Analysis
- max time kernel
58s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 18:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_92047a60d494108650571576619f815f_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-29_92047a60d494108650571576619f815f_elex_emotet_stop.exe
- Size 208KB
- Sample260930-w55wbstybs
- SHA256 cf1707f10951e71f437cd0a27607570a00d5b339e37b78a6b77e7cfd2fa68bae
- MD5 92047a60d494108650571576619f815f
- SHA1 8375c4f042621cc947fa09fb327e21ac8f628ff8
- SHA512 ea0d0090f51eefd43040e4aebabfe8909c2ce58ae559859c2eed8a57eb2e9c6ff77b919093423e558c4837ef5b6654bfbe71ee93645bc37c467ee85ada84911f
- SSDEEP 3072:jLQaL9tbLkRIgd1Lye9yjE2hWAN5Xbsl9dL+LOfe4pLthEjQT6j:vlZtbLWIgd1LZ9oECZbsl95+LOmkEj1
- TLSH T11E247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5776 EUZRCXB.exe 1332 JNPG.exe 1044 RSCN.exe 4768 ZGG.exe 2132 GBSUA.exe 3836 EMVCIDM.exe 4032 WUJI.exe 4316 GSPCCDY.exe 1928 MFA.exe 1084 ZLAHSDP.exe 6064 EQSWIG.exe 1132 ITR.exe 4172 QHD.exe 1380 MENN.exe 5584 CUOEP.exe 3692 CXAI.exe 1704 OQIT.exe 1440 YOVNUO.exe 5344 CECN.exe 1864 PCCZIJP.exe 3264 OMFPRX.exe 2388 FVTMDOG.exe 4028 GYXQJ.exe 2692 VOK.exe 2236 KJCM.exe 4732 QETNOB.exe 6136 UMIV.exe 700 YCOVFM.exe 4932 CKVV.exe 5908 GVTQRX.exe 4636 CYCOFA.exe 1684 YZLRRE.exe 6108 MJUP.exe 3700 GXZZH.exe 4336 XXBE.exe 1400 NAKIEZ.exe 5568 TNJRICL.exe 716 NJOA.exe 4140 GES.exe 4832 LJKLOND.exe 3068 NHQGWV.exe 5328 NKT.exe 5132 MVERKZK.exe 6068 QLLZ.exe 3824 FBM.exe 6020 HZSLK.exe 6100 UBIKY.exe 5012 VEMGEOS.exe 5736 EFO.exe 1168 MSS.exe 3192 LORRF.exe 5544 YYI.exe 984 TMNZE.exe 3716 KUPEHZ.exe 2868 MSUYPH.exe 1384 UXZFZ.exe 2604 VALANWA.exe 1072 ILTZTGV.exe 2280 MTAHF.exe 6072 BJB.exe 5492 JPN.exe 1868 IHQVF.exe 1448 SFWP.exe 1140 ALIW.exe - Drops file in System32 directory 57 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\GVTQRX.exe CKVV.exe File created C:\windows\SysWOW64\MJUP.exe.bat YZLRRE.exe File created C:\windows\SysWOW64\MVERKZK.exe NKT.exe File created C:\windows\SysWOW64\MJUP.exe YZLRRE.exe File opened for modification C:\windows\SysWOW64\VALANWA.exe UXZFZ.exe File created C:\windows\SysWOW64\JPN.exe BJB.exe File opened for modification C:\windows\SysWOW64\GSPCCDY.exe WUJI.exe File opened for modification C:\windows\SysWOW64\GES.exe NJOA.exe File opened for modification C:\windows\SysWOW64\ILTZTGV.exe VALANWA.exe File created C:\windows\SysWOW64\MFA.exe GSPCCDY.exe File created C:\windows\SysWOW64\CECN.exe YOVNUO.exe File opened for modification C:\windows\SysWOW64\KJCM.exe VOK.exe File opened for modification C:\windows\SysWOW64\NJOA.exe TNJRICL.exe File opened for modification C:\windows\SysWOW64\EQSWIG.exe ZLAHSDP.exe File created C:\windows\SysWOW64\GES.exe.bat NJOA.exe File created C:\windows\SysWOW64\NKT.exe NHQGWV.exe File created C:\windows\SysWOW64\GSPCCDY.exe.bat WUJI.exe File created C:\windows\SysWOW64\GYXQJ.exe.bat FVTMDOG.exe File created C:\windows\SysWOW64\MVERKZK.exe.bat NKT.exe File created C:\windows\SysWOW64\EQSWIG.exe.bat ZLAHSDP.exe File created C:\windows\SysWOW64\GYXQJ.exe FVTMDOG.exe File created C:\windows\SysWOW64\GVTQRX.exe.bat CKVV.exe File created C:\windows\SysWOW64\ILTZTGV.exe.bat VALANWA.exe File opened for modification C:\windows\SysWOW64\CUOEP.exe MENN.exe File created C:\windows\SysWOW64\NJOA.exe.bat TNJRICL.exe File created C:\windows\SysWOW64\LJKLOND.exe.bat GES.exe File created C:\windows\SysWOW64\LORRF.exe.bat MSS.exe File created C:\windows\SysWOW64\VALANWA.exe.bat UXZFZ.exe File created C:\windows\SysWOW64\ILTZTGV.exe VALANWA.exe File opened for modification C:\windows\SysWOW64\MFA.exe GSPCCDY.exe File opened for modification C:\windows\SysWOW64\ITR.exe EQSWIG.exe File created C:\windows\SysWOW64\ITR.exe.bat EQSWIG.exe File opened for modification C:\windows\SysWOW64\GYXQJ.exe FVTMDOG.exe File opened for modification C:\windows\SysWOW64\MVERKZK.exe NKT.exe File created C:\windows\SysWOW64\GSPCCDY.exe WUJI.exe File created C:\windows\SysWOW64\GES.exe NJOA.exe File created C:\windows\SysWOW64\CECN.exe.bat YOVNUO.exe File created C:\windows\SysWOW64\KJCM.exe VOK.exe File opened for modification C:\windows\SysWOW64\MJUP.exe YZLRRE.exe File created C:\windows\SysWOW64\NJOA.exe TNJRICL.exe File opened for modification C:\windows\SysWOW64\LJKLOND.exe GES.exe File created C:\windows\SysWOW64\EQSWIG.exe ZLAHSDP.exe File created C:\windows\SysWOW64\CUOEP.exe MENN.exe File opened for modification C:\windows\SysWOW64\JPN.exe BJB.exe File created C:\windows\SysWOW64\CUOEP.exe.bat MENN.exe File created C:\windows\SysWOW64\KJCM.exe.bat VOK.exe File created C:\windows\SysWOW64\GVTQRX.exe CKVV.exe File created C:\windows\SysWOW64\NKT.exe.bat NHQGWV.exe File created C:\windows\SysWOW64\LORRF.exe MSS.exe File created C:\windows\SysWOW64\VALANWA.exe UXZFZ.exe File created C:\windows\SysWOW64\MFA.exe.bat GSPCCDY.exe File opened for modification C:\windows\SysWOW64\CECN.exe YOVNUO.exe File opened for modification C:\windows\SysWOW64\NKT.exe NHQGWV.exe File opened for modification C:\windows\SysWOW64\LORRF.exe MSS.exe File created C:\windows\SysWOW64\JPN.exe.bat BJB.exe File created C:\windows\SysWOW64\ITR.exe EQSWIG.exe File created C:\windows\SysWOW64\LJKLOND.exe GES.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\EUZRCXB.exe 2026-09-29_92047a60d494108650571576619f815f_elex_emotet_stop.exe File created C:\windows\OEHXB.exe XTEPTR.exe File opened for modification C:\windows\UMIV.exe QETNOB.exe File created C:\windows\EFO.exe.bat VEMGEOS.exe File opened for modification C:\windows\MSUYPH.exe KUPEHZ.exe File created C:\windows\OEHXB.exe.bat XTEPTR.exe File created C:\windows\system\NSWRQB.exe.bat PHLBHVW.exe File opened for modification C:\windows\system\NHQGWV.exe LJKLOND.exe File created C:\windows\system\VEMGEOS.exe.bat UBIKY.exe File created C:\windows\QETNOB.exe.bat KJCM.exe File opened for modification C:\windows\system\VEMGEOS.exe UBIKY.exe File created C:\windows\system\PHLBHVW.exe.bat OEHXB.exe File opened for modification C:\windows\system\GXZZH.exe MJUP.exe File created C:\windows\MSS.exe.bat EFO.exe File created C:\windows\system\YYI.exe LORRF.exe File created C:\windows\system\QHD.exe.bat ITR.exe File created C:\windows\ZLAHSDP.exe MFA.exe File opened for modification C:\windows\system\YZLRRE.exe CYCOFA.exe File created C:\windows\system\GXZZH.exe MJUP.exe File created C:\windows\system\IHQVF.exe JPN.exe File created C:\windows\EFO.exe VEMGEOS.exe File opened for modification C:\windows\ZLAHSDP.exe MFA.exe File opened for modification C:\windows\system\FVTMDOG.exe OMFPRX.exe File created C:\windows\QETNOB.exe KJCM.exe File created C:\windows\system\GXZZH.exe.bat MJUP.exe File created C:\windows\system\UBIKY.exe.bat HZSLK.exe File created C:\windows\system\VEMGEOS.exe UBIKY.exe File created C:\windows\system\UXZFZ.exe MSUYPH.exe File created C:\windows\TMNZE.exe.bat YYI.exe File created C:\windows\ZLAHSDP.exe.bat MFA.exe File created C:\windows\NAKIEZ.exe XXBE.exe File created C:\windows\system\UXZFZ.exe.bat MSUYPH.exe File created C:\windows\MTAHF.exe.bat ILTZTGV.exe File opened for modification C:\windows\system\CXAI.exe CUOEP.exe File created C:\windows\OMFPRX.exe.bat PCCZIJP.exe File created C:\windows\system\VOK.exe GYXQJ.exe File opened for modification C:\windows\system\UXZFZ.exe MSUYPH.exe File created C:\windows\MTAHF.exe ILTZTGV.exe File created C:\windows\system\ALIW.exe SFWP.exe File opened for modification C:\windows\MSS.exe EFO.exe File opened for modification C:\windows\TMNZE.exe YYI.exe File opened for modification C:\windows\RSCN.exe JNPG.exe File opened for modification C:\windows\system\XXBE.exe GXZZH.exe File created C:\windows\system\TNJRICL.exe.bat NAKIEZ.exe File opened for modification C:\windows\NWRVLIP.exe ALIW.exe File opened for modification C:\windows\system\ZGG.exe RSCN.exe File created C:\windows\system\YZLRRE.exe CYCOFA.exe File created C:\windows\system\NHQGWV.exe LJKLOND.exe File created C:\windows\QLLZ.exe.bat MVERKZK.exe File created C:\windows\system\HZSLK.exe FBM.exe File created C:\windows\SFWP.exe.bat IHQVF.exe File created C:\windows\RSCN.exe.bat JNPG.exe File created C:\windows\system\NSWRQB.exe PHLBHVW.exe File created C:\windows\WUJI.exe.bat EMVCIDM.exe File created C:\windows\YOVNUO.exe.bat OQIT.exe File opened for modification C:\windows\BJB.exe MTAHF.exe File opened for modification C:\windows\system\ALIW.exe SFWP.exe File opened for modification C:\windows\system\GBSUA.exe ZGG.exe File opened for modification C:\windows\OQIT.exe CXAI.exe File created C:\windows\system\KUPEHZ.exe TMNZE.exe File created C:\windows\BJB.exe.bat MTAHF.exe File opened for modification C:\windows\system\XTEPTR.exe NWRVLIP.exe File opened for modification C:\windows\system\NSWRQB.exe PHLBHVW.exe File created C:\windows\JNPG.exe.bat EUZRCXB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6104 cmd.exe 4796 cmd.exe 4868 cmd.exe 1944 cmd.exe 3516 cmd.exe 6044 cmd.exe 5624 cmd.exe 3644 cmd.exe 5236 cmd.exe 4736 cmd.exe 4776 cmd.exe 5036 cmd.exe 3884 cmd.exe 4076 cmd.exe 4080 cmd.exe 5896 cmd.exe 6008 cmd.exe 3336 cmd.exe 1328 cmd.exe 3944 cmd.exe 2636 cmd.exe 3036 cmd.exe 4180 cmd.exe 4360 cmd.exe 5292 cmd.exe 2812 cmd.exe 2772 cmd.exe 6096 cmd.exe 3980 cmd.exe 5572 cmd.exe 5860 cmd.exe 4044 cmd.exe 5928 cmd.exe 4988 cmd.exe 5480 cmd.exe 4548 cmd.exe 4904 cmd.exe 3432 cmd.exe 3096 cmd.exe 1884 cmd.exe 1192 cmd.exe 2520 cmd.exe 2996 cmd.exe 5600 cmd.exe 1672 cmd.exe 5836 cmd.exe 4128 cmd.exe 2532 cmd.exe 5104 cmd.exe 1412 cmd.exe 4660 cmd.exe 4444 cmd.exe 5780 cmd.exe 5516 cmd.exe 1096 cmd.exe 4448 cmd.exe 1616 cmd.exe 3188 cmd.exe 5008 cmd.exe 6084 cmd.exe 2852 cmd.exe 4192 cmd.exe 3972 cmd.exe 4452 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2708 1376 WerFault.exe 86 6068 5776 WerFault.exe 92 1492 1332 WerFault.exe 98 1652 1044 WerFault.exe 103 3672 4768 WerFault.exe 108 3776 2132 WerFault.exe 113 4380 3836 WerFault.exe 118 2464 4032 WerFault.exe 123 4912 4316 WerFault.exe 128 1060 1928 WerFault.exe 133 5096 1084 WerFault.exe 138 2852 6064 WerFault.exe 143 4328 1132 WerFault.exe 148 1384 4172 WerFault.exe 153 4208 1380 WerFault.exe 158 1624 5584 WerFault.exe 163 1116 3692 WerFault.exe 168 2344 1704 WerFault.exe 173 4916 1440 WerFault.exe 178 2296 5344 WerFault.exe 183 6116 1864 WerFault.exe 188 4080 3264 WerFault.exe 193 4920 2388 WerFault.exe 198 4656 4028 WerFault.exe 203 1616 2692 WerFault.exe 208 5848 2236 WerFault.exe 213 3776 4732 WerFault.exe 218 3656 6136 WerFault.exe 223 5736 700 WerFault.exe 228 4736 4932 WerFault.exe 233 6084 5908 WerFault.exe 238 3380 4636 WerFault.exe 243 4840 1684 WerFault.exe 248 4608 6108 WerFault.exe 253 1488 3700 WerFault.exe 258 1156 4336 WerFault.exe 264 2232 1400 WerFault.exe 269 2184 5568 WerFault.exe 274 5536 716 WerFault.exe 279 5868 4140 WerFault.exe 284 1952 4832 WerFault.exe 289 5596 3068 WerFault.exe 294 6092 5328 WerFault.exe 299 368 5132 WerFault.exe 304 956 6068 WerFault.exe 309 4668 3824 WerFault.exe 314 5444 6020 WerFault.exe 319 5768 6100 WerFault.exe 324 2888 5012 WerFault.exe 329 1496 5736 WerFault.exe 334 5212 1168 WerFault.exe 339 6024 3192 WerFault.exe 344 6092 5544 WerFault.exe 349 4664 984 WerFault.exe 354 5356 3716 WerFault.exe 359 4632 2868 WerFault.exe 364 4860 1384 WerFault.exe 369 1252 2604 WerFault.exe 374 2212 1072 WerFault.exe 379 1564 2280 WerFault.exe 384 1420 6072 WerFault.exe 389 2924 5492 WerFault.exe 394 5288 1868 WerFault.exe 399 2308 1448 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUJI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCCZIJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYCOFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EQSWIG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMVCIDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VALANWA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILTZTGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FVTMDOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CECN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJOA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKVV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLAHSDP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UXZFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSWRQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MENN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHQVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GSPCCDY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWRVLIP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJCM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1376 2026-09-29_92047a60d494108650571576619f815f_elex_emotet_stop.exe 1376 2026-09-29_92047a60d494108650571576619f815f_elex_emotet_stop.exe 5776 EUZRCXB.exe 5776 EUZRCXB.exe 1332 JNPG.exe 1332 JNPG.exe 1044 RSCN.exe 1044 RSCN.exe 4768 ZGG.exe 4768 ZGG.exe 2132 GBSUA.exe 2132 GBSUA.exe 3836 EMVCIDM.exe 3836 EMVCIDM.exe 4032 WUJI.exe 4032 WUJI.exe 4316 GSPCCDY.exe 4316 GSPCCDY.exe 1928 MFA.exe 1928 MFA.exe 1084 ZLAHSDP.exe 1084 ZLAHSDP.exe 6064 EQSWIG.exe 6064 EQSWIG.exe 1132 ITR.exe 1132 ITR.exe 4172 QHD.exe 4172 QHD.exe 1380 MENN.exe 1380 MENN.exe 5584 CUOEP.exe 5584 CUOEP.exe 3692 CXAI.exe 3692 CXAI.exe 1704 OQIT.exe 1704 OQIT.exe 1440 YOVNUO.exe 1440 YOVNUO.exe 5344 CECN.exe 5344 CECN.exe 1864 PCCZIJP.exe 1864 PCCZIJP.exe 3264 OMFPRX.exe 3264 OMFPRX.exe 2388 FVTMDOG.exe 2388 FVTMDOG.exe 4028 GYXQJ.exe 4028 GYXQJ.exe 2692 VOK.exe 2692 VOK.exe 2236 KJCM.exe 2236 KJCM.exe 4732 QETNOB.exe 4732 QETNOB.exe 6136 UMIV.exe 6136 UMIV.exe 700 YCOVFM.exe 700 YCOVFM.exe 4932 CKVV.exe 4932 CKVV.exe 5908 GVTQRX.exe 5908 GVTQRX.exe 4636 CYCOFA.exe 4636 CYCOFA.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1376 2026-09-29_92047a60d494108650571576619f815f_elex_emotet_stop.exe 1376 2026-09-29_92047a60d494108650571576619f815f_elex_emotet_stop.exe 5776 EUZRCXB.exe 5776 EUZRCXB.exe 1332 JNPG.exe 1332 JNPG.exe 1044 RSCN.exe 1044 RSCN.exe 4768 ZGG.exe 4768 ZGG.exe 2132 GBSUA.exe 2132 GBSUA.exe 3836 EMVCIDM.exe 3836 EMVCIDM.exe 4032 WUJI.exe 4032 WUJI.exe 4316 GSPCCDY.exe 4316 GSPCCDY.exe 1928 MFA.exe 1928 MFA.exe 1084 ZLAHSDP.exe 1084 ZLAHSDP.exe 6064 EQSWIG.exe 6064 EQSWIG.exe 1132 ITR.exe 1132 ITR.exe 4172 QHD.exe 4172 QHD.exe 1380 MENN.exe 1380 MENN.exe 5584 CUOEP.exe 5584 CUOEP.exe 3692 CXAI.exe 3692 CXAI.exe 1704 OQIT.exe 1704 OQIT.exe 1440 YOVNUO.exe 1440 YOVNUO.exe 5344 CECN.exe 5344 CECN.exe 1864 PCCZIJP.exe 1864 PCCZIJP.exe 3264 OMFPRX.exe 3264 OMFPRX.exe 2388 FVTMDOG.exe 2388 FVTMDOG.exe 4028 GYXQJ.exe 4028 GYXQJ.exe 2692 VOK.exe 2692 VOK.exe 2236 KJCM.exe 2236 KJCM.exe 4732 QETNOB.exe 4732 QETNOB.exe 6136 UMIV.exe 6136 UMIV.exe 700 YCOVFM.exe 700 YCOVFM.exe 4932 CKVV.exe 4932 CKVV.exe 5908 GVTQRX.exe 5908 GVTQRX.exe 4636 CYCOFA.exe 4636 CYCOFA.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1376 wrote to memory of 5292 1376 2026-09-29_92047a60d494108650571576619f815f_elex_emotet_stop.exe 88 PID 5292 wrote to memory of 5776 5292 cmd.exe 92 PID 5776 wrote to memory of 4352 5776 EUZRCXB.exe 94 PID 4352 wrote to memory of 1332 4352 cmd.exe 98 PID 1332 wrote to memory of 5476 1332 JNPG.exe 99 PID 5476 wrote to memory of 1044 5476 cmd.exe 103 PID 1044 wrote to memory of 2068 1044 RSCN.exe 104 PID 2068 wrote to memory of 4768 2068 cmd.exe 108 PID 4768 wrote to memory of 3352 4768 ZGG.exe 109 PID 3352 wrote to memory of 2132 3352 cmd.exe 113 PID 2132 wrote to memory of 4044 2132 GBSUA.exe 114 PID 4044 wrote to memory of 3836 4044 cmd.exe 118 PID 3836 wrote to memory of 6104 3836 EMVCIDM.exe 119 PID 6104 wrote to memory of 4032 6104 cmd.exe 123 PID 4032 wrote to memory of 5516 4032 WUJI.exe 124 PID 5516 wrote to memory of 4316 5516 cmd.exe 128 PID 4316 wrote to memory of 5656 4316 GSPCCDY.exe 129 PID 5656 wrote to memory of 1928 5656 cmd.exe 133 PID 1928 wrote to memory of 5624 1928 MFA.exe 134 PID 5624 wrote to memory of 1084 5624 cmd.exe 138 PID 1084 wrote to memory of 5104 1084 ZLAHSDP.exe 139 PID 6064 wrote to memory of 3096 6064 EQSWIG.exe 144 PID 3096 wrote to memory of 1132 3096 cmd.exe 148 PID 1132 wrote to memory of 5072 1132 ITR.exe 149 PID 5072 wrote to memory of 4172 5072 cmd.exe 153 PID 4172 wrote to memory of 3212 4172 QHD.exe 154 PID 3212 wrote to memory of 1380 3212 cmd.exe 158 PID 1380 wrote to memory of 3520 1380 MENN.exe 159 PID 3520 wrote to memory of 5584 3520 cmd.exe 163 PID 5584 wrote to memory of 5036 5584 CUOEP.exe 164 PID 5036 wrote to memory of 3692 5036 cmd.exe 168 PID 3692 wrote to memory of 1412 3692 CXAI.exe 169 PID 1412 wrote to memory of 1704 1412 cmd.exe 173 PID 1704 wrote to memory of 4512 1704 OQIT.exe 174 PID 4512 wrote to memory of 1440 4512 cmd.exe 178 PID 1440 wrote to memory of 1976 1440 YOVNUO.exe 179 PID 1976 wrote to memory of 5344 1976 cmd.exe 183 PID 5344 wrote to memory of 3884 5344 CECN.exe 184 PID 3884 wrote to memory of 1864 3884 cmd.exe 188 PID 1864 wrote to memory of 3572 1864 PCCZIJP.exe 189 PID 3572 wrote to memory of 3264 3572 cmd.exe 193 PID 3264 wrote to memory of 6032 3264 OMFPRX.exe 194 PID 6032 wrote to memory of 2388 6032 cmd.exe 198 PID 2388 wrote to memory of 5368 2388 FVTMDOG.exe 199 PID 5368 wrote to memory of 4028 5368 cmd.exe 203 PID 4028 wrote to memory of 1096 4028 GYXQJ.exe 204 PID 1096 wrote to memory of 2692 1096 cmd.exe 208 PID 2692 wrote to memory of 1712 2692 VOK.exe 209 PID 1712 wrote to memory of 2236 1712 cmd.exe 213 PID 2236 wrote to memory of 4764 2236 KJCM.exe 214 PID 4764 wrote to memory of 4732 4764 cmd.exe 218 PID 4732 wrote to memory of 3404 4732 QETNOB.exe 219 PID 3404 wrote to memory of 6136 3404 cmd.exe 223 PID 6136 wrote to memory of 2612 6136 UMIV.exe 224 PID 2612 wrote to memory of 700 2612 cmd.exe 228 PID 700 wrote to memory of 3448 700 YCOVFM.exe 229 PID 3448 wrote to memory of 4932 3448 cmd.exe 233 PID 4932 wrote to memory of 4916 4932 CKVV.exe 234 PID 4916 wrote to memory of 5908 4916 cmd.exe 238 PID 5908 wrote to memory of 4148 5908 GVTQRX.exe 239 PID 4148 wrote to memory of 4636 4148 cmd.exe 243 PID 4636 wrote to memory of 4796 4636 CYCOFA.exe 244 PID 4796 wrote to memory of 1684 4796 cmd.exe 248 PID 1684 wrote to memory of 4008 1684 YZLRRE.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_92047a60d494108650571576619f815f_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_92047a60d494108650571576619f815f_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUZRCXB.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\windows\EUZRCXB.exeC:\windows\EUZRCXB.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JNPG.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\windows\JNPG.exeC:\windows\JNPG.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RSCN.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\windows\RSCN.exeC:\windows\RSCN.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGG.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\windows\system\ZGG.exeC:\windows\system\ZGG.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GBSUA.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\windows\system\GBSUA.exeC:\windows\system\GBSUA.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EMVCIDM.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\windows\EMVCIDM.exeC:\windows\EMVCIDM.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUJI.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\windows\WUJI.exeC:\windows\WUJI.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSPCCDY.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\windows\SysWOW64\GSPCCDY.exeC:\windows\system32\GSPCCDY.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MFA.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\SysWOW64\MFA.exeC:\windows\system32\MFA.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLAHSDP.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\windows\ZLAHSDP.exeC:\windows\ZLAHSDP.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EQSWIG.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5104 -
C:\windows\SysWOW64\EQSWIG.exeC:\windows\system32\EQSWIG.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ITR.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\windows\SysWOW64\ITR.exeC:\windows\system32\ITR.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHD.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\windows\system\QHD.exeC:\windows\system\QHD.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MENN.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\windows\MENN.exeC:\windows\MENN.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CUOEP.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\windows\SysWOW64\CUOEP.exeC:\windows\system32\CUOEP.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CXAI.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\windows\system\CXAI.exeC:\windows\system\CXAI.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQIT.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\windows\OQIT.exeC:\windows\OQIT.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOVNUO.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\windows\YOVNUO.exeC:\windows\YOVNUO.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CECN.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\windows\SysWOW64\CECN.exeC:\windows\system32\CECN.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PCCZIJP.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\windows\system\PCCZIJP.exeC:\windows\system\PCCZIJP.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OMFPRX.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\windows\OMFPRX.exeC:\windows\OMFPRX.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FVTMDOG.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\windows\system\FVTMDOG.exeC:\windows\system\FVTMDOG.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GYXQJ.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\windows\SysWOW64\GYXQJ.exeC:\windows\system32\GYXQJ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VOK.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\windows\system\VOK.exeC:\windows\system\VOK.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJCM.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\windows\SysWOW64\KJCM.exeC:\windows\system32\KJCM.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QETNOB.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\windows\QETNOB.exeC:\windows\QETNOB.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UMIV.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\windows\UMIV.exeC:\windows\UMIV.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCOVFM.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\windows\YCOVFM.exeC:\windows\YCOVFM.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKVV.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\windows\CKVV.exeC:\windows\CKVV.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GVTQRX.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\windows\SysWOW64\GVTQRX.exeC:\windows\system32\GVTQRX.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYCOFA.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\windows\system\CYCOFA.exeC:\windows\system\CYCOFA.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZLRRE.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\windows\system\YZLRRE.exeC:\windows\system\YZLRRE.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJUP.exe.bat" "66⤵PID:4008
-
C:\windows\SysWOW64\MJUP.exeC:\windows\system32\MJUP.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXZZH.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4660 -
C:\windows\system\GXZZH.exeC:\windows\system\GXZZH.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXBE.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2356 -
C:\windows\system\XXBE.exeC:\windows\system\XXBE.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NAKIEZ.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3300 -
C:\windows\NAKIEZ.exeC:\windows\NAKIEZ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TNJRICL.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:2192 -
C:\windows\system\TNJRICL.exeC:\windows\system\TNJRICL.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJOA.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:3220 -
C:\windows\SysWOW64\NJOA.exeC:\windows\system32\NJOA.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GES.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4168 -
C:\windows\SysWOW64\GES.exeC:\windows\system32\GES.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJKLOND.exe.bat" "80⤵
- Executes a command shell one-liner
PID:2812 -
C:\windows\SysWOW64\LJKLOND.exeC:\windows\system32\LJKLOND.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHQGWV.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4076 -
C:\windows\system\NHQGWV.exeC:\windows\system\NHQGWV.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NKT.exe.bat" "84⤵PID:5940
-
C:\windows\SysWOW64\NKT.exeC:\windows\system32\NKT.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVERKZK.exe.bat" "86⤵
- Executes a command shell one-liner
PID:4080 -
C:\windows\SysWOW64\MVERKZK.exeC:\windows\system32\MVERKZK.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QLLZ.exe.bat" "88⤵PID:4644
-
C:\windows\QLLZ.exeC:\windows\QLLZ.exe89⤵
- Executes dropped EXE
PID:6068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FBM.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2820 -
C:\windows\system\FBM.exeC:\windows\system\FBM.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HZSLK.exe.bat" "92⤵PID:1920
-
C:\windows\system\HZSLK.exeC:\windows\system\HZSLK.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBIKY.exe.bat" "94⤵
- Executes a command shell one-liner
PID:5480 -
C:\windows\system\UBIKY.exeC:\windows\system\UBIKY.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VEMGEOS.exe.bat" "96⤵PID:4120
-
C:\windows\system\VEMGEOS.exeC:\windows\system\VEMGEOS.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EFO.exe.bat" "98⤵PID:1088
-
C:\windows\EFO.exeC:\windows\EFO.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MSS.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:1436 -
C:\windows\MSS.exeC:\windows\MSS.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LORRF.exe.bat" "102⤵
- Executes a command shell one-liner
PID:2772 -
C:\windows\SysWOW64\LORRF.exeC:\windows\system32\LORRF.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YYI.exe.bat" "104⤵PID:1244
-
C:\windows\system\YYI.exeC:\windows\system\YYI.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TMNZE.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:484 -
C:\windows\TMNZE.exeC:\windows\TMNZE.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KUPEHZ.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4868 -
C:\windows\system\KUPEHZ.exeC:\windows\system\KUPEHZ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MSUYPH.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1944 -
C:\windows\MSUYPH.exeC:\windows\MSUYPH.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UXZFZ.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:3208 -
C:\windows\system\UXZFZ.exeC:\windows\system\UXZFZ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VALANWA.exe.bat" "114⤵
- Executes a command shell one-liner
PID:3644 -
C:\windows\SysWOW64\VALANWA.exeC:\windows\system32\VALANWA.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ILTZTGV.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:3304 -
C:\windows\SysWOW64\ILTZTGV.exeC:\windows\system32\ILTZTGV.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTAHF.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:3040 -
C:\windows\MTAHF.exeC:\windows\MTAHF.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BJB.exe.bat" "120⤵PID:1424
-
C:\windows\BJB.exeC:\windows\BJB.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-