Analysis
- max time kernel
75s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 08:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_b4cb6d36350cf33d9d200f1db2216055_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-30_b4cb6d36350cf33d9d200f1db2216055_elex_emotet_stop.exe
- Size 208KB
- Sample260930-kacqhsys2p
- SHA256 839e803d78e309d5dcea852458fb8ba13fc11225e965a24c7b1cc667a22a1608
- MD5 b4cb6d36350cf33d9d200f1db2216055
- SHA1 53345b24a0c901f35068e00219f5dc4c6376ea67
- SHA512 eb8820877bae1e1ae3920160ca3e2b04ba8650b9a4124379994af721304d4b6ad274bfb9dee8d4c3f33ff13669fef93c115f629e3b39b593f4685a5cc0c31ae6
- SSDEEP 3072:jLQaL9tbLkRIgd1Lye9yjE2hWAN5Xbsl9dL+LOft4pLthEjQT6j:vlZtbLWIgd1LZ9oECZbsl95+LOVkEj1
- TLSH T163247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5652 QDKDEI.exe 2732 YQBK.exe 4596 ORR.exe 3396 NJUMOZF.exe 6076 CEEQZ.exe 920 GMK.exe 1880 PVMD.exe 424 BNPWX.exe 1328 VBUFHQI.exe 5040 HJBF.exe 124 RRD.exe 2712 GMMXIB.exe 3868 GSMLJG.exe 2704 ANR.exe 2860 PIBZEA.exe 6124 SVF.exe 5516 SBY.exe 4300 BOIP.exe 4948 REJ.exe 3376 IMLT.exe 5604 GFTHZX.exe 3484 RXWAHEU.exe 4204 GAFEA.exe 6068 JOKODZJ.exe 3688 JTK.exe 2700 PTSQV.exe 1380 DZPNC.exe 1368 VZRSGN.exe 3288 PVW.exe 1060 KIBTA.exe 4432 VBEEAU.exe 5960 MOPW.exe 1152 OEIYXOG.exe 5228 OWQZ.exe 5828 LCWO.exe 3408 BNNM.exe 1156 FVTMDOG.exe 2968 QNW.exe 3996 IAHXTS.exe 5424 GWGYYV.exe 3292 SEMGKO.exe 1120 GZKZ.exe 4512 ZNWPNJT.exe 4796 VSIT.exe 3816 RTSDC.exe 3788 FWB.exe 3904 JWKWURJ.exe 6016 AHNMDF.exe 4364 TZDXMY.exe 1600 SSFNV.exe 2560 TNJRICL.exe 600 LQNNOS.exe 5300 IWFCE.exe 264 QBKJ.exe 4876 AZXD.exe 4304 GUXEB.exe 5896 LFTKGO.exe 792 EDEISV.exe 4188 ODG.exe 1256 STNVI.exe 1568 HJO.exe 3016 LRUUBY.exe 1376 AHVU.exe 2832 ZFP.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\VSIT.exe ZNWPNJT.exe File created C:\windows\SysWOW64\STNVI.exe ODG.exe File created C:\windows\SysWOW64\HJO.exe STNVI.exe File created C:\windows\SysWOW64\JLLU.exe NGS.exe File created C:\windows\SysWOW64\HUDX.exe.bat ZKCV.exe File created C:\windows\SysWOW64\VBUFHQI.exe BNPWX.exe File created C:\windows\SysWOW64\AZXD.exe.bat QBKJ.exe File created C:\windows\SysWOW64\ZKCV.exe BZRFO.exe File opened for modification C:\windows\SysWOW64\BWDC.exe OMZ.exe File created C:\windows\SysWOW64\QNW.exe FVTMDOG.exe File opened for modification C:\windows\SysWOW64\PIBZEA.exe ANR.exe File opened for modification C:\windows\SysWOW64\GAFEA.exe RXWAHEU.exe File created C:\windows\SysWOW64\MOPW.exe VBEEAU.exe File opened for modification C:\windows\SysWOW64\STNVI.exe ODG.exe File created C:\windows\SysWOW64\BWDC.exe OMZ.exe File created C:\windows\SysWOW64\GAFEA.exe RXWAHEU.exe File created C:\windows\SysWOW64\PVW.exe.bat VZRSGN.exe File created C:\windows\SysWOW64\HJO.exe.bat STNVI.exe File created C:\windows\SysWOW64\JLLU.exe.bat NGS.exe File created C:\windows\SysWOW64\PIBZEA.exe.bat ANR.exe File created C:\windows\SysWOW64\VZRSGN.exe DZPNC.exe File created C:\windows\SysWOW64\VZRSGN.exe.bat DZPNC.exe File opened for modification C:\windows\SysWOW64\QNW.exe FVTMDOG.exe File opened for modification C:\windows\SysWOW64\ODG.exe EDEISV.exe File created C:\windows\SysWOW64\STNVI.exe.bat ODG.exe File created C:\windows\SysWOW64\MDPBXL.exe ZFP.exe File created C:\windows\SysWOW64\HUDX.exe ZKCV.exe File created C:\windows\SysWOW64\QDKDEI.exe 2026-09-30_b4cb6d36350cf33d9d200f1db2216055_elex_emotet_stop.exe File created C:\windows\SysWOW64\VBUFHQI.exe.bat BNPWX.exe File opened for modification C:\windows\SysWOW64\MOPW.exe VBEEAU.exe File created C:\windows\SysWOW64\MOPW.exe.bat VBEEAU.exe File created C:\windows\SysWOW64\ODG.exe EDEISV.exe File opened for modification C:\windows\SysWOW64\ZKCV.exe BZRFO.exe File created C:\windows\SysWOW64\JQFHY.exe PTMFSBI.exe File created C:\windows\SysWOW64\JSAPMET.exe NVVSF.exe File opened for modification C:\windows\SysWOW64\PVMD.exe GMK.exe File opened for modification C:\windows\SysWOW64\BNPWX.exe PVMD.exe File opened for modification C:\windows\SysWOW64\JTK.exe JOKODZJ.exe File created C:\windows\SysWOW64\QNW.exe.bat FVTMDOG.exe File opened for modification C:\windows\SysWOW64\HJO.exe STNVI.exe File created C:\windows\SysWOW64\PIBZEA.exe ANR.exe File opened for modification C:\windows\SysWOW64\IMLT.exe REJ.exe File opened for modification C:\windows\SysWOW64\XAJMCCW.exe YKLBQQH.exe File created C:\windows\SysWOW64\JUSJOJQ.exe HWRPQV.exe File opened for modification C:\windows\SysWOW64\JUSJOJQ.exe HWRPQV.exe File created C:\windows\SysWOW64\IWFCE.exe LQNNOS.exe File opened for modification C:\windows\SysWOW64\AZXD.exe QBKJ.exe File created C:\windows\SysWOW64\ZKCV.exe.bat BZRFO.exe File opened for modification C:\windows\SysWOW64\JSAPMET.exe NVVSF.exe File opened for modification C:\windows\SysWOW64\QDKDEI.exe 2026-09-30_b4cb6d36350cf33d9d200f1db2216055_elex_emotet_stop.exe File created C:\windows\SysWOW64\BNPWX.exe PVMD.exe File created C:\windows\SysWOW64\JTK.exe JOKODZJ.exe File opened for modification C:\windows\SysWOW64\PVW.exe VZRSGN.exe File opened for modification C:\windows\SysWOW64\VSIT.exe ZNWPNJT.exe File created C:\windows\SysWOW64\AZXD.exe QBKJ.exe File opened for modification C:\windows\SysWOW64\MDPBXL.exe ZFP.exe File created C:\windows\SysWOW64\MDPBXL.exe.bat ZFP.exe File opened for modification C:\windows\SysWOW64\VBUFHQI.exe BNPWX.exe File created C:\windows\SysWOW64\IMLT.exe.bat REJ.exe File opened for modification C:\windows\SysWOW64\VZRSGN.exe DZPNC.exe File created C:\windows\SysWOW64\PVW.exe VZRSGN.exe File opened for modification C:\windows\SysWOW64\SEMGKO.exe GWGYYV.exe File created C:\windows\SysWOW64\SEMGKO.exe.bat GWGYYV.exe File opened for modification C:\windows\SysWOW64\HUDX.exe ZKCV.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\BZRFO.exe.bat OOJHAPS.exe File created C:\windows\system\NVVSF.exe.bat WXOPTB.exe File created C:\windows\system\NJUMOZF.exe.bat ORR.exe File opened for modification C:\windows\system\VBEEAU.exe KIBTA.exe File created C:\windows\system\JSER.exe.bat HUDX.exe File created C:\windows\system\WTJFEP.exe JQFHY.exe File opened for modification C:\windows\system\CKNKHT.exe XAJMCCW.exe File opened for modification C:\windows\WQHSR.exe PNJRMKU.exe File created C:\windows\system\OMZ.exe WQHSR.exe File created C:\windows\system\UDLJ.exe.bat OSHCM.exe File created C:\windows\REJ.exe BOIP.exe File opened for modification C:\windows\JOKODZJ.exe GAFEA.exe File created C:\windows\system\OEIYXOG.exe MOPW.exe File created C:\windows\system\OWQZ.exe.bat OEIYXOG.exe File created C:\windows\RTSDC.exe.bat VSIT.exe File opened for modification C:\windows\AHNMDF.exe JWKWURJ.exe File opened for modification C:\windows\JOJLQX.exe DLNEL.exe File opened for modification C:\windows\HWRPQV.exe QGSEEBS.exe File opened for modification C:\windows\RRD.exe HJBF.exe File created C:\windows\system\GSMLJG.exe GMMXIB.exe File opened for modification C:\windows\system\OEIYXOG.exe MOPW.exe File created C:\windows\system\SSFNV.exe TZDXMY.exe File opened for modification C:\windows\system\GMK.exe CEEQZ.exe File created C:\windows\system\GMMXIB.exe.bat RRD.exe File opened for modification C:\windows\RTSDC.exe VSIT.exe File created C:\windows\system\DLNEL.exe.bat HFHHEW.exe File created C:\windows\JOJLQX.exe.bat DLNEL.exe File created C:\windows\system\WXOPTB.exe.bat JUSJOJQ.exe File created C:\windows\system\FIVXPD.exe JSAPMET.exe File opened for modification C:\windows\system\FIVXPD.exe JSAPMET.exe File created C:\windows\system\SVF.exe.bat PIBZEA.exe File created C:\windows\GWGYYV.exe IAHXTS.exe File opened for modification C:\windows\EDEISV.exe LFTKGO.exe File created C:\windows\system\OOJHAPS.exe.bat JLLU.exe File created C:\windows\REJ.exe.bat BOIP.exe File opened for modification C:\windows\GFTHZX.exe IMLT.exe File created C:\windows\JOKODZJ.exe GAFEA.exe File created C:\windows\KIBTA.exe PVW.exe File opened for modification C:\windows\system\QBKJ.exe IWFCE.exe File created C:\windows\ZFP.exe.bat AHVU.exe File created C:\windows\system\HFHHEW.exe UDLJ.exe File opened for modification C:\windows\system\DZPNC.exe PTSQV.exe File created C:\windows\system\OEIYXOG.exe.bat MOPW.exe File created C:\windows\system\SSFNV.exe.bat TZDXMY.exe File opened for modification C:\windows\system\NGS.exe MDPBXL.exe File opened for modification C:\windows\system\TZHCLZ.exe WTJFEP.exe File created C:\windows\system\OMZ.exe.bat WQHSR.exe File created C:\windows\JOJLQX.exe DLNEL.exe File created C:\windows\system\SLRWCUR.exe.bat FIVXPD.exe File created C:\windows\system\GMMXIB.exe RRD.exe File opened for modification C:\windows\RXWAHEU.exe GFTHZX.exe File created C:\windows\system\JWKWURJ.exe FWB.exe File opened for modification C:\windows\ZFP.exe AHVU.exe File created C:\windows\system\OSHCM.exe MUOIN.exe File created C:\windows\system\OSHCM.exe.bat MUOIN.exe File created C:\windows\system\FWVCHM.exe SLRWCUR.exe File created C:\windows\YQBK.exe QDKDEI.exe File opened for modification C:\windows\TZDXMY.exe AHNMDF.exe File created C:\windows\AHVU.exe LRUUBY.exe File created C:\windows\GFTHZX.exe IMLT.exe File created C:\windows\BNNM.exe.bat LCWO.exe File created C:\windows\FWB.exe.bat RTSDC.exe File created C:\windows\GUXEB.exe AZXD.exe File created C:\windows\LFTKGO.exe GUXEB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1636 cmd.exe 1244 cmd.exe 4540 cmd.exe 2476 cmd.exe 5640 cmd.exe 5844 cmd.exe 2112 cmd.exe 5400 cmd.exe 5784 cmd.exe 1404 cmd.exe 1632 cmd.exe 2672 cmd.exe 2916 cmd.exe 3812 cmd.exe 2644 cmd.exe 5100 cmd.exe 2592 cmd.exe 4672 cmd.exe 4952 cmd.exe 3272 cmd.exe 3824 cmd.exe 4296 cmd.exe 3616 cmd.exe 1056 cmd.exe 1944 cmd.exe 4212 cmd.exe 1196 cmd.exe 936 cmd.exe 2328 cmd.exe 2992 cmd.exe 3512 cmd.exe 3744 cmd.exe 1876 cmd.exe 1468 cmd.exe 5692 cmd.exe 5904 cmd.exe 4988 cmd.exe 2980 cmd.exe 252 cmd.exe 1084 cmd.exe 1408 cmd.exe 2952 cmd.exe 2548 cmd.exe 4632 cmd.exe 5444 cmd.exe 3348 cmd.exe 3116 cmd.exe 2888 cmd.exe 3048 cmd.exe 5736 cmd.exe 5392 cmd.exe 2108 cmd.exe 2576 cmd.exe 3524 cmd.exe 1184 cmd.exe 1280 cmd.exe 2496 cmd.exe 2492 cmd.exe 3240 cmd.exe 4636 cmd.exe 5620 cmd.exe 1928 cmd.exe 6116 cmd.exe 3388 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2348 3344 WerFault.exe 89 4344 5652 WerFault.exe 94 2592 2732 WerFault.exe 100 616 4596 WerFault.exe 105 6012 3396 WerFault.exe 110 2540 6076 WerFault.exe 115 3824 920 WerFault.exe 120 3560 1880 WerFault.exe 125 1932 424 WerFault.exe 130 2840 1328 WerFault.exe 135 5692 5040 WerFault.exe 140 4344 124 WerFault.exe 145 1592 2712 WerFault.exe 150 2780 3868 WerFault.exe 155 1084 2704 WerFault.exe 160 3548 2860 WerFault.exe 165 1944 6124 WerFault.exe 170 2412 5516 WerFault.exe 175 1196 4300 WerFault.exe 180 5044 4948 WerFault.exe 185 3844 3376 WerFault.exe 190 1600 5604 WerFault.exe 195 2100 3484 WerFault.exe 200 4452 4204 WerFault.exe 205 856 6068 WerFault.exe 210 1952 3688 WerFault.exe 215 1944 2700 WerFault.exe 220 5760 1380 WerFault.exe 225 1196 1368 WerFault.exe 230 1184 3288 WerFault.exe 235 5844 1060 WerFault.exe 240 5076 4432 WerFault.exe 245 5452 5960 WerFault.exe 250 4452 1152 WerFault.exe 255 856 5228 WerFault.exe 260 1412 5828 WerFault.exe 265 1408 3408 WerFault.exe 270 3904 1156 WerFault.exe 275 5088 2968 WerFault.exe 280 5332 3996 WerFault.exe 286 1608 5424 WerFault.exe 291 3976 3292 WerFault.exe 296 3980 1120 WerFault.exe 301 620 4512 WerFault.exe 306 3164 4796 WerFault.exe 311 2620 3816 WerFault.exe 316 3100 3788 WerFault.exe 321 5388 3904 WerFault.exe 326 2944 6016 WerFault.exe 331 4344 4364 WerFault.exe 336 5420 1600 WerFault.exe 341 4848 2560 WerFault.exe 346 4440 600 WerFault.exe 351 3236 5300 WerFault.exe 356 3552 264 WerFault.exe 361 4212 4876 WerFault.exe 366 2572 4304 WerFault.exe 371 4860 5896 WerFault.exe 375 5824 792 WerFault.exe 381 1124 4188 WerFault.exe 386 4484 1256 WerFault.exe 391 4440 1568 WerFault.exe 396 1336 3016 WerFault.exe 401 4936 1376 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMMXIB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFTKGO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STNVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OOJHAPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IWFCE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBKJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDEISV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TZHCLZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTSQV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSER.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGSEEBS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JQFHY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEIYXOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSHCM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDLJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWKWURJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKNKHT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEEQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTMFSBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXOPTB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3344 2026-09-30_b4cb6d36350cf33d9d200f1db2216055_elex_emotet_stop.exe 3344 2026-09-30_b4cb6d36350cf33d9d200f1db2216055_elex_emotet_stop.exe 5652 QDKDEI.exe 5652 QDKDEI.exe 2732 YQBK.exe 2732 YQBK.exe 4596 ORR.exe 4596 ORR.exe 3396 NJUMOZF.exe 3396 NJUMOZF.exe 6076 CEEQZ.exe 6076 CEEQZ.exe 920 GMK.exe 920 GMK.exe 1880 PVMD.exe 1880 PVMD.exe 424 BNPWX.exe 424 BNPWX.exe 1328 VBUFHQI.exe 1328 VBUFHQI.exe 5040 HJBF.exe 5040 HJBF.exe 124 RRD.exe 124 RRD.exe 2712 GMMXIB.exe 2712 GMMXIB.exe 3868 GSMLJG.exe 3868 GSMLJG.exe 2704 ANR.exe 2704 ANR.exe 2860 PIBZEA.exe 2860 PIBZEA.exe 6124 SVF.exe 6124 SVF.exe 5516 SBY.exe 5516 SBY.exe 4300 BOIP.exe 4300 BOIP.exe 4948 REJ.exe 4948 REJ.exe 3376 IMLT.exe 3376 IMLT.exe 5604 GFTHZX.exe 5604 GFTHZX.exe 3484 RXWAHEU.exe 3484 RXWAHEU.exe 4204 GAFEA.exe 4204 GAFEA.exe 6068 JOKODZJ.exe 6068 JOKODZJ.exe 3688 JTK.exe 3688 JTK.exe 2700 PTSQV.exe 2700 PTSQV.exe 1380 DZPNC.exe 1380 DZPNC.exe 1368 VZRSGN.exe 1368 VZRSGN.exe 3288 PVW.exe 3288 PVW.exe 1060 KIBTA.exe 1060 KIBTA.exe 4432 VBEEAU.exe 4432 VBEEAU.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3344 2026-09-30_b4cb6d36350cf33d9d200f1db2216055_elex_emotet_stop.exe 3344 2026-09-30_b4cb6d36350cf33d9d200f1db2216055_elex_emotet_stop.exe 5652 QDKDEI.exe 5652 QDKDEI.exe 2732 YQBK.exe 2732 YQBK.exe 4596 ORR.exe 4596 ORR.exe 3396 NJUMOZF.exe 3396 NJUMOZF.exe 6076 CEEQZ.exe 6076 CEEQZ.exe 920 GMK.exe 920 GMK.exe 1880 PVMD.exe 1880 PVMD.exe 424 BNPWX.exe 424 BNPWX.exe 1328 VBUFHQI.exe 1328 VBUFHQI.exe 5040 HJBF.exe 5040 HJBF.exe 124 RRD.exe 124 RRD.exe 2712 GMMXIB.exe 2712 GMMXIB.exe 3868 GSMLJG.exe 3868 GSMLJG.exe 2704 ANR.exe 2704 ANR.exe 2860 PIBZEA.exe 2860 PIBZEA.exe 6124 SVF.exe 6124 SVF.exe 5516 SBY.exe 5516 SBY.exe 4300 BOIP.exe 4300 BOIP.exe 4948 REJ.exe 4948 REJ.exe 3376 IMLT.exe 3376 IMLT.exe 5604 GFTHZX.exe 5604 GFTHZX.exe 3484 RXWAHEU.exe 3484 RXWAHEU.exe 4204 GAFEA.exe 4204 GAFEA.exe 6068 JOKODZJ.exe 6068 JOKODZJ.exe 3688 JTK.exe 3688 JTK.exe 2700 PTSQV.exe 2700 PTSQV.exe 1380 DZPNC.exe 1380 DZPNC.exe 1368 VZRSGN.exe 1368 VZRSGN.exe 3288 PVW.exe 3288 PVW.exe 1060 KIBTA.exe 1060 KIBTA.exe 4432 VBEEAU.exe 4432 VBEEAU.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3344 wrote to memory of 4508 3344 2026-09-30_b4cb6d36350cf33d9d200f1db2216055_elex_emotet_stop.exe 90 PID 4508 wrote to memory of 5652 4508 cmd.exe 94 PID 5652 wrote to memory of 4672 5652 QDKDEI.exe 96 PID 4672 wrote to memory of 2732 4672 cmd.exe 100 PID 2732 wrote to memory of 1928 2732 YQBK.exe 101 PID 1928 wrote to memory of 4596 1928 cmd.exe 105 PID 4596 wrote to memory of 3900 4596 ORR.exe 106 PID 3900 wrote to memory of 3396 3900 cmd.exe 110 PID 3396 wrote to memory of 6116 3396 NJUMOZF.exe 111 PID 6116 wrote to memory of 6076 6116 cmd.exe 115 PID 6076 wrote to memory of 1524 6076 CEEQZ.exe 116 PID 1524 wrote to memory of 920 1524 cmd.exe 120 PID 920 wrote to memory of 4420 920 GMK.exe 121 PID 4420 wrote to memory of 1880 4420 cmd.exe 125 PID 1880 wrote to memory of 3348 1880 PVMD.exe 126 PID 3348 wrote to memory of 424 3348 cmd.exe 130 PID 424 wrote to memory of 3116 424 BNPWX.exe 131 PID 3116 wrote to memory of 1328 3116 cmd.exe 135 PID 1328 wrote to memory of 3388 1328 VBUFHQI.exe 136 PID 3388 wrote to memory of 5040 3388 cmd.exe 140 PID 5040 wrote to memory of 2468 5040 HJBF.exe 141 PID 2468 wrote to memory of 124 2468 cmd.exe 145 PID 124 wrote to memory of 3536 124 RRD.exe 146 PID 3536 wrote to memory of 2712 3536 cmd.exe 150 PID 2712 wrote to memory of 2028 2712 GMMXIB.exe 151 PID 2028 wrote to memory of 3868 2028 cmd.exe 155 PID 3868 wrote to memory of 1748 3868 GSMLJG.exe 156 PID 1748 wrote to memory of 2704 1748 cmd.exe 160 PID 2704 wrote to memory of 3512 2704 ANR.exe 161 PID 3512 wrote to memory of 2860 3512 cmd.exe 165 PID 2860 wrote to memory of 936 2860 PIBZEA.exe 166 PID 936 wrote to memory of 6124 936 cmd.exe 170 PID 6124 wrote to memory of 5084 6124 SVF.exe 171 PID 5084 wrote to memory of 5516 5084 cmd.exe 175 PID 5516 wrote to memory of 3176 5516 SBY.exe 176 PID 3176 wrote to memory of 4300 3176 cmd.exe 180 PID 4300 wrote to memory of 3584 4300 BOIP.exe 181 PID 3584 wrote to memory of 4948 3584 cmd.exe 185 PID 4948 wrote to memory of 5380 4948 REJ.exe 186 PID 5380 wrote to memory of 3376 5380 cmd.exe 190 PID 3376 wrote to memory of 4608 3376 IMLT.exe 191 PID 4608 wrote to memory of 5604 4608 cmd.exe 195 PID 5604 wrote to memory of 5612 5604 GFTHZX.exe 196 PID 5612 wrote to memory of 3484 5612 cmd.exe 200 PID 3484 wrote to memory of 3524 3484 RXWAHEU.exe 201 PID 3524 wrote to memory of 4204 3524 cmd.exe 205 PID 4204 wrote to memory of 616 4204 GAFEA.exe 206 PID 616 wrote to memory of 6068 616 cmd.exe 210 PID 6068 wrote to memory of 4412 6068 JOKODZJ.exe 211 PID 4412 wrote to memory of 3688 4412 cmd.exe 215 PID 3688 wrote to memory of 2696 3688 JTK.exe 216 PID 2696 wrote to memory of 2700 2696 cmd.exe 220 PID 2700 wrote to memory of 4804 2700 PTSQV.exe 221 PID 4804 wrote to memory of 1380 4804 cmd.exe 225 PID 1380 wrote to memory of 4540 1380 DZPNC.exe 226 PID 4540 wrote to memory of 1368 4540 cmd.exe 230 PID 1368 wrote to memory of 2880 1368 VZRSGN.exe 231 PID 2880 wrote to memory of 3288 2880 cmd.exe 235 PID 3288 wrote to memory of 3120 3288 PVW.exe 236 PID 3120 wrote to memory of 1060 3120 cmd.exe 240 PID 1060 wrote to memory of 4404 1060 KIBTA.exe 241 PID 4404 wrote to memory of 4432 4404 cmd.exe 245 PID 4432 wrote to memory of 2328 4432 VBEEAU.exe 246 PID 2328 wrote to memory of 5960 2328 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_b4cb6d36350cf33d9d200f1db2216055_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_b4cb6d36350cf33d9d200f1db2216055_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QDKDEI.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\windows\SysWOW64\QDKDEI.exeC:\windows\system32\QDKDEI.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQBK.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\windows\YQBK.exeC:\windows\YQBK.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORR.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\windows\system\ORR.exeC:\windows\system\ORR.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NJUMOZF.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\windows\system\NJUMOZF.exeC:\windows\system\NJUMOZF.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CEEQZ.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\windows\system\CEEQZ.exeC:\windows\system\CEEQZ.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GMK.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\windows\system\GMK.exeC:\windows\system\GMK.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVMD.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\windows\SysWOW64\PVMD.exeC:\windows\system32\PVMD.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNPWX.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\windows\SysWOW64\BNPWX.exeC:\windows\system32\BNPWX.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VBUFHQI.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\windows\SysWOW64\VBUFHQI.exeC:\windows\system32\VBUFHQI.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HJBF.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\windows\system\HJBF.exeC:\windows\system\HJBF.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RRD.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\windows\RRD.exeC:\windows\RRD.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GMMXIB.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\windows\system\GMMXIB.exeC:\windows\system\GMMXIB.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GSMLJG.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\windows\system\GSMLJG.exeC:\windows\system\GSMLJG.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ANR.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\windows\system\ANR.exeC:\windows\system\ANR.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PIBZEA.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\windows\SysWOW64\PIBZEA.exeC:\windows\system32\PIBZEA.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SVF.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:936 -
C:\windows\system\SVF.exeC:\windows\system\SVF.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBY.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\windows\SBY.exeC:\windows\SBY.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BOIP.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\windows\system\BOIP.exeC:\windows\system\BOIP.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REJ.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\windows\REJ.exeC:\windows\REJ.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IMLT.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\windows\SysWOW64\IMLT.exeC:\windows\system32\IMLT.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GFTHZX.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\windows\GFTHZX.exeC:\windows\GFTHZX.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RXWAHEU.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\windows\RXWAHEU.exeC:\windows\RXWAHEU.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GAFEA.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\windows\SysWOW64\GAFEA.exeC:\windows\system32\GAFEA.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JOKODZJ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\windows\JOKODZJ.exeC:\windows\JOKODZJ.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JTK.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\SysWOW64\JTK.exeC:\windows\system32\JTK.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PTSQV.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\windows\system\PTSQV.exeC:\windows\system\PTSQV.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DZPNC.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\windows\system\DZPNC.exeC:\windows\system\DZPNC.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZRSGN.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\windows\SysWOW64\VZRSGN.exeC:\windows\system32\VZRSGN.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVW.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\windows\SysWOW64\PVW.exeC:\windows\system32\PVW.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIBTA.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\windows\KIBTA.exeC:\windows\KIBTA.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBEEAU.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\windows\system\VBEEAU.exeC:\windows\system\VBEEAU.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MOPW.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\windows\SysWOW64\MOPW.exeC:\windows\system32\MOPW.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OEIYXOG.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:2608 -
C:\windows\system\OEIYXOG.exeC:\windows\system\OEIYXOG.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OWQZ.exe.bat" "68⤵PID:696
-
C:\windows\system\OWQZ.exeC:\windows\system\OWQZ.exe69⤵
- Executes dropped EXE
PID:5228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCWO.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1404 -
C:\windows\LCWO.exeC:\windows\LCWO.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNNM.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2476 -
C:\windows\BNNM.exeC:\windows\BNNM.exe73⤵
- Executes dropped EXE
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FVTMDOG.exe.bat" "74⤵PID:2892
-
C:\windows\system\FVTMDOG.exeC:\windows\system\FVTMDOG.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QNW.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:5976 -
C:\windows\SysWOW64\QNW.exeC:\windows\system32\QNW.exe77⤵
- Executes dropped EXE
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IAHXTS.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:612 -
C:\windows\system\IAHXTS.exeC:\windows\system\IAHXTS.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWGYYV.exe.bat" "80⤵
- Executes a command shell one-liner
PID:1184 -
C:\windows\GWGYYV.exeC:\windows\GWGYYV.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEMGKO.exe.bat" "82⤵PID:5496
-
C:\windows\SysWOW64\SEMGKO.exeC:\windows\system32\SEMGKO.exe83⤵
- Executes dropped EXE
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GZKZ.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2888 -
C:\windows\system\GZKZ.exeC:\windows\system\GZKZ.exe85⤵
- Executes dropped EXE
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZNWPNJT.exe.bat" "86⤵
- Executes a command shell one-liner
PID:3744 -
C:\windows\system\ZNWPNJT.exeC:\windows\system\ZNWPNJT.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VSIT.exe.bat" "88⤵PID:2356
-
C:\windows\SysWOW64\VSIT.exeC:\windows\system32\VSIT.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTSDC.exe.bat" "90⤵
- Executes a command shell one-liner
PID:1876 -
C:\windows\RTSDC.exeC:\windows\RTSDC.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWB.exe.bat" "92⤵
- Executes a command shell one-liner
PID:5640 -
C:\windows\FWB.exeC:\windows\FWB.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWKWURJ.exe.bat" "94⤵PID:5760
-
C:\windows\system\JWKWURJ.exeC:\windows\system\JWKWURJ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AHNMDF.exe.bat" "96⤵PID:5212
-
C:\windows\AHNMDF.exeC:\windows\AHNMDF.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TZDXMY.exe.bat" "98⤵PID:4808
-
C:\windows\TZDXMY.exeC:\windows\TZDXMY.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SSFNV.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5844 -
C:\windows\system\SSFNV.exeC:\windows\system\SSFNV.exe101⤵
- Executes dropped EXE
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TNJRICL.exe.bat" "102⤵
- Executes a command shell one-liner
PID:2980 -
C:\windows\system\TNJRICL.exeC:\windows\system\TNJRICL.exe103⤵
- Executes dropped EXE
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LQNNOS.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:1388 -
C:\windows\system\LQNNOS.exeC:\windows\system\LQNNOS.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IWFCE.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2024 -
C:\windows\SysWOW64\IWFCE.exeC:\windows\system32\IWFCE.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QBKJ.exe.bat" "108⤵PID:1912
-
C:\windows\system\QBKJ.exeC:\windows\system\QBKJ.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZXD.exe.bat" "110⤵
- Executes a command shell one-liner
PID:1468 -
C:\windows\SysWOW64\AZXD.exeC:\windows\system32\AZXD.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GUXEB.exe.bat" "112⤵PID:4688
-
C:\windows\GUXEB.exeC:\windows\GUXEB.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFTKGO.exe.bat" "114⤵
- Executes a command shell one-liner
PID:1632 -
C:\windows\LFTKGO.exeC:\windows\LFTKGO.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDEISV.exe.bat" "116⤵PID:5940
-
C:\windows\EDEISV.exeC:\windows\EDEISV.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ODG.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4624 -
C:\windows\SysWOW64\ODG.exeC:\windows\system32\ODG.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STNVI.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:6056 -
C:\windows\SysWOW64\STNVI.exeC:\windows\system32\STNVI.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1256
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-