Analysis
- max time kernel
95s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 11:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_46f52df4bb5fdfb58d8372e439e87396_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-30_46f52df4bb5fdfb58d8372e439e87396_elex_emotet_stop.exe
- Size 208KB
- Sample260930-nywp3svfjd
- SHA256 4a0efb625645027d56c70cbf4756214a0dc271aead45896626ca564b3d52cb52
- MD5 46f52df4bb5fdfb58d8372e439e87396
- SHA1 73cbda1b9f88599677bda513204cf8557f031571
- SHA512 c7c66fe00d0c80faa7e85c857c720201f10e380bc361654f84db1ba2cfeab2a86c3327007b387a1cb5145879e0643de288adce5265aff1109881abc57c0de44d
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFliKL+LOfp4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFliS+LOhkEj1
- TLSH T137247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4368 MVTXY.exe 4668 KDABQKY.exe 1372 JODRYY.exe 1104 ZERIOF.exe 5876 HRDPZ.exe 2164 UPDB.exe 2284 VSH.exe 2376 RYZUWA.exe 1384 STDQC.exe 3912 URJ.exe 3684 EOWEZHE.exe 4588 TEXWFC.exe 1872 MHB.exe 4500 LSEPTGY.exe 4140 PILP.exe 5276 KLBOUBH.exe 1832 IGAPQ.exe 5452 KUJQK.exe 5000 HUTBO.exe 4836 BNJMF.exe 4756 OSJ.exe 4316 AACQ.exe 2244 PQD.exe 696 TGJPN.exe 4768 DHLURV.exe 1516 YSCT.exe 3940 XCF.exe 1924 PFIETCA.exe 4736 CQRDH.exe 4492 FDWMREK.exe 3208 DZVVW.exe 1904 SUE.exe 4860 YPDA.exe 2472 CXKIYQ.exe 2268 MVYVG.exe 3128 WDAIJVO.exe 4084 GBFUQE.exe 1520 TEOT.exe 2832 IUP.exe 5828 XPGXW.exe 4656 HXICIUS.exe 5648 NXIP.exe 5040 XVVKYFC.exe 1120 NGYAHL.exe 4460 XEMUW.exe 2580 UEOW.exe 6056 PSSGKX.exe 5688 GAHDXO.exe 5848 JNM.exe 4348 BQQQNEQ.exe 5980 RGR.exe 4956 ZMD.exe 3700 TZAGG.exe 3740 XPPGTQL.exe 1304 DPWT.exe 3228 NNCO.exe 1780 IAHXTS.exe 2660 AEKBHIT.exe 5476 VRPK.exe 3232 DWUR.exe 4100 XKZAEG.exe 1972 HHMVL.exe 4232 NDMVQS.exe 6040 PBRQX.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\PILP.exe LSEPTGY.exe File opened for modification C:\windows\SysWOW64\SUE.exe DZVVW.exe File created C:\windows\SysWOW64\BBGRX.exe.bat KOWZIAO.exe File created C:\windows\SysWOW64\OELHZHZ.exe DMQOQA.exe File created C:\windows\SysWOW64\PQD.exe.bat AACQ.exe File opened for modification C:\windows\SysWOW64\VHRIOBH.exe PHKUX.exe File created C:\windows\SysWOW64\HXICIUS.exe XPGXW.exe File created C:\windows\SysWOW64\PFIETCA.exe XCF.exe File created C:\windows\SysWOW64\HUTBO.exe KUJQK.exe File created C:\windows\SysWOW64\NNCO.exe.bat DPWT.exe File opened for modification C:\windows\SysWOW64\OELHZHZ.exe DMQOQA.exe File created C:\windows\SysWOW64\BBGRX.exe KOWZIAO.exe File created C:\windows\SysWOW64\BYDNCPW.exe TSR.exe File opened for modification C:\windows\SysWOW64\JKGRUAS.exe XKZGCHK.exe File opened for modification C:\windows\SysWOW64\DHX.exe YHPFPP.exe File created C:\windows\SysWOW64\GAHDXO.exe.bat PSSGKX.exe File created C:\windows\SysWOW64\OELHZHZ.exe.bat DMQOQA.exe File created C:\windows\SysWOW64\KUJQK.exe IGAPQ.exe File created C:\windows\SysWOW64\PFIETCA.exe.bat XCF.exe File created C:\windows\SysWOW64\MVYVG.exe CXKIYQ.exe File created C:\windows\SysWOW64\PCKYN.exe VPFP.exe File created C:\windows\SysWOW64\DMQOQA.exe QBZ.exe File opened for modification C:\windows\SysWOW64\VYNGH.exe NSNRG.exe File created C:\windows\SysWOW64\DZVVW.exe FDWMREK.exe File created C:\windows\SysWOW64\SUE.exe DZVVW.exe File created C:\windows\SysWOW64\HUTBO.exe.bat KUJQK.exe File opened for modification C:\windows\SysWOW64\MIOECKQ.exe RNJNS.exe File created C:\windows\SysWOW64\SUE.exe.bat DZVVW.exe File created C:\windows\SysWOW64\MVYVG.exe.bat CXKIYQ.exe File opened for modification C:\windows\SysWOW64\XEMUW.exe NGYAHL.exe File created C:\windows\SysWOW64\VRPK.exe AEKBHIT.exe File created C:\windows\SysWOW64\BYDNCPW.exe.bat TSR.exe File opened for modification C:\windows\SysWOW64\IIVUQE.exe MFM.exe File created C:\windows\SysWOW64\VYNGH.exe NSNRG.exe File created C:\windows\SysWOW64\PILP.exe.bat LSEPTGY.exe File opened for modification C:\windows\SysWOW64\PFIETCA.exe XCF.exe File opened for modification C:\windows\SysWOW64\DWUR.exe VRPK.exe File opened for modification C:\windows\SysWOW64\BBGRX.exe KOWZIAO.exe File created C:\windows\SysWOW64\VHRIOBH.exe PHKUX.exe File created C:\windows\SysWOW64\VYNGH.exe.bat NSNRG.exe File created C:\windows\SysWOW64\YMJBOG.exe JRA.exe File opened for modification C:\windows\SysWOW64\YMJBOG.exe JRA.exe File created C:\windows\SysWOW64\DZVVW.exe.bat FDWMREK.exe File opened for modification C:\windows\SysWOW64\VRPK.exe AEKBHIT.exe File created C:\windows\SysWOW64\NDMVQS.exe HHMVL.exe File created C:\windows\SysWOW64\DMQOQA.exe.bat QBZ.exe File opened for modification C:\windows\SysWOW64\NDPESL.exe XLEOKFF.exe File opened for modification C:\windows\SysWOW64\CCQ.exe YMJBOG.exe File created C:\windows\SysWOW64\DHX.exe YHPFPP.exe File opened for modification C:\windows\SysWOW64\CMB.exe HZWJSA.exe File created C:\windows\SysWOW64\PCKYN.exe.bat VPFP.exe File created C:\windows\SysWOW64\XLEOKFF.exe.bat WQA.exe File opened for modification C:\windows\SysWOW64\EKAWE.exe DHX.exe File opened for modification C:\windows\SysWOW64\NNCO.exe DPWT.exe File created C:\windows\SysWOW64\MFM.exe.bat UCAAWL.exe File created C:\windows\SysWOW64\JNM.exe.bat GAHDXO.exe File created C:\windows\SysWOW64\DWUR.exe VRPK.exe File created C:\windows\SysWOW64\AOLA.exe.bat HWWPCM.exe File opened for modification C:\windows\SysWOW64\KLBOUBH.exe PILP.exe File created C:\windows\SysWOW64\KLBOUBH.exe.bat PILP.exe File opened for modification C:\windows\SysWOW64\MFM.exe UCAAWL.exe File created C:\windows\SysWOW64\JKGRUAS.exe XKZGCHK.exe File created C:\windows\SysWOW64\JKGRUAS.exe.bat XKZGCHK.exe File created C:\windows\SysWOW64\EKAWE.exe DHX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\TEXWFC.exe EOWEZHE.exe File created C:\windows\VRXKOXX.exe PRQWF.exe File created C:\windows\system\OQXPOV.exe CIQP.exe File opened for modification C:\windows\WDAIJVO.exe MVYVG.exe File opened for modification C:\windows\system\WQA.exe DMWPRA.exe File created C:\windows\system\WQA.exe.bat DMWPRA.exe File created C:\windows\EOWEZHE.exe URJ.exe File created C:\windows\system\CXKIYQ.exe.bat YPDA.exe File opened for modification C:\windows\system\UCAAWL.exe VRXKOXX.exe File opened for modification C:\windows\QBZ.exe RQXZ.exe File created C:\windows\system\CKFB.exe DZULK.exe File opened for modification C:\windows\LSEPTGY.exe MHB.exe File created C:\windows\PRQWF.exe.bat VEL.exe File created C:\windows\system\WZGC.exe CMB.exe File created C:\windows\system\STDQC.exe RYZUWA.exe File created C:\windows\system\ZMD.exe RGR.exe File opened for modification C:\windows\VEL.exe LGFSNV.exe File created C:\windows\XZXWUET.exe.bat GZDQRG.exe File opened for modification C:\windows\PBRQX.exe NDMVQS.exe File created C:\windows\system\KDABQKY.exe.bat MVTXY.exe File created C:\windows\system\VSH.exe.bat UPDB.exe File opened for modification C:\windows\NGYAHL.exe XVVKYFC.exe File created C:\windows\system\IAHXTS.exe NNCO.exe File created C:\windows\system\BYYN.exe OVQO.exe File created C:\windows\system\JRA.exe.bat XZXWUET.exe File opened for modification C:\windows\EOWEZHE.exe URJ.exe File created C:\windows\BNJMF.exe HUTBO.exe File created C:\windows\LSEPTGY.exe.bat MHB.exe File opened for modification C:\windows\system\FDWMREK.exe CQRDH.exe File opened for modification C:\windows\system\TZAGG.exe ZMD.exe File created C:\windows\IGTTJUS.exe MIOECKQ.exe File opened for modification C:\windows\system\ZMD.exe RGR.exe File opened for modification C:\windows\XKZAEG.exe DWUR.exe File opened for modification C:\windows\system\HZWJSA.exe IGTTJUS.exe File opened for modification C:\windows\system\KDABQKY.exe MVTXY.exe File created C:\windows\XCF.exe YSCT.exe File created C:\windows\system\RYZUWA.exe.bat VSH.exe File opened for modification C:\windows\system\GBFUQE.exe WDAIJVO.exe File opened for modification C:\windows\system\XVVKYFC.exe NXIP.exe File created C:\windows\system\DMWPRA.exe.bat VHRIOBH.exe File opened for modification C:\windows\CMRU.exe AOLA.exe File created C:\windows\GZDQRG.exe VYNGH.exe File created C:\windows\YHPFPP.exe TER.exe File created C:\windows\DHLURV.exe TGJPN.exe File created C:\windows\PBRQX.exe NDMVQS.exe File created C:\windows\system\KDABQKY.exe MVTXY.exe File created C:\windows\UPDB.exe HRDPZ.exe File created C:\windows\EOWEZHE.exe.bat URJ.exe File opened for modification C:\windows\system\IGAPQ.exe KLBOUBH.exe File opened for modification C:\windows\system\TGJPN.exe PQD.exe File opened for modification C:\windows\AEKBHIT.exe IAHXTS.exe File created C:\windows\system\VPFP.exe.bat BBGRX.exe File created C:\windows\system\WQA.exe DMWPRA.exe File created C:\windows\UEOW.exe.bat XEMUW.exe File opened for modification C:\windows\system\IAHXTS.exe NNCO.exe File opened for modification C:\windows\IGTTJUS.exe MIOECKQ.exe File opened for modification C:\windows\system\WZGC.exe CMB.exe File created C:\windows\system\RGR.exe.bat BQQQNEQ.exe File created C:\windows\system\ZMD.exe.bat RGR.exe File opened for modification C:\windows\DPWT.exe XPPGTQL.exe File created C:\windows\KOWZIAO.exe.bat PBRQX.exe File created C:\windows\PRQWF.exe VEL.exe File opened for modification C:\windows\XZXWUET.exe GZDQRG.exe File opened for modification C:\windows\system\CIQP.exe CCQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3772 cmd.exe 5156 cmd.exe 5016 cmd.exe 4984 cmd.exe 4464 cmd.exe 3388 cmd.exe 5800 cmd.exe 5840 cmd.exe 2644 cmd.exe 1388 cmd.exe 3284 cmd.exe 1260 cmd.exe 468 cmd.exe 2040 cmd.exe 3964 cmd.exe 1772 cmd.exe 4792 cmd.exe 2608 cmd.exe 1320 cmd.exe 3508 cmd.exe 3680 cmd.exe 1984 cmd.exe 5260 cmd.exe 4552 cmd.exe 2516 cmd.exe 4628 cmd.exe 5104 cmd.exe 1328 cmd.exe 2928 cmd.exe 2772 cmd.exe 4788 cmd.exe 5920 cmd.exe 5532 cmd.exe 988 cmd.exe 4176 cmd.exe 5784 cmd.exe 4796 cmd.exe 5776 cmd.exe 4516 cmd.exe 2964 cmd.exe 6004 cmd.exe 4612 cmd.exe 6060 cmd.exe 1268 cmd.exe 6088 cmd.exe 3896 cmd.exe 5168 cmd.exe 5340 cmd.exe 1288 cmd.exe 2316 cmd.exe 3656 cmd.exe 1940 cmd.exe 5924 cmd.exe 4360 cmd.exe 2620 cmd.exe 5820 cmd.exe 4700 cmd.exe 3180 cmd.exe 2668 cmd.exe 5272 cmd.exe 5664 cmd.exe 3948 cmd.exe 2456 cmd.exe 1184 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4700 4152 WerFault.exe 87 4216 4368 WerFault.exe 93 3952 4668 WerFault.exe 99 2224 1372 WerFault.exe 104 5012 1104 WerFault.exe 109 1924 5876 WerFault.exe 114 1460 2164 WerFault.exe 119 1532 2284 WerFault.exe 124 4664 2376 WerFault.exe 129 3004 1384 WerFault.exe 134 4364 3912 WerFault.exe 139 5244 3684 WerFault.exe 144 3332 4588 WerFault.exe 149 3360 1872 WerFault.exe 154 2168 4500 WerFault.exe 159 3052 4140 WerFault.exe 164 5500 5276 WerFault.exe 169 6004 1832 WerFault.exe 174 1732 5452 WerFault.exe 179 5848 5000 WerFault.exe 184 5512 4836 WerFault.exe 189 4160 4756 WerFault.exe 194 4256 4316 WerFault.exe 199 4352 2244 WerFault.exe 204 4948 696 WerFault.exe 209 2968 4768 WerFault.exe 214 1536 1516 WerFault.exe 219 1112 3940 WerFault.exe 224 6020 1924 WerFault.exe 229 992 4736 WerFault.exe 234 3236 4492 WerFault.exe 239 6032 3208 WerFault.exe 244 3780 1904 WerFault.exe 249 3444 4860 WerFault.exe 254 1140 2472 WerFault.exe 259 1528 2268 WerFault.exe 264 1780 3128 WerFault.exe 270 1396 4084 WerFault.exe 275 2824 1520 WerFault.exe 280 3184 2832 WerFault.exe 285 5512 5828 WerFault.exe 290 4864 4656 WerFault.exe 295 3700 5648 WerFault.exe 300 2352 5040 WerFault.exe 305 2920 1120 WerFault.exe 310 2588 4460 WerFault.exe 315 252 2580 WerFault.exe 320 3052 6056 WerFault.exe 325 4788 5688 WerFault.exe 330 3880 5848 WerFault.exe 335 4692 4348 WerFault.exe 340 5372 5980 WerFault.exe 345 4984 4956 WerFault.exe 350 5636 3700 WerFault.exe 355 5468 3740 WerFault.exe 360 3412 1304 WerFault.exe 365 2304 3228 WerFault.exe 370 4120 1780 WerFault.exe 375 2904 2660 WerFault.exe 380 2140 5476 WerFault.exe 385 3000 3232 WerFault.exe 390 5932 4100 WerFault.exe 395 4584 1972 WerFault.exe 400 5464 4232 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXKIYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZVVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DHLURV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDAIJVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IGTTJUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZWJSA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STDQC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRXKOXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EOWEZHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDPESL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TER.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZDQRG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DHX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXICIUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDMVQS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BYDNCPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMWPRA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMQOQA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KDABQKY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OELHZHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZULK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVYVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DPWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHMVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4152 2026-09-30_46f52df4bb5fdfb58d8372e439e87396_elex_emotet_stop.exe 4152 2026-09-30_46f52df4bb5fdfb58d8372e439e87396_elex_emotet_stop.exe 4368 MVTXY.exe 4368 MVTXY.exe 4668 KDABQKY.exe 4668 KDABQKY.exe 1372 JODRYY.exe 1372 JODRYY.exe 1104 ZERIOF.exe 1104 ZERIOF.exe 5876 HRDPZ.exe 5876 HRDPZ.exe 2164 UPDB.exe 2164 UPDB.exe 2284 VSH.exe 2284 VSH.exe 2376 RYZUWA.exe 2376 RYZUWA.exe 1384 STDQC.exe 1384 STDQC.exe 3912 URJ.exe 3912 URJ.exe 3684 EOWEZHE.exe 3684 EOWEZHE.exe 4588 TEXWFC.exe 4588 TEXWFC.exe 1872 MHB.exe 1872 MHB.exe 4500 LSEPTGY.exe 4500 LSEPTGY.exe 4140 PILP.exe 4140 PILP.exe 5276 KLBOUBH.exe 5276 KLBOUBH.exe 1832 IGAPQ.exe 1832 IGAPQ.exe 5452 KUJQK.exe 5452 KUJQK.exe 5000 HUTBO.exe 5000 HUTBO.exe 4836 BNJMF.exe 4836 BNJMF.exe 4756 OSJ.exe 4756 OSJ.exe 4316 AACQ.exe 4316 AACQ.exe 2244 PQD.exe 2244 PQD.exe 696 TGJPN.exe 696 TGJPN.exe 4768 DHLURV.exe 4768 DHLURV.exe 1516 YSCT.exe 1516 YSCT.exe 3940 XCF.exe 3940 XCF.exe 1924 PFIETCA.exe 1924 PFIETCA.exe 4736 CQRDH.exe 4736 CQRDH.exe 4492 FDWMREK.exe 4492 FDWMREK.exe 3208 DZVVW.exe 3208 DZVVW.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4152 2026-09-30_46f52df4bb5fdfb58d8372e439e87396_elex_emotet_stop.exe 4152 2026-09-30_46f52df4bb5fdfb58d8372e439e87396_elex_emotet_stop.exe 4368 MVTXY.exe 4368 MVTXY.exe 4668 KDABQKY.exe 4668 KDABQKY.exe 1372 JODRYY.exe 1372 JODRYY.exe 1104 ZERIOF.exe 1104 ZERIOF.exe 5876 HRDPZ.exe 5876 HRDPZ.exe 2164 UPDB.exe 2164 UPDB.exe 2284 VSH.exe 2284 VSH.exe 2376 RYZUWA.exe 2376 RYZUWA.exe 1384 STDQC.exe 1384 STDQC.exe 3912 URJ.exe 3912 URJ.exe 3684 EOWEZHE.exe 3684 EOWEZHE.exe 4588 TEXWFC.exe 4588 TEXWFC.exe 1872 MHB.exe 1872 MHB.exe 4500 LSEPTGY.exe 4500 LSEPTGY.exe 4140 PILP.exe 4140 PILP.exe 5276 KLBOUBH.exe 5276 KLBOUBH.exe 1832 IGAPQ.exe 1832 IGAPQ.exe 5452 KUJQK.exe 5452 KUJQK.exe 5000 HUTBO.exe 5000 HUTBO.exe 4836 BNJMF.exe 4836 BNJMF.exe 4756 OSJ.exe 4756 OSJ.exe 4316 AACQ.exe 4316 AACQ.exe 2244 PQD.exe 2244 PQD.exe 696 TGJPN.exe 696 TGJPN.exe 4768 DHLURV.exe 4768 DHLURV.exe 1516 YSCT.exe 1516 YSCT.exe 3940 XCF.exe 3940 XCF.exe 1924 PFIETCA.exe 1924 PFIETCA.exe 4736 CQRDH.exe 4736 CQRDH.exe 4492 FDWMREK.exe 4492 FDWMREK.exe 3208 DZVVW.exe 3208 DZVVW.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4152 wrote to memory of 5784 4152 2026-09-30_46f52df4bb5fdfb58d8372e439e87396_elex_emotet_stop.exe 89 PID 5784 wrote to memory of 4368 5784 cmd.exe 93 PID 4368 wrote to memory of 5808 4368 MVTXY.exe 95 PID 5808 wrote to memory of 4668 5808 cmd.exe 99 PID 4668 wrote to memory of 2772 4668 KDABQKY.exe 100 PID 2772 wrote to memory of 1372 2772 cmd.exe 104 PID 1372 wrote to memory of 6068 1372 JODRYY.exe 105 PID 6068 wrote to memory of 1104 6068 cmd.exe 109 PID 1104 wrote to memory of 5260 1104 ZERIOF.exe 110 PID 5260 wrote to memory of 5876 5260 cmd.exe 114 PID 5876 wrote to memory of 1772 5876 HRDPZ.exe 115 PID 1772 wrote to memory of 2164 1772 cmd.exe 119 PID 2164 wrote to memory of 1268 2164 UPDB.exe 120 PID 1268 wrote to memory of 2284 1268 cmd.exe 124 PID 2284 wrote to memory of 796 2284 VSH.exe 125 PID 796 wrote to memory of 2376 796 cmd.exe 129 PID 2376 wrote to memory of 4796 2376 RYZUWA.exe 130 PID 4796 wrote to memory of 1384 4796 cmd.exe 134 PID 1384 wrote to memory of 2916 1384 STDQC.exe 135 PID 2916 wrote to memory of 3912 2916 cmd.exe 139 PID 3912 wrote to memory of 6088 3912 URJ.exe 140 PID 6088 wrote to memory of 3684 6088 cmd.exe 144 PID 3684 wrote to memory of 3896 3684 EOWEZHE.exe 145 PID 3896 wrote to memory of 4588 3896 cmd.exe 149 PID 4588 wrote to memory of 4644 4588 TEXWFC.exe 150 PID 4644 wrote to memory of 1872 4644 cmd.exe 154 PID 1872 wrote to memory of 3872 1872 MHB.exe 155 PID 3872 wrote to memory of 4500 3872 cmd.exe 159 PID 4500 wrote to memory of 1244 4500 LSEPTGY.exe 160 PID 1244 wrote to memory of 4140 1244 cmd.exe 164 PID 4140 wrote to memory of 4552 4140 PILP.exe 165 PID 4552 wrote to memory of 5276 4552 cmd.exe 169 PID 5276 wrote to memory of 5912 5276 KLBOUBH.exe 170 PID 5912 wrote to memory of 1832 5912 cmd.exe 174 PID 1832 wrote to memory of 4304 1832 IGAPQ.exe 175 PID 4304 wrote to memory of 5452 4304 cmd.exe 179 PID 5452 wrote to memory of 5360 5452 KUJQK.exe 180 PID 5360 wrote to memory of 5000 5360 cmd.exe 184 PID 5000 wrote to memory of 5472 5000 HUTBO.exe 185 PID 5472 wrote to memory of 4836 5472 cmd.exe 189 PID 4836 wrote to memory of 5080 4836 BNJMF.exe 190 PID 5080 wrote to memory of 4756 5080 cmd.exe 194 PID 4756 wrote to memory of 5272 4756 OSJ.exe 195 PID 5272 wrote to memory of 4316 5272 cmd.exe 199 PID 4316 wrote to memory of 752 4316 AACQ.exe 200 PID 752 wrote to memory of 2244 752 cmd.exe 204 PID 2244 wrote to memory of 4060 2244 PQD.exe 205 PID 4060 wrote to memory of 696 4060 cmd.exe 209 PID 696 wrote to memory of 5776 696 TGJPN.exe 210 PID 5776 wrote to memory of 4768 5776 cmd.exe 214 PID 4768 wrote to memory of 6116 4768 DHLURV.exe 215 PID 6116 wrote to memory of 1516 6116 cmd.exe 219 PID 1516 wrote to memory of 2516 1516 YSCT.exe 220 PID 2516 wrote to memory of 3940 2516 cmd.exe 224 PID 3940 wrote to memory of 1252 3940 XCF.exe 225 PID 1252 wrote to memory of 1924 1252 cmd.exe 229 PID 1924 wrote to memory of 5168 1924 PFIETCA.exe 230 PID 5168 wrote to memory of 4736 5168 cmd.exe 234 PID 4736 wrote to memory of 1236 4736 CQRDH.exe 235 PID 1236 wrote to memory of 4492 1236 cmd.exe 239 PID 4492 wrote to memory of 2872 4492 FDWMREK.exe 240 PID 2872 wrote to memory of 3208 2872 cmd.exe 244 PID 3208 wrote to memory of 3876 3208 DZVVW.exe 245 PID 3876 wrote to memory of 1904 3876 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_46f52df4bb5fdfb58d8372e439e87396_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_46f52df4bb5fdfb58d8372e439e87396_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MVTXY.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\windows\MVTXY.exeC:\windows\MVTXY.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDABQKY.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\windows\system\KDABQKY.exeC:\windows\system\KDABQKY.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JODRYY.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\windows\system\JODRYY.exeC:\windows\system\JODRYY.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZERIOF.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\windows\SysWOW64\ZERIOF.exeC:\windows\system32\ZERIOF.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HRDPZ.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\windows\system\HRDPZ.exeC:\windows\system\HRDPZ.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPDB.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\windows\UPDB.exeC:\windows\UPDB.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSH.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\windows\system\VSH.exeC:\windows\system\VSH.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RYZUWA.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:796 -
C:\windows\system\RYZUWA.exeC:\windows\system\RYZUWA.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STDQC.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\windows\system\STDQC.exeC:\windows\system\STDQC.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\URJ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\windows\URJ.exeC:\windows\URJ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EOWEZHE.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\windows\EOWEZHE.exeC:\windows\EOWEZHE.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEXWFC.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\windows\TEXWFC.exeC:\windows\TEXWFC.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MHB.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\windows\system\MHB.exeC:\windows\system\MHB.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LSEPTGY.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\windows\LSEPTGY.exeC:\windows\LSEPTGY.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PILP.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\windows\SysWOW64\PILP.exeC:\windows\system32\PILP.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLBOUBH.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\windows\SysWOW64\KLBOUBH.exeC:\windows\system32\KLBOUBH.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IGAPQ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\windows\system\IGAPQ.exeC:\windows\system\IGAPQ.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUJQK.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\windows\SysWOW64\KUJQK.exeC:\windows\system32\KUJQK.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUTBO.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\windows\SysWOW64\HUTBO.exeC:\windows\system32\HUTBO.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNJMF.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\windows\BNJMF.exeC:\windows\BNJMF.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OSJ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\windows\OSJ.exeC:\windows\OSJ.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AACQ.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\windows\AACQ.exeC:\windows\AACQ.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PQD.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\windows\SysWOW64\PQD.exeC:\windows\system32\PQD.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGJPN.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\windows\system\TGJPN.exeC:\windows\system\TGJPN.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DHLURV.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\windows\DHLURV.exeC:\windows\DHLURV.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSCT.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\windows\system\YSCT.exeC:\windows\system\YSCT.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XCF.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\windows\XCF.exeC:\windows\XCF.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PFIETCA.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\windows\SysWOW64\PFIETCA.exeC:\windows\system32\PFIETCA.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CQRDH.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\windows\CQRDH.exeC:\windows\CQRDH.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FDWMREK.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\windows\system\FDWMREK.exeC:\windows\system\FDWMREK.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DZVVW.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\windows\SysWOW64\DZVVW.exeC:\windows\system32\DZVVW.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUE.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\windows\SysWOW64\SUE.exeC:\windows\system32\SUE.exe65⤵
- Executes dropped EXE
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YPDA.exe.bat" "66⤵PID:2760
-
C:\windows\SysWOW64\YPDA.exeC:\windows\system32\YPDA.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CXKIYQ.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4516 -
C:\windows\system\CXKIYQ.exeC:\windows\system\CXKIYQ.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVYVG.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:4484 -
C:\windows\SysWOW64\MVYVG.exeC:\windows\system32\MVYVG.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDAIJVO.exe.bat" "72⤵
- Executes a command shell one-liner
PID:5664 -
C:\windows\WDAIJVO.exeC:\windows\WDAIJVO.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GBFUQE.exe.bat" "74⤵PID:2968
-
C:\windows\system\GBFUQE.exeC:\windows\system\GBFUQE.exe75⤵
- Executes dropped EXE
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEOT.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2964 -
C:\windows\system\TEOT.exeC:\windows\system\TEOT.exe77⤵
- Executes dropped EXE
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IUP.exe.bat" "78⤵PID:5044
-
C:\windows\IUP.exeC:\windows\IUP.exe79⤵
- Executes dropped EXE
PID:2832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPGXW.exe.bat" "80⤵PID:1820
-
C:\windows\system\XPGXW.exeC:\windows\system\XPGXW.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXICIUS.exe.bat" "82⤵PID:2020
-
C:\windows\SysWOW64\HXICIUS.exeC:\windows\system32\HXICIUS.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NXIP.exe.bat" "84⤵PID:1192
-
C:\windows\system\NXIP.exeC:\windows\system\NXIP.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XVVKYFC.exe.bat" "86⤵PID:4784
-
C:\windows\system\XVVKYFC.exeC:\windows\system\XVVKYFC.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NGYAHL.exe.bat" "88⤵PID:3172
-
C:\windows\NGYAHL.exeC:\windows\NGYAHL.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XEMUW.exe.bat" "90⤵PID:4188
-
C:\windows\SysWOW64\XEMUW.exeC:\windows\system32\XEMUW.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UEOW.exe.bat" "92⤵PID:3112
-
C:\windows\UEOW.exeC:\windows\UEOW.exe93⤵
- Executes dropped EXE
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PSSGKX.exe.bat" "94⤵PID:1528
-
C:\windows\PSSGKX.exeC:\windows\PSSGKX.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GAHDXO.exe.bat" "96⤵PID:5908
-
C:\windows\SysWOW64\GAHDXO.exeC:\windows\system32\GAHDXO.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNM.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:4384 -
C:\windows\SysWOW64\JNM.exeC:\windows\system32\JNM.exe99⤵
- Executes dropped EXE
PID:5848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BQQQNEQ.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:1156 -
C:\windows\system\BQQQNEQ.exeC:\windows\system\BQQQNEQ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGR.exe.bat" "102⤵PID:1116
-
C:\windows\system\RGR.exeC:\windows\system\RGR.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMD.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:5348 -
C:\windows\system\ZMD.exeC:\windows\system\ZMD.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TZAGG.exe.bat" "106⤵PID:4364
-
C:\windows\system\TZAGG.exeC:\windows\system\TZAGG.exe107⤵
- Executes dropped EXE
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPPGTQL.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:1432 -
C:\windows\system\XPPGTQL.exeC:\windows\system\XPPGTQL.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DPWT.exe.bat" "110⤵PID:1840
-
C:\windows\DPWT.exeC:\windows\DPWT.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NNCO.exe.bat" "112⤵PID:4760
-
C:\windows\SysWOW64\NNCO.exeC:\windows\system32\NNCO.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IAHXTS.exe.bat" "114⤵PID:4620
-
C:\windows\system\IAHXTS.exeC:\windows\system\IAHXTS.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AEKBHIT.exe.bat" "116⤵
- Executes a command shell one-liner
PID:6004 -
C:\windows\AEKBHIT.exeC:\windows\AEKBHIT.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRPK.exe.bat" "118⤵
- Executes a command shell one-liner
PID:4792 -
C:\windows\SysWOW64\VRPK.exeC:\windows\system32\VRPK.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DWUR.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5840 -
C:\windows\SysWOW64\DWUR.exeC:\windows\system32\DWUR.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-