Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 00:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_5a742e8e4f4cd190242f59c8dea2205f_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-29_5a742e8e4f4cd190242f59c8dea2205f_elex_emotet_stop.exe
- Size 208KB
- Sample260930-anw17sshja
- SHA256 77e67cedcd8dd89ecd940732440d605ee276ae5a05c1a389d436671d488356ab
- MD5 5a742e8e4f4cd190242f59c8dea2205f
- SHA1 d3459c83f6e114fe315db765895e3cc3b70d071e
- SHA512 e193a64f9146c289c1753c254673d6acda20d617c2d34c92400e8d8a6fdb3e11e2ffd892b818ceeab88fe79bea96a836bd42f0ffc04207c8b57a69a07d6216d2
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5Xb1lldL+LOfT4pLthEjQT6j:MlZtbLWIgd1LZ9oECZb1ll5+LOLkEj1
- TLSH T1A8247D1236D2C073E4B7023188F6C7787BB6BD919B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4368 HPXOJR.exe 5816 RSPPB.exe 712 UAYD.exe 4304 VDOZXUZ.exe 5336 BYZADQI.exe 3084 EHI.exe 3148 MUN.exe 2636 OHE.exe 5788 PGMOQ.exe 4828 QICCF.exe 5056 JBSNO.exe 2140 SBAH.exe 2604 JKPMI.exe 1672 WQP.exe 2868 QIE.exe 3704 OTHRK.exe 4092 ILWCU.exe 2484 GWZS.exe 4560 SXPD.exe 3680 UFPZ.exe 3164 KAHDMY.exe 5516 QVK.exe 1404 QYWAX.exe 4292 NRYKJG.exe 2008 ACOB.exe 2496 SCIGB.exe 5512 APVVL.exe 3524 PKE.exe 756 XYR.exe 5820 VLQHM.exe 5756 FJW.exe 4476 JZCJF.exe 6112 KUGF.exe 300 TCIKO.exe 3132 UFZGDG.exe 1988 UICBQ.exe 1008 EJEOUC.exe 5200 QZX.exe 4928 UCWCPZ.exe 4964 LKKZBQ.exe 4508 MFODH.exe 4176 GAFEA.exe 5060 HVJIGPW.exe 1732 PJVPQNA.exe 2160 KWAY.exe 2536 XCAKDZQ.exe 1152 CZT.exe 4880 SSVPBIH.exe 4652 RDYF.exe 5828 SGCBPEE.exe 3300 OMUQGZ.exe 5672 UZTR.exe 2072 ORJC.exe 5208 XADPX.exe 3584 QSSAH.exe 2460 UIZ.exe 1524 XRIW.exe 3520 EMRBL.exe 4336 AJRMV.exe 5648 SMDIACS.exe 2012 WCJQM.exe 1924 RQOAXU.exe 4276 KIWLGV.exe 5396 QEVLLQB.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\TCIKO.exe KUGF.exe File created C:\windows\SysWOW64\PJVPQNA.exe HVJIGPW.exe File created C:\windows\SysWOW64\EJEOUC.exe UICBQ.exe File opened for modification C:\windows\SysWOW64\HVJIGPW.exe GAFEA.exe File opened for modification C:\windows\SysWOW64\PJVPQNA.exe HVJIGPW.exe File opened for modification C:\windows\SysWOW64\SSVPBIH.exe CZT.exe File created C:\windows\SysWOW64\QEVLLQB.exe KIWLGV.exe File created C:\windows\SysWOW64\TCIKO.exe KUGF.exe File created C:\windows\SysWOW64\TCIKO.exe.bat KUGF.exe File opened for modification C:\windows\SysWOW64\GAFEA.exe MFODH.exe File created C:\windows\SysWOW64\VDOZXUZ.exe.bat UAYD.exe File created C:\windows\SysWOW64\QICCF.exe PGMOQ.exe File created C:\windows\SysWOW64\KAHDMY.exe.bat UFPZ.exe File created C:\windows\SysWOW64\ACOB.exe NRYKJG.exe File created C:\windows\SysWOW64\PJVPQNA.exe.bat HVJIGPW.exe File created C:\windows\SysWOW64\RHTHWO.exe LHMTNU.exe File created C:\windows\SysWOW64\RSPPB.exe HPXOJR.exe File created C:\windows\SysWOW64\VDOZXUZ.exe UAYD.exe File opened for modification C:\windows\SysWOW64\OHE.exe MUN.exe File created C:\windows\SysWOW64\SCIGB.exe ACOB.exe File opened for modification C:\windows\SysWOW64\KUGF.exe JZCJF.exe File created C:\windows\SysWOW64\HWSKD.exe SBBGSZJ.exe File created C:\windows\SysWOW64\ASUMB.exe WCF.exe File created C:\windows\SysWOW64\HPXOJR.exe 2026-09-29_5a742e8e4f4cd190242f59c8dea2205f_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\QIE.exe WQP.exe File created C:\windows\SysWOW64\GAFEA.exe MFODH.exe File opened for modification C:\windows\SysWOW64\OMUQGZ.exe SGCBPEE.exe File created C:\windows\SysWOW64\SMDIACS.exe.bat AJRMV.exe File created C:\windows\SysWOW64\ASUMB.exe.bat WCF.exe File created C:\windows\SysWOW64\HPXOJR.exe.bat 2026-09-29_5a742e8e4f4cd190242f59c8dea2205f_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\RSPPB.exe HPXOJR.exe File created C:\windows\SysWOW64\XADPX.exe.bat ORJC.exe File opened for modification C:\windows\SysWOW64\SMDIACS.exe AJRMV.exe File created C:\windows\SysWOW64\HWSKD.exe.bat SBBGSZJ.exe File opened for modification C:\windows\SysWOW64\RHTHWO.exe LHMTNU.exe File created C:\windows\SysWOW64\OHE.exe MUN.exe File created C:\windows\SysWOW64\EJEOUC.exe.bat UICBQ.exe File opened for modification C:\windows\SysWOW64\XADPX.exe ORJC.exe File created C:\windows\SysWOW64\LHMTNU.exe MWJLFGV.exe File created C:\windows\SysWOW64\RSPPB.exe.bat HPXOJR.exe File created C:\windows\SysWOW64\XADPX.exe ORJC.exe File created C:\windows\SysWOW64\QEVLLQB.exe.bat KIWLGV.exe File created C:\windows\SysWOW64\RHTHWO.exe.bat LHMTNU.exe File opened for modification C:\windows\SysWOW64\HPXOJR.exe 2026-09-29_5a742e8e4f4cd190242f59c8dea2205f_elex_emotet_stop.exe File created C:\windows\SysWOW64\QZX.exe EJEOUC.exe File created C:\windows\SysWOW64\GAFEA.exe.bat MFODH.exe File created C:\windows\SysWOW64\SSVPBIH.exe.bat CZT.exe File opened for modification C:\windows\SysWOW64\HWSKD.exe SBBGSZJ.exe File opened for modification C:\windows\SysWOW64\ASUMB.exe WCF.exe File opened for modification C:\windows\SysWOW64\ACOB.exe NRYKJG.exe File created C:\windows\SysWOW64\ACOB.exe.bat NRYKJG.exe File created C:\windows\SysWOW64\QIE.exe.bat WQP.exe File created C:\windows\SysWOW64\KAHDMY.exe UFPZ.exe File created C:\windows\SysWOW64\PKE.exe.bat APVVL.exe File created C:\windows\SysWOW64\OMUQGZ.exe SGCBPEE.exe File opened for modification C:\windows\SysWOW64\VDOZXUZ.exe UAYD.exe File opened for modification C:\windows\SysWOW64\SCIGB.exe ACOB.exe File created C:\windows\SysWOW64\SCIGB.exe.bat ACOB.exe File created C:\windows\SysWOW64\KUGF.exe.bat JZCJF.exe File created C:\windows\SysWOW64\OMUQGZ.exe.bat SGCBPEE.exe File created C:\windows\SysWOW64\OHE.exe.bat MUN.exe File created C:\windows\SysWOW64\QICCF.exe.bat PGMOQ.exe File created C:\windows\SysWOW64\QIE.exe WQP.exe File opened for modification C:\windows\SysWOW64\PKE.exe APVVL.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\OTHRK.exe QIE.exe File created C:\windows\system\UAYD.exe RSPPB.exe File opened for modification C:\windows\system\GWZS.exe ILWCU.exe File opened for modification C:\windows\QVK.exe KAHDMY.exe File created C:\windows\UZTR.exe OMUQGZ.exe File opened for modification C:\windows\NRYKJG.exe QYWAX.exe File opened for modification C:\windows\system\APVVL.exe SCIGB.exe File created C:\windows\XRIW.exe UIZ.exe File opened for modification C:\windows\system\EMRBL.exe XRIW.exe File created C:\windows\KIWLGV.exe RQOAXU.exe File created C:\windows\DCNVT.exe.bat ISEXF.exe File created C:\windows\system\XYR.exe.bat PKE.exe File opened for modification C:\windows\system\SGCBPEE.exe RDYF.exe File opened for modification C:\windows\VHBI.exe TLKZQ.exe File created C:\windows\system\AAQWQ.exe YFL.exe File created C:\windows\system\JKPMI.exe SBAH.exe File opened for modification C:\windows\system\KWAY.exe PJVPQNA.exe File created C:\windows\RDYF.exe.bat SSVPBIH.exe File created C:\windows\QSSAH.exe.bat XADPX.exe File opened for modification C:\windows\MUN.exe EHI.exe File created C:\windows\system\BYZADQI.exe VDOZXUZ.exe File opened for modification C:\windows\CZT.exe XCAKDZQ.exe File opened for modification C:\windows\system\IGCD.exe AAQWQ.exe File created C:\windows\system\SXPD.exe GWZS.exe File opened for modification C:\windows\system\XYR.exe PKE.exe File opened for modification C:\windows\KIWLGV.exe RQOAXU.exe File created C:\windows\MHCODC.exe.bat XMT.exe File created C:\windows\system\SXPD.exe.bat GWZS.exe File created C:\windows\QVK.exe KAHDMY.exe File created C:\windows\FJW.exe VLQHM.exe File created C:\windows\UFZGDG.exe TCIKO.exe File created C:\windows\MFODH.exe.bat LKKZBQ.exe File opened for modification C:\windows\MHCODC.exe XMT.exe File opened for modification C:\windows\system\YFL.exe ASUMB.exe File created C:\windows\QVK.exe.bat KAHDMY.exe File created C:\windows\system\UICBQ.exe UFZGDG.exe File created C:\windows\CZT.exe XCAKDZQ.exe File opened for modification C:\windows\SBBGSZJ.exe QEVLLQB.exe File opened for modification C:\windows\system\PGMOQ.exe OHE.exe File opened for modification C:\windows\system\SBAH.exe JBSNO.exe File created C:\windows\UFZGDG.exe.bat TCIKO.exe File created C:\windows\UZTR.exe.bat OMUQGZ.exe File opened for modification C:\windows\QSSAH.exe XADPX.exe File created C:\windows\ZNCZ.exe MHCODC.exe File created C:\windows\system\IGCD.exe AAQWQ.exe File created C:\windows\system\SBAH.exe.bat JBSNO.exe File created C:\windows\system\WQP.exe JKPMI.exe File created C:\windows\ILWCU.exe.bat OTHRK.exe File opened for modification C:\windows\system\XCAKDZQ.exe KWAY.exe File opened for modification C:\windows\TLKZQ.exe YYN.exe File created C:\windows\VHBI.exe TLKZQ.exe File created C:\windows\system\YFL.exe ASUMB.exe File created C:\windows\OTHRK.exe.bat QIE.exe File created C:\windows\JZCJF.exe FJW.exe File opened for modification C:\windows\UFZGDG.exe TCIKO.exe File created C:\windows\RQOAXU.exe WCJQM.exe File opened for modification C:\windows\ZNCZ.exe MHCODC.exe File created C:\windows\VHBI.exe.bat TLKZQ.exe File created C:\windows\system\XYR.exe PKE.exe File created C:\windows\MFODH.exe LKKZBQ.exe File created C:\windows\WCJQM.exe.bat SMDIACS.exe File created C:\windows\system\AAQWQ.exe.bat YFL.exe File opened for modification C:\windows\system\BYZADQI.exe VDOZXUZ.exe File created C:\windows\system\UAYD.exe.bat RSPPB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5172 cmd.exe 4244 cmd.exe 5576 cmd.exe 5012 cmd.exe 2664 cmd.exe 4356 cmd.exe 3472 cmd.exe 2412 cmd.exe 4712 cmd.exe 4624 cmd.exe 5896 cmd.exe 1140 cmd.exe 2312 cmd.exe 1848 cmd.exe 3116 cmd.exe 1380 cmd.exe 2712 cmd.exe 4620 cmd.exe 1352 cmd.exe 4616 cmd.exe 4684 cmd.exe 5164 cmd.exe 6000 cmd.exe 1520 cmd.exe 4980 cmd.exe 6088 cmd.exe 3708 cmd.exe 256 cmd.exe 4384 cmd.exe 4640 cmd.exe 2340 cmd.exe 5808 cmd.exe 2552 cmd.exe 5140 cmd.exe 3068 cmd.exe 3372 cmd.exe 2276 cmd.exe 5972 cmd.exe 4852 cmd.exe 200 cmd.exe 3168 cmd.exe 4816 cmd.exe 592 cmd.exe 4132 cmd.exe 3292 cmd.exe 3456 cmd.exe 4904 cmd.exe 4760 cmd.exe 2044 cmd.exe 1080 cmd.exe 1164 cmd.exe 1556 cmd.exe 2800 cmd.exe 4784 cmd.exe 5564 cmd.exe 2704 cmd.exe 2772 cmd.exe 1880 cmd.exe 2404 cmd.exe 1440 cmd.exe 3228 cmd.exe 4168 cmd.exe 1684 cmd.exe 3716 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2448 4084 WerFault.exe 88 1404 4368 WerFault.exe 93 5592 5816 WerFault.exe 99 6128 712 WerFault.exe 104 1740 4304 WerFault.exe 109 1916 5336 WerFault.exe 114 3368 3084 WerFault.exe 119 1140 3148 WerFault.exe 124 4688 2636 WerFault.exe 129 2644 5788 WerFault.exe 134 2716 4828 WerFault.exe 139 4216 5056 WerFault.exe 144 4472 2140 WerFault.exe 149 5252 2604 WerFault.exe 154 4132 1672 WerFault.exe 159 5668 2868 WerFault.exe 164 2156 3704 WerFault.exe 169 2856 4092 WerFault.exe 174 4568 2484 WerFault.exe 179 2752 4560 WerFault.exe 184 3500 3680 WerFault.exe 189 1124 3164 WerFault.exe 194 4452 5516 WerFault.exe 199 5040 1404 WerFault.exe 204 2632 4292 WerFault.exe 209 4268 2008 WerFault.exe 214 1340 2496 WerFault.exe 219 900 5512 WerFault.exe 224 616 3524 WerFault.exe 229 5256 756 WerFault.exe 234 2644 5820 WerFault.exe 239 1736 5756 WerFault.exe 244 3624 4476 WerFault.exe 249 4424 6112 WerFault.exe 254 1268 300 WerFault.exe 260 1304 3132 WerFault.exe 265 1512 1988 WerFault.exe 270 4380 1008 WerFault.exe 275 2856 5200 WerFault.exe 280 5328 4928 WerFault.exe 285 2420 4964 WerFault.exe 290 3456 4508 WerFault.exe 295 1320 4176 WerFault.exe 300 5024 5060 WerFault.exe 305 1448 1732 WerFault.exe 310 3820 2160 WerFault.exe 315 1916 2536 WerFault.exe 320 3452 1152 WerFault.exe 325 616 4880 WerFault.exe 330 4284 4652 WerFault.exe 335 5572 5828 WerFault.exe 340 2980 3300 WerFault.exe 345 4232 5672 WerFault.exe 350 3816 2072 WerFault.exe 355 4948 5208 WerFault.exe 360 3360 3584 WerFault.exe 365 5792 2460 WerFault.exe 370 3452 1524 WerFault.exe 375 5132 3520 WerFault.exe 380 4684 4336 WerFault.exe 385 1708 5648 WerFault.exe 390 1320 2012 WerFault.exe 395 5252 1924 WerFault.exe 400 5072 4276 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWSKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ISEXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XADPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASUMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJRMV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNCZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HPXOJR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYWAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZCJF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OMUQGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QIE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCIGB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCIKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFZGDG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UICBQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMDIACS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APVVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFODH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQOAXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KAHDMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHTHWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDOZXUZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGMOQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VLQHM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSVPBIH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMRBL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWJLFGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UAYD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4084 2026-09-29_5a742e8e4f4cd190242f59c8dea2205f_elex_emotet_stop.exe 4084 2026-09-29_5a742e8e4f4cd190242f59c8dea2205f_elex_emotet_stop.exe 4368 HPXOJR.exe 4368 HPXOJR.exe 5816 RSPPB.exe 5816 RSPPB.exe 712 UAYD.exe 712 UAYD.exe 4304 VDOZXUZ.exe 4304 VDOZXUZ.exe 5336 BYZADQI.exe 5336 BYZADQI.exe 3084 EHI.exe 3084 EHI.exe 3148 MUN.exe 3148 MUN.exe 2636 OHE.exe 2636 OHE.exe 5788 PGMOQ.exe 5788 PGMOQ.exe 4828 QICCF.exe 4828 QICCF.exe 5056 JBSNO.exe 5056 JBSNO.exe 2140 SBAH.exe 2140 SBAH.exe 2604 JKPMI.exe 2604 JKPMI.exe 1672 WQP.exe 1672 WQP.exe 2868 QIE.exe 2868 QIE.exe 3704 OTHRK.exe 3704 OTHRK.exe 4092 ILWCU.exe 4092 ILWCU.exe 2484 GWZS.exe 2484 GWZS.exe 4560 SXPD.exe 4560 SXPD.exe 3680 UFPZ.exe 3680 UFPZ.exe 3164 KAHDMY.exe 3164 KAHDMY.exe 5516 QVK.exe 5516 QVK.exe 1404 QYWAX.exe 1404 QYWAX.exe 4292 NRYKJG.exe 4292 NRYKJG.exe 2008 ACOB.exe 2008 ACOB.exe 2496 SCIGB.exe 2496 SCIGB.exe 5512 APVVL.exe 5512 APVVL.exe 3524 PKE.exe 3524 PKE.exe 756 XYR.exe 756 XYR.exe 5820 VLQHM.exe 5820 VLQHM.exe 5756 FJW.exe 5756 FJW.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4084 2026-09-29_5a742e8e4f4cd190242f59c8dea2205f_elex_emotet_stop.exe 4084 2026-09-29_5a742e8e4f4cd190242f59c8dea2205f_elex_emotet_stop.exe 4368 HPXOJR.exe 4368 HPXOJR.exe 5816 RSPPB.exe 5816 RSPPB.exe 712 UAYD.exe 712 UAYD.exe 4304 VDOZXUZ.exe 4304 VDOZXUZ.exe 5336 BYZADQI.exe 5336 BYZADQI.exe 3084 EHI.exe 3084 EHI.exe 3148 MUN.exe 3148 MUN.exe 2636 OHE.exe 2636 OHE.exe 5788 PGMOQ.exe 5788 PGMOQ.exe 4828 QICCF.exe 4828 QICCF.exe 5056 JBSNO.exe 5056 JBSNO.exe 2140 SBAH.exe 2140 SBAH.exe 2604 JKPMI.exe 2604 JKPMI.exe 1672 WQP.exe 1672 WQP.exe 2868 QIE.exe 2868 QIE.exe 3704 OTHRK.exe 3704 OTHRK.exe 4092 ILWCU.exe 4092 ILWCU.exe 2484 GWZS.exe 2484 GWZS.exe 4560 SXPD.exe 4560 SXPD.exe 3680 UFPZ.exe 3680 UFPZ.exe 3164 KAHDMY.exe 3164 KAHDMY.exe 5516 QVK.exe 5516 QVK.exe 1404 QYWAX.exe 1404 QYWAX.exe 4292 NRYKJG.exe 4292 NRYKJG.exe 2008 ACOB.exe 2008 ACOB.exe 2496 SCIGB.exe 2496 SCIGB.exe 5512 APVVL.exe 5512 APVVL.exe 3524 PKE.exe 3524 PKE.exe 756 XYR.exe 756 XYR.exe 5820 VLQHM.exe 5820 VLQHM.exe 5756 FJW.exe 5756 FJW.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4084 wrote to memory of 5136 4084 2026-09-29_5a742e8e4f4cd190242f59c8dea2205f_elex_emotet_stop.exe 89 PID 5136 wrote to memory of 4368 5136 cmd.exe 93 PID 4368 wrote to memory of 5856 4368 HPXOJR.exe 95 PID 5856 wrote to memory of 5816 5856 cmd.exe 99 PID 5816 wrote to memory of 1768 5816 RSPPB.exe 100 PID 1768 wrote to memory of 712 1768 cmd.exe 104 PID 712 wrote to memory of 5508 712 UAYD.exe 105 PID 5508 wrote to memory of 4304 5508 cmd.exe 109 PID 4304 wrote to memory of 5064 4304 VDOZXUZ.exe 110 PID 5064 wrote to memory of 5336 5064 cmd.exe 114 PID 5336 wrote to memory of 3336 5336 BYZADQI.exe 115 PID 3336 wrote to memory of 3084 3336 cmd.exe 119 PID 3084 wrote to memory of 1520 3084 EHI.exe 120 PID 1520 wrote to memory of 3148 1520 cmd.exe 124 PID 3148 wrote to memory of 1636 3148 MUN.exe 125 PID 1636 wrote to memory of 2636 1636 cmd.exe 129 PID 2636 wrote to memory of 1548 2636 OHE.exe 130 PID 1548 wrote to memory of 5788 1548 cmd.exe 134 PID 5788 wrote to memory of 1820 5788 PGMOQ.exe 135 PID 1820 wrote to memory of 4828 1820 cmd.exe 139 PID 4828 wrote to memory of 2520 4828 QICCF.exe 140 PID 2520 wrote to memory of 5056 2520 cmd.exe 144 PID 5056 wrote to memory of 4552 5056 JBSNO.exe 145 PID 4552 wrote to memory of 2140 4552 cmd.exe 149 PID 2140 wrote to memory of 3212 2140 SBAH.exe 150 PID 3212 wrote to memory of 2604 3212 cmd.exe 154 PID 2604 wrote to memory of 5808 2604 JKPMI.exe 155 PID 5808 wrote to memory of 1672 5808 cmd.exe 159 PID 1672 wrote to memory of 592 1672 WQP.exe 160 PID 592 wrote to memory of 2868 592 cmd.exe 164 PID 2868 wrote to memory of 4620 2868 QIE.exe 165 PID 4620 wrote to memory of 3704 4620 cmd.exe 169 PID 3704 wrote to memory of 428 3704 OTHRK.exe 170 PID 428 wrote to memory of 4092 428 cmd.exe 174 PID 4092 wrote to memory of 2900 4092 ILWCU.exe 175 PID 2900 wrote to memory of 2484 2900 cmd.exe 179 PID 2484 wrote to memory of 3288 2484 GWZS.exe 180 PID 3288 wrote to memory of 4560 3288 cmd.exe 184 PID 4560 wrote to memory of 5604 4560 SXPD.exe 185 PID 5604 wrote to memory of 3680 5604 cmd.exe 189 PID 3680 wrote to memory of 5896 3680 UFPZ.exe 190 PID 5896 wrote to memory of 3164 5896 cmd.exe 194 PID 3164 wrote to memory of 2648 3164 KAHDMY.exe 195 PID 2648 wrote to memory of 5516 2648 cmd.exe 199 PID 5516 wrote to memory of 4216 5516 QVK.exe 200 PID 4216 wrote to memory of 1404 4216 cmd.exe 204 PID 1404 wrote to memory of 1880 1404 QYWAX.exe 205 PID 1880 wrote to memory of 4292 1880 cmd.exe 209 PID 4292 wrote to memory of 5972 4292 NRYKJG.exe 210 PID 5972 wrote to memory of 2008 5972 cmd.exe 214 PID 2008 wrote to memory of 3016 2008 ACOB.exe 215 PID 3016 wrote to memory of 2496 3016 cmd.exe 219 PID 2496 wrote to memory of 5172 2496 SCIGB.exe 220 PID 5172 wrote to memory of 5512 5172 cmd.exe 224 PID 5512 wrote to memory of 5188 5512 APVVL.exe 225 PID 5188 wrote to memory of 3524 5188 cmd.exe 229 PID 3524 wrote to memory of 1140 3524 PKE.exe 230 PID 1140 wrote to memory of 756 1140 cmd.exe 234 PID 756 wrote to memory of 5576 756 XYR.exe 235 PID 5576 wrote to memory of 5820 5576 cmd.exe 239 PID 5820 wrote to memory of 3056 5820 VLQHM.exe 240 PID 3056 wrote to memory of 5756 3056 cmd.exe 244 PID 5756 wrote to memory of 1228 5756 FJW.exe 245 PID 1228 wrote to memory of 4476 1228 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_5a742e8e4f4cd190242f59c8dea2205f_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_5a742e8e4f4cd190242f59c8dea2205f_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HPXOJR.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\windows\SysWOW64\HPXOJR.exeC:\windows\system32\HPXOJR.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RSPPB.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\windows\SysWOW64\RSPPB.exeC:\windows\system32\RSPPB.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UAYD.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\windows\system\UAYD.exeC:\windows\system\UAYD.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDOZXUZ.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\windows\SysWOW64\VDOZXUZ.exeC:\windows\system32\VDOZXUZ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BYZADQI.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\windows\system\BYZADQI.exeC:\windows\system\BYZADQI.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHI.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\windows\EHI.exeC:\windows\EHI.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MUN.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\windows\MUN.exeC:\windows\MUN.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHE.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\windows\SysWOW64\OHE.exeC:\windows\system32\OHE.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGMOQ.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\windows\system\PGMOQ.exeC:\windows\system\PGMOQ.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QICCF.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\windows\SysWOW64\QICCF.exeC:\windows\system32\QICCF.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBSNO.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\windows\system\JBSNO.exeC:\windows\system\JBSNO.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SBAH.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\windows\system\SBAH.exeC:\windows\system\SBAH.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JKPMI.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\windows\system\JKPMI.exeC:\windows\system\JKPMI.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQP.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\windows\system\WQP.exeC:\windows\system\WQP.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QIE.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:592 -
C:\windows\SysWOW64\QIE.exeC:\windows\system32\QIE.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTHRK.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\windows\OTHRK.exeC:\windows\OTHRK.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ILWCU.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:428 -
C:\windows\ILWCU.exeC:\windows\ILWCU.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GWZS.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\windows\system\GWZS.exeC:\windows\system\GWZS.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SXPD.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\windows\system\SXPD.exeC:\windows\system\SXPD.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFPZ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\windows\UFPZ.exeC:\windows\UFPZ.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KAHDMY.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\windows\SysWOW64\KAHDMY.exeC:\windows\system32\KAHDMY.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVK.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\windows\QVK.exeC:\windows\QVK.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYWAX.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\QYWAX.exeC:\windows\QYWAX.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NRYKJG.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\windows\NRYKJG.exeC:\windows\NRYKJG.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACOB.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\windows\SysWOW64\ACOB.exeC:\windows\system32\ACOB.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SCIGB.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\windows\SysWOW64\SCIGB.exeC:\windows\system32\SCIGB.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\APVVL.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\windows\system\APVVL.exeC:\windows\system\APVVL.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PKE.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\windows\SysWOW64\PKE.exeC:\windows\system32\PKE.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XYR.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\windows\system\XYR.exeC:\windows\system\XYR.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VLQHM.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\windows\VLQHM.exeC:\windows\VLQHM.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJW.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\windows\FJW.exeC:\windows\FJW.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZCJF.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\windows\JZCJF.exeC:\windows\JZCJF.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUGF.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4356 -
C:\windows\SysWOW64\KUGF.exeC:\windows\system32\KUGF.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TCIKO.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3260 -
C:\windows\SysWOW64\TCIKO.exeC:\windows\system32\TCIKO.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFZGDG.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:4256 -
C:\windows\UFZGDG.exeC:\windows\UFZGDG.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UICBQ.exe.bat" "72⤵
- Executes a command shell one-liner
PID:1352 -
C:\windows\system\UICBQ.exeC:\windows\system\UICBQ.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EJEOUC.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:3036 -
C:\windows\SysWOW64\EJEOUC.exeC:\windows\system32\EJEOUC.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QZX.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4616 -
C:\windows\SysWOW64\QZX.exeC:\windows\system32\QZX.exe77⤵
- Executes dropped EXE
PID:5200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCWCPZ.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4980 -
C:\windows\UCWCPZ.exeC:\windows\UCWCPZ.exe79⤵
- Executes dropped EXE
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LKKZBQ.exe.bat" "80⤵PID:3688
-
C:\windows\system\LKKZBQ.exeC:\windows\system\LKKZBQ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MFODH.exe.bat" "82⤵PID:3692
-
C:\windows\MFODH.exeC:\windows\MFODH.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GAFEA.exe.bat" "84⤵
- Executes a command shell one-liner
PID:3472 -
C:\windows\SysWOW64\GAFEA.exeC:\windows\system32\GAFEA.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVJIGPW.exe.bat" "86⤵PID:4308
-
C:\windows\SysWOW64\HVJIGPW.exeC:\windows\system32\HVJIGPW.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJVPQNA.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4244 -
C:\windows\SysWOW64\PJVPQNA.exeC:\windows\system32\PJVPQNA.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWAY.exe.bat" "90⤵
- Executes a command shell one-liner
PID:6088 -
C:\windows\system\KWAY.exeC:\windows\system\KWAY.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCAKDZQ.exe.bat" "92⤵PID:1700
-
C:\windows\system\XCAKDZQ.exeC:\windows\system\XCAKDZQ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZT.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4132 -
C:\windows\CZT.exeC:\windows\CZT.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSVPBIH.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2412 -
C:\windows\SysWOW64\SSVPBIH.exeC:\windows\system32\SSVPBIH.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDYF.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2404 -
C:\windows\RDYF.exeC:\windows\RDYF.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGCBPEE.exe.bat" "100⤵PID:5544
-
C:\windows\system\SGCBPEE.exeC:\windows\system\SGCBPEE.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OMUQGZ.exe.bat" "102⤵PID:5320
-
C:\windows\SysWOW64\OMUQGZ.exeC:\windows\system32\OMUQGZ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UZTR.exe.bat" "104⤵
- Executes a command shell one-liner
PID:2552 -
C:\windows\UZTR.exeC:\windows\UZTR.exe105⤵
- Executes dropped EXE
PID:5672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORJC.exe.bat" "106⤵PID:1136
-
C:\windows\system\ORJC.exeC:\windows\system\ORJC.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XADPX.exe.bat" "108⤵PID:2492
-
C:\windows\SysWOW64\XADPX.exeC:\windows\system32\XADPX.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSSAH.exe.bat" "110⤵
- Executes a command shell one-liner
PID:1080 -
C:\windows\QSSAH.exeC:\windows\QSSAH.exe111⤵
- Executes dropped EXE
PID:3584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UIZ.exe.bat" "112⤵PID:2776
-
C:\windows\system\UIZ.exeC:\windows\system\UIZ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRIW.exe.bat" "114⤵PID:4628
-
C:\windows\XRIW.exeC:\windows\XRIW.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMRBL.exe.bat" "116⤵
- Executes a command shell one-liner
PID:3708 -
C:\windows\system\EMRBL.exeC:\windows\system\EMRBL.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AJRMV.exe.bat" "118⤵PID:348
-
C:\windows\system\AJRMV.exeC:\windows\system\AJRMV.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SMDIACS.exe.bat" "120⤵PID:6024
-
C:\windows\SysWOW64\SMDIACS.exeC:\windows\system32\SMDIACS.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-