Analysis
- max time kernel
84s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 17:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_b476b6823a6104334b51342776e5df73_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-29_b476b6823a6104334b51342776e5df73_elex_emotet_stop.exe
- Size 208KB
- Sample260930-vs627atgjc
- SHA256 d3899552cf3cfe59965e9105d0569ff2c18687b6a5acaa6457f58b5ab97ed58e
- MD5 b476b6823a6104334b51342776e5df73
- SHA1 685bb213d6d6e3973859656a5a57fd1c24530a26
- SHA512 4b2ab37141d1be5a3bd3dda1ad6d5b3d94ed3fda5a7997d93d9938c845507c3351735059b253dccf2acfa7f075090076c283d71fa4fde183c3cb06e7821c806b
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfM4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOkkEj1
- TLSH T105247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3092 NKQZPSQ.exe 3232 FDM.exe 2416 LYY.exe 1816 KJBHRJ.exe 4588 DCQSIJT.exe 3388 CMTAJX.exe 1136 YSLQ.exe 1848 XDO.exe 2916 MTPFOUV.exe 4528 WQDZ.exe 4448 EEHG.exe 2376 GCN.exe 5448 QAA.exe 4744 GQBM.exe 4292 TSKL.exe 1496 IILCX.exe 5248 HGEF.exe 3868 OWFWYMN.exe 4140 NHIMZS.exe 1916 QUZWSEY.exe 3248 QXDS.exe 4612 YNERFPP.exe 5236 ABJB.exe 5064 ERPBTH.exe 6124 IZEJ.exe 4544 BCI.exe 108 NKOMX.exe 3116 UAP.exe 4772 AAXR.exe 3056 RIZXYVL.exe 5552 MWEG.exe 4560 FZIKOT.exe 4912 ZMNTYTQ.exe 432 APQXEJ.exe 5148 UCV.exe 5716 PQAQQ.exe 5088 GDKIGF.exe 348 EYKI.exe 1692 TTTNWV.exe 1956 LUV.exe 5472 PKCAL.exe 4184 PNFEZIH.exe 476 GYIMZO.exe 5668 SGP.exe 5832 BORZPEB.exe 3560 ORHXD.exe 4676 YONK.exe 904 RSRNYN.exe 2708 GISN.exe 1156 YVCXV.exe 4576 HVEKYDM.exe 3680 CQJ.exe 1896 LGP.exe 4252 NECAXTS.exe 3424 VSU.exe 5272 QFZYJ.exe 3208 FAJ.exe 2188 RSMD.exe 4700 LGQMNA.exe 5244 WYTFV.exe 3128 GWZS.exe 1404 KMGAPIA.exe 4500 UMI.exe 4724 LASXIK.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\DPMVI.exe WUV.exe File opened for modification C:\windows\SysWOW64\QAA.exe GCN.exe File opened for modification C:\windows\SysWOW64\HVEKYDM.exe YVCXV.exe File created C:\windows\SysWOW64\NECAXTS.exe LGP.exe File created C:\windows\SysWOW64\KWQAZ.exe.bat GOKSNRY.exe File opened for modification C:\windows\SysWOW64\BEME.exe GJHUPWE.exe File opened for modification C:\windows\SysWOW64\LITFZC.exe AQQNRVA.exe File created C:\windows\SysWOW64\DWUR.exe.bat BZOWMG.exe File created C:\windows\SysWOW64\YNERFPP.exe.bat QXDS.exe File created C:\windows\SysWOW64\NKOMX.exe BCI.exe File opened for modification C:\windows\SysWOW64\NKOMX.exe BCI.exe File created C:\windows\SysWOW64\AAXR.exe UAP.exe File opened for modification C:\windows\SysWOW64\AAXR.exe UAP.exe File opened for modification C:\windows\SysWOW64\UMI.exe KMGAPIA.exe File created C:\windows\SysWOW64\GOKSNRY.exe VWHZFK.exe File created C:\windows\SysWOW64\XDO.exe.bat YSLQ.exe File created C:\windows\SysWOW64\WQDZ.exe.bat MTPFOUV.exe File created C:\windows\SysWOW64\NKOMX.exe.bat BCI.exe File opened for modification C:\windows\SysWOW64\CQJ.exe HVEKYDM.exe File created C:\windows\SysWOW64\QFZYJ.exe VSU.exe File created C:\windows\SysWOW64\UMI.exe KMGAPIA.exe File created C:\windows\SysWOW64\QAA.exe GCN.exe File created C:\windows\SysWOW64\QAA.exe.bat GCN.exe File created C:\windows\SysWOW64\GQBM.exe QAA.exe File opened for modification C:\windows\SysWOW64\GQBM.exe QAA.exe File created C:\windows\SysWOW64\CQJ.exe HVEKYDM.exe File created C:\windows\SysWOW64\LITFZC.exe.bat AQQNRVA.exe File opened for modification C:\windows\SysWOW64\COKI.exe IBF.exe File created C:\windows\SysWOW64\IILCX.exe TSKL.exe File created C:\windows\SysWOW64\QXDS.exe.bat QUZWSEY.exe File created C:\windows\SysWOW64\YNERFPP.exe QXDS.exe File created C:\windows\SysWOW64\GISN.exe RSRNYN.exe File created C:\windows\SysWOW64\WYTFV.exe LGQMNA.exe File created C:\windows\SysWOW64\FSRTQM.exe.bat FNZ.exe File created C:\windows\SysWOW64\GQBM.exe.bat QAA.exe File created C:\windows\SysWOW64\UAP.exe NKOMX.exe File created C:\windows\SysWOW64\HVEKYDM.exe YVCXV.exe File created C:\windows\SysWOW64\WYTFV.exe.bat LGQMNA.exe File opened for modification C:\windows\SysWOW64\NOAPME.exe PQPMZYQ.exe File opened for modification C:\windows\SysWOW64\GCN.exe EEHG.exe File created C:\windows\SysWOW64\APQXEJ.exe.bat ZMNTYTQ.exe File created C:\windows\SysWOW64\EYKI.exe.bat GDKIGF.exe File created C:\windows\SysWOW64\CQJ.exe.bat HVEKYDM.exe File opened for modification C:\windows\SysWOW64\QFZYJ.exe VSU.exe File opened for modification C:\windows\SysWOW64\VWHZFK.exe AACQ.exe File created C:\windows\SysWOW64\FSRTQM.exe FNZ.exe File created C:\windows\SysWOW64\GJHUPWE.exe.bat CBBML.exe File created C:\windows\SysWOW64\GCN.exe EEHG.exe File created C:\windows\SysWOW64\ZMNTYTQ.exe.bat FZIKOT.exe File opened for modification C:\windows\SysWOW64\EYKI.exe GDKIGF.exe File opened for modification C:\windows\SysWOW64\GISN.exe RSRNYN.exe File created C:\windows\SysWOW64\YVCXV.exe GISN.exe File opened for modification C:\windows\SysWOW64\WYTFV.exe LGQMNA.exe File opened for modification C:\windows\SysWOW64\FDM.exe NKQZPSQ.exe File opened for modification C:\windows\SysWOW64\IILCX.exe TSKL.exe File created C:\windows\SysWOW64\RIZXYVL.exe.bat AAXR.exe File created C:\windows\SysWOW64\ZMNTYTQ.exe FZIKOT.exe File created C:\windows\SysWOW64\APQXEJ.exe ZMNTYTQ.exe File opened for modification C:\windows\SysWOW64\YVCXV.exe GISN.exe File created C:\windows\SysWOW64\VWHZFK.exe AACQ.exe File created C:\windows\SysWOW64\LITFZC.exe AQQNRVA.exe File created C:\windows\SysWOW64\WQDZ.exe MTPFOUV.exe File opened for modification C:\windows\SysWOW64\YNERFPP.exe QXDS.exe File opened for modification C:\windows\SysWOW64\UAP.exe NKOMX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\QUZWSEY.exe NHIMZS.exe File created C:\windows\system\TTTNWV.exe EYKI.exe File created C:\windows\system\UAUCLIS.exe.bat LASXIK.exe File opened for modification C:\windows\WUV.exe MXPWI.exe File created C:\windows\system\QHBZWJD.exe.bat FPYGOB.exe File created C:\windows\system\YSLQ.exe CMTAJX.exe File created C:\windows\system\OWFWYMN.exe HGEF.exe File opened for modification C:\windows\NHIMZS.exe OWFWYMN.exe File created C:\windows\system\GYIMZO.exe.bat PNFEZIH.exe File created C:\windows\system\SGP.exe.bat GYIMZO.exe File opened for modification C:\windows\system\LASXIK.exe UMI.exe File opened for modification C:\windows\DCIX.exe IHD.exe File opened for modification C:\windows\system\MTPFOUV.exe XDO.exe File created C:\windows\system\TSKL.exe GQBM.exe File created C:\windows\system\ERPBTH.exe.bat ABJB.exe File created C:\windows\system\RSRNYN.exe YONK.exe File opened for modification C:\windows\system\RSRNYN.exe YONK.exe File opened for modification C:\windows\system\UAUCLIS.exe LASXIK.exe File opened for modification C:\windows\system\FPYGOB.exe KTUX.exe File opened for modification C:\windows\system\MWFCT.exe RJA.exe File created C:\windows\system\CMTAJX.exe.bat DCQSIJT.exe File created C:\windows\system\ERPBTH.exe ABJB.exe File created C:\windows\system\ZMR.exe KWQAZ.exe File created C:\windows\HGEF.exe IILCX.exe File created C:\windows\NKQZPSQ.exe.bat 2026-09-29_b476b6823a6104334b51342776e5df73_elex_emotet_stop.exe File created C:\windows\KJBHRJ.exe LYY.exe File opened for modification C:\windows\LUV.exe TTTNWV.exe File opened for modification C:\windows\RSMD.exe FAJ.exe File created C:\windows\FNZ.exe.bat ZMR.exe File created C:\windows\LSZHZG.exe.bat FSRTQM.exe File opened for modification C:\windows\system\UQGALEU.exe DPMVI.exe File opened for modification C:\windows\system\ABJB.exe YNERFPP.exe File created C:\windows\system\PNFEZIH.exe PKCAL.exe File created C:\windows\BORZPEB.exe.bat SGP.exe File opened for modification C:\windows\system\MXPWI.exe BEME.exe File created C:\windows\IHD.exe CHVAS.exe File created C:\windows\system\XCORRD.exe COKI.exe File opened for modification C:\windows\IIK.exe XPPGTQL.exe File created C:\windows\system\UDDNQOS.exe UQDZ.exe File opened for modification C:\windows\system\TTTNWV.exe EYKI.exe File created C:\windows\system\LASXIK.exe UMI.exe File created C:\windows\LSZHZG.exe FSRTQM.exe File created C:\windows\CBBML.exe.bat LSZHZG.exe File opened for modification C:\windows\system\AQQNRVA.exe FCLDH.exe File opened for modification C:\windows\system\UDDNQOS.exe UQDZ.exe File opened for modification C:\windows\system\BZOWMG.exe GLJNC.exe File created C:\windows\PMIRGZ.exe DWUR.exe File created C:\windows\IHD.exe.bat CHVAS.exe File created C:\windows\DCIX.exe IHD.exe File created C:\windows\system\PQPMZYQ.exe.bat MDKDPY.exe File opened for modification C:\windows\system\GLJNC.exe UDDNQOS.exe File opened for modification C:\windows\TPHM.exe PMIRGZ.exe File created C:\windows\EEHG.exe.bat WQDZ.exe File created C:\windows\system\ABJB.exe YNERFPP.exe File opened for modification C:\windows\GDKIGF.exe PQAQQ.exe File opened for modification C:\windows\system\YONK.exe ORHXD.exe File opened for modification C:\windows\system\GWZS.exe WYTFV.exe File created C:\windows\WUV.exe.bat MXPWI.exe File opened for modification C:\windows\system\XCORRD.exe COKI.exe File created C:\windows\TPHM.exe.bat PMIRGZ.exe File opened for modification C:\windows\system\YSLQ.exe CMTAJX.exe File created C:\windows\EEHG.exe WQDZ.exe File created C:\windows\system\TSKL.exe.bat GQBM.exe File created C:\windows\system\YONK.exe ORHXD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4808 cmd.exe 4956 cmd.exe 2260 cmd.exe 5708 cmd.exe 2900 cmd.exe 5000 cmd.exe 2344 cmd.exe 4652 cmd.exe 4672 cmd.exe 5436 cmd.exe 5368 cmd.exe 3852 cmd.exe 5808 cmd.exe 2024 cmd.exe 2040 cmd.exe 1604 cmd.exe 4320 cmd.exe 1052 cmd.exe 4592 cmd.exe 5484 cmd.exe 1540 cmd.exe 5268 cmd.exe 5112 cmd.exe 2656 cmd.exe 5044 cmd.exe 3256 cmd.exe 1380 cmd.exe 3772 cmd.exe 5048 cmd.exe 1548 cmd.exe 892 cmd.exe 3340 cmd.exe 3496 cmd.exe 1220 cmd.exe 5912 cmd.exe 4208 cmd.exe 1932 cmd.exe 1748 cmd.exe 2560 cmd.exe 260 cmd.exe 5380 cmd.exe 3080 cmd.exe 4112 cmd.exe 2800 cmd.exe 5728 cmd.exe 4388 cmd.exe 4860 cmd.exe 2128 cmd.exe 4356 cmd.exe 3164 cmd.exe 2400 cmd.exe 5900 cmd.exe 1884 cmd.exe 5336 cmd.exe 792 cmd.exe 4920 cmd.exe 3856 cmd.exe 5524 cmd.exe 1300 cmd.exe 5600 cmd.exe 6024 cmd.exe 2476 cmd.exe 2920 cmd.exe 1164 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3040 1556 WerFault.exe 87 5032 3092 WerFault.exe 93 756 3232 WerFault.exe 99 4748 2416 WerFault.exe 104 704 1816 WerFault.exe 109 2032 4588 WerFault.exe 114 4836 3388 WerFault.exe 119 3152 1136 WerFault.exe 124 5816 1848 WerFault.exe 129 3168 2916 WerFault.exe 134 1368 4528 WerFault.exe 139 1884 4448 WerFault.exe 144 892 2376 WerFault.exe 149 4344 5448 WerFault.exe 154 3716 4744 WerFault.exe 159 1340 4292 WerFault.exe 164 5764 1496 WerFault.exe 169 4772 5248 WerFault.exe 174 2584 3868 WerFault.exe 179 1792 4140 WerFault.exe 184 5956 1916 WerFault.exe 189 3876 3248 WerFault.exe 194 5060 4612 WerFault.exe 199 544 5236 WerFault.exe 204 4616 5064 WerFault.exe 209 612 6124 WerFault.exe 214 4508 4544 WerFault.exe 219 4340 108 WerFault.exe 224 3352 3116 WerFault.exe 229 1404 4772 WerFault.exe 234 4276 3056 WerFault.exe 239 4816 5552 WerFault.exe 244 1152 4560 WerFault.exe 249 3752 4912 WerFault.exe 254 4768 432 WerFault.exe 259 4220 5148 WerFault.exe 264 2684 5716 WerFault.exe 269 4468 5088 WerFault.exe 274 1156 348 WerFault.exe 279 4632 1692 WerFault.exe 284 3100 1956 WerFault.exe 289 3944 5472 WerFault.exe 294 4300 4184 WerFault.exe 299 3452 476 WerFault.exe 304 1204 5668 WerFault.exe 309 2348 5832 WerFault.exe 314 2668 3560 WerFault.exe 319 3788 4676 WerFault.exe 324 5328 904 WerFault.exe 329 5684 2708 WerFault.exe 334 5760 1156 WerFault.exe 339 3100 4576 WerFault.exe 344 3512 3680 WerFault.exe 349 2900 1896 WerFault.exe 354 4724 4252 WerFault.exe 359 3640 3424 WerFault.exe 364 3340 5272 WerFault.exe 369 3080 3208 WerFault.exe 374 2676 2188 WerFault.exe 379 4752 4700 WerFault.exe 384 2800 5244 WerFault.exe 389 5092 3128 WerFault.exe 394 3252 1404 WerFault.exe 399 3924 4500 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQPMZYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJBHRJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YVCXV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_b476b6823a6104334b51342776e5df73_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GJHUPWE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWQAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language COKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DWUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GDKIGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HGEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QXDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSRNYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GQBM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMGAPIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXPWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTSWRC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAXR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCLDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LITFZC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCIX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOAPME.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMIRGZ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1556 2026-09-29_b476b6823a6104334b51342776e5df73_elex_emotet_stop.exe 1556 2026-09-29_b476b6823a6104334b51342776e5df73_elex_emotet_stop.exe 3092 NKQZPSQ.exe 3092 NKQZPSQ.exe 3232 FDM.exe 3232 FDM.exe 2416 LYY.exe 2416 LYY.exe 1816 KJBHRJ.exe 1816 KJBHRJ.exe 4588 DCQSIJT.exe 4588 DCQSIJT.exe 3388 CMTAJX.exe 3388 CMTAJX.exe 1136 YSLQ.exe 1136 YSLQ.exe 1848 XDO.exe 1848 XDO.exe 2916 MTPFOUV.exe 2916 MTPFOUV.exe 4528 WQDZ.exe 4528 WQDZ.exe 4448 EEHG.exe 4448 EEHG.exe 2376 GCN.exe 2376 GCN.exe 5448 QAA.exe 5448 QAA.exe 4744 GQBM.exe 4744 GQBM.exe 4292 TSKL.exe 4292 TSKL.exe 1496 IILCX.exe 1496 IILCX.exe 5248 HGEF.exe 5248 HGEF.exe 3868 OWFWYMN.exe 3868 OWFWYMN.exe 4140 NHIMZS.exe 4140 NHIMZS.exe 1916 QUZWSEY.exe 1916 QUZWSEY.exe 3248 QXDS.exe 3248 QXDS.exe 4612 YNERFPP.exe 4612 YNERFPP.exe 5236 ABJB.exe 5236 ABJB.exe 5064 ERPBTH.exe 5064 ERPBTH.exe 6124 IZEJ.exe 6124 IZEJ.exe 4544 BCI.exe 4544 BCI.exe 108 NKOMX.exe 108 NKOMX.exe 3116 UAP.exe 3116 UAP.exe 4772 AAXR.exe 4772 AAXR.exe 3056 RIZXYVL.exe 3056 RIZXYVL.exe 5552 MWEG.exe 5552 MWEG.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1556 2026-09-29_b476b6823a6104334b51342776e5df73_elex_emotet_stop.exe 1556 2026-09-29_b476b6823a6104334b51342776e5df73_elex_emotet_stop.exe 3092 NKQZPSQ.exe 3092 NKQZPSQ.exe 3232 FDM.exe 3232 FDM.exe 2416 LYY.exe 2416 LYY.exe 1816 KJBHRJ.exe 1816 KJBHRJ.exe 4588 DCQSIJT.exe 4588 DCQSIJT.exe 3388 CMTAJX.exe 3388 CMTAJX.exe 1136 YSLQ.exe 1136 YSLQ.exe 1848 XDO.exe 1848 XDO.exe 2916 MTPFOUV.exe 2916 MTPFOUV.exe 4528 WQDZ.exe 4528 WQDZ.exe 4448 EEHG.exe 4448 EEHG.exe 2376 GCN.exe 2376 GCN.exe 5448 QAA.exe 5448 QAA.exe 4744 GQBM.exe 4744 GQBM.exe 4292 TSKL.exe 4292 TSKL.exe 1496 IILCX.exe 1496 IILCX.exe 5248 HGEF.exe 5248 HGEF.exe 3868 OWFWYMN.exe 3868 OWFWYMN.exe 4140 NHIMZS.exe 4140 NHIMZS.exe 1916 QUZWSEY.exe 1916 QUZWSEY.exe 3248 QXDS.exe 3248 QXDS.exe 4612 YNERFPP.exe 4612 YNERFPP.exe 5236 ABJB.exe 5236 ABJB.exe 5064 ERPBTH.exe 5064 ERPBTH.exe 6124 IZEJ.exe 6124 IZEJ.exe 4544 BCI.exe 4544 BCI.exe 108 NKOMX.exe 108 NKOMX.exe 3116 UAP.exe 3116 UAP.exe 4772 AAXR.exe 4772 AAXR.exe 3056 RIZXYVL.exe 3056 RIZXYVL.exe 5552 MWEG.exe 5552 MWEG.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1556 wrote to memory of 4112 1556 2026-09-29_b476b6823a6104334b51342776e5df73_elex_emotet_stop.exe 89 PID 4112 wrote to memory of 3092 4112 cmd.exe 93 PID 3092 wrote to memory of 5592 3092 NKQZPSQ.exe 95 PID 5592 wrote to memory of 3232 5592 cmd.exe 99 PID 3232 wrote to memory of 1300 3232 FDM.exe 100 PID 1300 wrote to memory of 2416 1300 cmd.exe 104 PID 2416 wrote to memory of 4824 2416 LYY.exe 105 PID 4824 wrote to memory of 1816 4824 cmd.exe 109 PID 1816 wrote to memory of 4956 1816 KJBHRJ.exe 110 PID 4956 wrote to memory of 4588 4956 cmd.exe 114 PID 4588 wrote to memory of 4388 4588 DCQSIJT.exe 115 PID 4388 wrote to memory of 3388 4388 cmd.exe 119 PID 3388 wrote to memory of 5576 3388 CMTAJX.exe 120 PID 5576 wrote to memory of 1136 5576 cmd.exe 124 PID 1136 wrote to memory of 3024 1136 YSLQ.exe 125 PID 3024 wrote to memory of 1848 3024 cmd.exe 129 PID 1848 wrote to memory of 524 1848 XDO.exe 130 PID 524 wrote to memory of 2916 524 cmd.exe 134 PID 2916 wrote to memory of 5436 2916 MTPFOUV.exe 135 PID 5436 wrote to memory of 4528 5436 cmd.exe 139 PID 4528 wrote to memory of 5756 4528 WQDZ.exe 140 PID 5756 wrote to memory of 4448 5756 cmd.exe 144 PID 4448 wrote to memory of 5340 4448 EEHG.exe 145 PID 5340 wrote to memory of 2376 5340 cmd.exe 149 PID 2376 wrote to memory of 2576 2376 GCN.exe 150 PID 2576 wrote to memory of 5448 2576 cmd.exe 154 PID 5448 wrote to memory of 4860 5448 QAA.exe 155 PID 4860 wrote to memory of 4744 4860 cmd.exe 159 PID 4744 wrote to memory of 1604 4744 GQBM.exe 160 PID 1604 wrote to memory of 4292 1604 cmd.exe 164 PID 4292 wrote to memory of 4920 4292 TSKL.exe 165 PID 4920 wrote to memory of 1496 4920 cmd.exe 169 PID 1496 wrote to memory of 5696 1496 IILCX.exe 170 PID 5696 wrote to memory of 5248 5696 cmd.exe 174 PID 5248 wrote to memory of 5600 5248 HGEF.exe 175 PID 5600 wrote to memory of 3868 5600 cmd.exe 179 PID 3868 wrote to memory of 4320 3868 OWFWYMN.exe 180 PID 4320 wrote to memory of 4140 4320 cmd.exe 184 PID 4140 wrote to memory of 3192 4140 NHIMZS.exe 185 PID 3192 wrote to memory of 1916 3192 cmd.exe 189 PID 1916 wrote to memory of 5488 1916 QUZWSEY.exe 190 PID 5488 wrote to memory of 3248 5488 cmd.exe 194 PID 3248 wrote to memory of 5580 3248 QXDS.exe 195 PID 5580 wrote to memory of 4612 5580 cmd.exe 199 PID 4612 wrote to memory of 2128 4612 YNERFPP.exe 200 PID 2128 wrote to memory of 5236 2128 cmd.exe 204 PID 5236 wrote to memory of 5628 5236 ABJB.exe 205 PID 5628 wrote to memory of 5064 5628 cmd.exe 209 PID 5064 wrote to memory of 3772 5064 ERPBTH.exe 210 PID 3772 wrote to memory of 6124 3772 cmd.exe 214 PID 6124 wrote to memory of 1312 6124 IZEJ.exe 215 PID 1312 wrote to memory of 4544 1312 cmd.exe 219 PID 4544 wrote to memory of 5900 4544 BCI.exe 220 PID 5900 wrote to memory of 108 5900 cmd.exe 224 PID 108 wrote to memory of 5484 108 NKOMX.exe 225 PID 5484 wrote to memory of 3116 5484 cmd.exe 229 PID 3116 wrote to memory of 5048 3116 UAP.exe 230 PID 5048 wrote to memory of 4772 5048 cmd.exe 234 PID 4772 wrote to memory of 2308 4772 AAXR.exe 235 PID 2308 wrote to memory of 3056 2308 cmd.exe 239 PID 3056 wrote to memory of 1356 3056 RIZXYVL.exe 240 PID 1356 wrote to memory of 5552 1356 cmd.exe 244 PID 5552 wrote to memory of 2480 5552 MWEG.exe 245 PID 2480 wrote to memory of 4560 2480 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_b476b6823a6104334b51342776e5df73_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_b476b6823a6104334b51342776e5df73_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NKQZPSQ.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\windows\NKQZPSQ.exeC:\windows\NKQZPSQ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FDM.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\windows\SysWOW64\FDM.exeC:\windows\system32\FDM.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LYY.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\windows\LYY.exeC:\windows\LYY.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KJBHRJ.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\KJBHRJ.exeC:\windows\KJBHRJ.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DCQSIJT.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\windows\DCQSIJT.exeC:\windows\DCQSIJT.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CMTAJX.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\windows\system\CMTAJX.exeC:\windows\system\CMTAJX.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSLQ.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\windows\system\YSLQ.exeC:\windows\system\YSLQ.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XDO.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\windows\SysWOW64\XDO.exeC:\windows\system32\XDO.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MTPFOUV.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:524 -
C:\windows\system\MTPFOUV.exeC:\windows\system\MTPFOUV.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQDZ.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\SysWOW64\WQDZ.exeC:\windows\system32\WQDZ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEHG.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\windows\EEHG.exeC:\windows\EEHG.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GCN.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\windows\SysWOW64\GCN.exeC:\windows\system32\GCN.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QAA.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\windows\SysWOW64\QAA.exeC:\windows\system32\QAA.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GQBM.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\windows\SysWOW64\GQBM.exeC:\windows\system32\GQBM.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TSKL.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\windows\system\TSKL.exeC:\windows\system\TSKL.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IILCX.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\windows\SysWOW64\IILCX.exeC:\windows\system32\IILCX.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HGEF.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\windows\HGEF.exeC:\windows\HGEF.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OWFWYMN.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\windows\system\OWFWYMN.exeC:\windows\system\OWFWYMN.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NHIMZS.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\windows\NHIMZS.exeC:\windows\NHIMZS.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUZWSEY.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\windows\QUZWSEY.exeC:\windows\QUZWSEY.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QXDS.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\windows\SysWOW64\QXDS.exeC:\windows\system32\QXDS.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNERFPP.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\windows\SysWOW64\YNERFPP.exeC:\windows\system32\YNERFPP.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABJB.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\windows\system\ABJB.exeC:\windows\system\ABJB.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ERPBTH.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\windows\system\ERPBTH.exeC:\windows\system\ERPBTH.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IZEJ.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\windows\system\IZEJ.exeC:\windows\system\IZEJ.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCI.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\windows\BCI.exeC:\windows\BCI.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NKOMX.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\windows\SysWOW64\NKOMX.exeC:\windows\system32\NKOMX.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UAP.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\windows\SysWOW64\UAP.exeC:\windows\system32\UAP.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAXR.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\windows\SysWOW64\AAXR.exeC:\windows\system32\AAXR.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIZXYVL.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\windows\SysWOW64\RIZXYVL.exeC:\windows\system32\RIZXYVL.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MWEG.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\windows\SysWOW64\MWEG.exeC:\windows\system32\MWEG.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZIKOT.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\windows\FZIKOT.exeC:\windows\FZIKOT.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZMNTYTQ.exe.bat" "66⤵PID:3508
-
C:\windows\SysWOW64\ZMNTYTQ.exeC:\windows\system32\ZMNTYTQ.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\APQXEJ.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5368 -
C:\windows\SysWOW64\APQXEJ.exeC:\windows\system32\APQXEJ.exe69⤵
- Executes dropped EXE
PID:432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCV.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:5940 -
C:\windows\SysWOW64\UCV.exeC:\windows\system32\UCV.exe71⤵
- Executes dropped EXE
PID:5148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PQAQQ.exe.bat" "72⤵
- Executes a command shell one-liner
PID:1884 -
C:\windows\PQAQQ.exeC:\windows\PQAQQ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GDKIGF.exe.bat" "74⤵PID:5032
-
C:\windows\GDKIGF.exeC:\windows\GDKIGF.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYKI.exe.bat" "76⤵PID:2412
-
C:\windows\SysWOW64\EYKI.exeC:\windows\system32\EYKI.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TTTNWV.exe.bat" "78⤵
- Executes a command shell one-liner
PID:3856 -
C:\windows\system\TTTNWV.exeC:\windows\system\TTTNWV.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LUV.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5524 -
C:\windows\LUV.exeC:\windows\LUV.exe81⤵
- Executes dropped EXE
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PKCAL.exe.bat" "82⤵PID:4296
-
C:\windows\PKCAL.exeC:\windows\PKCAL.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PNFEZIH.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2260 -
C:\windows\system\PNFEZIH.exeC:\windows\system\PNFEZIH.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GYIMZO.exe.bat" "86⤵
- Executes a command shell one-liner
PID:1052 -
C:\windows\system\GYIMZO.exeC:\windows\system\GYIMZO.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGP.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:1560 -
C:\windows\system\SGP.exeC:\windows\system\SGP.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BORZPEB.exe.bat" "90⤵PID:4664
-
C:\windows\BORZPEB.exeC:\windows\BORZPEB.exe91⤵
- Executes dropped EXE
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORHXD.exe.bat" "92⤵PID:5516
-
C:\windows\system\ORHXD.exeC:\windows\system\ORHXD.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YONK.exe.bat" "94⤵PID:2464
-
C:\windows\system\YONK.exeC:\windows\system\YONK.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSRNYN.exe.bat" "96⤵PID:4420
-
C:\windows\system\RSRNYN.exeC:\windows\system\RSRNYN.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GISN.exe.bat" "98⤵PID:3468
-
C:\windows\SysWOW64\GISN.exeC:\windows\system32\GISN.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YVCXV.exe.bat" "100⤵PID:2780
-
C:\windows\SysWOW64\YVCXV.exeC:\windows\system32\YVCXV.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVEKYDM.exe.bat" "102⤵PID:4268
-
C:\windows\SysWOW64\HVEKYDM.exeC:\windows\system32\HVEKYDM.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQJ.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:4088 -
C:\windows\SysWOW64\CQJ.exeC:\windows\system32\CQJ.exe105⤵
- Executes dropped EXE
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGP.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3852 -
C:\windows\LGP.exeC:\windows\LGP.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NECAXTS.exe.bat" "108⤵PID:5960
-
C:\windows\SysWOW64\NECAXTS.exeC:\windows\system32\NECAXTS.exe109⤵
- Executes dropped EXE
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSU.exe.bat" "110⤵
- Executes a command shell one-liner
PID:1540 -
C:\windows\system\VSU.exeC:\windows\system\VSU.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QFZYJ.exe.bat" "112⤵PID:1264
-
C:\windows\SysWOW64\QFZYJ.exeC:\windows\system32\QFZYJ.exe113⤵
- Executes dropped EXE
PID:5272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FAJ.exe.bat" "114⤵PID:5172
-
C:\windows\system\FAJ.exeC:\windows\system\FAJ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RSMD.exe.bat" "116⤵
- Executes a command shell one-liner
PID:5268 -
C:\windows\RSMD.exeC:\windows\RSMD.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGQMNA.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5112 -
C:\windows\LGQMNA.exeC:\windows\LGQMNA.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYTFV.exe.bat" "120⤵PID:5684
-
C:\windows\SysWOW64\WYTFV.exeC:\windows\system32\WYTFV.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-