Analysis
- max time kernel
100s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 05:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_177f2487688ca1d7737b932a09a005d8_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-29_177f2487688ca1d7737b932a09a005d8_elex_emotet_stop.exe
- Size 208KB
- Sample260930-fpkbpavscx
- SHA256 0e005644acf826251662d53c8ef95a4ac266fde447493234e826d127f6df4e32
- MD5 177f2487688ca1d7737b932a09a005d8
- SHA1 6fe5059e1c2b30af299a7d3f6c1f45e1c725e3d8
- SHA512 ed9e07240fad381e5d3fb11304465871b4aa56728e1156a2dbbaef0ba4cf9670b74a3daf00f49971c28336b2a1ab425e52a03c4ba5c46dd3477929da8c17474c
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFleKL+LOfe4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFleS+LOWkEj1
- TLSH T197247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2792 YBQOYR.exe 2672 EUUDM.exe 428 BMWO.exe 5900 PIIHDX.exe 6132 RFV.exe 1140 BDB.exe 2992 QTCN.exe 3364 SRHH.exe 3596 WXAW.exe 5128 GXCBI.exe 2480 FQFR.exe 4340 XLIVWO.exe 4696 JBXV.exe 5704 NJEVUZ.exe 2292 CZFU.exe 5252 SUOZMHK.exe 1728 SHO.exe 2944 MVTXY.exe 4828 BQC.exe 4560 WDHS.exe 2404 GBNN.exe 3168 KMLAIIK.exe 3264 JCEDV.exe 3504 HMHT.exe 4348 PCIKLO.exe 5512 VDQ.exe 3948 MLSD.exe 1352 ZOAC.exe 4724 PEBBSM.exe 6036 CPSSGP.exe 4676 CSV.exe 5464 XFAF.exe 5948 QIE.exe 4120 AGKVJL.exe 4640 SBNZW.exe 2228 TERUCRX.exe 2972 ORW.exe 664 RHLMYJ.exe 6088 JIFRCHK.exe 1572 NYTROZ.exe 4648 FTX.exe 5240 LTFIDR.exe 1896 GOKSNRY.exe 2368 GJNV.exe 5964 OZO.exe 5560 APVVL.exe 4748 EXCVXFY.exe 5188 NGEABL.exe 5872 TGLOKF.exe 4356 UJPRP.exe 2492 METNDTN.exe 2888 QUZV.exe 3060 HUCATIL.exe 3344 XPLFE.exe 3820 LVRCL.exe 2624 RQQ.exe 5836 XRY.exe 5920 BZE.exe 2532 WUJI.exe 4160 EAJWW.exe 5776 SFHLD.exe 1956 YFPHULN.exe 5428 VDUW.exe 5404 PYZFM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\WDHS.exe.bat BQC.exe File opened for modification C:\windows\SysWOW64\KMLAIIK.exe GBNN.exe File opened for modification C:\windows\SysWOW64\VDQ.exe PCIKLO.exe File opened for modification C:\windows\SysWOW64\EXCVXFY.exe APVVL.exe File created C:\windows\SysWOW64\VDUW.exe YFPHULN.exe File created C:\windows\SysWOW64\OHRZXX.exe.bat XCHG.exe File opened for modification C:\windows\SysWOW64\IPU.exe EHNMOO.exe File opened for modification C:\windows\SysWOW64\WDHS.exe BQC.exe File opened for modification C:\windows\SysWOW64\GBNN.exe WDHS.exe File opened for modification C:\windows\SysWOW64\GOKSNRY.exe LTFIDR.exe File created C:\windows\SysWOW64\KMEXOVS.exe PYZFM.exe File created C:\windows\SysWOW64\ELUZ.exe.bat PVTAT.exe File created C:\windows\SysWOW64\NSIJZ.exe.bat TFD.exe File created C:\windows\SysWOW64\QIE.exe XFAF.exe File created C:\windows\SysWOW64\GFDFB.exe UMIV.exe File created C:\windows\SysWOW64\EYJCZL.exe.bat ODA.exe File created C:\windows\SysWOW64\PIIHDX.exe BMWO.exe File created C:\windows\SysWOW64\NYTROZ.exe.bat JIFRCHK.exe File created C:\windows\SysWOW64\SFHLD.exe.bat EAJWW.exe File created C:\windows\SysWOW64\NOAPME.exe.bat YLR.exe File opened for modification C:\windows\SysWOW64\FXENNGF.exe OPCIJA.exe File created C:\windows\SysWOW64\GBNN.exe.bat WDHS.exe File created C:\windows\SysWOW64\QUZV.exe.bat METNDTN.exe File created C:\windows\SysWOW64\ZVTGHT.exe NDYNZ.exe File created C:\windows\SysWOW64\NYTROZ.exe JIFRCHK.exe File created C:\windows\SysWOW64\GOKSNRY.exe.bat LTFIDR.exe File created C:\windows\SysWOW64\MLSD.exe.bat VDQ.exe File created C:\windows\SysWOW64\PPYCD.exe EXVK.exe File created C:\windows\SysWOW64\MVU.exe XADPX.exe File opened for modification C:\windows\SysWOW64\ITAZLQ.exe ELUZ.exe File created C:\windows\SysWOW64\YWOW.exe.bat YRW.exe File created C:\windows\SysWOW64\SRHH.exe.bat QTCN.exe File created C:\windows\SysWOW64\KMLAIIK.exe GBNN.exe File created C:\windows\SysWOW64\KMLAIIK.exe.bat GBNN.exe File created C:\windows\SysWOW64\VDQ.exe.bat PCIKLO.exe File created C:\windows\SysWOW64\XFAF.exe.bat CSV.exe File created C:\windows\SysWOW64\EXCVXFY.exe APVVL.exe File opened for modification C:\windows\SysWOW64\BZE.exe XRY.exe File created C:\windows\SysWOW64\GFDFB.exe.bat UMIV.exe File opened for modification C:\windows\SysWOW64\BQC.exe MVTXY.exe File created C:\windows\SysWOW64\LTFIDR.exe.bat FTX.exe File created C:\windows\SysWOW64\QUZV.exe METNDTN.exe File created C:\windows\SysWOW64\BZE.exe.bat XRY.exe File created C:\windows\SysWOW64\EAJWW.exe.bat WUJI.exe File created C:\windows\SysWOW64\XADPX.exe XULAW.exe File created C:\windows\SysWOW64\ZVTGHT.exe.bat NDYNZ.exe File created C:\windows\SysWOW64\JULMK.exe.bat FEFMXQ.exe File opened for modification C:\windows\SysWOW64\PPYCD.exe EXVK.exe File created C:\windows\SysWOW64\ARB.exe ZOXZ.exe File created C:\windows\SysWOW64\FXENNGF.exe OPCIJA.exe File created C:\windows\SysWOW64\FXENNGF.exe.bat OPCIJA.exe File created C:\windows\SysWOW64\NSIJZ.exe TFD.exe File created C:\windows\SysWOW64\PIIHDX.exe.bat BMWO.exe File created C:\windows\SysWOW64\BDB.exe RFV.exe File opened for modification C:\windows\SysWOW64\HMHT.exe JCEDV.exe File opened for modification C:\windows\SysWOW64\LTFIDR.exe FTX.exe File opened for modification C:\windows\SysWOW64\EAJWW.exe WUJI.exe File created C:\windows\SysWOW64\MVU.exe.bat XADPX.exe File created C:\windows\SysWOW64\EHNMOO.exe.bat KUJC.exe File created C:\windows\SysWOW64\SBNZW.exe.bat AGKVJL.exe File created C:\windows\SysWOW64\PCIKLO.exe HMHT.exe File created C:\windows\SysWOW64\EYJCZL.exe ODA.exe File opened for modification C:\windows\SysWOW64\EHNMOO.exe KUJC.exe File created C:\windows\SysWOW64\BQC.exe MVTXY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\XLIVWO.exe FQFR.exe File opened for modification C:\windows\system\PEBBSM.exe ZOAC.exe File created C:\windows\system\GJNV.exe.bat GOKSNRY.exe File opened for modification C:\windows\system\KFJIRCL.exe QRERG.exe File opened for modification C:\windows\JGSFZK.exe XNPM.exe File created C:\windows\JIFRCHK.exe RHLMYJ.exe File opened for modification C:\windows\system\METNDTN.exe UJPRP.exe File opened for modification C:\windows\system\EXVK.exe YWOW.exe File created C:\windows\system\JBXV.exe XLIVWO.exe File created C:\windows\MVTXY.exe.bat SHO.exe File created C:\windows\LVRCL.exe.bat XPLFE.exe File created C:\windows\JGSFZK.exe.bat XNPM.exe File opened for modification C:\windows\system\VPG.exe PPYCD.exe File created C:\windows\system\HNZYIDM.exe.bat ICW.exe File created C:\windows\system\OPCIJA.exe IPU.exe File created C:\windows\LDLPF.exe RQH.exe File opened for modification C:\windows\BMWO.exe EUUDM.exe File created C:\windows\system\CSV.exe CPSSGP.exe File created C:\windows\system\METNDTN.exe UJPRP.exe File created C:\windows\system\APVVL.exe OZO.exe File created C:\windows\YFPHULN.exe.bat SFHLD.exe File created C:\windows\JTF.exe OGASIM.exe File created C:\windows\FWB.exe.bat ZVTGHT.exe File created C:\windows\system\KFJIRCL.exe.bat QRERG.exe File opened for modification C:\windows\UMIV.exe JTF.exe File opened for modification C:\windows\QLLZ.exe VPG.exe File created C:\windows\QAN.exe QVU.exe File created C:\windows\VXAXAH.exe NSIJZ.exe File created C:\windows\BMWO.exe.bat EUUDM.exe File created C:\windows\system\WXAW.exe.bat SRHH.exe File created C:\windows\system\YIGJGRI.exe GFDFB.exe File created C:\windows\system\ICW.exe.bat OHRZXX.exe File created C:\windows\system\QTFHKHC.exe VXAXAH.exe File created C:\windows\YBQOYR.exe.bat 2026-09-29_177f2487688ca1d7737b932a09a005d8_elex_emotet_stop.exe File created C:\windows\PYZFM.exe.bat VDUW.exe File created C:\windows\system\WXMTRR.exe KFJIRCL.exe File created C:\windows\QVU.exe.bat IHI.exe File opened for modification C:\windows\system\NGEABL.exe EXCVXFY.exe File opened for modification C:\windows\system\TGLOKF.exe NGEABL.exe File created C:\windows\XPLFE.exe.bat HUCATIL.exe File opened for modification C:\windows\system\XCHG.exe AWBJ.exe File created C:\windows\RQH.exe FXENNGF.exe File opened for modification C:\windows\ZOXZ.exe QAN.exe File created C:\windows\YBQOYR.exe 2026-09-29_177f2487688ca1d7737b932a09a005d8_elex_emotet_stop.exe File created C:\windows\CPSSGP.exe.bat PEBBSM.exe File created C:\windows\system\ORW.exe.bat TERUCRX.exe File created C:\windows\system\NGEABL.exe EXCVXFY.exe File opened for modification C:\windows\system\XRY.exe RQQ.exe File created C:\windows\YLR.exe WXMTRR.exe File created C:\windows\GHAIGZQ.exe.bat EJZ.exe File created C:\windows\ZOAC.exe.bat MLSD.exe File opened for modification C:\windows\NJEVUZ.exe JBXV.exe File opened for modification C:\windows\MVTXY.exe SHO.exe File opened for modification C:\windows\XPLFE.exe HUCATIL.exe File created C:\windows\WUJI.exe.bat BZE.exe File created C:\windows\WOPBUG.exe URWHNJ.exe File created C:\windows\WOPBUG.exe.bat URWHNJ.exe File created C:\windows\NJEVUZ.exe.bat JBXV.exe File opened for modification C:\windows\TERUCRX.exe SBNZW.exe File opened for modification C:\windows\ABCEP.exe ITAZLQ.exe File created C:\windows\system\CHAYAL.exe ZZU.exe File opened for modification C:\windows\system\IHI.exe CHAYAL.exe File created C:\windows\system\JCEDV.exe KMLAIIK.exe File created C:\windows\YQQG.exe.bat QLLZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 860 cmd.exe 5816 cmd.exe 3144 cmd.exe 1912 cmd.exe 2736 cmd.exe 3200 cmd.exe 4948 cmd.exe 3488 cmd.exe 556 cmd.exe 2052 cmd.exe 4980 cmd.exe 4476 cmd.exe 5156 cmd.exe 4300 cmd.exe 4900 cmd.exe 3016 cmd.exe 4996 cmd.exe 4272 cmd.exe 3324 cmd.exe 2168 cmd.exe 3604 cmd.exe 3160 cmd.exe 1488 cmd.exe 5452 cmd.exe 5008 cmd.exe 5160 cmd.exe 5852 cmd.exe 2012 cmd.exe 3444 cmd.exe 2500 cmd.exe 3148 cmd.exe 1340 cmd.exe 6044 cmd.exe 3560 cmd.exe 4976 cmd.exe 4468 cmd.exe 668 cmd.exe 4148 cmd.exe 4408 cmd.exe 824 cmd.exe 3792 cmd.exe 3464 cmd.exe 5040 cmd.exe 3892 cmd.exe 1552 cmd.exe 1904 cmd.exe 2952 cmd.exe 1384 cmd.exe 5672 cmd.exe 4940 cmd.exe 2668 cmd.exe 4344 cmd.exe 5772 cmd.exe 5712 cmd.exe 4692 cmd.exe 1980 cmd.exe 844 cmd.exe 2140 cmd.exe 1436 cmd.exe 1952 cmd.exe 4116 cmd.exe 936 cmd.exe 2552 cmd.exe 2068 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4216 4492 WerFault.exe 87 3564 2792 WerFault.exe 93 2624 2672 WerFault.exe 99 5132 428 WerFault.exe 104 4480 5900 WerFault.exe 109 5432 6132 WerFault.exe 114 1952 1140 WerFault.exe 119 4868 2992 WerFault.exe 124 1164 3364 WerFault.exe 129 4896 3596 WerFault.exe 134 2828 5128 WerFault.exe 139 5428 2480 WerFault.exe 144 1956 4340 WerFault.exe 149 1560 4696 WerFault.exe 154 5116 5704 WerFault.exe 159 3220 2292 WerFault.exe 164 1228 5252 WerFault.exe 169 5952 1728 WerFault.exe 174 2760 2944 WerFault.exe 179 3740 4828 WerFault.exe 183 4944 4560 WerFault.exe 189 2400 2404 WerFault.exe 194 5204 3168 WerFault.exe 199 2644 3264 WerFault.exe 204 4376 3504 WerFault.exe 209 3444 4348 WerFault.exe 214 4468 5512 WerFault.exe 219 1028 3948 WerFault.exe 224 5328 1352 WerFault.exe 229 5092 4724 WerFault.exe 234 2524 6036 WerFault.exe 239 5104 4676 WerFault.exe 244 5604 5464 WerFault.exe 249 4144 5948 WerFault.exe 254 4116 4120 WerFault.exe 259 2316 4640 WerFault.exe 264 2904 2228 WerFault.exe 269 4760 2972 WerFault.exe 275 856 664 WerFault.exe 279 4356 6088 WerFault.exe 285 3732 1572 WerFault.exe 290 5104 4648 WerFault.exe 295 2936 5240 WerFault.exe 300 5136 1896 WerFault.exe 305 2748 2368 WerFault.exe 310 1456 5964 WerFault.exe 315 5568 5560 WerFault.exe 320 2032 4748 WerFault.exe 325 1408 5188 WerFault.exe 330 1240 5872 WerFault.exe 335 1128 4356 WerFault.exe 340 4580 2492 WerFault.exe 345 360 2888 WerFault.exe 350 5472 3060 WerFault.exe 355 2748 3344 WerFault.exe 360 4612 3820 WerFault.exe 365 5044 2624 WerFault.exe 370 6008 5836 WerFault.exe 375 3676 5920 WerFault.exe 380 4788 2532 WerFault.exe 385 5320 4160 WerFault.exe 390 5916 5776 WerFault.exe 395 3332 1956 WerFault.exe 400 560 5428 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TERUCRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PYZFM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URWHNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CSV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAJWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ARB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LTFIDR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCVXFY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXENNGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFDFB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABCEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MLSD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMHT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGEABL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLIVWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IPU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHLMYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UJPRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOAC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFAF.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4492 2026-09-29_177f2487688ca1d7737b932a09a005d8_elex_emotet_stop.exe 4492 2026-09-29_177f2487688ca1d7737b932a09a005d8_elex_emotet_stop.exe 2792 YBQOYR.exe 2792 YBQOYR.exe 2672 EUUDM.exe 2672 EUUDM.exe 428 BMWO.exe 428 BMWO.exe 5900 PIIHDX.exe 5900 PIIHDX.exe 6132 RFV.exe 6132 RFV.exe 1140 BDB.exe 1140 BDB.exe 2992 QTCN.exe 2992 QTCN.exe 3364 SRHH.exe 3364 SRHH.exe 3596 WXAW.exe 3596 WXAW.exe 5128 GXCBI.exe 5128 GXCBI.exe 2480 FQFR.exe 2480 FQFR.exe 4340 XLIVWO.exe 4340 XLIVWO.exe 4696 JBXV.exe 4696 JBXV.exe 5704 NJEVUZ.exe 5704 NJEVUZ.exe 2292 CZFU.exe 2292 CZFU.exe 5252 SUOZMHK.exe 5252 SUOZMHK.exe 1728 SHO.exe 1728 SHO.exe 2944 MVTXY.exe 2944 MVTXY.exe 4828 BQC.exe 4828 BQC.exe 4560 WDHS.exe 4560 WDHS.exe 2404 GBNN.exe 2404 GBNN.exe 3168 KMLAIIK.exe 3168 KMLAIIK.exe 3264 JCEDV.exe 3264 JCEDV.exe 3504 HMHT.exe 3504 HMHT.exe 4348 PCIKLO.exe 4348 PCIKLO.exe 5512 VDQ.exe 5512 VDQ.exe 3948 MLSD.exe 3948 MLSD.exe 1352 ZOAC.exe 1352 ZOAC.exe 4724 PEBBSM.exe 4724 PEBBSM.exe 6036 CPSSGP.exe 6036 CPSSGP.exe 4676 CSV.exe 4676 CSV.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4492 2026-09-29_177f2487688ca1d7737b932a09a005d8_elex_emotet_stop.exe 4492 2026-09-29_177f2487688ca1d7737b932a09a005d8_elex_emotet_stop.exe 2792 YBQOYR.exe 2792 YBQOYR.exe 2672 EUUDM.exe 2672 EUUDM.exe 428 BMWO.exe 428 BMWO.exe 5900 PIIHDX.exe 5900 PIIHDX.exe 6132 RFV.exe 6132 RFV.exe 1140 BDB.exe 1140 BDB.exe 2992 QTCN.exe 2992 QTCN.exe 3364 SRHH.exe 3364 SRHH.exe 3596 WXAW.exe 3596 WXAW.exe 5128 GXCBI.exe 5128 GXCBI.exe 2480 FQFR.exe 2480 FQFR.exe 4340 XLIVWO.exe 4340 XLIVWO.exe 4696 JBXV.exe 4696 JBXV.exe 5704 NJEVUZ.exe 5704 NJEVUZ.exe 2292 CZFU.exe 2292 CZFU.exe 5252 SUOZMHK.exe 5252 SUOZMHK.exe 1728 SHO.exe 1728 SHO.exe 2944 MVTXY.exe 2944 MVTXY.exe 4828 BQC.exe 4828 BQC.exe 4560 WDHS.exe 4560 WDHS.exe 2404 GBNN.exe 2404 GBNN.exe 3168 KMLAIIK.exe 3168 KMLAIIK.exe 3264 JCEDV.exe 3264 JCEDV.exe 3504 HMHT.exe 3504 HMHT.exe 4348 PCIKLO.exe 4348 PCIKLO.exe 5512 VDQ.exe 5512 VDQ.exe 3948 MLSD.exe 3948 MLSD.exe 1352 ZOAC.exe 1352 ZOAC.exe 4724 PEBBSM.exe 4724 PEBBSM.exe 6036 CPSSGP.exe 6036 CPSSGP.exe 4676 CSV.exe 4676 CSV.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4492 wrote to memory of 708 4492 2026-09-29_177f2487688ca1d7737b932a09a005d8_elex_emotet_stop.exe 89 PID 708 wrote to memory of 2792 708 cmd.exe 93 PID 2792 wrote to memory of 3424 2792 YBQOYR.exe 95 PID 3424 wrote to memory of 2672 3424 cmd.exe 99 PID 2672 wrote to memory of 3356 2672 EUUDM.exe 100 PID 3356 wrote to memory of 428 3356 cmd.exe 104 PID 428 wrote to memory of 2836 428 BMWO.exe 105 PID 2836 wrote to memory of 5900 2836 cmd.exe 109 PID 5900 wrote to memory of 4744 5900 PIIHDX.exe 110 PID 4744 wrote to memory of 6132 4744 cmd.exe 114 PID 6132 wrote to memory of 5772 6132 RFV.exe 115 PID 5772 wrote to memory of 1140 5772 cmd.exe 119 PID 1140 wrote to memory of 860 1140 BDB.exe 120 PID 860 wrote to memory of 2992 860 cmd.exe 124 PID 2992 wrote to memory of 2140 2992 QTCN.exe 125 PID 2140 wrote to memory of 3364 2140 cmd.exe 129 PID 3364 wrote to memory of 5080 3364 SRHH.exe 130 PID 5080 wrote to memory of 3596 5080 cmd.exe 134 PID 3596 wrote to memory of 5180 3596 WXAW.exe 135 PID 5180 wrote to memory of 5128 5180 cmd.exe 139 PID 5128 wrote to memory of 556 5128 GXCBI.exe 140 PID 556 wrote to memory of 2480 556 cmd.exe 144 PID 2480 wrote to memory of 5816 2480 FQFR.exe 145 PID 5816 wrote to memory of 4340 5816 cmd.exe 149 PID 4340 wrote to memory of 6120 4340 XLIVWO.exe 150 PID 6120 wrote to memory of 4696 6120 cmd.exe 154 PID 4696 wrote to memory of 1204 4696 JBXV.exe 155 PID 1204 wrote to memory of 5704 1204 cmd.exe 159 PID 5704 wrote to memory of 1052 5704 NJEVUZ.exe 160 PID 1052 wrote to memory of 2292 1052 cmd.exe 164 PID 2292 wrote to memory of 880 2292 CZFU.exe 165 PID 880 wrote to memory of 5252 880 cmd.exe 169 PID 5252 wrote to memory of 5712 5252 SUOZMHK.exe 170 PID 5712 wrote to memory of 1728 5712 cmd.exe 174 PID 1728 wrote to memory of 5068 1728 SHO.exe 175 PID 5068 wrote to memory of 2944 5068 cmd.exe 179 PID 2944 wrote to memory of 1372 2944 MVTXY.exe 180 PID 1372 wrote to memory of 4828 1372 cmd.exe 183 PID 4828 wrote to memory of 616 4828 BQC.exe 185 PID 616 wrote to memory of 4560 616 cmd.exe 189 PID 4560 wrote to memory of 1020 4560 WDHS.exe 190 PID 1020 wrote to memory of 2404 1020 cmd.exe 194 PID 2404 wrote to memory of 2984 2404 GBNN.exe 195 PID 2984 wrote to memory of 3168 2984 cmd.exe 199 PID 3168 wrote to memory of 3940 3168 KMLAIIK.exe 200 PID 3940 wrote to memory of 3264 3940 cmd.exe 204 PID 3264 wrote to memory of 4216 3264 JCEDV.exe 205 PID 4216 wrote to memory of 3504 4216 cmd.exe 209 PID 3504 wrote to memory of 1232 3504 HMHT.exe 210 PID 1232 wrote to memory of 4348 1232 cmd.exe 214 PID 4348 wrote to memory of 2052 4348 PCIKLO.exe 215 PID 2052 wrote to memory of 5512 2052 cmd.exe 219 PID 5512 wrote to memory of 1544 5512 VDQ.exe 220 PID 1544 wrote to memory of 3948 1544 cmd.exe 224 PID 3948 wrote to memory of 936 3948 MLSD.exe 225 PID 936 wrote to memory of 1352 936 cmd.exe 229 PID 1352 wrote to memory of 2444 1352 ZOAC.exe 230 PID 2444 wrote to memory of 4724 2444 cmd.exe 234 PID 4724 wrote to memory of 4672 4724 PEBBSM.exe 235 PID 4672 wrote to memory of 6036 4672 cmd.exe 239 PID 6036 wrote to memory of 1384 6036 CPSSGP.exe 240 PID 1384 wrote to memory of 4676 1384 cmd.exe 244 PID 4676 wrote to memory of 4980 4676 CSV.exe 245 PID 4980 wrote to memory of 5464 4980 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_177f2487688ca1d7737b932a09a005d8_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_177f2487688ca1d7737b932a09a005d8_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YBQOYR.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:708 -
C:\windows\YBQOYR.exeC:\windows\YBQOYR.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUUDM.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\windows\EUUDM.exeC:\windows\EUUDM.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMWO.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\windows\BMWO.exeC:\windows\BMWO.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PIIHDX.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\windows\SysWOW64\PIIHDX.exeC:\windows\system32\PIIHDX.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RFV.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\windows\RFV.exeC:\windows\RFV.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDB.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\windows\SysWOW64\BDB.exeC:\windows\system32\BDB.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTCN.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:860 -
C:\windows\system\QTCN.exeC:\windows\system\QTCN.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRHH.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\windows\SysWOW64\SRHH.exeC:\windows\system32\SRHH.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WXAW.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\windows\system\WXAW.exeC:\windows\system\WXAW.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXCBI.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\windows\system\GXCBI.exeC:\windows\system\GXCBI.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQFR.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:556 -
C:\windows\system\FQFR.exeC:\windows\system\FQFR.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XLIVWO.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\windows\XLIVWO.exeC:\windows\XLIVWO.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBXV.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\windows\system\JBXV.exeC:\windows\system\JBXV.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NJEVUZ.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\windows\NJEVUZ.exeC:\windows\NJEVUZ.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZFU.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\windows\CZFU.exeC:\windows\CZFU.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SUOZMHK.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:880 -
C:\windows\SUOZMHK.exeC:\windows\SUOZMHK.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SHO.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\windows\SysWOW64\SHO.exeC:\windows\system32\SHO.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MVTXY.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\windows\MVTXY.exeC:\windows\MVTXY.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BQC.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\windows\SysWOW64\BQC.exeC:\windows\system32\BQC.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WDHS.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:616 -
C:\windows\SysWOW64\WDHS.exeC:\windows\system32\WDHS.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GBNN.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\windows\SysWOW64\GBNN.exeC:\windows\system32\GBNN.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMLAIIK.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\windows\SysWOW64\KMLAIIK.exeC:\windows\system32\KMLAIIK.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JCEDV.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\windows\system\JCEDV.exeC:\windows\system\JCEDV.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HMHT.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\SysWOW64\HMHT.exeC:\windows\system32\HMHT.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCIKLO.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\windows\SysWOW64\PCIKLO.exeC:\windows\system32\PCIKLO.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDQ.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\windows\SysWOW64\VDQ.exeC:\windows\system32\VDQ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLSD.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\windows\SysWOW64\MLSD.exeC:\windows\system32\MLSD.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOAC.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:936 -
C:\windows\ZOAC.exeC:\windows\ZOAC.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEBBSM.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\windows\system\PEBBSM.exeC:\windows\system\PEBBSM.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPSSGP.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\windows\CPSSGP.exeC:\windows\CPSSGP.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CSV.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\windows\system\CSV.exeC:\windows\system\CSV.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFAF.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\windows\SysWOW64\XFAF.exeC:\windows\system32\XFAF.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QIE.exe.bat" "66⤵PID:2260
-
C:\windows\SysWOW64\QIE.exeC:\windows\system32\QIE.exe67⤵
- Executes dropped EXE
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGKVJL.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5672 -
C:\windows\AGKVJL.exeC:\windows\AGKVJL.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SBNZW.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2676 -
C:\windows\SysWOW64\SBNZW.exeC:\windows\system32\SBNZW.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TERUCRX.exe.bat" "72⤵PID:3368
-
C:\windows\TERUCRX.exeC:\windows\TERUCRX.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORW.exe.bat" "74⤵PID:4836
-
C:\windows\system\ORW.exeC:\windows\system\ORW.exe75⤵
- Executes dropped EXE
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHLMYJ.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:5676 -
C:\windows\system\RHLMYJ.exeC:\windows\system\RHLMYJ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JIFRCHK.exe.bat" "78⤵PID:5432
-
C:\windows\JIFRCHK.exeC:\windows\JIFRCHK.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYTROZ.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4300 -
C:\windows\SysWOW64\NYTROZ.exeC:\windows\system32\NYTROZ.exe81⤵
- Executes dropped EXE
PID:1572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTX.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:424 -
C:\windows\FTX.exeC:\windows\FTX.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LTFIDR.exe.bat" "84⤵PID:3584
-
C:\windows\SysWOW64\LTFIDR.exeC:\windows\system32\LTFIDR.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GOKSNRY.exe.bat" "86⤵PID:5460
-
C:\windows\SysWOW64\GOKSNRY.exeC:\windows\system32\GOKSNRY.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GJNV.exe.bat" "88⤵PID:5076
-
C:\windows\system\GJNV.exeC:\windows\system\GJNV.exe89⤵
- Executes dropped EXE
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OZO.exe.bat" "90⤵PID:4376
-
C:\windows\OZO.exeC:\windows\OZO.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\APVVL.exe.bat" "92⤵
- Executes a command shell one-liner
PID:2552 -
C:\windows\system\APVVL.exeC:\windows\system\APVVL.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXCVXFY.exe.bat" "94⤵PID:6100
-
C:\windows\SysWOW64\EXCVXFY.exeC:\windows\system32\EXCVXFY.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NGEABL.exe.bat" "96⤵PID:748
-
C:\windows\system\NGEABL.exeC:\windows\system\NGEABL.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGLOKF.exe.bat" "98⤵PID:2352
-
C:\windows\system\TGLOKF.exeC:\windows\system\TGLOKF.exe99⤵
- Executes dropped EXE
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UJPRP.exe.bat" "100⤵
- Executes a command shell one-liner
PID:2068 -
C:\windows\UJPRP.exeC:\windows\UJPRP.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\METNDTN.exe.bat" "102⤵PID:3436
-
C:\windows\system\METNDTN.exeC:\windows\system\METNDTN.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUZV.exe.bat" "104⤵PID:2448
-
C:\windows\SysWOW64\QUZV.exeC:\windows\system32\QUZV.exe105⤵
- Executes dropped EXE
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUCATIL.exe.bat" "106⤵PID:3564
-
C:\windows\SysWOW64\HUCATIL.exeC:\windows\system32\HUCATIL.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XPLFE.exe.bat" "108⤵
- Executes a command shell one-liner
PID:1436 -
C:\windows\XPLFE.exeC:\windows\XPLFE.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LVRCL.exe.bat" "110⤵PID:1664
-
C:\windows\LVRCL.exeC:\windows\LVRCL.exe111⤵
- Executes dropped EXE
PID:3820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RQQ.exe.bat" "112⤵PID:5980
-
C:\windows\SysWOW64\RQQ.exeC:\windows\system32\RQQ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XRY.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3160 -
C:\windows\system\XRY.exeC:\windows\system\XRY.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BZE.exe.bat" "116⤵
- Executes a command shell one-liner
PID:3144 -
C:\windows\SysWOW64\BZE.exeC:\windows\system32\BZE.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUJI.exe.bat" "118⤵
- Executes a command shell one-liner
PID:5852 -
C:\windows\WUJI.exeC:\windows\WUJI.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EAJWW.exe.bat" "120⤵
- Executes a command shell one-liner
PID:824 -
C:\windows\SysWOW64\EAJWW.exeC:\windows\system32\EAJWW.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-