Analysis
- max time kernel
71s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 20:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_57ce0439c30c20894c43f3dfb1160329_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-29_57ce0439c30c20894c43f3dfb1160329_elex_emotet_stop.exe
- Size 208KB
- Sample260930-zer4bssxfv
- SHA256 96cbd1c83f1d754630cd69dc1eeffbd7149b33fff980c05442a6f9bff5192adf
- MD5 57ce0439c30c20894c43f3dfb1160329
- SHA1 833fc5a8ee1b49b3b38945886baf840e00b9ba87
- SHA512 3c6c0ab68d2193823a993919501e012f7438b0150fedc1f5bfcd78a738dada2154c4c2826370a6d057b86aea5e42af67f2738803b7ce0fb2a93c66297188462c
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFleKL+LOfR4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFleS+LOZkEj1
- TLSH T124247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2744 HLYSQTY.exe 108 PJFMKI.exe 6084 ARAABOE.exe 3772 ZXH.exe 5588 GQWMQO.exe 6108 MLIFWK.exe 3412 DLWCIT.exe 5532 VUD.exe 4820 JPO.exe 1840 NSZN.exe 5384 ULOWCLK.exe 1544 EDGD.exe 3204 DOVLYNO.exe 2372 FWEAFH.exe 576 DMRS.exe 2580 SKEJCV.exe 4840 MYQ.exe 2696 YBANZ.exe 6092 THNQKSK.exe 2384 ACZRQPS.exe 5328 GXKK.exe 1308 DNYC.exe 1232 EQOYBUS.exe 4300 QTYLKGV.exe 4732 AMILOB.exe 2044 RUWQAS.exe 5344 QFZYJ.exe 2344 NKR.exe 5144 GYQT.exe 616 ZQGE.exe 1160 GMRX.exe 1400 EWU.exe 3208 FZLJ.exe 120 WIZG.exe 1876 KGZSNKT.exe 3556 MBQ.exe 5580 AZQ.exe 4528 EEIDZLF.exe 4992 MKVJJJB.exe 4896 UXAQMI.exe 436 LIKGV.exe 6048 QIMI.exe 4704 YOZP.exe 1760 AME.exe 3336 ZWHZHFC.exe 2096 JUVLP.exe 4956 UNCEY.exe 4824 CAPL.exe 1280 MYVX.exe 1204 STUGV.exe 2432 QJN.exe 4460 PUQRYRI.exe 3408 KPVB.exe 3472 OXBJNB.exe 3664 UTAJ.exe 5644 QYL.exe 5776 WLKZMC.exe 2844 POODSAU.exe 1720 ZMBXZJD.exe 1864 SPFT.exe 2936 XQNHWT.exe 960 PQPMZYQ.exe 1984 ROUGHHR.exe 3136 EYLFV.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\KPVB.exe PUQRYRI.exe File opened for modification C:\windows\SysWOW64\HLYSQTY.exe 2026-09-29_57ce0439c30c20894c43f3dfb1160329_elex_emotet_stop.exe File created C:\windows\SysWOW64\HLYSQTY.exe.bat 2026-09-29_57ce0439c30c20894c43f3dfb1160329_elex_emotet_stop.exe File created C:\windows\SysWOW64\EDGD.exe ULOWCLK.exe File created C:\windows\SysWOW64\WIZG.exe FZLJ.exe File opened for modification C:\windows\SysWOW64\MYVX.exe CAPL.exe File created C:\windows\SysWOW64\BUSK.exe XQUPJZ.exe File created C:\windows\SysWOW64\QYL.exe UTAJ.exe File created C:\windows\SysWOW64\ROUGHHR.exe PQPMZYQ.exe File created C:\windows\SysWOW64\QFZYJ.exe RUWQAS.exe File created C:\windows\SysWOW64\ARAABOE.exe.bat PJFMKI.exe File created C:\windows\SysWOW64\ULOWCLK.exe NSZN.exe File opened for modification C:\windows\SysWOW64\THNQKSK.exe YBANZ.exe File opened for modification C:\windows\SysWOW64\GXKK.exe ACZRQPS.exe File created C:\windows\SysWOW64\OPVL.exe.bat LHODT.exe File created C:\windows\SysWOW64\THNQKSK.exe YBANZ.exe File created C:\windows\SysWOW64\ACZRQPS.exe THNQKSK.exe File opened for modification C:\windows\SysWOW64\OXBJNB.exe KPVB.exe File created C:\windows\SysWOW64\ALCZTEF.exe.bat GYXQJ.exe File opened for modification C:\windows\SysWOW64\XQUPJZ.exe ALCZTEF.exe File opened for modification C:\windows\SysWOW64\YQVG.exe IAUPUU.exe File created C:\windows\SysWOW64\YQVG.exe.bat IAUPUU.exe File created C:\windows\SysWOW64\EDGD.exe.bat ULOWCLK.exe File created C:\windows\SysWOW64\QYL.exe.bat UTAJ.exe File created C:\windows\SysWOW64\EYLFV.exe ROUGHHR.exe File created C:\windows\SysWOW64\THNQKSK.exe.bat YBANZ.exe File opened for modification C:\windows\SysWOW64\EYLFV.exe ROUGHHR.exe File created C:\windows\SysWOW64\RUWQAS.exe.bat AMILOB.exe File opened for modification C:\windows\SysWOW64\WIZG.exe FZLJ.exe File created C:\windows\SysWOW64\XQUPJZ.exe.bat ALCZTEF.exe File opened for modification C:\windows\SysWOW64\BUSK.exe XQUPJZ.exe File created C:\windows\SysWOW64\RUWQAS.exe AMILOB.exe File opened for modification C:\windows\SysWOW64\RUWQAS.exe AMILOB.exe File created C:\windows\SysWOW64\WIZG.exe.bat FZLJ.exe File created C:\windows\SysWOW64\MYVX.exe.bat CAPL.exe File created C:\windows\SysWOW64\ULOWCLK.exe.bat NSZN.exe File created C:\windows\SysWOW64\ROUGHHR.exe.bat PQPMZYQ.exe File created C:\windows\SysWOW64\EYLFV.exe.bat ROUGHHR.exe File created C:\windows\SysWOW64\ALCZTEF.exe GYXQJ.exe File created C:\windows\SysWOW64\IXQLHEF.exe.bat JHX.exe File opened for modification C:\windows\SysWOW64\ULOWCLK.exe NSZN.exe File created C:\windows\SysWOW64\QFZYJ.exe.bat RUWQAS.exe File opened for modification C:\windows\SysWOW64\KGZSNKT.exe WIZG.exe File created C:\windows\SysWOW64\MYVX.exe CAPL.exe File opened for modification C:\windows\SysWOW64\GYXQJ.exe OPVL.exe File created C:\windows\SysWOW64\GYXQJ.exe.bat OPVL.exe File created C:\windows\SysWOW64\IXQLHEF.exe JHX.exe File created C:\windows\SysWOW64\YQVG.exe IAUPUU.exe File created C:\windows\SysWOW64\OXBJNB.exe KPVB.exe File created C:\windows\SysWOW64\GXKK.exe ACZRQPS.exe File created C:\windows\SysWOW64\KGZSNKT.exe.bat WIZG.exe File opened for modification C:\windows\SysWOW64\ALCZTEF.exe GYXQJ.exe File created C:\windows\SysWOW64\BUSK.exe.bat XQUPJZ.exe File created C:\windows\SysWOW64\QTYLKGV.exe EQOYBUS.exe File opened for modification C:\windows\SysWOW64\OPVL.exe LHODT.exe File opened for modification C:\windows\SysWOW64\QTYLKGV.exe EQOYBUS.exe File created C:\windows\SysWOW64\KGZSNKT.exe WIZG.exe File created C:\windows\SysWOW64\HLYSQTY.exe 2026-09-29_57ce0439c30c20894c43f3dfb1160329_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\KPVB.exe PUQRYRI.exe File created C:\windows\SysWOW64\KPVB.exe.bat PUQRYRI.exe File created C:\windows\SysWOW64\GYXQJ.exe OPVL.exe File created C:\windows\SysWOW64\ARAABOE.exe PJFMKI.exe File opened for modification C:\windows\SysWOW64\EDGD.exe ULOWCLK.exe File opened for modification C:\windows\SysWOW64\QFZYJ.exe RUWQAS.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\GMRX.exe ZQGE.exe File created C:\windows\system\FZLJ.exe.bat EWU.exe File created C:\windows\system\QJN.exe.bat STUGV.exe File opened for modification C:\windows\system\VZFKGP.exe EYLFV.exe File opened for modification C:\windows\system\GQWMQO.exe ZXH.exe File opened for modification C:\windows\system\DOVLYNO.exe EDGD.exe File created C:\windows\MKVJJJB.exe.bat EEIDZLF.exe File opened for modification C:\windows\system\PQPMZYQ.exe XQNHWT.exe File created C:\windows\JUVLP.exe.bat ZWHZHFC.exe File created C:\windows\system\STUGV.exe.bat MYVX.exe File created C:\windows\EQOYBUS.exe.bat DNYC.exe File created C:\windows\system\GQWMQO.exe ZXH.exe File created C:\windows\system\GQWMQO.exe.bat ZXH.exe File created C:\windows\DLWCIT.exe MLIFWK.exe File created C:\windows\VUD.exe DLWCIT.exe File created C:\windows\MYQ.exe SKEJCV.exe File created C:\windows\FWEAFH.exe.bat DOVLYNO.exe File opened for modification C:\windows\system\DMRS.exe FWEAFH.exe File created C:\windows\system\DNYC.exe GXKK.exe File opened for modification C:\windows\EWU.exe GMRX.exe File created C:\windows\ZWHZHFC.exe.bat AME.exe File created C:\windows\system\STUGV.exe MYVX.exe File created C:\windows\YOZP.exe.bat QIMI.exe File opened for modification C:\windows\PUQRYRI.exe QJN.exe File created C:\windows\GYQT.exe NKR.exe File created C:\windows\GMRX.exe.bat ZQGE.exe File created C:\windows\system\AME.exe YOZP.exe File opened for modification C:\windows\system\STUGV.exe MYVX.exe File created C:\windows\PUQRYRI.exe.bat QJN.exe File created C:\windows\MYQ.exe.bat SKEJCV.exe File created C:\windows\system\YBANZ.exe.bat MYQ.exe File created C:\windows\ZQGE.exe.bat GYQT.exe File created C:\windows\system\PQPMZYQ.exe.bat XQNHWT.exe File created C:\windows\system\VZFKGP.exe.bat EYLFV.exe File opened for modification C:\windows\system\PJFMKI.exe HLYSQTY.exe File created C:\windows\system\AZQ.exe.bat MBQ.exe File created C:\windows\EEIDZLF.exe AZQ.exe File opened for modification C:\windows\YOZP.exe QIMI.exe File created C:\windows\UNCEY.exe.bat JUVLP.exe File created C:\windows\system\LHODT.exe LCWO.exe File created C:\windows\JPO.exe VUD.exe File opened for modification C:\windows\EEIDZLF.exe AZQ.exe File opened for modification C:\windows\JHX.exe BUSK.exe File created C:\windows\system\YBANZ.exe MYQ.exe File created C:\windows\system\UXAQMI.exe MKVJJJB.exe File opened for modification C:\windows\LIKGV.exe UXAQMI.exe File opened for modification C:\windows\system\QJN.exe STUGV.exe File opened for modification C:\windows\XQNHWT.exe SPFT.exe File opened for modification C:\windows\system\LHODT.exe LCWO.exe File opened for modification C:\windows\system\ZXH.exe ARAABOE.exe File created C:\windows\VUD.exe.bat DLWCIT.exe File created C:\windows\NKR.exe.bat QFZYJ.exe File created C:\windows\system\QIMI.exe LIKGV.exe File opened for modification C:\windows\WTG.exe SDAYDI.exe File opened for modification C:\windows\DLWCIT.exe MLIFWK.exe File created C:\windows\system\NSZN.exe JPO.exe File created C:\windows\system\FZLJ.exe EWU.exe File created C:\windows\MBQ.exe KGZSNKT.exe File opened for modification C:\windows\LCWO.exe VZFKGP.exe File created C:\windows\system\LHODT.exe.bat LCWO.exe File created C:\windows\system\DMRS.exe FWEAFH.exe File created C:\windows\CAPL.exe.bat UNCEY.exe File opened for modification C:\windows\SFFZT.exe OZVK.exe File created C:\windows\system\PJFMKI.exe.bat HLYSQTY.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3676 cmd.exe 5528 cmd.exe 4816 cmd.exe 3756 cmd.exe 3592 cmd.exe 1800 cmd.exe 1532 cmd.exe 3148 cmd.exe 5428 cmd.exe 1436 cmd.exe 5652 cmd.exe 4640 cmd.exe 4224 cmd.exe 2992 cmd.exe 1156 cmd.exe 4800 cmd.exe 2940 cmd.exe 5708 cmd.exe 3976 cmd.exe 5724 cmd.exe 2676 cmd.exe 2180 cmd.exe 2664 cmd.exe 4996 cmd.exe 1808 cmd.exe 1516 cmd.exe 2024 cmd.exe 5336 cmd.exe 3568 cmd.exe 5944 cmd.exe 364 cmd.exe 1044 cmd.exe 3844 cmd.exe 1032 cmd.exe 2768 cmd.exe 3140 cmd.exe 4340 cmd.exe 1512 cmd.exe 200 cmd.exe 5980 cmd.exe 5440 cmd.exe 3704 cmd.exe 1640 cmd.exe 2476 cmd.exe 4872 cmd.exe 5928 cmd.exe 3536 cmd.exe 2776 cmd.exe 4512 cmd.exe 2440 cmd.exe 4632 cmd.exe 4904 cmd.exe 3828 cmd.exe 4164 cmd.exe 4304 cmd.exe 5208 cmd.exe 5924 cmd.exe 1652 cmd.exe 5600 cmd.exe 5572 cmd.exe 52 cmd.exe 4636 cmd.exe 2612 cmd.exe 4360 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5244 3460 WerFault.exe 88 2512 2744 WerFault.exe 93 2560 108 WerFault.exe 99 5644 6084 WerFault.exe 104 2024 3772 WerFault.exe 109 5752 5588 WerFault.exe 114 2640 6108 WerFault.exe 119 5856 3412 WerFault.exe 124 2988 5532 WerFault.exe 129 4924 4820 WerFault.exe 134 4948 1840 WerFault.exe 139 3444 5384 WerFault.exe 144 2572 1544 WerFault.exe 149 4184 3204 WerFault.exe 154 2044 2372 WerFault.exe 159 5580 576 WerFault.exe 164 4684 2580 WerFault.exe 169 2840 4840 WerFault.exe 174 4752 2696 WerFault.exe 179 2880 6092 WerFault.exe 184 2036 2384 WerFault.exe 189 1720 5328 WerFault.exe 194 3976 1308 WerFault.exe 199 1532 1232 WerFault.exe 204 1876 4300 WerFault.exe 209 2096 4732 WerFault.exe 214 2268 2044 WerFault.exe 219 6076 5344 WerFault.exe 224 2840 2344 WerFault.exe 229 5188 5144 WerFault.exe 234 4492 616 WerFault.exe 239 2932 1160 WerFault.exe 244 2016 1400 WerFault.exe 250 1760 3208 WerFault.exe 255 4780 120 WerFault.exe 260 5224 1876 WerFault.exe 265 1220 3556 WerFault.exe 270 5312 5580 WerFault.exe 275 1312 4528 WerFault.exe 280 2496 4992 WerFault.exe 285 3028 4896 WerFault.exe 290 5240 436 WerFault.exe 295 2936 6048 WerFault.exe 300 5512 4704 WerFault.exe 305 2612 1760 WerFault.exe 310 3044 3336 WerFault.exe 315 5036 2096 WerFault.exe 320 5940 4956 WerFault.exe 325 4464 4824 WerFault.exe 330 4964 1280 WerFault.exe 335 428 1204 WerFault.exe 340 3108 2432 WerFault.exe 345 972 4460 WerFault.exe 350 5400 3408 WerFault.exe 355 5756 3472 WerFault.exe 360 5032 3664 WerFault.exe 365 5600 5644 WerFault.exe 370 5100 5776 WerFault.exe 375 4988 2844 WerFault.exe 380 256 1720 WerFault.exe 385 1420 1864 WerFault.exe 390 1932 2936 WerFault.exe 395 5876 960 WerFault.exe 400 3312 1984 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THNQKSK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWHZHFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUQRYRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWEAFH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEROYOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKEJCV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIKGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JPO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUWQAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QJN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZMBXZJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAUPUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACZRQPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGZSNKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPFT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJFMKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHODT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMRS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALCZTEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3460 2026-09-29_57ce0439c30c20894c43f3dfb1160329_elex_emotet_stop.exe 3460 2026-09-29_57ce0439c30c20894c43f3dfb1160329_elex_emotet_stop.exe 2744 HLYSQTY.exe 2744 HLYSQTY.exe 108 PJFMKI.exe 108 PJFMKI.exe 6084 ARAABOE.exe 6084 ARAABOE.exe 3772 ZXH.exe 3772 ZXH.exe 5588 GQWMQO.exe 5588 GQWMQO.exe 6108 MLIFWK.exe 6108 MLIFWK.exe 3412 DLWCIT.exe 3412 DLWCIT.exe 5532 VUD.exe 5532 VUD.exe 4820 JPO.exe 4820 JPO.exe 1840 NSZN.exe 1840 NSZN.exe 5384 ULOWCLK.exe 5384 ULOWCLK.exe 1544 EDGD.exe 1544 EDGD.exe 3204 DOVLYNO.exe 3204 DOVLYNO.exe 2372 FWEAFH.exe 2372 FWEAFH.exe 576 DMRS.exe 576 DMRS.exe 2580 SKEJCV.exe 2580 SKEJCV.exe 4840 MYQ.exe 4840 MYQ.exe 2696 YBANZ.exe 2696 YBANZ.exe 6092 THNQKSK.exe 6092 THNQKSK.exe 2384 ACZRQPS.exe 2384 ACZRQPS.exe 5328 GXKK.exe 5328 GXKK.exe 1308 DNYC.exe 1308 DNYC.exe 1232 EQOYBUS.exe 1232 EQOYBUS.exe 4300 QTYLKGV.exe 4300 QTYLKGV.exe 4732 AMILOB.exe 4732 AMILOB.exe 2044 RUWQAS.exe 2044 RUWQAS.exe 5344 QFZYJ.exe 5344 QFZYJ.exe 2344 NKR.exe 2344 NKR.exe 5144 GYQT.exe 5144 GYQT.exe 616 ZQGE.exe 616 ZQGE.exe 1160 GMRX.exe 1160 GMRX.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3460 2026-09-29_57ce0439c30c20894c43f3dfb1160329_elex_emotet_stop.exe 3460 2026-09-29_57ce0439c30c20894c43f3dfb1160329_elex_emotet_stop.exe 2744 HLYSQTY.exe 2744 HLYSQTY.exe 108 PJFMKI.exe 108 PJFMKI.exe 6084 ARAABOE.exe 6084 ARAABOE.exe 3772 ZXH.exe 3772 ZXH.exe 5588 GQWMQO.exe 5588 GQWMQO.exe 6108 MLIFWK.exe 6108 MLIFWK.exe 3412 DLWCIT.exe 3412 DLWCIT.exe 5532 VUD.exe 5532 VUD.exe 4820 JPO.exe 4820 JPO.exe 1840 NSZN.exe 1840 NSZN.exe 5384 ULOWCLK.exe 5384 ULOWCLK.exe 1544 EDGD.exe 1544 EDGD.exe 3204 DOVLYNO.exe 3204 DOVLYNO.exe 2372 FWEAFH.exe 2372 FWEAFH.exe 576 DMRS.exe 576 DMRS.exe 2580 SKEJCV.exe 2580 SKEJCV.exe 4840 MYQ.exe 4840 MYQ.exe 2696 YBANZ.exe 2696 YBANZ.exe 6092 THNQKSK.exe 6092 THNQKSK.exe 2384 ACZRQPS.exe 2384 ACZRQPS.exe 5328 GXKK.exe 5328 GXKK.exe 1308 DNYC.exe 1308 DNYC.exe 1232 EQOYBUS.exe 1232 EQOYBUS.exe 4300 QTYLKGV.exe 4300 QTYLKGV.exe 4732 AMILOB.exe 4732 AMILOB.exe 2044 RUWQAS.exe 2044 RUWQAS.exe 5344 QFZYJ.exe 5344 QFZYJ.exe 2344 NKR.exe 2344 NKR.exe 5144 GYQT.exe 5144 GYQT.exe 616 ZQGE.exe 616 ZQGE.exe 1160 GMRX.exe 1160 GMRX.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3460 wrote to memory of 2676 3460 2026-09-29_57ce0439c30c20894c43f3dfb1160329_elex_emotet_stop.exe 89 PID 2676 wrote to memory of 2744 2676 cmd.exe 93 PID 2744 wrote to memory of 5900 2744 HLYSQTY.exe 95 PID 5900 wrote to memory of 108 5900 cmd.exe 99 PID 108 wrote to memory of 2956 108 PJFMKI.exe 100 PID 2956 wrote to memory of 6084 2956 cmd.exe 104 PID 6084 wrote to memory of 1324 6084 ARAABOE.exe 105 PID 1324 wrote to memory of 3772 1324 cmd.exe 109 PID 3772 wrote to memory of 5796 3772 ZXH.exe 110 PID 5796 wrote to memory of 5588 5796 cmd.exe 114 PID 5588 wrote to memory of 3676 5588 GQWMQO.exe 115 PID 3676 wrote to memory of 6108 3676 cmd.exe 119 PID 6108 wrote to memory of 2620 6108 MLIFWK.exe 120 PID 2620 wrote to memory of 3412 2620 cmd.exe 124 PID 3412 wrote to memory of 3872 3412 DLWCIT.exe 125 PID 3872 wrote to memory of 5532 3872 cmd.exe 129 PID 5532 wrote to memory of 2328 5532 VUD.exe 130 PID 2328 wrote to memory of 4820 2328 cmd.exe 134 PID 4820 wrote to memory of 4836 4820 JPO.exe 135 PID 4836 wrote to memory of 1840 4836 cmd.exe 139 PID 1840 wrote to memory of 4468 1840 NSZN.exe 140 PID 4468 wrote to memory of 5384 4468 cmd.exe 144 PID 5384 wrote to memory of 1156 5384 ULOWCLK.exe 145 PID 1156 wrote to memory of 1544 1156 cmd.exe 149 PID 1544 wrote to memory of 4304 1544 EDGD.exe 150 PID 4304 wrote to memory of 3204 4304 cmd.exe 154 PID 3204 wrote to memory of 1132 3204 DOVLYNO.exe 155 PID 1132 wrote to memory of 2372 1132 cmd.exe 159 PID 2372 wrote to memory of 52 2372 FWEAFH.exe 160 PID 52 wrote to memory of 576 52 cmd.exe 164 PID 576 wrote to memory of 5864 576 DMRS.exe 165 PID 5864 wrote to memory of 2580 5864 cmd.exe 169 PID 2580 wrote to memory of 4368 2580 SKEJCV.exe 170 PID 4368 wrote to memory of 4840 4368 cmd.exe 174 PID 4840 wrote to memory of 4636 4840 MYQ.exe 175 PID 4636 wrote to memory of 2696 4636 cmd.exe 179 PID 2696 wrote to memory of 836 2696 YBANZ.exe 180 PID 836 wrote to memory of 6092 836 cmd.exe 184 PID 6092 wrote to memory of 2996 6092 THNQKSK.exe 185 PID 2996 wrote to memory of 2384 2996 cmd.exe 189 PID 2384 wrote to memory of 2924 2384 ACZRQPS.exe 190 PID 2924 wrote to memory of 5328 2924 cmd.exe 194 PID 5328 wrote to memory of 4340 5328 GXKK.exe 195 PID 4340 wrote to memory of 1308 4340 cmd.exe 199 PID 1308 wrote to memory of 5388 1308 DNYC.exe 200 PID 5388 wrote to memory of 1232 5388 cmd.exe 204 PID 1232 wrote to memory of 1512 1232 EQOYBUS.exe 205 PID 1512 wrote to memory of 4300 1512 cmd.exe 209 PID 4300 wrote to memory of 5572 4300 QTYLKGV.exe 210 PID 5572 wrote to memory of 4732 5572 cmd.exe 214 PID 4732 wrote to memory of 3304 4732 AMILOB.exe 215 PID 3304 wrote to memory of 2044 3304 cmd.exe 219 PID 2044 wrote to memory of 5208 2044 RUWQAS.exe 220 PID 5208 wrote to memory of 5344 5208 cmd.exe 224 PID 5344 wrote to memory of 4868 5344 QFZYJ.exe 225 PID 4868 wrote to memory of 2344 4868 cmd.exe 229 PID 2344 wrote to memory of 5888 2344 NKR.exe 230 PID 5888 wrote to memory of 5144 5888 cmd.exe 234 PID 5144 wrote to memory of 5944 5144 GYQT.exe 235 PID 5944 wrote to memory of 616 5944 cmd.exe 239 PID 616 wrote to memory of 3948 616 ZQGE.exe 240 PID 3948 wrote to memory of 1160 3948 cmd.exe 244 PID 1160 wrote to memory of 2072 1160 GMRX.exe 246 PID 2072 wrote to memory of 1400 2072 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_57ce0439c30c20894c43f3dfb1160329_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_57ce0439c30c20894c43f3dfb1160329_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HLYSQTY.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\windows\SysWOW64\HLYSQTY.exeC:\windows\system32\HLYSQTY.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJFMKI.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\windows\system\PJFMKI.exeC:\windows\system\PJFMKI.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ARAABOE.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\windows\SysWOW64\ARAABOE.exeC:\windows\system32\ARAABOE.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZXH.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\windows\system\ZXH.exeC:\windows\system\ZXH.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GQWMQO.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\windows\system\GQWMQO.exeC:\windows\system\GQWMQO.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLIFWK.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\windows\system\MLIFWK.exeC:\windows\system\MLIFWK.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DLWCIT.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\windows\DLWCIT.exeC:\windows\DLWCIT.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUD.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\windows\VUD.exeC:\windows\VUD.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JPO.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\windows\JPO.exeC:\windows\JPO.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSZN.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\windows\system\NSZN.exeC:\windows\system\NSZN.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ULOWCLK.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\SysWOW64\ULOWCLK.exeC:\windows\system32\ULOWCLK.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EDGD.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\windows\SysWOW64\EDGD.exeC:\windows\system32\EDGD.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOVLYNO.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\windows\system\DOVLYNO.exeC:\windows\system\DOVLYNO.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWEAFH.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\windows\FWEAFH.exeC:\windows\FWEAFH.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DMRS.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:52 -
C:\windows\system\DMRS.exeC:\windows\system\DMRS.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SKEJCV.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\windows\system\SKEJCV.exeC:\windows\system\SKEJCV.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYQ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\windows\MYQ.exeC:\windows\MYQ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBANZ.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\windows\system\YBANZ.exeC:\windows\system\YBANZ.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THNQKSK.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:836 -
C:\windows\SysWOW64\THNQKSK.exeC:\windows\system32\THNQKSK.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACZRQPS.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\windows\SysWOW64\ACZRQPS.exeC:\windows\system32\ACZRQPS.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GXKK.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\windows\SysWOW64\GXKK.exeC:\windows\system32\GXKK.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNYC.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\windows\system\DNYC.exeC:\windows\system\DNYC.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQOYBUS.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\windows\EQOYBUS.exeC:\windows\EQOYBUS.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QTYLKGV.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\windows\SysWOW64\QTYLKGV.exeC:\windows\system32\QTYLKGV.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AMILOB.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\windows\AMILOB.exeC:\windows\AMILOB.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUWQAS.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\windows\SysWOW64\RUWQAS.exeC:\windows\system32\RUWQAS.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QFZYJ.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\windows\SysWOW64\QFZYJ.exeC:\windows\system32\QFZYJ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NKR.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\windows\NKR.exeC:\windows\NKR.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYQT.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\windows\GYQT.exeC:\windows\GYQT.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQGE.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\windows\ZQGE.exeC:\windows\ZQGE.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMRX.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\windows\GMRX.exeC:\windows\GMRX.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EWU.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\windows\EWU.exeC:\windows\EWU.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZLJ.exe.bat" "66⤵PID:2392
-
C:\windows\system\FZLJ.exeC:\windows\system\FZLJ.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WIZG.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:4784 -
C:\windows\SysWOW64\WIZG.exeC:\windows\system32\WIZG.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGZSNKT.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:3604 -
C:\windows\SysWOW64\KGZSNKT.exeC:\windows\system32\KGZSNKT.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MBQ.exe.bat" "72⤵PID:2508
-
C:\windows\MBQ.exeC:\windows\MBQ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZQ.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:4132 -
C:\windows\system\AZQ.exeC:\windows\system\AZQ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEIDZLF.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:2144 -
C:\windows\EEIDZLF.exeC:\windows\EEIDZLF.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKVJJJB.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5416 -
C:\windows\MKVJJJB.exeC:\windows\MKVJJJB.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UXAQMI.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4872 -
C:\windows\system\UXAQMI.exeC:\windows\system\UXAQMI.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LIKGV.exe.bat" "82⤵PID:5332
-
C:\windows\LIKGV.exeC:\windows\LIKGV.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIMI.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4800 -
C:\windows\system\QIMI.exeC:\windows\system\QIMI.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOZP.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:1500 -
C:\windows\YOZP.exeC:\windows\YOZP.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AME.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2180 -
C:\windows\system\AME.exeC:\windows\system\AME.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZWHZHFC.exe.bat" "90⤵PID:1784
-
C:\windows\ZWHZHFC.exeC:\windows\ZWHZHFC.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JUVLP.exe.bat" "92⤵PID:5744
-
C:\windows\JUVLP.exeC:\windows\JUVLP.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UNCEY.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:5056 -
C:\windows\UNCEY.exeC:\windows\UNCEY.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAPL.exe.bat" "96⤵
- Executes a command shell one-liner
PID:5428 -
C:\windows\CAPL.exeC:\windows\CAPL.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MYVX.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2940 -
C:\windows\SysWOW64\MYVX.exeC:\windows\system32\MYVX.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STUGV.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:364 -
C:\windows\system\STUGV.exeC:\windows\system\STUGV.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJN.exe.bat" "102⤵PID:1908
-
C:\windows\system\QJN.exeC:\windows\system\QJN.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUQRYRI.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:4472 -
C:\windows\PUQRYRI.exeC:\windows\PUQRYRI.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KPVB.exe.bat" "106⤵
- Executes a command shell one-liner
PID:200 -
C:\windows\SysWOW64\KPVB.exeC:\windows\system32\KPVB.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OXBJNB.exe.bat" "108⤵
- Executes a command shell one-liner
PID:5980 -
C:\windows\SysWOW64\OXBJNB.exeC:\windows\system32\OXBJNB.exe109⤵
- Executes dropped EXE
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTAJ.exe.bat" "110⤵PID:2816
-
C:\windows\system\UTAJ.exeC:\windows\system\UTAJ.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QYL.exe.bat" "112⤵
- Executes a command shell one-liner
PID:5708 -
C:\windows\SysWOW64\QYL.exeC:\windows\system32\QYL.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WLKZMC.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2440 -
C:\windows\WLKZMC.exeC:\windows\WLKZMC.exe115⤵
- Executes dropped EXE
PID:5776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\POODSAU.exe.bat" "116⤵
- Executes a command shell one-liner
PID:5928 -
C:\windows\system\POODSAU.exeC:\windows\system\POODSAU.exe117⤵
- Executes dropped EXE
PID:2844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZMBXZJD.exe.bat" "118⤵PID:5548
-
C:\windows\ZMBXZJD.exeC:\windows\ZMBXZJD.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SPFT.exe.bat" "120⤵PID:4964
-
C:\windows\SPFT.exeC:\windows\SPFT.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-