Analysis
- max time kernel
84s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 08:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_c10af6b7dd86560dbbce5c57ca292aa4_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-30_c10af6b7dd86560dbbce5c57ca292aa4_elex_emotet_stop.exe
- Size 208KB
- Sample260930-jyepcaxt2l
- SHA256 3a1e5f3d4ad937d9b2f812955dd600a9986ded07c77d340b2ae83e4ee30bf279
- MD5 c10af6b7dd86560dbbce5c57ca292aa4
- SHA1 68e2f86b2f7eb797cbd9583a5c6aadfbc64a4e65
- SHA512 704a094cf95fa5360f5e70fafa63718cd1697cd5fea6431caad7d86795260ad681db0c087816f3ce4c4fec1613adcc81f0880bab2a6c1e2e38b097b52f8666fd
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfu4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOmkEj1
- TLSH T1A9247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4968 DCTS.exe 4268 WQTPD.exe 5280 EDGD.exe 2020 MJKK.exe 5920 QZRKDE.exe 5856 WUC.exe 2632 GSQXY.exe 2904 OYVMJ.exe 2800 NIXU.exe 2580 VWK.exe 4136 YETXJ.exe 3144 UKD.exe 4764 TUOCAQI.exe 4576 MNVNRJQ.exe 692 JNFQVN.exe 4288 RTKWGL.exe 5488 CLZPXM.exe 5840 BECXY.exe 3052 QUDXEN.exe 5760 YAQDPM.exe 416 DFITFHE.exe 5472 MBGLFZV.exe 4924 RGYAWC.exe 4336 CUFYBEM.exe 4880 LHKFLC.exe 4840 EAZQVD.exe 5268 XSHB.exe 2796 UTQLQ.exe 2144 EQW.exe 4228 VBHNGPL.exe 4504 GJNV.exe 3504 NFROGD.exe 3008 QVG.exe 1712 GLHORJS.exe 4180 QIMI.exe 5260 DLDH.exe 4004 SBEYTQ.exe 704 GMMXIB.exe 2372 MHLYMW.exe 1140 ZSUW.exe 5884 ANY.exe 3524 CLLMNF.exe 2472 RBMM.exe 1948 QZX.exe 3860 FPYGOB.exe 1688 QHORFU.exe 3940 AFTL.exe 4792 GATMRF.exe 5592 VVCQ.exe 2888 XTQLKBL.exe 1252 YOTOXY.exe 2300 XHWWG.exe 3176 FNJL.exe 5140 UDWVY.exe 2648 TNZ.exe 3416 QOJ.exe 5416 OMUQGZ.exe 5908 SPSL.exe 1396 ORJC.exe 1528 QPOWBM.exe 1664 ZNUQJU.exe 4660 SQY.exe 3988 EGMUI.exe 4196 LWNM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\FNJL.exe XHWWG.exe File opened for modification C:\windows\SysWOW64\DCEWOQM.exe PROX.exe File opened for modification C:\windows\SysWOW64\NIA.exe LLV.exe File opened for modification C:\windows\SysWOW64\GAMBFAK.exe CKFB.exe File created C:\windows\SysWOW64\XSHB.exe.bat EAZQVD.exe File created C:\windows\SysWOW64\IQI.exe CDREWPQ.exe File created C:\windows\SysWOW64\BRY.exe.bat IQI.exe File created C:\windows\SysWOW64\DPG.exe YPWP.exe File opened for modification C:\windows\SysWOW64\VBVCR.exe OGMPGFN.exe File created C:\windows\SysWOW64\QXWVI.exe.bat CZYYB.exe File opened for modification C:\windows\SysWOW64\UARPJ.exe TXNLDB.exe File created C:\windows\SysWOW64\YETXJ.exe.bat VWK.exe File opened for modification C:\windows\SysWOW64\YAQDPM.exe QUDXEN.exe File opened for modification C:\windows\SysWOW64\YOTOXY.exe XTQLKBL.exe File created C:\windows\SysWOW64\SQY.exe ZNUQJU.exe File created C:\windows\SysWOW64\BRY.exe IQI.exe File created C:\windows\SysWOW64\NIA.exe.bat LLV.exe File opened for modification C:\windows\SysWOW64\EDGD.exe WQTPD.exe File opened for modification C:\windows\SysWOW64\VWK.exe NIXU.exe File created C:\windows\SysWOW64\UKD.exe YETXJ.exe File created C:\windows\SysWOW64\UKD.exe.bat YETXJ.exe File created C:\windows\SysWOW64\VVCQ.exe.bat GATMRF.exe File opened for modification C:\windows\SysWOW64\OMUQGZ.exe QOJ.exe File opened for modification C:\windows\SysWOW64\LWNM.exe EGMUI.exe File created C:\windows\SysWOW64\JAN.exe OPXKC.exe File created C:\windows\SysWOW64\YETXJ.exe VWK.exe File created C:\windows\SysWOW64\QZX.exe RBMM.exe File created C:\windows\SysWOW64\JAN.exe.bat OPXKC.exe File opened for modification C:\windows\SysWOW64\IQI.exe CDREWPQ.exe File created C:\windows\SysWOW64\YPWP.exe QBKJ.exe File created C:\windows\SysWOW64\GAMBFAK.exe.bat CKFB.exe File created C:\windows\SysWOW64\UARPJ.exe TXNLDB.exe File opened for modification C:\windows\SysWOW64\JNFQVN.exe MNVNRJQ.exe File created C:\windows\SysWOW64\BECXY.exe CLZPXM.exe File created C:\windows\SysWOW64\VVCQ.exe GATMRF.exe File created C:\windows\SysWOW64\GJSDR.exe.bat LWNM.exe File opened for modification C:\windows\SysWOW64\GLHORJS.exe QVG.exe File created C:\windows\SysWOW64\GLHORJS.exe.bat QVG.exe File created C:\windows\SysWOW64\YOTOXY.exe.bat XTQLKBL.exe File created C:\windows\SysWOW64\FNJL.exe.bat XHWWG.exe File opened for modification C:\windows\SysWOW64\JAN.exe OPXKC.exe File opened for modification C:\windows\SysWOW64\BRY.exe IQI.exe File opened for modification C:\windows\SysWOW64\YPWP.exe QBKJ.exe File opened for modification C:\windows\SysWOW64\JSQQ.exe HUKWU.exe File created C:\windows\SysWOW64\EDGD.exe WQTPD.exe File opened for modification C:\windows\SysWOW64\UKD.exe YETXJ.exe File created C:\windows\SysWOW64\YAQDPM.exe.bat QUDXEN.exe File opened for modification C:\windows\SysWOW64\QZX.exe RBMM.exe File created C:\windows\SysWOW64\YOTOXY.exe XTQLKBL.exe File created C:\windows\SysWOW64\QOJ.exe.bat TNZ.exe File opened for modification C:\windows\SysWOW64\SQY.exe ZNUQJU.exe File created C:\windows\SysWOW64\JSQQ.exe.bat HUKWU.exe File created C:\windows\SysWOW64\NIXU.exe OYVMJ.exe File opened for modification C:\windows\SysWOW64\YETXJ.exe VWK.exe File created C:\windows\SysWOW64\JNFQVN.exe MNVNRJQ.exe File opened for modification C:\windows\SysWOW64\BECXY.exe CLZPXM.exe File created C:\windows\SysWOW64\BECXY.exe.bat CLZPXM.exe File created C:\windows\SysWOW64\SQY.exe.bat ZNUQJU.exe File created C:\windows\SysWOW64\LWNM.exe EGMUI.exe File created C:\windows\SysWOW64\DCEWOQM.exe PROX.exe File created C:\windows\SysWOW64\JNFQVN.exe.bat MNVNRJQ.exe File created C:\windows\SysWOW64\QZX.exe.bat RBMM.exe File opened for modification C:\windows\SysWOW64\VVCQ.exe GATMRF.exe File opened for modification C:\windows\SysWOW64\QOJ.exe TNZ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\GJNV.exe VBHNGPL.exe File opened for modification C:\windows\AFTL.exe QHORFU.exe File opened for modification C:\windows\TNZ.exe UDWVY.exe File opened for modification C:\windows\system\OPXKC.exe GJSDR.exe File created C:\windows\system\CDREWPQ.exe JAN.exe File created C:\windows\system\WQTPD.exe.bat DCTS.exe File created C:\windows\WUC.exe.bat QZRKDE.exe File created C:\windows\system\MBGLFZV.exe.bat DFITFHE.exe File opened for modification C:\windows\LHKFLC.exe CUFYBEM.exe File opened for modification C:\windows\MHLYMW.exe GMMXIB.exe File created C:\windows\system\JWKWURJ.exe.bat BRY.exe File created C:\windows\system\SSFNV.exe DCEWOQM.exe File opened for modification C:\windows\system\QBKJ.exe BGAEWZ.exe File created C:\windows\EQW.exe.bat UTQLQ.exe File opened for modification C:\windows\system\RBMM.exe CLLMNF.exe File created C:\windows\GATMRF.exe AFTL.exe File opened for modification C:\windows\JVTUX.exe FNM.exe File opened for modification C:\windows\system\CKFB.exe JSQQ.exe File opened for modification C:\windows\IJC.exe OOWZTRP.exe File created C:\windows\SBEYTQ.exe.bat DLDH.exe File created C:\windows\system\CLLMNF.exe ANY.exe File created C:\windows\system\FPYGOB.exe.bat QZX.exe File created C:\windows\XHWWG.exe.bat YOTOXY.exe File opened for modification C:\windows\system\JWKWURJ.exe BRY.exe File opened for modification C:\windows\FNM.exe DPG.exe File created C:\windows\JVTUX.exe FNM.exe File created C:\windows\YLU.exe.bat JVTUX.exe File created C:\windows\MJKK.exe.bat EDGD.exe File created C:\windows\system\RTKWGL.exe JNFQVN.exe File created C:\windows\system\QIMI.exe GLHORJS.exe File opened for modification C:\windows\ZOXPJ.exe YLU.exe File created C:\windows\system\CKFB.exe JSQQ.exe File created C:\windows\system\CNLDVND.exe.bat QXWVI.exe File created C:\windows\system\TXNLDB.exe.bat CNLDVND.exe File created C:\windows\GSQXY.exe.bat WUC.exe File created C:\windows\system\GJNV.exe.bat VBHNGPL.exe File opened for modification C:\windows\system\QIMI.exe GLHORJS.exe File created C:\windows\GATMRF.exe.bat AFTL.exe File created C:\windows\system\BGAEWZ.exe NIA.exe File created C:\windows\system\CUFYBEM.exe RGYAWC.exe File created C:\windows\LHKFLC.exe.bat CUFYBEM.exe File created C:\windows\system\QBKJ.exe.bat BGAEWZ.exe File created C:\windows\system\BWUDWV.exe VBVCR.exe File created C:\windows\CZYYB.exe.bat BWUDWV.exe File created C:\windows\system\TXNLDB.exe CNLDVND.exe File created C:\windows\system\GMMXIB.exe SBEYTQ.exe File created C:\windows\system\OYVMJ.exe GSQXY.exe File created C:\windows\system\CUFYBEM.exe.bat RGYAWC.exe File created C:\windows\NFROGD.exe.bat GJNV.exe File opened for modification C:\windows\system\DLDH.exe QIMI.exe File created C:\windows\TNZ.exe.bat UDWVY.exe File opened for modification C:\windows\system\SSFNV.exe DCEWOQM.exe File created C:\windows\system\CKFB.exe.bat JSQQ.exe File created C:\windows\LHKFLC.exe CUFYBEM.exe File created C:\windows\system\CLLMNF.exe.bat ANY.exe File created C:\windows\QPOWBM.exe.bat ORJC.exe File created C:\windows\system\OPXKC.exe GJSDR.exe File opened for modification C:\windows\system\CDREWPQ.exe JAN.exe File created C:\windows\system\CDREWPQ.exe.bat JAN.exe File opened for modification C:\windows\system\VBHNGPL.exe EQW.exe File opened for modification C:\windows\QVG.exe NFROGD.exe File opened for modification C:\windows\XTQLKBL.exe VVCQ.exe File created C:\windows\system\ORJC.exe.bat SPSL.exe File opened for modification C:\windows\QPOWBM.exe ORJC.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2312 cmd.exe 1376 cmd.exe 5412 cmd.exe 6028 cmd.exe 4756 cmd.exe 5804 cmd.exe 2324 cmd.exe 1348 cmd.exe 3904 cmd.exe 2404 cmd.exe 5368 cmd.exe 2208 cmd.exe 4548 cmd.exe 2064 cmd.exe 124 cmd.exe 4400 cmd.exe 1468 cmd.exe 3844 cmd.exe 3796 cmd.exe 2696 cmd.exe 2876 cmd.exe 2812 cmd.exe 2720 cmd.exe 816 cmd.exe 2672 cmd.exe 2616 cmd.exe 1072 cmd.exe 6004 cmd.exe 3688 cmd.exe 2620 cmd.exe 788 cmd.exe 2204 cmd.exe 5800 cmd.exe 4172 cmd.exe 5220 cmd.exe 296 cmd.exe 5940 cmd.exe 5512 cmd.exe 4904 cmd.exe 1152 cmd.exe 1200 cmd.exe 4832 cmd.exe 5976 cmd.exe 5812 cmd.exe 1308 cmd.exe 5200 cmd.exe 4168 cmd.exe 3928 cmd.exe 1784 cmd.exe 3340 cmd.exe 4884 cmd.exe 1096 cmd.exe 544 cmd.exe 3360 cmd.exe 2556 cmd.exe 4820 cmd.exe 4780 cmd.exe 2892 cmd.exe 4564 cmd.exe 3872 cmd.exe 1548 cmd.exe 5168 cmd.exe 2820 cmd.exe 5440 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1180 4472 WerFault.exe 88 2464 4968 WerFault.exe 93 4400 4268 WerFault.exe 99 3012 5280 WerFault.exe 104 2708 2020 WerFault.exe 109 916 5920 WerFault.exe 114 4484 5856 WerFault.exe 119 2912 2632 WerFault.exe 124 1320 2904 WerFault.exe 129 1124 2800 WerFault.exe 134 5296 2580 WerFault.exe 139 3388 4136 WerFault.exe 144 4960 3144 WerFault.exe 149 5052 4764 WerFault.exe 154 4304 4576 WerFault.exe 159 4872 692 WerFault.exe 164 2888 4288 WerFault.exe 168 1928 5488 WerFault.exe 174 4568 5840 WerFault.exe 179 4456 3052 WerFault.exe 184 708 5760 WerFault.exe 189 3808 416 WerFault.exe 194 3988 5472 WerFault.exe 199 4148 4924 WerFault.exe 204 1144 4336 WerFault.exe 209 1924 4880 WerFault.exe 214 988 4840 WerFault.exe 219 1348 5268 WerFault.exe 224 1928 2796 WerFault.exe 229 4820 2144 WerFault.exe 234 4612 4228 WerFault.exe 239 4364 4504 WerFault.exe 244 1300 3504 WerFault.exe 249 4704 3008 WerFault.exe 254 2648 1712 WerFault.exe 259 2092 4180 WerFault.exe 264 2268 5260 WerFault.exe 269 5056 4004 WerFault.exe 274 2680 704 WerFault.exe 279 3964 2372 WerFault.exe 284 6004 1140 WerFault.exe 289 1320 5884 WerFault.exe 294 3056 3524 WerFault.exe 299 2672 2472 WerFault.exe 304 4196 1948 WerFault.exe 309 1172 3860 WerFault.exe 314 2176 1688 WerFault.exe 319 3364 3940 WerFault.exe 324 5508 4792 WerFault.exe 329 2380 5592 WerFault.exe 334 4456 2888 WerFault.exe 339 4200 1252 WerFault.exe 344 5084 2300 WerFault.exe 349 1228 3176 WerFault.exe 354 3108 5140 WerFault.exe 359 1700 2648 WerFault.exe 364 4412 3416 WerFault.exe 369 4332 5416 WerFault.exe 374 5152 5908 WerFault.exe 379 3300 1396 WerFault.exe 384 5536 1528 WerFault.exe 389 5632 1664 WerFault.exe 394 1564 4660 WerFault.exe 399 5168 3988 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWKWURJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXNLDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VVCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QPOWBM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNUQJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OPXKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCEWOQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YLU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLZPXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHORFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QOJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUKWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJKK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YETXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LWNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPSL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDREWPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNLDVND.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAZQVD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLHORJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QIMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OMUQGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EGMUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBVCR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUFYBEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOXPJ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4472 2026-09-30_c10af6b7dd86560dbbce5c57ca292aa4_elex_emotet_stop.exe 4472 2026-09-30_c10af6b7dd86560dbbce5c57ca292aa4_elex_emotet_stop.exe 4968 DCTS.exe 4968 DCTS.exe 4268 WQTPD.exe 4268 WQTPD.exe 5280 EDGD.exe 5280 EDGD.exe 2020 MJKK.exe 2020 MJKK.exe 5920 QZRKDE.exe 5920 QZRKDE.exe 5856 WUC.exe 5856 WUC.exe 2632 GSQXY.exe 2632 GSQXY.exe 2904 OYVMJ.exe 2904 OYVMJ.exe 2800 NIXU.exe 2800 NIXU.exe 2580 VWK.exe 2580 VWK.exe 4136 YETXJ.exe 4136 YETXJ.exe 3144 UKD.exe 3144 UKD.exe 4764 TUOCAQI.exe 4764 TUOCAQI.exe 4576 MNVNRJQ.exe 4576 MNVNRJQ.exe 692 JNFQVN.exe 692 JNFQVN.exe 4288 RTKWGL.exe 4288 RTKWGL.exe 5488 CLZPXM.exe 5488 CLZPXM.exe 5840 BECXY.exe 5840 BECXY.exe 3052 QUDXEN.exe 3052 QUDXEN.exe 5760 YAQDPM.exe 5760 YAQDPM.exe 416 DFITFHE.exe 416 DFITFHE.exe 5472 MBGLFZV.exe 5472 MBGLFZV.exe 4924 RGYAWC.exe 4924 RGYAWC.exe 4336 CUFYBEM.exe 4336 CUFYBEM.exe 4880 LHKFLC.exe 4880 LHKFLC.exe 4840 EAZQVD.exe 4840 EAZQVD.exe 5268 XSHB.exe 5268 XSHB.exe 2796 UTQLQ.exe 2796 UTQLQ.exe 2144 EQW.exe 2144 EQW.exe 4228 VBHNGPL.exe 4228 VBHNGPL.exe 4504 GJNV.exe 4504 GJNV.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4472 2026-09-30_c10af6b7dd86560dbbce5c57ca292aa4_elex_emotet_stop.exe 4472 2026-09-30_c10af6b7dd86560dbbce5c57ca292aa4_elex_emotet_stop.exe 4968 DCTS.exe 4968 DCTS.exe 4268 WQTPD.exe 4268 WQTPD.exe 5280 EDGD.exe 5280 EDGD.exe 2020 MJKK.exe 2020 MJKK.exe 5920 QZRKDE.exe 5920 QZRKDE.exe 5856 WUC.exe 5856 WUC.exe 2632 GSQXY.exe 2632 GSQXY.exe 2904 OYVMJ.exe 2904 OYVMJ.exe 2800 NIXU.exe 2800 NIXU.exe 2580 VWK.exe 2580 VWK.exe 4136 YETXJ.exe 4136 YETXJ.exe 3144 UKD.exe 3144 UKD.exe 4764 TUOCAQI.exe 4764 TUOCAQI.exe 4576 MNVNRJQ.exe 4576 MNVNRJQ.exe 692 JNFQVN.exe 692 JNFQVN.exe 4288 RTKWGL.exe 4288 RTKWGL.exe 5488 CLZPXM.exe 5488 CLZPXM.exe 5840 BECXY.exe 5840 BECXY.exe 3052 QUDXEN.exe 3052 QUDXEN.exe 5760 YAQDPM.exe 5760 YAQDPM.exe 416 DFITFHE.exe 416 DFITFHE.exe 5472 MBGLFZV.exe 5472 MBGLFZV.exe 4924 RGYAWC.exe 4924 RGYAWC.exe 4336 CUFYBEM.exe 4336 CUFYBEM.exe 4880 LHKFLC.exe 4880 LHKFLC.exe 4840 EAZQVD.exe 4840 EAZQVD.exe 5268 XSHB.exe 5268 XSHB.exe 2796 UTQLQ.exe 2796 UTQLQ.exe 2144 EQW.exe 2144 EQW.exe 4228 VBHNGPL.exe 4228 VBHNGPL.exe 4504 GJNV.exe 4504 GJNV.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4472 wrote to memory of 3276 4472 2026-09-30_c10af6b7dd86560dbbce5c57ca292aa4_elex_emotet_stop.exe 89 PID 3276 wrote to memory of 4968 3276 cmd.exe 93 PID 4968 wrote to memory of 4728 4968 DCTS.exe 95 PID 4728 wrote to memory of 4268 4728 cmd.exe 99 PID 4268 wrote to memory of 544 4268 WQTPD.exe 100 PID 544 wrote to memory of 5280 544 cmd.exe 104 PID 5280 wrote to memory of 3656 5280 EDGD.exe 105 PID 3656 wrote to memory of 2020 3656 cmd.exe 109 PID 2020 wrote to memory of 4744 2020 MJKK.exe 110 PID 4744 wrote to memory of 5920 4744 cmd.exe 114 PID 5920 wrote to memory of 2696 5920 QZRKDE.exe 115 PID 2696 wrote to memory of 5856 2696 cmd.exe 119 PID 5856 wrote to memory of 2876 5856 WUC.exe 120 PID 2876 wrote to memory of 2632 2876 cmd.exe 124 PID 2632 wrote to memory of 3872 2632 GSQXY.exe 125 PID 3872 wrote to memory of 2904 3872 cmd.exe 129 PID 2904 wrote to memory of 2248 2904 OYVMJ.exe 130 PID 2248 wrote to memory of 2800 2248 cmd.exe 134 PID 2800 wrote to memory of 5544 2800 NIXU.exe 135 PID 5544 wrote to memory of 2580 5544 cmd.exe 139 PID 2580 wrote to memory of 1188 2580 VWK.exe 140 PID 1188 wrote to memory of 4136 1188 cmd.exe 144 PID 4136 wrote to memory of 5368 4136 YETXJ.exe 145 PID 5368 wrote to memory of 3144 5368 cmd.exe 149 PID 3144 wrote to memory of 1412 3144 UKD.exe 150 PID 1412 wrote to memory of 4764 1412 cmd.exe 154 PID 4764 wrote to memory of 1040 4764 TUOCAQI.exe 155 PID 1040 wrote to memory of 4576 1040 cmd.exe 159 PID 4576 wrote to memory of 5500 4576 MNVNRJQ.exe 160 PID 5500 wrote to memory of 692 5500 cmd.exe 164 PID 692 wrote to memory of 5220 692 JNFQVN.exe 165 PID 5220 wrote to memory of 4288 5220 cmd.exe 168 PID 4288 wrote to memory of 5968 4288 RTKWGL.exe 170 PID 5968 wrote to memory of 5488 5968 cmd.exe 174 PID 5488 wrote to memory of 1972 5488 CLZPXM.exe 175 PID 1972 wrote to memory of 5840 1972 cmd.exe 179 PID 5840 wrote to memory of 5492 5840 BECXY.exe 180 PID 5492 wrote to memory of 3052 5492 cmd.exe 184 PID 3052 wrote to memory of 3348 3052 QUDXEN.exe 185 PID 3348 wrote to memory of 5760 3348 cmd.exe 189 PID 5760 wrote to memory of 5816 5760 YAQDPM.exe 190 PID 5816 wrote to memory of 416 5816 cmd.exe 194 PID 416 wrote to memory of 5484 416 DFITFHE.exe 195 PID 5484 wrote to memory of 5472 5484 cmd.exe 199 PID 5472 wrote to memory of 3020 5472 MBGLFZV.exe 200 PID 3020 wrote to memory of 4924 3020 cmd.exe 204 PID 4924 wrote to memory of 5352 4924 RGYAWC.exe 205 PID 5352 wrote to memory of 4336 5352 cmd.exe 209 PID 4336 wrote to memory of 1152 4336 CUFYBEM.exe 210 PID 1152 wrote to memory of 4880 1152 cmd.exe 214 PID 4880 wrote to memory of 2640 4880 LHKFLC.exe 215 PID 2640 wrote to memory of 4840 2640 cmd.exe 219 PID 4840 wrote to memory of 1548 4840 EAZQVD.exe 220 PID 1548 wrote to memory of 5268 1548 cmd.exe 224 PID 5268 wrote to memory of 4564 5268 XSHB.exe 225 PID 4564 wrote to memory of 2796 4564 cmd.exe 229 PID 2796 wrote to memory of 2332 2796 UTQLQ.exe 230 PID 2332 wrote to memory of 2144 2332 cmd.exe 234 PID 2144 wrote to memory of 1200 2144 EQW.exe 235 PID 1200 wrote to memory of 4228 1200 cmd.exe 239 PID 4228 wrote to memory of 4372 4228 VBHNGPL.exe 240 PID 4372 wrote to memory of 4504 4372 cmd.exe 244 PID 4504 wrote to memory of 3692 4504 GJNV.exe 245 PID 3692 wrote to memory of 3504 3692 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_c10af6b7dd86560dbbce5c57ca292aa4_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_c10af6b7dd86560dbbce5c57ca292aa4_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DCTS.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\windows\system\DCTS.exeC:\windows\system\DCTS.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQTPD.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\windows\system\WQTPD.exeC:\windows\system\WQTPD.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EDGD.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:544 -
C:\windows\SysWOW64\EDGD.exeC:\windows\system32\EDGD.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MJKK.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\windows\MJKK.exeC:\windows\MJKK.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QZRKDE.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\windows\system\QZRKDE.exeC:\windows\system\QZRKDE.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUC.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\windows\WUC.exeC:\windows\WUC.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSQXY.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\windows\GSQXY.exeC:\windows\GSQXY.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OYVMJ.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\windows\system\OYVMJ.exeC:\windows\system\OYVMJ.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NIXU.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\windows\SysWOW64\NIXU.exeC:\windows\system32\NIXU.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWK.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\windows\SysWOW64\VWK.exeC:\windows\system32\VWK.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YETXJ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\windows\SysWOW64\YETXJ.exeC:\windows\system32\YETXJ.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UKD.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\windows\SysWOW64\UKD.exeC:\windows\system32\UKD.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TUOCAQI.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\windows\TUOCAQI.exeC:\windows\TUOCAQI.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MNVNRJQ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\windows\system\MNVNRJQ.exeC:\windows\system\MNVNRJQ.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNFQVN.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\windows\SysWOW64\JNFQVN.exeC:\windows\system32\JNFQVN.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RTKWGL.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\windows\system\RTKWGL.exeC:\windows\system\RTKWGL.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLZPXM.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\windows\system\CLZPXM.exeC:\windows\system\CLZPXM.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BECXY.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\windows\SysWOW64\BECXY.exeC:\windows\system32\BECXY.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QUDXEN.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\windows\system\QUDXEN.exeC:\windows\system\QUDXEN.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAQDPM.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\windows\SysWOW64\YAQDPM.exeC:\windows\system32\YAQDPM.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DFITFHE.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\windows\DFITFHE.exeC:\windows\DFITFHE.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MBGLFZV.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\windows\system\MBGLFZV.exeC:\windows\system\MBGLFZV.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RGYAWC.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\windows\RGYAWC.exeC:\windows\RGYAWC.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CUFYBEM.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\windows\system\CUFYBEM.exeC:\windows\system\CUFYBEM.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LHKFLC.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\windows\LHKFLC.exeC:\windows\LHKFLC.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EAZQVD.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\windows\EAZQVD.exeC:\windows\EAZQVD.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSHB.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\windows\SysWOW64\XSHB.exeC:\windows\system32\XSHB.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UTQLQ.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\windows\UTQLQ.exeC:\windows\UTQLQ.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQW.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\windows\EQW.exeC:\windows\EQW.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBHNGPL.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\windows\system\VBHNGPL.exeC:\windows\system\VBHNGPL.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GJNV.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\windows\system\GJNV.exeC:\windows\system\GJNV.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFROGD.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\windows\NFROGD.exeC:\windows\NFROGD.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVG.exe.bat" "66⤵PID:2044
-
C:\windows\QVG.exeC:\windows\QVG.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GLHORJS.exe.bat" "68⤵PID:3128
-
C:\windows\SysWOW64\GLHORJS.exeC:\windows\system32\GLHORJS.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIMI.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:3116 -
C:\windows\system\QIMI.exeC:\windows\system\QIMI.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLDH.exe.bat" "72⤵PID:204
-
C:\windows\system\DLDH.exeC:\windows\system\DLDH.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBEYTQ.exe.bat" "74⤵PID:260
-
C:\windows\SBEYTQ.exeC:\windows\SBEYTQ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GMMXIB.exe.bat" "76⤵PID:5732
-
C:\windows\system\GMMXIB.exeC:\windows\system\GMMXIB.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MHLYMW.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3928 -
C:\windows\MHLYMW.exeC:\windows\MHLYMW.exe79⤵
- Executes dropped EXE
PID:2372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSUW.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:2824 -
C:\windows\ZSUW.exeC:\windows\ZSUW.exe81⤵
- Executes dropped EXE
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANY.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:3408 -
C:\windows\SysWOW64\ANY.exeC:\windows\system32\ANY.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLLMNF.exe.bat" "84⤵PID:936
-
C:\windows\system\CLLMNF.exeC:\windows\system\CLLMNF.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBMM.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2312 -
C:\windows\system\RBMM.exeC:\windows\system\RBMM.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QZX.exe.bat" "88⤵PID:1588
-
C:\windows\SysWOW64\QZX.exeC:\windows\system32\QZX.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FPYGOB.exe.bat" "90⤵PID:2856
-
C:\windows\system\FPYGOB.exeC:\windows\system\FPYGOB.exe91⤵
- Executes dropped EXE
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHORFU.exe.bat" "92⤵PID:6052
-
C:\windows\system\QHORFU.exeC:\windows\system\QHORFU.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFTL.exe.bat" "94⤵
- Executes a command shell one-liner
PID:2812 -
C:\windows\AFTL.exeC:\windows\AFTL.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GATMRF.exe.bat" "96⤵PID:2700
-
C:\windows\GATMRF.exeC:\windows\GATMRF.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VVCQ.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:2052 -
C:\windows\SysWOW64\VVCQ.exeC:\windows\system32\VVCQ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTQLKBL.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:2792 -
C:\windows\XTQLKBL.exeC:\windows\XTQLKBL.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YOTOXY.exe.bat" "102⤵PID:4368
-
C:\windows\SysWOW64\YOTOXY.exeC:\windows\system32\YOTOXY.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHWWG.exe.bat" "104⤵PID:6012
-
C:\windows\XHWWG.exeC:\windows\XHWWG.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FNJL.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1376 -
C:\windows\SysWOW64\FNJL.exeC:\windows\system32\FNJL.exe107⤵
- Executes dropped EXE
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDWVY.exe.bat" "108⤵PID:2400
-
C:\windows\system\UDWVY.exeC:\windows\system\UDWVY.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TNZ.exe.bat" "110⤵PID:4148
-
C:\windows\TNZ.exeC:\windows\TNZ.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QOJ.exe.bat" "112⤵
- Executes a command shell one-liner
PID:2208 -
C:\windows\SysWOW64\QOJ.exeC:\windows\system32\QOJ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OMUQGZ.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:752 -
C:\windows\SysWOW64\OMUQGZ.exeC:\windows\system32\OMUQGZ.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SPSL.exe.bat" "116⤵PID:5764
-
C:\windows\SysWOW64\SPSL.exeC:\windows\system32\SPSL.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORJC.exe.bat" "118⤵
- Executes a command shell one-liner
PID:1348 -
C:\windows\system\ORJC.exeC:\windows\system\ORJC.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPOWBM.exe.bat" "120⤵PID:2380
-
C:\windows\QPOWBM.exeC:\windows\QPOWBM.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-