Analysis
- max time kernel
81s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 16:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_be016c1bb62f3764c7fb7261191d6bd8_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-29_be016c1bb62f3764c7fb7261191d6bd8_elex_emotet_stop.exe
- Size 208KB
- Sample260930-vg8rmsde62
- SHA256 c0674ca61e18aa4a6c758e97bf9d525a5d6010853ba606d10f01276a5eeda1ed
- MD5 be016c1bb62f3764c7fb7261191d6bd8
- SHA1 db1332d3ff4a991ce8e334871eb2878e9486de05
- SHA512 c978b610e00a8aadb07345dee1482230780ab8287a715d84ddfc2517e164e9a1e7d750d15d2c9714adab4741dade4e075c573ae5fda4ad97aa04fd9ce265b2a6
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfB4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOpkEj1
- TLSH T1B3247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5940 AGKVJL.exe 5256 LJJ.exe 5564 AESBHY.exe 2796 RPVRQ.exe 2012 IXXWBJ.exe 4824 KVDRJS.exe 5484 ZQUV.exe 5180 OGVUAAV.exe 2768 AZQ.exe 1904 TRGYSI.exe 1596 XHMY.exe 5688 GHODIYR.exe 1836 MIWRRAS.exe 5808 DQYWCY.exe 2920 FOD.exe 3336 KGNT.exe 2624 OWUBACA.exe 5240 SEBB.exe 1636 NSFKWN.exe 5356 EAHXASN.exe 3044 ZNMH.exe 2160 RQQ.exe 3408 EBYBDL.exe 2488 AZGN.exe 936 NKPLUHV.exe 3204 GCEWLIL.exe 2648 OSFOKV.exe 3352 UTN.exe 1708 AOMK.exe 2948 PJVPQNA.exe 1868 TRCP.exe 2256 ZMBXZJD.exe 3412 UAGH.exe 3800 QFQWAEM.exe 5864 LSVG.exe 3676 NOAPME.exe 4672 XOCU.exe 5908 GWEZB.exe 3040 SEL.exe 2484 LHODT.exe 1056 QIWRCJT.exe 1028 AIY.exe 804 GIGRWJ.exe 3856 GWGYYV.exe 4256 XBQQ.exe 3004 IULJW.exe 2120 OUTWFC.exe 5768 IPYGPCS.exe 3404 SQATTZ.exe 2288 EYG.exe 5336 NGIY.exe 4264 ROPGVHH.exe 6064 IWRLY.exe 1688 DKWUIMY.exe 3012 DCEWOQM.exe 3636 OVH.exe 3788 ZNCZ.exe 3180 OIMMQAS.exe 1120 JWRV.exe 4968 EJVFKA.exe 5260 MWWTMMY.exe 5592 XPZ.exe 1276 SCVVW.exe 1068 MQAFHU.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\OIMMQAS.exe.bat ZNCZ.exe File created C:\windows\SysWOW64\LUMPM.exe NTFBDVD.exe File opened for modification C:\windows\SysWOW64\PCRDRAC.exe MOMMH.exe File created C:\windows\SysWOW64\AESBHY.exe LJJ.exe File created C:\windows\SysWOW64\KGNT.exe FOD.exe File created C:\windows\SysWOW64\OWUBACA.exe.bat KGNT.exe File created C:\windows\SysWOW64\SEBB.exe.bat OWUBACA.exe File opened for modification C:\windows\SysWOW64\NKPLUHV.exe AZGN.exe File created C:\windows\SysWOW64\PJVPQNA.exe AOMK.exe File opened for modification C:\windows\SysWOW64\PJVPQNA.exe AOMK.exe File created C:\windows\SysWOW64\QIWRCJT.exe LHODT.exe File opened for modification C:\windows\SysWOW64\AESBHY.exe LJJ.exe File opened for modification C:\windows\SysWOW64\KVDRJS.exe IXXWBJ.exe File created C:\windows\SysWOW64\DCEWOQM.exe.bat DKWUIMY.exe File opened for modification C:\windows\SysWOW64\EJVFKA.exe JWRV.exe File created C:\windows\SysWOW64\EJVFKA.exe.bat JWRV.exe File created C:\windows\SysWOW64\NTFBDVD.exe WTDWSX.exe File created C:\windows\SysWOW64\EAHXASN.exe.bat NSFKWN.exe File created C:\windows\SysWOW64\OSFOKV.exe GCEWLIL.exe File created C:\windows\SysWOW64\PCRDRAC.exe.bat MOMMH.exe File created C:\windows\SysWOW64\KVDRJS.exe IXXWBJ.exe File created C:\windows\SysWOW64\KGNT.exe.bat FOD.exe File created C:\windows\SysWOW64\RQQ.exe ZNMH.exe File opened for modification C:\windows\SysWOW64\QIWRCJT.exe LHODT.exe File created C:\windows\SysWOW64\QIWRCJT.exe.bat LHODT.exe File created C:\windows\SysWOW64\IULJW.exe XBQQ.exe File opened for modification C:\windows\SysWOW64\HQT.exe HLTVFYY.exe File opened for modification C:\windows\SysWOW64\NTFBDVD.exe WTDWSX.exe File created C:\windows\SysWOW64\SEBB.exe OWUBACA.exe File created C:\windows\SysWOW64\NSFKWN.exe.bat SEBB.exe File created C:\windows\SysWOW64\OSFOKV.exe.bat GCEWLIL.exe File created C:\windows\SysWOW64\PJVPQNA.exe.bat AOMK.exe File created C:\windows\SysWOW64\NOAPME.exe.bat LSVG.exe File created C:\windows\SysWOW64\IULJW.exe.bat XBQQ.exe File created C:\windows\SysWOW64\EYG.exe SQATTZ.exe File opened for modification C:\windows\SysWOW64\EYG.exe SQATTZ.exe File opened for modification C:\windows\SysWOW64\NSFKWN.exe SEBB.exe File created C:\windows\SysWOW64\AZGN.exe.bat EBYBDL.exe File opened for modification C:\windows\SysWOW64\OSFOKV.exe GCEWLIL.exe File created C:\windows\SysWOW64\OUTWFC.exe IULJW.exe File opened for modification C:\windows\SysWOW64\LJJ.exe AGKVJL.exe File created C:\windows\SysWOW64\ZQUV.exe KVDRJS.exe File created C:\windows\SysWOW64\OWUBACA.exe KGNT.exe File opened for modification C:\windows\SysWOW64\EBYBDL.exe RQQ.exe File created C:\windows\SysWOW64\AZGN.exe EBYBDL.exe File created C:\windows\SysWOW64\NKPLUHV.exe.bat AZGN.exe File created C:\windows\SysWOW64\OIMMQAS.exe ZNCZ.exe File created C:\windows\SysWOW64\HQT.exe.bat HLTVFYY.exe File opened for modification C:\windows\SysWOW64\OIMMQAS.exe ZNCZ.exe File created C:\windows\SysWOW64\SCVVW.exe XPZ.exe File created C:\windows\SysWOW64\HQT.exe HLTVFYY.exe File created C:\windows\SysWOW64\PCRDRAC.exe MOMMH.exe File created C:\windows\SysWOW64\EBYBDL.exe.bat RQQ.exe File created C:\windows\SysWOW64\VQXZ.exe.bat PVXYAX.exe File created C:\windows\SysWOW64\IFVZXX.exe.bat PCRDRAC.exe File created C:\windows\SysWOW64\KVDRJS.exe.bat IXXWBJ.exe File opened for modification C:\windows\SysWOW64\OWUBACA.exe KGNT.exe File created C:\windows\SysWOW64\TRCP.exe PJVPQNA.exe File created C:\windows\SysWOW64\VQXZ.exe PVXYAX.exe File created C:\windows\SysWOW64\LHD.exe.bat DBYD.exe File created C:\windows\SysWOW64\LJJ.exe AGKVJL.exe File opened for modification C:\windows\SysWOW64\SEBB.exe OWUBACA.exe File opened for modification C:\windows\SysWOW64\DCEWOQM.exe DKWUIMY.exe File opened for modification C:\windows\SysWOW64\IFVZXX.exe PCRDRAC.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\NEHCG.exe JVB.exe File created C:\windows\system\MOMMH.exe KRG.exe File created C:\windows\EJJUCU.exe FIVXPD.exe File opened for modification C:\windows\GHODIYR.exe XHMY.exe File created C:\windows\system\OVH.exe.bat DCEWOQM.exe File opened for modification C:\windows\YWQVI.exe PVO.exe File created C:\windows\XCF.exe NEZ.exe File created C:\windows\BKMIW.exe XCF.exe File created C:\windows\system\LSVG.exe QFQWAEM.exe File opened for modification C:\windows\system\SEL.exe GWEZB.exe File created C:\windows\AIY.exe.bat QIWRCJT.exe File opened for modification C:\windows\system\GIGRWJ.exe AIY.exe File created C:\windows\XPZ.exe.bat MWWTMMY.exe File opened for modification C:\windows\MQAFHU.exe SCVVW.exe File opened for modification C:\windows\XPT.exe TZNEO.exe File created C:\windows\system\YWKMOD.exe.bat NEHCG.exe File created C:\windows\AGKVJL.exe.bat 2026-09-29_be016c1bb62f3764c7fb7261191d6bd8_elex_emotet_stop.exe File opened for modification C:\windows\system\XHMY.exe TRGYSI.exe File created C:\windows\ZNMH.exe.bat EAHXASN.exe File opened for modification C:\windows\system\AOMK.exe UTN.exe File opened for modification C:\windows\PVXYAX.exe LFRY.exe File created C:\windows\AGKVJL.exe 2026-09-29_be016c1bb62f3764c7fb7261191d6bd8_elex_emotet_stop.exe File created C:\windows\system\AZQ.exe OGVUAAV.exe File created C:\windows\system\MIWRRAS.exe.bat GHODIYR.exe File created C:\windows\YWQVI.exe.bat PVO.exe File opened for modification C:\windows\XCF.exe NEZ.exe File created C:\windows\NEHCG.exe.bat JVB.exe File created C:\windows\system\LFRY.exe.bat KKNUJ.exe File created C:\windows\system\RPVRQ.exe.bat AESBHY.exe File created C:\windows\XOCU.exe NOAPME.exe File created C:\windows\DKWUIMY.exe.bat IWRLY.exe File opened for modification C:\windows\ZNCZ.exe OVH.exe File created C:\windows\CMRU.exe.bat YWKMOD.exe File created C:\windows\BTZGN.exe.bat VGAY.exe File created C:\windows\system\QOI.exe BTZGN.exe File created C:\windows\system\QOI.exe.bat BTZGN.exe File created C:\windows\system\GCEWLIL.exe NKPLUHV.exe File created C:\windows\YWQVI.exe PVO.exe File created C:\windows\OIWKRE.exe.bat DQBRJ.exe File created C:\windows\system\KKNUJ.exe QOI.exe File opened for modification C:\windows\system\KKNUJ.exe QOI.exe File created C:\windows\IXXWBJ.exe RPVRQ.exe File created C:\windows\GWGYYV.exe GIGRWJ.exe File created C:\windows\XPT.exe.bat TZNEO.exe File created C:\windows\system\DFDZQWS.exe CMRU.exe File created C:\windows\system\UTN.exe.bat OSFOKV.exe File created C:\windows\system\AOMK.exe UTN.exe File created C:\windows\AIY.exe QIWRCJT.exe File created C:\windows\ZNCZ.exe.bat OVH.exe File created C:\windows\MWWTMMY.exe EJVFKA.exe File opened for modification C:\windows\system\SRVESD.exe YWQVI.exe File opened for modification C:\windows\CMRU.exe YWKMOD.exe File created C:\windows\system\KRG.exe QDBIPS.exe File created C:\windows\system\OGVUAAV.exe.bat ZQUV.exe File created C:\windows\GHODIYR.exe.bat XHMY.exe File created C:\windows\system\QFQWAEM.exe.bat UAGH.exe File created C:\windows\GWEZB.exe.bat XOCU.exe File created C:\windows\SQATTZ.exe.bat IPYGPCS.exe File created C:\windows\MQAFHU.exe SCVVW.exe File created C:\windows\system\JVB.exe OIWKRE.exe File opened for modification C:\windows\NEHCG.exe JVB.exe File opened for modification C:\windows\system\JVB.exe OIWKRE.exe File created C:\windows\system\KKNUJ.exe.bat QOI.exe File opened for modification C:\windows\system\IILVLZ.exe IFVZXX.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2156 cmd.exe 3100 cmd.exe 4920 cmd.exe 2772 cmd.exe 3608 cmd.exe 900 cmd.exe 4296 cmd.exe 4072 cmd.exe 3400 cmd.exe 3816 cmd.exe 924 cmd.exe 4156 cmd.exe 3152 cmd.exe 1664 cmd.exe 1724 cmd.exe 2072 cmd.exe 4588 cmd.exe 4064 cmd.exe 2936 cmd.exe 940 cmd.exe 1972 cmd.exe 4580 cmd.exe 4960 cmd.exe 5152 cmd.exe 4764 cmd.exe 2152 cmd.exe 2448 cmd.exe 2092 cmd.exe 1448 cmd.exe 3464 cmd.exe 3036 cmd.exe 424 cmd.exe 3548 cmd.exe 4244 cmd.exe 2572 cmd.exe 1180 cmd.exe 3460 cmd.exe 2856 cmd.exe 4640 cmd.exe 3104 cmd.exe 1212 cmd.exe 4912 cmd.exe 5020 cmd.exe 4420 cmd.exe 4736 cmd.exe 4900 cmd.exe 1248 cmd.exe 1388 cmd.exe 2820 cmd.exe 476 cmd.exe 3508 cmd.exe 2096 cmd.exe 2060 cmd.exe 3808 cmd.exe 4896 cmd.exe 4644 cmd.exe 4520 cmd.exe 2544 cmd.exe 2452 cmd.exe 548 cmd.exe 4728 cmd.exe 2236 cmd.exe 4052 cmd.exe 2748 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4584 4436 WerFault.exe 87 3008 5940 WerFault.exe 93 2300 5256 WerFault.exe 99 5596 5564 WerFault.exe 104 4520 2796 WerFault.exe 109 1532 2012 WerFault.exe 114 2392 4824 WerFault.exe 119 3248 5484 WerFault.exe 124 3568 5180 WerFault.exe 129 832 2768 WerFault.exe 134 264 1904 WerFault.exe 139 4208 1596 WerFault.exe 144 5460 5688 WerFault.exe 149 5208 1836 WerFault.exe 154 1604 5808 WerFault.exe 159 3628 2920 WerFault.exe 164 3268 3336 WerFault.exe 169 5788 2624 WerFault.exe 174 1708 5240 WerFault.exe 179 4076 1636 WerFault.exe 184 3464 5356 WerFault.exe 189 5524 3044 WerFault.exe 194 1020 2160 WerFault.exe 199 4908 3408 WerFault.exe 204 3616 2488 WerFault.exe 209 6032 936 WerFault.exe 214 1416 3204 WerFault.exe 219 504 2648 WerFault.exe 224 2892 3352 WerFault.exe 229 1724 1708 WerFault.exe 234 2700 2948 WerFault.exe 239 5312 1868 WerFault.exe 244 2428 2256 WerFault.exe 249 5708 3412 WerFault.exe 254 3948 3800 WerFault.exe 259 5080 5864 WerFault.exe 264 2436 3676 WerFault.exe 269 5856 4672 WerFault.exe 274 6100 5908 WerFault.exe 280 4440 3040 WerFault.exe 285 5440 2484 WerFault.exe 290 1460 1056 WerFault.exe 295 3888 1028 WerFault.exe 300 2348 804 WerFault.exe 305 3624 3856 WerFault.exe 310 2168 4256 WerFault.exe 315 4756 3004 WerFault.exe 320 5236 2120 WerFault.exe 325 2112 5768 WerFault.exe 330 4936 3404 WerFault.exe 335 5052 2288 WerFault.exe 340 2772 5336 WerFault.exe 345 5064 4264 WerFault.exe 350 4444 6064 WerFault.exe 355 2592 1688 WerFault.exe 360 3432 3012 WerFault.exe 365 424 3636 WerFault.exe 370 6012 3788 WerFault.exe 375 3328 3180 WerFault.exe 380 2764 1120 WerFault.exe 385 1208 4968 WerFault.exe 390 5148 5260 WerFault.exe 395 2352 5592 WerFault.exe 400 5956 1276 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZMBXZJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTFBDVD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTZGN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QOI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KRG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXXWBJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MIWRRAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEBB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGIY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIMMQAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEHCG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FIVXPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROPGVHH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKMIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PVXYAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IILVLZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_be016c1bb62f3764c7fb7261191d6bd8_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWGYYV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUMPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QDBIPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AOMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MQAFHU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQXZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOD.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4436 2026-09-29_be016c1bb62f3764c7fb7261191d6bd8_elex_emotet_stop.exe 4436 2026-09-29_be016c1bb62f3764c7fb7261191d6bd8_elex_emotet_stop.exe 5940 AGKVJL.exe 5940 AGKVJL.exe 5256 LJJ.exe 5256 LJJ.exe 5564 AESBHY.exe 5564 AESBHY.exe 2796 RPVRQ.exe 2796 RPVRQ.exe 2012 IXXWBJ.exe 2012 IXXWBJ.exe 4824 KVDRJS.exe 4824 KVDRJS.exe 5484 ZQUV.exe 5484 ZQUV.exe 5180 OGVUAAV.exe 5180 OGVUAAV.exe 2768 AZQ.exe 2768 AZQ.exe 1904 TRGYSI.exe 1904 TRGYSI.exe 1596 XHMY.exe 1596 XHMY.exe 5688 GHODIYR.exe 5688 GHODIYR.exe 1836 MIWRRAS.exe 1836 MIWRRAS.exe 5808 DQYWCY.exe 5808 DQYWCY.exe 2920 FOD.exe 2920 FOD.exe 3336 KGNT.exe 3336 KGNT.exe 2624 OWUBACA.exe 2624 OWUBACA.exe 5240 SEBB.exe 5240 SEBB.exe 1636 NSFKWN.exe 1636 NSFKWN.exe 5356 EAHXASN.exe 5356 EAHXASN.exe 3044 ZNMH.exe 3044 ZNMH.exe 2160 RQQ.exe 2160 RQQ.exe 3408 EBYBDL.exe 3408 EBYBDL.exe 2488 AZGN.exe 2488 AZGN.exe 936 NKPLUHV.exe 936 NKPLUHV.exe 3204 GCEWLIL.exe 3204 GCEWLIL.exe 2648 OSFOKV.exe 2648 OSFOKV.exe 3352 UTN.exe 3352 UTN.exe 1708 AOMK.exe 1708 AOMK.exe 2948 PJVPQNA.exe 2948 PJVPQNA.exe 1868 TRCP.exe 1868 TRCP.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4436 2026-09-29_be016c1bb62f3764c7fb7261191d6bd8_elex_emotet_stop.exe 4436 2026-09-29_be016c1bb62f3764c7fb7261191d6bd8_elex_emotet_stop.exe 5940 AGKVJL.exe 5940 AGKVJL.exe 5256 LJJ.exe 5256 LJJ.exe 5564 AESBHY.exe 5564 AESBHY.exe 2796 RPVRQ.exe 2796 RPVRQ.exe 2012 IXXWBJ.exe 2012 IXXWBJ.exe 4824 KVDRJS.exe 4824 KVDRJS.exe 5484 ZQUV.exe 5484 ZQUV.exe 5180 OGVUAAV.exe 5180 OGVUAAV.exe 2768 AZQ.exe 2768 AZQ.exe 1904 TRGYSI.exe 1904 TRGYSI.exe 1596 XHMY.exe 1596 XHMY.exe 5688 GHODIYR.exe 5688 GHODIYR.exe 1836 MIWRRAS.exe 1836 MIWRRAS.exe 5808 DQYWCY.exe 5808 DQYWCY.exe 2920 FOD.exe 2920 FOD.exe 3336 KGNT.exe 3336 KGNT.exe 2624 OWUBACA.exe 2624 OWUBACA.exe 5240 SEBB.exe 5240 SEBB.exe 1636 NSFKWN.exe 1636 NSFKWN.exe 5356 EAHXASN.exe 5356 EAHXASN.exe 3044 ZNMH.exe 3044 ZNMH.exe 2160 RQQ.exe 2160 RQQ.exe 3408 EBYBDL.exe 3408 EBYBDL.exe 2488 AZGN.exe 2488 AZGN.exe 936 NKPLUHV.exe 936 NKPLUHV.exe 3204 GCEWLIL.exe 3204 GCEWLIL.exe 2648 OSFOKV.exe 2648 OSFOKV.exe 3352 UTN.exe 3352 UTN.exe 1708 AOMK.exe 1708 AOMK.exe 2948 PJVPQNA.exe 2948 PJVPQNA.exe 1868 TRCP.exe 1868 TRCP.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4436 wrote to memory of 256 4436 2026-09-29_be016c1bb62f3764c7fb7261191d6bd8_elex_emotet_stop.exe 89 PID 256 wrote to memory of 5940 256 cmd.exe 93 PID 5940 wrote to memory of 3100 5940 AGKVJL.exe 95 PID 3100 wrote to memory of 5256 3100 cmd.exe 99 PID 5256 wrote to memory of 1972 5256 LJJ.exe 100 PID 1972 wrote to memory of 5564 1972 cmd.exe 104 PID 5564 wrote to memory of 5344 5564 AESBHY.exe 105 PID 5344 wrote to memory of 2796 5344 cmd.exe 109 PID 2796 wrote to memory of 4420 2796 RPVRQ.exe 110 PID 4420 wrote to memory of 2012 4420 cmd.exe 114 PID 2012 wrote to memory of 1448 2012 IXXWBJ.exe 115 PID 1448 wrote to memory of 4824 1448 cmd.exe 119 PID 4824 wrote to memory of 2060 4824 KVDRJS.exe 120 PID 2060 wrote to memory of 5484 2060 cmd.exe 124 PID 5484 wrote to memory of 5600 5484 ZQUV.exe 125 PID 5600 wrote to memory of 5180 5600 cmd.exe 129 PID 5180 wrote to memory of 3740 5180 OGVUAAV.exe 130 PID 3740 wrote to memory of 2768 3740 cmd.exe 134 PID 2768 wrote to memory of 3612 2768 AZQ.exe 135 PID 3612 wrote to memory of 1904 3612 cmd.exe 139 PID 1904 wrote to memory of 2852 1904 TRGYSI.exe 140 PID 2852 wrote to memory of 1596 2852 cmd.exe 144 PID 1596 wrote to memory of 3808 1596 XHMY.exe 145 PID 3808 wrote to memory of 5688 3808 cmd.exe 149 PID 5688 wrote to memory of 4296 5688 GHODIYR.exe 150 PID 4296 wrote to memory of 1836 4296 cmd.exe 154 PID 1836 wrote to memory of 5872 1836 MIWRRAS.exe 155 PID 5872 wrote to memory of 5808 5872 cmd.exe 159 PID 5808 wrote to memory of 5140 5808 DQYWCY.exe 160 PID 5140 wrote to memory of 2920 5140 cmd.exe 164 PID 2920 wrote to memory of 5892 2920 FOD.exe 165 PID 5892 wrote to memory of 3336 5892 cmd.exe 169 PID 3336 wrote to memory of 5904 3336 KGNT.exe 170 PID 5904 wrote to memory of 2624 5904 cmd.exe 174 PID 2624 wrote to memory of 3172 2624 OWUBACA.exe 175 PID 3172 wrote to memory of 5240 3172 cmd.exe 179 PID 5240 wrote to memory of 2452 5240 SEBB.exe 180 PID 2452 wrote to memory of 1636 2452 cmd.exe 184 PID 1636 wrote to memory of 4260 1636 NSFKWN.exe 185 PID 4260 wrote to memory of 5356 4260 cmd.exe 189 PID 5356 wrote to memory of 2868 5356 EAHXASN.exe 190 PID 2868 wrote to memory of 3044 2868 cmd.exe 194 PID 3044 wrote to memory of 2704 3044 ZNMH.exe 195 PID 2704 wrote to memory of 2160 2704 cmd.exe 199 PID 2160 wrote to memory of 6020 2160 RQQ.exe 200 PID 6020 wrote to memory of 3408 6020 cmd.exe 204 PID 3408 wrote to memory of 948 3408 EBYBDL.exe 205 PID 948 wrote to memory of 2488 948 cmd.exe 209 PID 2488 wrote to memory of 5876 2488 AZGN.exe 210 PID 5876 wrote to memory of 936 5876 cmd.exe 214 PID 936 wrote to memory of 200 936 NKPLUHV.exe 215 PID 200 wrote to memory of 3204 200 cmd.exe 219 PID 3204 wrote to memory of 5836 3204 GCEWLIL.exe 220 PID 5836 wrote to memory of 2648 5836 cmd.exe 224 PID 2648 wrote to memory of 2820 2648 OSFOKV.exe 225 PID 2820 wrote to memory of 3352 2820 cmd.exe 229 PID 3352 wrote to memory of 548 3352 UTN.exe 230 PID 548 wrote to memory of 1708 548 cmd.exe 234 PID 1708 wrote to memory of 1980 1708 AOMK.exe 235 PID 1980 wrote to memory of 2948 1980 cmd.exe 239 PID 2948 wrote to memory of 3544 2948 PJVPQNA.exe 240 PID 3544 wrote to memory of 1868 3544 cmd.exe 244 PID 1868 wrote to memory of 4944 1868 TRCP.exe 245 PID 4944 wrote to memory of 2256 4944 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_be016c1bb62f3764c7fb7261191d6bd8_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_be016c1bb62f3764c7fb7261191d6bd8_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGKVJL.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:256 -
C:\windows\AGKVJL.exeC:\windows\AGKVJL.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJJ.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\windows\SysWOW64\LJJ.exeC:\windows\system32\LJJ.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AESBHY.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\windows\SysWOW64\AESBHY.exeC:\windows\system32\AESBHY.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPVRQ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\windows\system\RPVRQ.exeC:\windows\system\RPVRQ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IXXWBJ.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\windows\IXXWBJ.exeC:\windows\IXXWBJ.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVDRJS.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\windows\SysWOW64\KVDRJS.exeC:\windows\system32\KVDRJS.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQUV.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\windows\SysWOW64\ZQUV.exeC:\windows\system32\ZQUV.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGVUAAV.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\windows\system\OGVUAAV.exeC:\windows\system\OGVUAAV.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZQ.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\windows\system\AZQ.exeC:\windows\system\AZQ.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRGYSI.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\windows\TRGYSI.exeC:\windows\TRGYSI.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XHMY.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\windows\system\XHMY.exeC:\windows\system\XHMY.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GHODIYR.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\windows\GHODIYR.exeC:\windows\GHODIYR.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MIWRRAS.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\windows\system\MIWRRAS.exeC:\windows\system\MIWRRAS.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQYWCY.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\windows\system\DQYWCY.exeC:\windows\system\DQYWCY.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FOD.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\windows\system\FOD.exeC:\windows\system\FOD.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGNT.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\windows\SysWOW64\KGNT.exeC:\windows\system32\KGNT.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWUBACA.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\windows\SysWOW64\OWUBACA.exeC:\windows\system32\OWUBACA.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEBB.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\windows\SysWOW64\SEBB.exeC:\windows\system32\SEBB.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NSFKWN.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\SysWOW64\NSFKWN.exeC:\windows\system32\NSFKWN.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EAHXASN.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\windows\SysWOW64\EAHXASN.exeC:\windows\system32\EAHXASN.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNMH.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\windows\ZNMH.exeC:\windows\ZNMH.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RQQ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\windows\SysWOW64\RQQ.exeC:\windows\system32\RQQ.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EBYBDL.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\windows\SysWOW64\EBYBDL.exeC:\windows\system32\EBYBDL.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZGN.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\windows\SysWOW64\AZGN.exeC:\windows\system32\AZGN.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NKPLUHV.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\windows\SysWOW64\NKPLUHV.exeC:\windows\system32\NKPLUHV.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCEWLIL.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:200 -
C:\windows\system\GCEWLIL.exeC:\windows\system\GCEWLIL.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OSFOKV.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\windows\SysWOW64\OSFOKV.exeC:\windows\system32\OSFOKV.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTN.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\windows\system\UTN.exeC:\windows\system\UTN.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOMK.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:548 -
C:\windows\system\AOMK.exeC:\windows\system\AOMK.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJVPQNA.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\windows\SysWOW64\PJVPQNA.exeC:\windows\system32\PJVPQNA.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TRCP.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\windows\SysWOW64\TRCP.exeC:\windows\system32\TRCP.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZMBXZJD.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\windows\ZMBXZJD.exeC:\windows\ZMBXZJD.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UAGH.exe.bat" "66⤵PID:4340
-
C:\windows\UAGH.exeC:\windows\UAGH.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFQWAEM.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4580 -
C:\windows\system\QFQWAEM.exeC:\windows\system\QFQWAEM.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LSVG.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:5832 -
C:\windows\system\LSVG.exeC:\windows\system\LSVG.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOAPME.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4640 -
C:\windows\SysWOW64\NOAPME.exeC:\windows\system32\NOAPME.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XOCU.exe.bat" "74⤵PID:1204
-
C:\windows\XOCU.exeC:\windows\XOCU.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWEZB.exe.bat" "76⤵
- Executes a command shell one-liner
PID:4896 -
C:\windows\GWEZB.exeC:\windows\GWEZB.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEL.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5184 -
C:\windows\system\SEL.exeC:\windows\system\SEL.exe79⤵
- Executes dropped EXE
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LHODT.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4960 -
C:\windows\system\LHODT.exeC:\windows\system\LHODT.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QIWRCJT.exe.bat" "82⤵
- Executes a command shell one-liner
PID:3464 -
C:\windows\SysWOW64\QIWRCJT.exeC:\windows\system32\QIWRCJT.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AIY.exe.bat" "84⤵PID:5312
-
C:\windows\AIY.exeC:\windows\AIY.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GIGRWJ.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:4288 -
C:\windows\system\GIGRWJ.exeC:\windows\system\GIGRWJ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWGYYV.exe.bat" "88⤵PID:4836
-
C:\windows\GWGYYV.exeC:\windows\GWGYYV.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBQQ.exe.bat" "90⤵PID:1432
-
C:\windows\XBQQ.exeC:\windows\XBQQ.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IULJW.exe.bat" "92⤵PID:3496
-
C:\windows\SysWOW64\IULJW.exeC:\windows\system32\IULJW.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUTWFC.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4072 -
C:\windows\SysWOW64\OUTWFC.exeC:\windows\system32\OUTWFC.exe95⤵
- Executes dropped EXE
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IPYGPCS.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3548 -
C:\windows\system\IPYGPCS.exeC:\windows\system\IPYGPCS.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SQATTZ.exe.bat" "98⤵
- Executes a command shell one-liner
PID:5152 -
C:\windows\SQATTZ.exeC:\windows\SQATTZ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYG.exe.bat" "100⤵PID:4424
-
C:\windows\SysWOW64\EYG.exeC:\windows\system32\EYG.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NGIY.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4764 -
C:\windows\NGIY.exeC:\windows\NGIY.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ROPGVHH.exe.bat" "104⤵
- Executes a command shell one-liner
PID:3400 -
C:\windows\ROPGVHH.exeC:\windows\ROPGVHH.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IWRLY.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:4148 -
C:\windows\system\IWRLY.exeC:\windows\system\IWRLY.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DKWUIMY.exe.bat" "108⤵PID:568
-
C:\windows\DKWUIMY.exeC:\windows\DKWUIMY.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCEWOQM.exe.bat" "110⤵PID:1720
-
C:\windows\SysWOW64\DCEWOQM.exeC:\windows\system32\DCEWOQM.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVH.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3152 -
C:\windows\system\OVH.exeC:\windows\system\OVH.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNCZ.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:3248 -
C:\windows\ZNCZ.exeC:\windows\ZNCZ.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OIMMQAS.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3816 -
C:\windows\SysWOW64\OIMMQAS.exeC:\windows\system32\OIMMQAS.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWRV.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4476 -
C:\windows\system\JWRV.exeC:\windows\system\JWRV.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EJVFKA.exe.bat" "120⤵
- Executes a command shell one-liner
PID:2152 -
C:\windows\SysWOW64\EJVFKA.exeC:\windows\system32\EJVFKA.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-