Analysis
- max time kernel
76s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 16:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_de7db42df2e64fdf14aebbb933f6c0e4_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-29_de7db42df2e64fdf14aebbb933f6c0e4_elex_emotet_stop.exe
- Size 208KB
- Sample260930-tgnwsswtbw
- SHA256 45fedee96dc4e99f2624e1497a018b612a2874b5fa3084fc581d6956b41f849b
- MD5 de7db42df2e64fdf14aebbb933f6c0e4
- SHA1 ef3dcb11c82a49dc8decf062708052f363d804b3
- SHA512 9b27d02bea8ca15581965af45990128d8dac9eb3b91deb752c586b2d38c4323ee3696ccc408c66760a037d5483da89b6957e3d218a7bc76bbeffc48a1a27be46
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfP4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOnkEj1
- TLSH T160247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4544 JVB.exe 2324 OWXWPT.exe 5528 GZB.exe 2392 UXBDWV.exe 2468 PIRCKF.exe 4068 KVO.exe 5208 CYAHA.exe 3924 OGGPMOD.exe 4336 WWHHTB.exe 4820 EKMVD.exe 2556 OHAIL.exe 2916 KABS.exe 5856 ESRD.exe 5792 CLU.exe 3808 ULI.exe 1104 QMSSFOV.exe 624 VRCIVJ.exe 5392 DXPOG.exe 3508 QDPAIT.exe 1836 ULV.exe 3412 IWMZIO.exe 5760 GGPPR.exe 1372 HJSSWSC.exe 2348 PPFZHRX.exe 816 KKKJ.exe 244 TKEOVWO.exe 3856 GVUMJ.exe 3148 WLV.exe 3036 QZAVS.exe 4516 CPHVEMJ.exe 3532 VKLR.exe 5816 FHYL.exe 3912 OQSQD.exe 4616 DLK.exe 4360 HTQDA.exe 4280 IWUG.exe 5740 AZYCTB.exe 4468 QPZB.exe 580 FKIGKJA.exe 6096 OKKL.exe 720 AARTAZ.exe 4240 CYEFHH.exe 3688 SOFFOVO.exe 4400 KRJAUT.exe 5468 ZMTN.exe 852 PCUEL.exe 3836 EXD.exe 4264 ZLIAP.exe 2128 FGH.exe 4120 OTS.exe 5560 AWQOBG.exe 676 HRZS.exe 4308 YABXXZB.exe 2920 XKMN.exe 2596 MFVRRRY.exe 5524 FIZVXP.exe 4632 GED.exe 5752 AZIIM.exe 5976 TUME.exe 2672 DSRYHD.exe 3448 QCIXVO.exe 4708 WYHYAJT.exe 5248 PBLTFH.exe 2472 KETS.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\NQNC.exe.bat MNKYF.exe File created C:\windows\SysWOW64\RID.exe.bat YNAZPU.exe File created C:\windows\SysWOW64\ESRD.exe KABS.exe File created C:\windows\SysWOW64\ZMTN.exe KRJAUT.exe File created C:\windows\SysWOW64\HRZS.exe AWQOBG.exe File created C:\windows\SysWOW64\JVY.exe NQNC.exe File opened for modification C:\windows\SysWOW64\GSTXY.exe CKM.exe File created C:\windows\SysWOW64\GSTXY.exe.bat CKM.exe File opened for modification C:\windows\SysWOW64\MNS.exe GSTXY.exe File created C:\windows\SysWOW64\FHYL.exe VKLR.exe File opened for modification C:\windows\SysWOW64\DLK.exe OQSQD.exe File created C:\windows\SysWOW64\POBWX.exe HAXPM.exe File created C:\windows\SysWOW64\POBWX.exe.bat HAXPM.exe File created C:\windows\SysWOW64\KVO.exe PIRCKF.exe File created C:\windows\SysWOW64\IWMZIO.exe.bat ULV.exe File opened for modification C:\windows\SysWOW64\OQSQD.exe FHYL.exe File opened for modification C:\windows\SysWOW64\ZMTN.exe KRJAUT.exe File created C:\windows\SysWOW64\KAQ.exe JFMT.exe File created C:\windows\SysWOW64\BWAW.exe.bat JVY.exe File opened for modification C:\windows\SysWOW64\RID.exe YNAZPU.exe File created C:\windows\SysWOW64\TWQWJMF.exe POBWX.exe File opened for modification C:\windows\SysWOW64\KVO.exe PIRCKF.exe File created C:\windows\SysWOW64\EKMVD.exe.bat WWHHTB.exe File opened for modification C:\windows\SysWOW64\ESRD.exe KABS.exe File created C:\windows\SysWOW64\TKEOVWO.exe.bat KKKJ.exe File created C:\windows\SysWOW64\WLV.exe GVUMJ.exe File opened for modification C:\windows\SysWOW64\WLV.exe GVUMJ.exe File created C:\windows\SysWOW64\WWHHTB.exe OGGPMOD.exe File created C:\windows\SysWOW64\EKMVD.exe WWHHTB.exe File created C:\windows\SysWOW64\IWMZIO.exe ULV.exe File created C:\windows\SysWOW64\KETS.exe.bat PBLTFH.exe File created C:\windows\SysWOW64\NQNC.exe MNKYF.exe File created C:\windows\SysWOW64\OGGPMOD.exe CYAHA.exe File created C:\windows\SysWOW64\OQSQD.exe FHYL.exe File opened for modification C:\windows\SysWOW64\KRJAUT.exe SOFFOVO.exe File opened for modification C:\windows\SysWOW64\HRZS.exe AWQOBG.exe File created C:\windows\SysWOW64\YKWECEP.exe.bat OBUQYY.exe File opened for modification C:\windows\SysWOW64\IWMZIO.exe ULV.exe File created C:\windows\SysWOW64\FHYL.exe.bat VKLR.exe File opened for modification C:\windows\SysWOW64\OKKL.exe FKIGKJA.exe File created C:\windows\SysWOW64\OKKL.exe.bat FKIGKJA.exe File created C:\windows\SysWOW64\KRJAUT.exe.bat SOFFOVO.exe File created C:\windows\SysWOW64\ZLIAP.exe EXD.exe File opened for modification C:\windows\SysWOW64\QCIXVO.exe DSRYHD.exe File created C:\windows\SysWOW64\BWAW.exe JVY.exe File opened for modification C:\windows\SysWOW64\BWAW.exe JVY.exe File created C:\windows\SysWOW64\DDXKRAJ.exe KLHZAZB.exe File created C:\windows\SysWOW64\MNS.exe GSTXY.exe File opened for modification C:\windows\SysWOW64\POBWX.exe HAXPM.exe File created C:\windows\SysWOW64\KVO.exe.bat PIRCKF.exe File opened for modification C:\windows\SysWOW64\WWHHTB.exe OGGPMOD.exe File created C:\windows\SysWOW64\KETS.exe PBLTFH.exe File created C:\windows\SysWOW64\HAXPM.exe MNS.exe File created C:\windows\SysWOW64\HAXPM.exe.bat MNS.exe File opened for modification C:\windows\SysWOW64\TKEOVWO.exe KKKJ.exe File created C:\windows\SysWOW64\WLV.exe.bat GVUMJ.exe File created C:\windows\SysWOW64\OQSQD.exe.bat FHYL.exe File created C:\windows\SysWOW64\DLK.exe OQSQD.exe File opened for modification C:\windows\SysWOW64\ZLIAP.exe EXD.exe File created C:\windows\SysWOW64\AWQOBG.exe OTS.exe File created C:\windows\SysWOW64\KAQ.exe.bat JFMT.exe File opened for modification C:\windows\SysWOW64\NQNC.exe MNKYF.exe File created C:\windows\SysWOW64\TKEOVWO.exe KKKJ.exe File opened for modification C:\windows\SysWOW64\FHYL.exe VKLR.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\KKKJ.exe.bat PPFZHRX.exe File created C:\windows\HTQDA.exe.bat DLK.exe File created C:\windows\EXD.exe PCUEL.exe File created C:\windows\QOK.exe HFIEOXN.exe File created C:\windows\UXBDWV.exe.bat GZB.exe File created C:\windows\QZAVS.exe.bat WLV.exe File created C:\windows\YABXXZB.exe.bat HRZS.exe File created C:\windows\system\OUASGC.exe KETS.exe File created C:\windows\system\MNKYF.exe ORKXB.exe File opened for modification C:\windows\QMSSFOV.exe ULI.exe File created C:\windows\system\IWUG.exe HTQDA.exe File opened for modification C:\windows\system\AZYCTB.exe IWUG.exe File created C:\windows\KABS.exe OHAIL.exe File created C:\windows\system\DXPOG.exe.bat VRCIVJ.exe File created C:\windows\GVUMJ.exe TKEOVWO.exe File opened for modification C:\windows\HTQDA.exe DLK.exe File created C:\windows\system\OTS.exe FGH.exe File created C:\windows\system\JVB.exe 2026-09-29_de7db42df2e64fdf14aebbb933f6c0e4_elex_emotet_stop.exe File created C:\windows\system\CPHVEMJ.exe QZAVS.exe File opened for modification C:\windows\PCUEL.exe ZMTN.exe File created C:\windows\MUX.exe.bat IRZIU.exe File created C:\windows\system\CLU.exe ESRD.exe File opened for modification C:\windows\system\IWUG.exe HTQDA.exe File opened for modification C:\windows\YABXXZB.exe HRZS.exe File opened for modification C:\windows\DSRYHD.exe TUME.exe File created C:\windows\system\ZGK.exe.bat BWAW.exe File opened for modification C:\windows\system\TBKSIDT.exe HTDK.exe File opened for modification C:\windows\GZB.exe OWXWPT.exe File opened for modification C:\windows\system\MFVRRRY.exe XKMN.exe File created C:\windows\system\HTDK.exe.bat DDXKRAJ.exe File created C:\windows\GZB.exe OWXWPT.exe File created C:\windows\CYAHA.exe.bat KVO.exe File created C:\windows\HJSSWSC.exe GGPPR.exe File created C:\windows\QZAVS.exe WLV.exe File created C:\windows\system\AZYCTB.exe IWUG.exe File created C:\windows\QPZB.exe AZYCTB.exe File opened for modification C:\windows\AARTAZ.exe OKKL.exe File created C:\windows\system\CYEFHH.exe.bat AARTAZ.exe File created C:\windows\system\JVB.exe.bat 2026-09-29_de7db42df2e64fdf14aebbb933f6c0e4_elex_emotet_stop.exe File created C:\windows\system\OHAIL.exe EKMVD.exe File opened for modification C:\windows\VRCIVJ.exe QMSSFOV.exe File opened for modification C:\windows\ULV.exe QDPAIT.exe File created C:\windows\PCUEL.exe.bat ZMTN.exe File created C:\windows\system\MFVRRRY.exe.bat XKMN.exe File created C:\windows\GED.exe FIZVXP.exe File opened for modification C:\windows\GED.exe FIZVXP.exe File created C:\windows\CYAHA.exe KVO.exe File created C:\windows\GGPPR.exe IWMZIO.exe File created C:\windows\GGPPR.exe.bat IWMZIO.exe File opened for modification C:\windows\SOFFOVO.exe CYEFHH.exe File opened for modification C:\windows\system\WYHYAJT.exe QCIXVO.exe File opened for modification C:\windows\OBUQYY.exe ZGK.exe File created C:\windows\system\KLHZAZB.exe.bat RID.exe File opened for modification C:\windows\IRZIU.exe TWQWJMF.exe File opened for modification C:\windows\OWXWPT.exe JVB.exe File created C:\windows\GZB.exe.bat OWXWPT.exe File created C:\windows\system\JFMT.exe YRNNNK.exe File opened for modification C:\windows\system\HFIEOXN.exe KAQ.exe File created C:\windows\QOK.exe.bat HFIEOXN.exe File created C:\windows\system\VGML.exe.bat QOK.exe File opened for modification C:\windows\system\MNKYF.exe ORKXB.exe File opened for modification C:\windows\QPZB.exe AZYCTB.exe File opened for modification C:\windows\QZAVS.exe WLV.exe File created C:\windows\system\AZYCTB.exe.bat IWUG.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3004 cmd.exe 4652 cmd.exe 1980 cmd.exe 3404 cmd.exe 2524 cmd.exe 1588 cmd.exe 1616 cmd.exe 5152 cmd.exe 1516 cmd.exe 6136 cmd.exe 1560 cmd.exe 1132 cmd.exe 1876 cmd.exe 5956 cmd.exe 4508 cmd.exe 5004 cmd.exe 4288 cmd.exe 4364 cmd.exe 5768 cmd.exe 3696 cmd.exe 4472 cmd.exe 1988 cmd.exe 5484 cmd.exe 5500 cmd.exe 4340 cmd.exe 4412 cmd.exe 2664 cmd.exe 5800 cmd.exe 2656 cmd.exe 3304 cmd.exe 2120 cmd.exe 1888 cmd.exe 4320 cmd.exe 4136 cmd.exe 2980 cmd.exe 5264 cmd.exe 2876 cmd.exe 5656 cmd.exe 1944 cmd.exe 5488 cmd.exe 4996 cmd.exe 4392 cmd.exe 1020 cmd.exe 2080 cmd.exe 4716 cmd.exe 1968 cmd.exe 2356 cmd.exe 252 cmd.exe 6048 cmd.exe 1720 cmd.exe 6056 cmd.exe 3052 cmd.exe 2044 cmd.exe 1216 cmd.exe 1984 cmd.exe 3476 cmd.exe 4968 cmd.exe 4792 cmd.exe 1068 cmd.exe 5796 cmd.exe 2176 cmd.exe 1632 cmd.exe 2736 cmd.exe 5668 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2124 1340 WerFault.exe 88 4300 4544 WerFault.exe 92 2148 2324 WerFault.exe 95 4328 5528 WerFault.exe 104 3244 2392 WerFault.exe 109 2544 2468 WerFault.exe 114 3204 4068 WerFault.exe 119 3300 5208 WerFault.exe 124 4308 3924 WerFault.exe 129 3556 4336 WerFault.exe 134 2204 4820 WerFault.exe 139 620 2556 WerFault.exe 144 832 2916 WerFault.exe 149 2464 5856 WerFault.exe 154 2856 5792 WerFault.exe 159 3656 3808 WerFault.exe 164 6036 1104 WerFault.exe 169 1300 624 WerFault.exe 174 2020 5392 WerFault.exe 179 6072 3508 WerFault.exe 184 5776 1836 WerFault.exe 189 3912 3412 WerFault.exe 194 852 5760 WerFault.exe 199 4796 1372 WerFault.exe 204 4272 2348 WerFault.exe 209 1284 816 WerFault.exe 214 2836 244 WerFault.exe 219 1048 3856 WerFault.exe 223 1596 3148 WerFault.exe 229 720 3036 WerFault.exe 234 2852 4516 WerFault.exe 239 4560 3532 WerFault.exe 244 2100 5816 WerFault.exe 249 5468 3912 WerFault.exe 254 5332 4616 WerFault.exe 259 2856 4360 WerFault.exe 264 2888 4280 WerFault.exe 269 1260 5740 WerFault.exe 275 3216 4468 WerFault.exe 280 2376 580 WerFault.exe 285 5712 6096 WerFault.exe 290 2204 720 WerFault.exe 295 4316 4240 WerFault.exe 300 4440 3688 WerFault.exe 305 1172 4400 WerFault.exe 310 4556 5468 WerFault.exe 315 2012 852 WerFault.exe 320 5896 3836 WerFault.exe 325 3252 4264 WerFault.exe 330 5152 2128 WerFault.exe 335 3416 4120 WerFault.exe 340 4952 5560 WerFault.exe 345 684 676 WerFault.exe 350 4876 4308 WerFault.exe 355 1304 2920 WerFault.exe 360 1172 2596 WerFault.exe 365 4996 5524 WerFault.exe 370 2012 4632 WerFault.exe 375 3244 5752 WerFault.exe 380 3964 5976 WerFault.exe 385 4736 2672 WerFault.exe 390 3428 3448 WerFault.exe 395 5272 4708 WerFault.exe 400 5644 5248 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HTQDA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QZAVS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUASGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJEXOUG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MNS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAXPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCIXVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PBLTFH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GGPPR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_de7db42df2e64fdf14aebbb933f6c0e4_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRCIVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IRZIU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ESRD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VGML.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFIEOXN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMSSFOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HRZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DSRYHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YABXXZB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVUMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VKLR.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1340 2026-09-29_de7db42df2e64fdf14aebbb933f6c0e4_elex_emotet_stop.exe 1340 2026-09-29_de7db42df2e64fdf14aebbb933f6c0e4_elex_emotet_stop.exe 4544 JVB.exe 4544 JVB.exe 2324 OWXWPT.exe 2324 OWXWPT.exe 5528 GZB.exe 5528 GZB.exe 2392 UXBDWV.exe 2392 UXBDWV.exe 2468 PIRCKF.exe 2468 PIRCKF.exe 4068 KVO.exe 4068 KVO.exe 5208 CYAHA.exe 5208 CYAHA.exe 3924 OGGPMOD.exe 3924 OGGPMOD.exe 4336 WWHHTB.exe 4336 WWHHTB.exe 4820 EKMVD.exe 4820 EKMVD.exe 2556 OHAIL.exe 2556 OHAIL.exe 2916 KABS.exe 2916 KABS.exe 5856 ESRD.exe 5856 ESRD.exe 5792 CLU.exe 5792 CLU.exe 3808 ULI.exe 3808 ULI.exe 1104 QMSSFOV.exe 1104 QMSSFOV.exe 624 VRCIVJ.exe 624 VRCIVJ.exe 5392 DXPOG.exe 5392 DXPOG.exe 3508 QDPAIT.exe 3508 QDPAIT.exe 1836 ULV.exe 1836 ULV.exe 3412 IWMZIO.exe 3412 IWMZIO.exe 5760 GGPPR.exe 5760 GGPPR.exe 1372 HJSSWSC.exe 1372 HJSSWSC.exe 2348 PPFZHRX.exe 2348 PPFZHRX.exe 816 KKKJ.exe 816 KKKJ.exe 244 TKEOVWO.exe 244 TKEOVWO.exe 3856 GVUMJ.exe 3856 GVUMJ.exe 3148 WLV.exe 3148 WLV.exe 3036 QZAVS.exe 3036 QZAVS.exe 4516 CPHVEMJ.exe 4516 CPHVEMJ.exe 3532 VKLR.exe 3532 VKLR.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1340 2026-09-29_de7db42df2e64fdf14aebbb933f6c0e4_elex_emotet_stop.exe 1340 2026-09-29_de7db42df2e64fdf14aebbb933f6c0e4_elex_emotet_stop.exe 4544 JVB.exe 4544 JVB.exe 2324 OWXWPT.exe 2324 OWXWPT.exe 5528 GZB.exe 5528 GZB.exe 2392 UXBDWV.exe 2392 UXBDWV.exe 2468 PIRCKF.exe 2468 PIRCKF.exe 4068 KVO.exe 4068 KVO.exe 5208 CYAHA.exe 5208 CYAHA.exe 3924 OGGPMOD.exe 3924 OGGPMOD.exe 4336 WWHHTB.exe 4336 WWHHTB.exe 4820 EKMVD.exe 4820 EKMVD.exe 2556 OHAIL.exe 2556 OHAIL.exe 2916 KABS.exe 2916 KABS.exe 5856 ESRD.exe 5856 ESRD.exe 5792 CLU.exe 5792 CLU.exe 3808 ULI.exe 3808 ULI.exe 1104 QMSSFOV.exe 1104 QMSSFOV.exe 624 VRCIVJ.exe 624 VRCIVJ.exe 5392 DXPOG.exe 5392 DXPOG.exe 3508 QDPAIT.exe 3508 QDPAIT.exe 1836 ULV.exe 1836 ULV.exe 3412 IWMZIO.exe 3412 IWMZIO.exe 5760 GGPPR.exe 5760 GGPPR.exe 1372 HJSSWSC.exe 1372 HJSSWSC.exe 2348 PPFZHRX.exe 2348 PPFZHRX.exe 816 KKKJ.exe 816 KKKJ.exe 244 TKEOVWO.exe 244 TKEOVWO.exe 3856 GVUMJ.exe 3856 GVUMJ.exe 3148 WLV.exe 3148 WLV.exe 3036 QZAVS.exe 3036 QZAVS.exe 4516 CPHVEMJ.exe 4516 CPHVEMJ.exe 3532 VKLR.exe 3532 VKLR.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1340 wrote to memory of 724 1340 2026-09-29_de7db42df2e64fdf14aebbb933f6c0e4_elex_emotet_stop.exe 89 PID 724 wrote to memory of 4544 724 cmd.exe 92 PID 4544 wrote to memory of 4392 4544 JVB.exe 93 PID 4392 wrote to memory of 2324 4392 cmd.exe 95 PID 2324 wrote to memory of 3696 2324 OWXWPT.exe 100 PID 3696 wrote to memory of 5528 3696 cmd.exe 104 PID 5528 wrote to memory of 1280 5528 GZB.exe 105 PID 1280 wrote to memory of 2392 1280 cmd.exe 109 PID 2392 wrote to memory of 2524 2392 UXBDWV.exe 110 PID 2524 wrote to memory of 2468 2524 cmd.exe 114 PID 2468 wrote to memory of 4472 2468 PIRCKF.exe 115 PID 4472 wrote to memory of 4068 4472 cmd.exe 119 PID 4068 wrote to memory of 1720 4068 KVO.exe 120 PID 1720 wrote to memory of 5208 1720 cmd.exe 124 PID 5208 wrote to memory of 1828 5208 CYAHA.exe 125 PID 1828 wrote to memory of 3924 1828 cmd.exe 129 PID 3924 wrote to memory of 5688 3924 OGGPMOD.exe 130 PID 5688 wrote to memory of 4336 5688 cmd.exe 134 PID 4336 wrote to memory of 3548 4336 WWHHTB.exe 135 PID 3548 wrote to memory of 4820 3548 cmd.exe 139 PID 4820 wrote to memory of 2588 4820 EKMVD.exe 140 PID 2588 wrote to memory of 2556 2588 cmd.exe 144 PID 2556 wrote to memory of 5668 2556 OHAIL.exe 145 PID 5668 wrote to memory of 2916 5668 cmd.exe 149 PID 2916 wrote to memory of 1876 2916 KABS.exe 150 PID 1876 wrote to memory of 5856 1876 cmd.exe 154 PID 5856 wrote to memory of 2988 5856 ESRD.exe 155 PID 2988 wrote to memory of 5792 2988 cmd.exe 159 PID 5792 wrote to memory of 4136 5792 CLU.exe 160 PID 4136 wrote to memory of 3808 4136 cmd.exe 164 PID 3808 wrote to memory of 3504 3808 ULI.exe 165 PID 3504 wrote to memory of 1104 3504 cmd.exe 169 PID 1104 wrote to memory of 4576 1104 QMSSFOV.exe 170 PID 4576 wrote to memory of 624 4576 cmd.exe 174 PID 624 wrote to memory of 6056 624 VRCIVJ.exe 175 PID 6056 wrote to memory of 5392 6056 cmd.exe 179 PID 5392 wrote to memory of 704 5392 DXPOG.exe 180 PID 704 wrote to memory of 3508 704 cmd.exe 184 PID 3508 wrote to memory of 4920 3508 QDPAIT.exe 185 PID 4920 wrote to memory of 1836 4920 cmd.exe 189 PID 1836 wrote to memory of 3512 1836 ULV.exe 190 PID 3512 wrote to memory of 3412 3512 cmd.exe 194 PID 3412 wrote to memory of 4300 3412 IWMZIO.exe 195 PID 4300 wrote to memory of 5760 4300 cmd.exe 199 PID 5760 wrote to memory of 4776 5760 GGPPR.exe 200 PID 4776 wrote to memory of 1372 4776 cmd.exe 204 PID 1372 wrote to memory of 5892 1372 HJSSWSC.exe 205 PID 5892 wrote to memory of 2348 5892 cmd.exe 209 PID 2348 wrote to memory of 3488 2348 PPFZHRX.exe 210 PID 3488 wrote to memory of 816 3488 cmd.exe 214 PID 816 wrote to memory of 1320 816 KKKJ.exe 215 PID 1320 wrote to memory of 244 1320 cmd.exe 219 PID 244 wrote to memory of 3052 244 TKEOVWO.exe 220 PID 3052 wrote to memory of 3856 3052 cmd.exe 223 PID 3856 wrote to memory of 5800 3856 GVUMJ.exe 225 PID 5800 wrote to memory of 3148 5800 cmd.exe 229 PID 3148 wrote to memory of 1020 3148 WLV.exe 230 PID 1020 wrote to memory of 3036 1020 cmd.exe 234 PID 3036 wrote to memory of 2844 3036 QZAVS.exe 235 PID 2844 wrote to memory of 4516 2844 cmd.exe 239 PID 4516 wrote to memory of 3384 4516 CPHVEMJ.exe 240 PID 3384 wrote to memory of 3532 3384 cmd.exe 244 PID 3532 wrote to memory of 3728 3532 VKLR.exe 245 PID 3728 wrote to memory of 5816 3728 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_de7db42df2e64fdf14aebbb933f6c0e4_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_de7db42df2e64fdf14aebbb933f6c0e4_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JVB.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:724 -
C:\windows\system\JVB.exeC:\windows\system\JVB.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OWXWPT.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\windows\OWXWPT.exeC:\windows\OWXWPT.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZB.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\windows\GZB.exeC:\windows\GZB.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UXBDWV.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\windows\UXBDWV.exeC:\windows\UXBDWV.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PIRCKF.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\windows\system\PIRCKF.exeC:\windows\system\PIRCKF.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVO.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\windows\SysWOW64\KVO.exeC:\windows\system32\KVO.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CYAHA.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\windows\CYAHA.exeC:\windows\CYAHA.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OGGPMOD.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\windows\SysWOW64\OGGPMOD.exeC:\windows\system32\OGGPMOD.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WWHHTB.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\windows\SysWOW64\WWHHTB.exeC:\windows\system32\WWHHTB.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EKMVD.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\windows\SysWOW64\EKMVD.exeC:\windows\system32\EKMVD.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHAIL.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\windows\system\OHAIL.exeC:\windows\system\OHAIL.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KABS.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\windows\KABS.exeC:\windows\KABS.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ESRD.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\windows\SysWOW64\ESRD.exeC:\windows\system32\ESRD.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLU.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\windows\system\CLU.exeC:\windows\system\CLU.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ULI.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\windows\ULI.exeC:\windows\ULI.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QMSSFOV.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\windows\QMSSFOV.exeC:\windows\QMSSFOV.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRCIVJ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\windows\VRCIVJ.exeC:\windows\VRCIVJ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DXPOG.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\windows\system\DXPOG.exeC:\windows\system\DXPOG.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QDPAIT.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:704 -
C:\windows\SysWOW64\QDPAIT.exeC:\windows\system32\QDPAIT.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ULV.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\windows\ULV.exeC:\windows\ULV.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IWMZIO.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\windows\SysWOW64\IWMZIO.exeC:\windows\system32\IWMZIO.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GGPPR.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\windows\GGPPR.exeC:\windows\GGPPR.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HJSSWSC.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\windows\HJSSWSC.exeC:\windows\HJSSWSC.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PPFZHRX.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\windows\PPFZHRX.exeC:\windows\PPFZHRX.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KKKJ.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\windows\system\KKKJ.exeC:\windows\system\KKKJ.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKEOVWO.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\windows\SysWOW64\TKEOVWO.exeC:\windows\system32\TKEOVWO.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GVUMJ.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\windows\GVUMJ.exeC:\windows\GVUMJ.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLV.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\windows\SysWOW64\WLV.exeC:\windows\system32\WLV.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QZAVS.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\windows\QZAVS.exeC:\windows\QZAVS.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPHVEMJ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\windows\system\CPHVEMJ.exeC:\windows\system\CPHVEMJ.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VKLR.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\windows\VKLR.exeC:\windows\VKLR.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FHYL.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\windows\SysWOW64\FHYL.exeC:\windows\system32\FHYL.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OQSQD.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:620 -
C:\windows\SysWOW64\OQSQD.exeC:\windows\system32\OQSQD.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLK.exe.bat" "68⤵PID:5536
-
C:\windows\SysWOW64\DLK.exeC:\windows\system32\DLK.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HTQDA.exe.bat" "70⤵PID:5400
-
C:\windows\HTQDA.exeC:\windows\HTQDA.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IWUG.exe.bat" "72⤵PID:1624
-
C:\windows\system\IWUG.exeC:\windows\system\IWUG.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZYCTB.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2980 -
C:\windows\system\AZYCTB.exeC:\windows\system\AZYCTB.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPZB.exe.bat" "76⤵PID:3204
-
C:\windows\QPZB.exeC:\windows\QPZB.exe77⤵
- Executes dropped EXE
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FKIGKJA.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2080 -
C:\windows\FKIGKJA.exeC:\windows\FKIGKJA.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OKKL.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4252 -
C:\windows\SysWOW64\OKKL.exeC:\windows\system32\OKKL.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AARTAZ.exe.bat" "82⤵
- Executes a command shell one-liner
PID:5264 -
C:\windows\AARTAZ.exeC:\windows\AARTAZ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYEFHH.exe.bat" "84⤵PID:960
-
C:\windows\system\CYEFHH.exeC:\windows\system\CYEFHH.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SOFFOVO.exe.bat" "86⤵PID:4680
-
C:\windows\SOFFOVO.exeC:\windows\SOFFOVO.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KRJAUT.exe.bat" "88⤵PID:1336
-
C:\windows\SysWOW64\KRJAUT.exeC:\windows\system32\KRJAUT.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZMTN.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:1140 -
C:\windows\SysWOW64\ZMTN.exeC:\windows\system32\ZMTN.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PCUEL.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3476 -
C:\windows\PCUEL.exeC:\windows\PCUEL.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EXD.exe.bat" "94⤵PID:5900
-
C:\windows\EXD.exeC:\windows\EXD.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZLIAP.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2876 -
C:\windows\SysWOW64\ZLIAP.exeC:\windows\system32\ZLIAP.exe97⤵
- Executes dropped EXE
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FGH.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1988 -
C:\windows\system\FGH.exeC:\windows\system\FGH.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OTS.exe.bat" "100⤵PID:2004
-
C:\windows\system\OTS.exeC:\windows\system\OTS.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AWQOBG.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1588 -
C:\windows\SysWOW64\AWQOBG.exeC:\windows\system32\AWQOBG.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HRZS.exe.bat" "104⤵PID:928
-
C:\windows\SysWOW64\HRZS.exeC:\windows\system32\HRZS.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YABXXZB.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:4248 -
C:\windows\YABXXZB.exeC:\windows\YABXXZB.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XKMN.exe.bat" "108⤵PID:5776
-
C:\windows\XKMN.exeC:\windows\XKMN.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MFVRRRY.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:3320 -
C:\windows\system\MFVRRRY.exeC:\windows\system\MFVRRRY.exe111⤵
- Executes dropped EXE
PID:2596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FIZVXP.exe.bat" "112⤵PID:1108
-
C:\windows\FIZVXP.exeC:\windows\FIZVXP.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GED.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:2572 -
C:\windows\GED.exeC:\windows\GED.exe115⤵
- Executes dropped EXE
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AZIIM.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:240 -
C:\windows\AZIIM.exeC:\windows\AZIIM.exe117⤵
- Executes dropped EXE
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TUME.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5660 -
C:\windows\TUME.exeC:\windows\TUME.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DSRYHD.exe.bat" "120⤵PID:2836
-
C:\windows\DSRYHD.exeC:\windows\DSRYHD.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-