4544 cmd.exe 3644 cmd.exe 1524 cmd.exe 2276 cmd.exe 2040 cmd.exe 2408 cmd.exe 3004 cmd.exe 1112 cmd.exe 4448 cmd.exe 5704 cmd.exe 5784 cmd.exe 3836 cmd.exe 5848 cmd.exe 5744 cmd.exe 2128 cmd.exe 2776 cmd.exe 4708 cmd.exe 1364 cmd.exe 5724 cmd.exe 5620 cmd.exe 3044 cmd.exe 4092 cmd.exe 5340 cmd.exe 1952 cmd.exe 5016 cmd.exe 5348 cmd.exe 4628 cmd.exe 4208 cmd.exe 3356 cmd.exe 2480 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5808 5636 WerFault.exe 87 4292 5020 WerFault.exe 93 2604 1596 WerFault.exe 99 6036 4372 WerFault.exe 104 3584 1668 WerFault.exe 109 1924 1780 WerFault.exe 114 1824 1180 WerFault.exe 119 1348 416 WerFault.exe 124 4184 5976 WerFault.exe 129 1280 4820 WerFault.exe 134 5228 5136 WerFault.exe 139 4520 5528 WerFault.exe 144 5640 1100 WerFault.exe 149 2144 4324 WerFault.exe 154 3456 3492 WerFault.exe 159 1876 2712 WerFault.exe 164 2448 4428 WerFault.exe 169 888 460 WerFault.exe 174 4580 1060 WerFault.exe 179 5960 764 WerFault.exe 184 1640 3556 WerFault.exe 189 5364 4936 WerFault.exe 194 4684 2516 WerFault.exe 199 256 4716 WerFault.exe 204 4440 1088 WerFault.exe 209 2580 4292 WerFault.exe 214 1500 4752 WerFault.exe 219 5988 1876 WerFault.exe 224 4628 3888 WerFault.exe 229 4612 2804 WerFault.exe 234 3284 724 WerFault.exe 239 2080 2156 WerFault.exe 244 2520 3608 WerFault.exe 249 3644 676 WerFault.exe 254 3672 3196 WerFault.exe 259 960 908 WerFault.exe 264 6000 760 WerFault.exe 269 5428 2192 WerFault.exe 274 4128 6064 WerFault.exe 279 3516 200 WerFault.exe 285 4884 3660 WerFault.exe 290 1964 4792 WerFault.exe 295 4664 4384 WerFault.exe 300 368 3528 WerFault.exe 305 2360 4608 WerFault.exe 310 4764 5476 WerFault.exe 315 3936 4308 WerFault.exe 320 3456 5044 WerFault.exe 325 1464 5032 WerFault.exe 330 3516 5880 WerFault.exe 335 5492 2948 WerFault.exe 340 1328 3524 WerFault.exe 345 1496 5364 WerFault.exe 350 1384 1380 WerFault.exe 355 2540 2868 WerFault.exe 360 4500 2144 WerFault.exe 365 3136 3404 WerFault.exe 370 3740 716 WerFault.exe 375 5992 1920 WerFault.exe 380 1204 3132 WerFault.exe 385 2140 1588 WerFault.exe 390 2928 4456 WerFault.exe 395 792 3452 WerFault.exe 400 1460 2352 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFSZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAZQRNG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZBSHZLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QZBQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UNMH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROIJQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPUBMSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language METNDTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPSBIWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLZVTAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHLIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNJRICL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXNEPCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTPEFUK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GCEWLIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFCJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSCXSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFFZMJE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQMAXDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BRNSTQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OFOJRL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCBHQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUTWFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FII.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5636 2026-09-29_31078bbe220c5d13fd50507a594ae650_elex_emotet_stop.exe 5636 2026-09-29_31078bbe220c5d13fd50507a594ae650_elex_emotet_stop.exe 5020 RJMNXBH.exe 5020 RJMNXBH.exe 1596 VKAHK.exe 1596 VKAHK.exe 4372 HCPSC.exe 4372 HCPSC.exe 1668 BPUBMSN.exe 1668 BPUBMSN.exe 1780 HLL.exe 1780 HLL.exe 1180 BDB.exe 1180 BDB.exe 416 VRGF.exe 416 VRGF.exe 5976 BRNSTQB.exe 5976 BRNSTQB.exe 4820 WMS.exe 4820 WMS.exe 5136 FMUHH.exe 5136 FMUHH.exe 5528 AAZQRNG.exe 5528 AAZQRNG.exe 1100 RIT.exe 1100 RIT.exe 4324 VQIDH.exe 4324 VQIDH.exe 3492 PDMNJCT.exe 3492 PDMNJCT.exe 2712 ZBSHZLC.exe 2712 ZBSHZLC.exe 4428 LCHSIMK.exe 4428 LCHSIMK.exe 460 RPZTNPA.exe 460 RPZTNPA.exe 1060 RSCXSF.exe 1060 RSCXSF.exe 764 QIWRN.exe 764 QIWRN.exe 3556 JLZVTAS.exe 3556 JLZVTAS.exe 4936 JODRYY.exe 4936 JODRYY.exe 2516 CRHVENV.exe 2516 CRHVENV.exe 4716 WEME.exe 4716 WEME.exe 1088 OFOJRL.exe 1088 OFOJRL.exe 4292 GISN.exe 4292 GISN.exe 4752 QFFZMJE.exe 4752 QFFZMJE.exe 1876 UNMH.exe 1876 UNMH.exe 3888 IYUY.exe 3888 IYUY.exe 2804 ZGWLQK.exe 2804 ZGWLQK.exe 724 UUBUAJF.exe 724 UUBUAJF.exe 2156 OHGE.exe 2156 OHGE.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5636 2026-09-29_31078bbe220c5d13fd50507a594ae650_elex_emotet_stop.exe 5636 2026-09-29_31078bbe220c5d13fd50507a594ae650_elex_emotet_stop.exe 5020 RJMNXBH.exe 5020 RJMNXBH.exe 1596 VKAHK.exe 1596 VKAHK.exe 4372 HCPSC.exe 4372 HCPSC.exe 1668 BPUBMSN.exe 1668 BPUBMSN.exe 1780 HLL.exe 1780 HLL.exe 1180 BDB.exe 1180 BDB.exe 416 VRGF.exe 416 VRGF.exe 5976 BRNSTQB.exe 5976 BRNSTQB.exe 4820 WMS.exe 4820 WMS.exe 5136 FMUHH.exe 5136 FMUHH.exe 5528 AAZQRNG.exe 5528 AAZQRNG.exe 1100 RIT.exe 1100 RIT.exe 4324 VQIDH.exe 4324 VQIDH.exe 3492 PDMNJCT.exe 3492 PDMNJCT.exe 2712 ZBSHZLC.exe 2712 ZBSHZLC.exe 4428 LCHSIMK.exe 4428 LCHSIMK.exe 460 RPZTNPA.exe 460 RPZTNPA.exe 1060 RSCXSF.exe 1060 RSCXSF.exe 764 QIWRN.exe 764 QIWRN.exe 3556 JLZVTAS.exe 3556 JLZVTAS.exe 4936 JODRYY.exe 4936 JODRYY.exe 2516 CRHVENV.exe 2516 CRHVENV.exe 4716 WEME.exe 4716 WEME.exe 1088 OFOJRL.exe 1088 OFOJRL.exe 4292 GISN.exe 4292 GISN.exe 4752 QFFZMJE.exe 4752 QFFZMJE.exe 1876 UNMH.exe 1876 UNMH.exe 3888 IYUY.exe 3888 IYUY.exe 2804 ZGWLQK.exe 2804 ZGWLQK.exe 724 UUBUAJF.exe 724 UUBUAJF.exe 2156 OHGE.exe 2156 OHGE.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5636 wrote to memory of 5784 5636 2026-09-29_31078bbe220c5d13fd50507a594ae650_elex_emotet_stop.exe 89 PID 5784 wrote to memory of 5020 5784 cmd.exe 93 PID 5020 wrote to memory of 4316 5020 RJMNXBH.exe 95 PID 4316 wrote to memory of 1596 4316 cmd.exe 99 PID 1596 wrote to memory of 5928 1596 VKAHK.exe 100 PID 5928 wrote to memory of 4372 5928 cmd.exe 104 PID 4372 wrote to memory of 6020 4372 HCPSC.exe 105 PID 6020 wrote to memory of 1668 6020 cmd.exe 109 PID 1668 wrote to memory of 3436 1668 BPUBMSN.exe 110 PID 3436 wrote to memory of 1780 3436 cmd.exe 114 PID 1780 wrote to memory of 6028 1780 HLL.exe 115 PID 6028 wrote to memory of 1180 6028 cmd.exe 119 PID 1180 wrote to memory of 864 1180 BDB.exe 120 PID 864 wrote to memory of 416 864 cmd.exe 124 PID 416 wrote to memory of 5724 416 VRGF.exe 125 PID 5724 wrote to memory of 5976 5724 cmd.exe 129 PID 5976 wrote to memory of 2624 5976 BRNSTQB.exe 130 PID 2624 wrote to memory of 4820 2624 cmd.exe 134 PID 4820 wrote to memory of 2228 4820 WMS.exe 135 PID 2228 wrote to memory of 5136 2228 cmd.exe 139 PID 5136 wrote to memory of 5468 5136 FMUHH.exe 140 PID 5468 wrote to memory of 5528 5468 cmd.exe 144 PID 5528 wrote to memory of 3416 5528 AAZQRNG.exe 145 PID 3416 wrote to memory of 1100 3416 cmd.exe 149 PID 1100 wrote to memory of 2636 1100 RIT.exe 150 PID 2636 wrote to memory of 4324 2636 cmd.exe 154 PID 4324 wrote to memory of 5620 4324 VQIDH.exe 155 PID 5620 wrote to memory of 3492 5620 cmd.exe 159 PID 3492 wrote to memory of 3768 3492 PDMNJCT.exe 160 PID 3768 wrote to memory of 2712 3768 cmd.exe 164 PID 2712 wrote to memory of 4996 2712 ZBSHZLC.exe 165 PID 4996 wrote to memory of 4428 4996 cmd.exe 169 PID 4428 wrote to memory of 1524 4428 LCHSIMK.exe 170 PID 1524 wrote to memory of 460 1524 cmd.exe 174 PID 460 wrote to memory of 836 460 RPZTNPA.exe 175 PID 836 wrote to memory of 1060 836 cmd.exe 179 PID 1060 wrote to memory of 1116 1060 RSCXSF.exe 180 PID 1116 wrote to memory of 764 1116 cmd.exe 184 PID 764 wrote to memory of 5612 764 QIWRN.exe 185 PID 5612 wrote to memory of 3556 5612 cmd.exe 189 PID 3556 wrote to memory of 2472 3556 JLZVTAS.exe 190 PID 2472 wrote to memory of 4936 2472 cmd.exe 194 PID 4936 wrote to memory of 2276 4936 JODRYY.exe 195 PID 2276 wrote to memory of 2516 2276 cmd.exe 199 PID 2516 wrote to memory of 5016 2516 CRHVENV.exe 200 PID 5016 wrote to memory of 4716 5016 cmd.exe 204 PID 4716 wrote to memory of 1616 4716 WEME.exe 205 PID 1616 wrote to memory of 1088 1616 cmd.exe 209 PID 1088 wrote to memory of 2040 1088 OFOJRL.exe 210 PID 2040 wrote to memory of 4292 2040 cmd.exe 214 PID 4292 wrote to memory of 4064 4292 GISN.exe 215 PID 4064 wrote to memory of 4752 4064 cmd.exe 219 PID 4752 wrote to memory of 1320 4752 QFFZMJE.exe 220 PID 1320 wrote to memory of 1876 1320 cmd.exe 224 PID 1876 wrote to memory of 3164 1876 UNMH.exe 225 PID 3164 wrote to memory of 3888 3164 cmd.exe 229 PID 3888 wrote to memory of 2616 3888 IYUY.exe 230 PID 2616 wrote to memory of 2804 2616 cmd.exe 234 PID 2804 wrote to memory of 3836 2804 ZGWLQK.exe 235 PID 3836 wrote to memory of 724 3836 cmd.exe 239 PID 724 wrote to memory of 2496 724 UUBUAJF.exe 240 PID 2496 wrote to memory of 2156 2496 cmd.exe 244 PID 2156 wrote to memory of 2708 2156 OHGE.exe 245 PID 2708 wrote to memory of 3608 2708 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_31078bbe220c5d13fd50507a594ae650_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_31078bbe220c5d13fd50507a594ae650_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJMNXBH.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\windows\RJMNXBH.exeC:\windows\RJMNXBH.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VKAHK.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\windows\SysWOW64\VKAHK.exeC:\windows\system32\VKAHK.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HCPSC.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\windows\SysWOW64\HCPSC.exeC:\windows\system32\HCPSC.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BPUBMSN.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\windows\system\BPUBMSN.exeC:\windows\system\BPUBMSN.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HLL.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\windows\SysWOW64\HLL.exeC:\windows\system32\HLL.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDB.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\windows\SysWOW64\BDB.exeC:\windows\system32\BDB.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRGF.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:864 -
C:\windows\VRGF.exeC:\windows\VRGF.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BRNSTQB.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\windows\system\BRNSTQB.exeC:\windows\system\BRNSTQB.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WMS.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\windows\system\WMS.exeC:\windows\system\WMS.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FMUHH.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\windows\FMUHH.exeC:\windows\FMUHH.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAZQRNG.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\windows\SysWOW64\AAZQRNG.exeC:\windows\system32\AAZQRNG.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIT.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\windows\SysWOW64\RIT.exeC:\windows\system32\RIT.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VQIDH.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\windows\system\VQIDH.exeC:\windows\system\VQIDH.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDMNJCT.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\windows\SysWOW64\PDMNJCT.exeC:\windows\system32\PDMNJCT.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBSHZLC.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\windows\ZBSHZLC.exeC:\windows\ZBSHZLC.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LCHSIMK.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\windows\system\LCHSIMK.exeC:\windows\system\LCHSIMK.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RPZTNPA.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\windows\SysWOW64\RPZTNPA.exeC:\windows\system32\RPZTNPA.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSCXSF.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:836 -
C:\windows\system\RSCXSF.exeC:\windows\system\RSCXSF.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIWRN.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\windows\system\QIWRN.exeC:\windows\system\QIWRN.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLZVTAS.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\windows\JLZVTAS.exeC:\windows\JLZVTAS.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JODRYY.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\windows\system\JODRYY.exeC:\windows\system\JODRYY.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CRHVENV.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\windows\CRHVENV.exeC:\windows\CRHVENV.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WEME.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\windows\WEME.exeC:\windows\WEME.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OFOJRL.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\windows\SysWOW64\OFOJRL.exeC:\windows\system32\OFOJRL.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GISN.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\windows\SysWOW64\GISN.exeC:\windows\system32\GISN.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFFZMJE.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\windows\system\QFFZMJE.exeC:\windows\system\QFFZMJE.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNMH.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\windows\system\UNMH.exeC:\windows\system\UNMH.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYUY.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\windows\IYUY.exeC:\windows\IYUY.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZGWLQK.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\windows\SysWOW64\ZGWLQK.exeC:\windows\system32\ZGWLQK.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UUBUAJF.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\windows\system\UUBUAJF.exeC:\windows\system\UUBUAJF.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHGE.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\windows\system\OHGE.exeC:\windows\system\OHGE.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SXNEPCP.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\windows\SXNEPCP.exeC:\windows\SXNEPCP.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NKR.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5348 -
C:\windows\NKR.exeC:\windows\NKR.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYWFJ.exe.bat" "68⤵PID:5504
-
C:\windows\HYWFJ.exeC:\windows\HYWFJ.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQZPSJ.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:1552 -
C:\windows\system\SQZPSJ.exeC:\windows\system\SQZPSJ.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EGGX.exe.bat" "72⤵PID:4976
-
C:\windows\SysWOW64\EGGX.exeC:\windows\system32\EGGX.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QZBQE.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:5644 -
C:\windows\SysWOW64\QZBQE.exeC:\windows\system32\QZBQE.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMGAPIA.exe.bat" "76⤵PID:2916
-
C:\windows\KMGAPIA.exeC:\windows\KMGAPIA.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZLJ.exe.bat" "78⤵PID:1080
-
C:\windows\system\FZLJ.exeC:\windows\system\FZLJ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UQMAXDE.exe.bat" "80⤵PID:3628
-
C:\windows\UQMAXDE.exeC:\windows\UQMAXDE.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TFFDS.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2408 -
C:\windows\SysWOW64\TFFDS.exeC:\windows\system32\TFFDS.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COHIWGO.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4264 -
C:\windows\SysWOW64\COHIWGO.exeC:\windows\system32\COHIWGO.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWNQ.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:1432 -
C:\windows\GWNQ.exeC:\windows\GWNQ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ROIJQ.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3280 -
C:\windows\system\ROIJQ.exeC:\windows\system\ROIJQ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XOQ.exe.bat" "90⤵
- Executes a command shell one-liner
PID:3004 -
C:\windows\XOQ.exeC:\windows\XOQ.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCQ.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:592 -
C:\windows\SysWOW64\FCQ.exeC:\windows\system32\FCQ.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UXAQMI.exe.bat" "94⤵PID:596
-
C:\windows\system\UXAQMI.exeC:\windows\system\UXAQMI.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSZR.exe.bat" "96⤵PID:3008
-
C:\windows\SSZR.exeC:\windows\SSZR.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NGEABL.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4628 -
C:\windows\system\NGEABL.exeC:\windows\system\NGEABL.exe99⤵
- Executes dropped EXE
PID:5880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CBNM.exe.bat" "100⤵
- Executes a command shell one-liner
PID:2316 -
C:\windows\system\CBNM.exeC:\windows\system\CBNM.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SROET.exe.bat" "102⤵PID:4788
-
C:\windows\SROET.exeC:\windows\SROET.exe103⤵
- Executes dropped EXE
PID:3524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\METNDTN.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:5712 -
C:\windows\system\METNDTN.exeC:\windows\system\METNDTN.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUZV.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3268 -
C:\windows\SysWOW64\QUZV.exeC:\windows\system32\QUZV.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPD.exe.bat" "108⤵
- Executes a command shell one-liner
PID:1872 -
C:\windows\system\RPD.exeC:\windows\system\RPD.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VFSZH.exe.bat" "110⤵PID:300
-
C:\windows\VFSZH.exeC:\windows\VFSZH.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EGUEKRI.exe.bat" "112⤵PID:4504
-
C:\windows\system\EGUEKRI.exeC:\windows\system\EGUEKRI.exe113⤵
- Executes dropped EXE
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KGUS.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:3936 -
C:\windows\system\KGUS.exeC:\windows\system\KGUS.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WWISFD.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:4380 -
C:\windows\SysWOW64\WWISFD.exeC:\windows\system32\WWISFD.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NHLIO.exe.bat" "118⤵PID:3088
-
C:\windows\NHLIO.exeC:\windows\NHLIO.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YXS.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:4460 -
C:\windows\YXS.exeC:\windows\YXS.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-