Analysis
- max time kernel
80s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/10/2026, 16:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_35fa5026e9d13466adc25bb64c546320_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-30_35fa5026e9d13466adc25bb64c546320_elex_emotet_stop.exe
- Size 208KB
- Sample261001-trhsjaxy2l
- SHA256 5fb28033a17363079dfedc8756a43432d28a1d3ad62fa87e3fd61c9d38ac03e9
- MD5 35fa5026e9d13466adc25bb64c546320
- SHA1 e707e63db2bf5c056801b502eafce6cd8d8e3569
- SHA512 da19e183cd38ae68772fc128402a375af8bd15376a9410f8c0794b00e7eabedc2d09ec91be5cb09502221f895065571f585d279b30feb6dc901771567b002d9a
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfG4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOekEj1
- TLSH T163247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4400 MUJUX.exe 1636 NIPKVFK.exe 4908 FQJ.exe 2040 QIZ.exe 1984 WEYBMG.exe 2148 RRD.exe 1892 ECLJLR.exe 1236 VCNOOOE.exe 796 BCVC.exe 4580 FSBKJJT.exe 5952 OTD.exe 2976 NDGFWMR.exe 4136 OHSBBK.exe 1496 IUP.exe 1380 ACD.exe 4924 JCFV.exe 2472 TATP.exe 5212 IDCTCU.exe 1176 DQH.exe 5244 BBKTVHH.exe 4808 FJQBZ.exe 1420 GMUWMQE.exe 3164 TSCIO.exe 1868 HVLHC.exe 2888 QDNMGB.exe 2608 LOVK.exe 3824 EJZ.exe 4188 VRBL.exe 2016 KMKYWUL.exe 1748 FAPH.exe 1844 OIRMK.exe 1284 PDVQPPL.exe 4516 IGZMDF.exe 1552 NGG.exe 1188 MRRPUOK.exe 5396 OPXKC.exe 4896 PSBF.exe 4156 ENKSA.exe 2252 IQI.exe 2548 KOWZIAO.exe 1500 FZEYW.exe 1772 HWSKD.exe 1540 XMT.exe 1224 HKZEZ.exe 240 UVHCG.exe 1820 UQTYTQM.exe 5876 LJWOCE.exe 4596 BZXGA.exe 5768 FWP.exe 2712 RKOB.exe 4944 DAHTR.exe 4644 WNOZ.exe 4256 HGVK.exe 1384 GRG.exe 876 FKJIXPS.exe 4312 KCXLK.exe 5884 KFVGYO.exe 3384 YLVS.exe 6076 NGFWLMO.exe 1612 AMFIVY.exe 4708 GMM.exe 1644 MMUKN.exe 1828 DMWPRA.exe 4024 BNEC.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\FAPH.exe KMKYWUL.exe File created C:\windows\SysWOW64\MRRPUOK.exe NGG.exe File created C:\windows\SysWOW64\PSBF.exe.bat OPXKC.exe File created C:\windows\SysWOW64\RKOB.exe FWP.exe File opened for modification C:\windows\SysWOW64\RKOB.exe FWP.exe File created C:\windows\SysWOW64\DAHTR.exe.bat RKOB.exe File opened for modification C:\windows\SysWOW64\KJP.exe RGDX.exe File created C:\windows\SysWOW64\IDCTCU.exe TATP.exe File created C:\windows\SysWOW64\FAPH.exe KMKYWUL.exe File opened for modification C:\windows\SysWOW64\PDVQPPL.exe OIRMK.exe File created C:\windows\SysWOW64\IQI.exe.bat ENKSA.exe File opened for modification C:\windows\SysWOW64\UVHCG.exe HKZEZ.exe File created C:\windows\SysWOW64\UVHCG.exe.bat HKZEZ.exe File created C:\windows\SysWOW64\LJWOCE.exe UQTYTQM.exe File created C:\windows\SysWOW64\WNOZ.exe.bat DAHTR.exe File opened for modification C:\windows\SysWOW64\LOVK.exe QDNMGB.exe File created C:\windows\SysWOW64\OIRMK.exe FAPH.exe File opened for modification C:\windows\SysWOW64\MRRPUOK.exe NGG.exe File created C:\windows\SysWOW64\IQI.exe ENKSA.exe File created C:\windows\SysWOW64\MMUKN.exe GMM.exe File opened for modification C:\windows\SysWOW64\MMUKN.exe GMM.exe File created C:\windows\SysWOW64\RHQF.exe.bat WWHHTB.exe File opened for modification C:\windows\SysWOW64\CHFGZUK.exe JEB.exe File opened for modification C:\windows\SysWOW64\MUJUX.exe 2026-09-30_35fa5026e9d13466adc25bb64c546320_elex_emotet_stop.exe File created C:\windows\SysWOW64\OHSBBK.exe NDGFWMR.exe File created C:\windows\SysWOW64\HKZEZ.exe XMT.exe File created C:\windows\SysWOW64\HKZEZ.exe.bat XMT.exe File created C:\windows\SysWOW64\WNOZ.exe DAHTR.exe File created C:\windows\SysWOW64\FXALY.exe BPTDLLE.exe File created C:\windows\SysWOW64\FXALY.exe.bat BPTDLLE.exe File created C:\windows\SysWOW64\RTTSMUK.exe TVA.exe File created C:\windows\SysWOW64\LOVK.exe QDNMGB.exe File created C:\windows\SysWOW64\BZXGA.exe LJWOCE.exe File opened for modification C:\windows\SysWOW64\BZXGA.exe LJWOCE.exe File created C:\windows\SysWOW64\GAU.exe UKNBP.exe File opened for modification C:\windows\SysWOW64\RHQF.exe WWHHTB.exe File created C:\windows\SysWOW64\ZVTWIZO.exe BKI.exe File created C:\windows\SysWOW64\YOWMQN.exe ZVTWIZO.exe File opened for modification C:\windows\SysWOW64\RTTSMUK.exe TVA.exe File created C:\windows\SysWOW64\BBKTVHH.exe DQH.exe File created C:\windows\SysWOW64\PDVQPPL.exe OIRMK.exe File opened for modification C:\windows\SysWOW64\HKZEZ.exe XMT.exe File created C:\windows\SysWOW64\MMUKN.exe.bat GMM.exe File created C:\windows\SysWOW64\GAU.exe.bat UKNBP.exe File created C:\windows\SysWOW64\MUJUX.exe 2026-09-30_35fa5026e9d13466adc25bb64c546320_elex_emotet_stop.exe File created C:\windows\SysWOW64\FAPH.exe.bat KMKYWUL.exe File created C:\windows\SysWOW64\CHFGZUK.exe.bat JEB.exe File created C:\windows\SysWOW64\BBKTVHH.exe.bat DQH.exe File created C:\windows\SysWOW64\WWHHTB.exe.bat IYHVRXQ.exe File created C:\windows\SysWOW64\RHQF.exe WWHHTB.exe File created C:\windows\SysWOW64\MUJUX.exe.bat 2026-09-30_35fa5026e9d13466adc25bb64c546320_elex_emotet_stop.exe File created C:\windows\SysWOW64\OHSBBK.exe.bat NDGFWMR.exe File created C:\windows\SysWOW64\DQH.exe.bat IDCTCU.exe File opened for modification C:\windows\SysWOW64\OIRMK.exe FAPH.exe File created C:\windows\SysWOW64\WWHHTB.exe IYHVRXQ.exe File opened for modification C:\windows\SysWOW64\ALH.exe VLZKRO.exe File created C:\windows\SysWOW64\EKAWE.exe UNV.exe File created C:\windows\SysWOW64\IDCTCU.exe.bat TATP.exe File opened for modification C:\windows\SysWOW64\PSBF.exe OPXKC.exe File created C:\windows\SysWOW64\DAHTR.exe RKOB.exe File created C:\windows\SysWOW64\ALH.exe.bat VLZKRO.exe File opened for modification C:\windows\SysWOW64\GAU.exe UKNBP.exe File opened for modification C:\windows\SysWOW64\WWHHTB.exe IYHVRXQ.exe File opened for modification C:\windows\SysWOW64\ZVTWIZO.exe BKI.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\EJZ.exe.bat LOVK.exe File created C:\windows\KOWZIAO.exe IQI.exe File opened for modification C:\windows\XFES.exe EKAWE.exe File created C:\windows\HDKMYGQ.exe.bat XFES.exe File created C:\windows\system\WGBQJ.exe HDKMYGQ.exe File opened for modification C:\windows\KMKYWUL.exe VRBL.exe File created C:\windows\ENKSA.exe.bat PSBF.exe File opened for modification C:\windows\system\NGFWLMO.exe YLVS.exe File opened for modification C:\windows\system\JSER.exe BNEC.exe File opened for modification C:\windows\TVA.exe FXALY.exe File created C:\windows\TVA.exe.bat FXALY.exe File created C:\windows\KCXLK.exe FKJIXPS.exe File created C:\windows\BKJY.exe KJP.exe File created C:\windows\system\SBCCL.exe.bat VWSN.exe File opened for modification C:\windows\RRD.exe WEYBMG.exe File created C:\windows\system\KFVGYO.exe.bat KCXLK.exe File created C:\windows\GMM.exe.bat AMFIVY.exe File opened for modification C:\windows\NIPKVFK.exe MUJUX.exe File created C:\windows\RRD.exe.bat WEYBMG.exe File created C:\windows\system\ACD.exe IUP.exe File created C:\windows\system\TATP.exe.bat JCFV.exe File created C:\windows\TSCIO.exe.bat GMUWMQE.exe File created C:\windows\system\UQTYTQM.exe UVHCG.exe File created C:\windows\XFES.exe EKAWE.exe File created C:\windows\IUP.exe OHSBBK.exe File opened for modification C:\windows\FJQBZ.exe BBKTVHH.exe File opened for modification C:\windows\EJZ.exe LOVK.exe File opened for modification C:\windows\GRG.exe HGVK.exe File created C:\windows\system\UKNBP.exe LKLV.exe File created C:\windows\BPTDLLE.exe.bat CHFGZUK.exe File opened for modification C:\windows\system\VWSN.exe RTTSMUK.exe File opened for modification C:\windows\FQJ.exe NIPKVFK.exe File opened for modification C:\windows\BCVC.exe VCNOOOE.exe File created C:\windows\system\FWP.exe.bat BZXGA.exe File created C:\windows\GMM.exe AMFIVY.exe File created C:\windows\system\RGDX.exe.bat YOWMQN.exe File opened for modification C:\windows\UNV.exe BKJY.exe File created C:\windows\system\DCTSXH.exe.bat YXBDHL.exe File created C:\windows\GMUWMQE.exe FJQBZ.exe File created C:\windows\TSCIO.exe GMUWMQE.exe File opened for modification C:\windows\system\VRBL.exe EJZ.exe File created C:\windows\KMKYWUL.exe VRBL.exe File opened for modification C:\windows\FZEYW.exe KOWZIAO.exe File created C:\windows\FKJIXPS.exe.bat GRG.exe File opened for modification C:\windows\system\DMWPRA.exe MMUKN.exe File created C:\windows\LKLV.exe.bat SSEL.exe File opened for modification C:\windows\ENKSA.exe PSBF.exe File created C:\windows\KCXLK.exe.bat FKJIXPS.exe File created C:\windows\system\JEB.exe.bat WGBQJ.exe File opened for modification C:\windows\BPTDLLE.exe CHFGZUK.exe File created C:\windows\system\DCTSXH.exe YXBDHL.exe File created C:\windows\system\BQSTCKP.exe DCTSXH.exe File created C:\windows\system\FSBKJJT.exe BCVC.exe File opened for modification C:\windows\system\FSBKJJT.exe BCVC.exe File created C:\windows\GRG.exe.bat HGVK.exe File created C:\windows\system\DMWPRA.exe.bat MMUKN.exe File created C:\windows\system\VLZKRO.exe JSER.exe File created C:\windows\BKJY.exe.bat KJP.exe File opened for modification C:\windows\IUP.exe OHSBBK.exe File opened for modification C:\windows\HVLHC.exe TSCIO.exe File created C:\windows\system\VRBL.exe.bat EJZ.exe File created C:\windows\system\UKNBP.exe.bat LKLV.exe File opened for modification C:\windows\IYHVRXQ.exe GAU.exe File created C:\windows\NDGFWMR.exe OTD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3172 cmd.exe 2020 cmd.exe 6104 cmd.exe 2192 cmd.exe 5308 cmd.exe 8 cmd.exe 5012 cmd.exe 4228 cmd.exe 5528 cmd.exe 1100 cmd.exe 2828 cmd.exe 1768 cmd.exe 2028 cmd.exe 2948 cmd.exe 1936 cmd.exe 1952 cmd.exe 120 cmd.exe 1348 cmd.exe 3652 cmd.exe 2272 cmd.exe 4576 cmd.exe 2400 cmd.exe 3664 cmd.exe 4800 cmd.exe 3864 cmd.exe 4604 cmd.exe 4100 cmd.exe 5532 cmd.exe 564 cmd.exe 5084 cmd.exe 4076 cmd.exe 1368 cmd.exe 6120 cmd.exe 2528 cmd.exe 2268 cmd.exe 708 cmd.exe 5660 cmd.exe 3568 cmd.exe 5928 cmd.exe 5864 cmd.exe 5028 cmd.exe 5296 cmd.exe 4484 cmd.exe 5560 cmd.exe 3704 cmd.exe 4520 cmd.exe 4176 cmd.exe 1044 cmd.exe 424 cmd.exe 2264 cmd.exe 1572 cmd.exe 2912 cmd.exe 6108 cmd.exe 4712 cmd.exe 2424 cmd.exe 3352 cmd.exe 1684 cmd.exe 1012 cmd.exe 2092 cmd.exe 4972 cmd.exe 3360 cmd.exe 4532 cmd.exe 2796 cmd.exe 2836 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5848 5080 WerFault.exe 89 3188 4400 WerFault.exe 93 3372 1636 WerFault.exe 100 1284 4908 WerFault.exe 105 1752 2040 WerFault.exe 110 6076 1984 WerFault.exe 115 4644 2148 WerFault.exe 120 3040 1892 WerFault.exe 125 5616 1236 WerFault.exe 130 4024 796 WerFault.exe 135 432 4580 WerFault.exe 139 4512 5952 WerFault.exe 146 3812 2976 WerFault.exe 151 5532 4136 WerFault.exe 156 1152 1496 WerFault.exe 161 3864 1380 WerFault.exe 166 3328 4924 WerFault.exe 171 3368 2472 WerFault.exe 176 2808 5212 WerFault.exe 181 2072 1176 WerFault.exe 186 1932 5244 WerFault.exe 191 5252 4808 WerFault.exe 196 3320 1420 WerFault.exe 201 1656 3164 WerFault.exe 206 4236 1868 WerFault.exe 211 3388 2888 WerFault.exe 216 1952 2608 WerFault.exe 221 4896 3824 WerFault.exe 226 4068 4188 WerFault.exe 231 3664 2016 WerFault.exe 236 2740 1748 WerFault.exe 241 2592 1844 WerFault.exe 246 2328 1284 WerFault.exe 251 4852 4516 WerFault.exe 256 3852 1552 WerFault.exe 261 1056 1188 WerFault.exe 266 1384 5396 WerFault.exe 271 2496 4896 WerFault.exe 276 2236 4156 WerFault.exe 282 2044 2252 WerFault.exe 287 5024 2548 WerFault.exe 292 4420 1500 WerFault.exe 297 2204 1772 WerFault.exe 302 5624 1540 WerFault.exe 307 1048 1224 WerFault.exe 312 2868 240 WerFault.exe 317 5292 1820 WerFault.exe 322 3340 5876 WerFault.exe 327 5416 4596 WerFault.exe 332 2512 5768 WerFault.exe 337 4716 2712 WerFault.exe 342 2968 4944 WerFault.exe 347 5892 4644 WerFault.exe 352 2020 4256 WerFault.exe 357 4068 1384 WerFault.exe 362 4484 876 WerFault.exe 367 3868 4312 WerFault.exe 372 5848 5884 WerFault.exe 377 4420 3384 WerFault.exe 382 1332 6076 WerFault.exe 387 2468 1612 WerFault.exe 391 4632 4708 WerFault.exe 397 4740 1644 WerFault.exe 402 4160 1828 WerFault.exe 407 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKJY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMUWMQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSEL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MRRPUOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAHTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VLZKRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTTSMUK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VWSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSCIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCNOOOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CHFGZUK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHSBBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KOWZIAO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPTDLLE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JCFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMFIVY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NIPKVFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKLV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JEB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YLVS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMWPRA.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5080 2026-09-30_35fa5026e9d13466adc25bb64c546320_elex_emotet_stop.exe 5080 2026-09-30_35fa5026e9d13466adc25bb64c546320_elex_emotet_stop.exe 4400 MUJUX.exe 4400 MUJUX.exe 1636 NIPKVFK.exe 1636 NIPKVFK.exe 4908 FQJ.exe 4908 FQJ.exe 2040 QIZ.exe 2040 QIZ.exe 1984 WEYBMG.exe 1984 WEYBMG.exe 2148 RRD.exe 2148 RRD.exe 1892 ECLJLR.exe 1892 ECLJLR.exe 1236 VCNOOOE.exe 1236 VCNOOOE.exe 796 BCVC.exe 796 BCVC.exe 4580 FSBKJJT.exe 4580 FSBKJJT.exe 5952 OTD.exe 5952 OTD.exe 2976 NDGFWMR.exe 2976 NDGFWMR.exe 4136 OHSBBK.exe 4136 OHSBBK.exe 1496 IUP.exe 1496 IUP.exe 1380 ACD.exe 1380 ACD.exe 4924 JCFV.exe 4924 JCFV.exe 2472 TATP.exe 2472 TATP.exe 5212 IDCTCU.exe 5212 IDCTCU.exe 1176 DQH.exe 1176 DQH.exe 5244 BBKTVHH.exe 5244 BBKTVHH.exe 4808 FJQBZ.exe 4808 FJQBZ.exe 1420 GMUWMQE.exe 1420 GMUWMQE.exe 3164 TSCIO.exe 3164 TSCIO.exe 1868 HVLHC.exe 1868 HVLHC.exe 2888 QDNMGB.exe 2888 QDNMGB.exe 2608 LOVK.exe 2608 LOVK.exe 3824 EJZ.exe 3824 EJZ.exe 4188 VRBL.exe 4188 VRBL.exe 2016 KMKYWUL.exe 2016 KMKYWUL.exe 1748 FAPH.exe 1748 FAPH.exe 1844 OIRMK.exe 1844 OIRMK.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5080 2026-09-30_35fa5026e9d13466adc25bb64c546320_elex_emotet_stop.exe 5080 2026-09-30_35fa5026e9d13466adc25bb64c546320_elex_emotet_stop.exe 4400 MUJUX.exe 4400 MUJUX.exe 1636 NIPKVFK.exe 1636 NIPKVFK.exe 4908 FQJ.exe 4908 FQJ.exe 2040 QIZ.exe 2040 QIZ.exe 1984 WEYBMG.exe 1984 WEYBMG.exe 2148 RRD.exe 2148 RRD.exe 1892 ECLJLR.exe 1892 ECLJLR.exe 1236 VCNOOOE.exe 1236 VCNOOOE.exe 796 BCVC.exe 796 BCVC.exe 4580 FSBKJJT.exe 4580 FSBKJJT.exe 5952 OTD.exe 5952 OTD.exe 2976 NDGFWMR.exe 2976 NDGFWMR.exe 4136 OHSBBK.exe 4136 OHSBBK.exe 1496 IUP.exe 1496 IUP.exe 1380 ACD.exe 1380 ACD.exe 4924 JCFV.exe 4924 JCFV.exe 2472 TATP.exe 2472 TATP.exe 5212 IDCTCU.exe 5212 IDCTCU.exe 1176 DQH.exe 1176 DQH.exe 5244 BBKTVHH.exe 5244 BBKTVHH.exe 4808 FJQBZ.exe 4808 FJQBZ.exe 1420 GMUWMQE.exe 1420 GMUWMQE.exe 3164 TSCIO.exe 3164 TSCIO.exe 1868 HVLHC.exe 1868 HVLHC.exe 2888 QDNMGB.exe 2888 QDNMGB.exe 2608 LOVK.exe 2608 LOVK.exe 3824 EJZ.exe 3824 EJZ.exe 4188 VRBL.exe 4188 VRBL.exe 2016 KMKYWUL.exe 2016 KMKYWUL.exe 1748 FAPH.exe 1748 FAPH.exe 1844 OIRMK.exe 1844 OIRMK.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5080 wrote to memory of 5960 5080 2026-09-30_35fa5026e9d13466adc25bb64c546320_elex_emotet_stop.exe 90 PID 5960 wrote to memory of 4400 5960 cmd.exe 93 PID 4400 wrote to memory of 1684 4400 MUJUX.exe 96 PID 1684 wrote to memory of 1636 1684 cmd.exe 100 PID 1636 wrote to memory of 2288 1636 NIPKVFK.exe 101 PID 2288 wrote to memory of 4908 2288 cmd.exe 105 PID 4908 wrote to memory of 4164 4908 FQJ.exe 106 PID 4164 wrote to memory of 2040 4164 cmd.exe 110 PID 2040 wrote to memory of 3172 2040 QIZ.exe 111 PID 3172 wrote to memory of 1984 3172 cmd.exe 115 PID 1984 wrote to memory of 4940 1984 WEYBMG.exe 116 PID 4940 wrote to memory of 2148 4940 cmd.exe 120 PID 2148 wrote to memory of 5660 2148 RRD.exe 121 PID 5660 wrote to memory of 1892 5660 cmd.exe 125 PID 1892 wrote to memory of 3544 1892 ECLJLR.exe 126 PID 3544 wrote to memory of 1236 3544 cmd.exe 130 PID 1236 wrote to memory of 424 1236 VCNOOOE.exe 131 PID 424 wrote to memory of 796 424 cmd.exe 135 PID 796 wrote to memory of 4880 796 BCVC.exe 136 PID 4880 wrote to memory of 4580 4880 cmd.exe 139 PID 4580 wrote to memory of 1960 4580 FSBKJJT.exe 142 PID 1960 wrote to memory of 5952 1960 cmd.exe 146 PID 5952 wrote to memory of 4548 5952 OTD.exe 147 PID 4548 wrote to memory of 2976 4548 cmd.exe 151 PID 2976 wrote to memory of 3416 2976 NDGFWMR.exe 152 PID 3416 wrote to memory of 4136 3416 cmd.exe 156 PID 4136 wrote to memory of 4356 4136 OHSBBK.exe 157 PID 4356 wrote to memory of 1496 4356 cmd.exe 161 PID 1496 wrote to memory of 5360 1496 IUP.exe 162 PID 5360 wrote to memory of 1380 5360 cmd.exe 166 PID 1380 wrote to memory of 5528 1380 ACD.exe 167 PID 5528 wrote to memory of 4924 5528 cmd.exe 171 PID 4924 wrote to memory of 564 4924 JCFV.exe 172 PID 564 wrote to memory of 2472 564 cmd.exe 176 PID 2472 wrote to memory of 5752 2472 TATP.exe 177 PID 5752 wrote to memory of 5212 5752 cmd.exe 181 PID 5212 wrote to memory of 5872 5212 IDCTCU.exe 182 PID 5872 wrote to memory of 1176 5872 cmd.exe 186 PID 1176 wrote to memory of 6140 1176 DQH.exe 187 PID 6140 wrote to memory of 5244 6140 cmd.exe 191 PID 5244 wrote to memory of 4856 5244 BBKTVHH.exe 192 PID 4856 wrote to memory of 4808 4856 cmd.exe 196 PID 4808 wrote to memory of 2188 4808 FJQBZ.exe 197 PID 2188 wrote to memory of 1420 2188 cmd.exe 201 PID 1420 wrote to memory of 5964 1420 GMUWMQE.exe 202 PID 5964 wrote to memory of 3164 5964 cmd.exe 206 PID 3164 wrote to memory of 5084 3164 TSCIO.exe 207 PID 5084 wrote to memory of 1868 5084 cmd.exe 211 PID 1868 wrote to memory of 1936 1868 HVLHC.exe 212 PID 1936 wrote to memory of 2888 1936 cmd.exe 216 PID 2888 wrote to memory of 6104 2888 QDNMGB.exe 217 PID 6104 wrote to memory of 2608 6104 cmd.exe 221 PID 2608 wrote to memory of 2192 2608 LOVK.exe 222 PID 2192 wrote to memory of 3824 2192 cmd.exe 226 PID 3824 wrote to memory of 984 3824 EJZ.exe 227 PID 984 wrote to memory of 4188 984 cmd.exe 231 PID 4188 wrote to memory of 2168 4188 VRBL.exe 232 PID 2168 wrote to memory of 2016 2168 cmd.exe 236 PID 2016 wrote to memory of 4076 2016 KMKYWUL.exe 237 PID 4076 wrote to memory of 1748 4076 cmd.exe 241 PID 1748 wrote to memory of 4468 1748 FAPH.exe 242 PID 4468 wrote to memory of 1844 4468 cmd.exe 246 PID 1844 wrote to memory of 2676 1844 OIRMK.exe 247 PID 2676 wrote to memory of 1284 2676 cmd.exe 251
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_35fa5026e9d13466adc25bb64c546320_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_35fa5026e9d13466adc25bb64c546320_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUJUX.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\windows\SysWOW64\MUJUX.exeC:\windows\system32\MUJUX.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NIPKVFK.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\windows\NIPKVFK.exeC:\windows\NIPKVFK.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FQJ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\windows\FQJ.exeC:\windows\FQJ.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QIZ.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\windows\QIZ.exeC:\windows\QIZ.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WEYBMG.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\windows\system\WEYBMG.exeC:\windows\system\WEYBMG.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RRD.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\windows\RRD.exeC:\windows\RRD.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECLJLR.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\windows\system\ECLJLR.exeC:\windows\system\ECLJLR.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VCNOOOE.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\windows\VCNOOOE.exeC:\windows\VCNOOOE.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCVC.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:424 -
C:\windows\BCVC.exeC:\windows\BCVC.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FSBKJJT.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\windows\system\FSBKJJT.exeC:\windows\system\FSBKJJT.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTD.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\windows\OTD.exeC:\windows\OTD.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDGFWMR.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\windows\NDGFWMR.exeC:\windows\NDGFWMR.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHSBBK.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\windows\SysWOW64\OHSBBK.exeC:\windows\system32\OHSBBK.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IUP.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\windows\IUP.exeC:\windows\IUP.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ACD.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\windows\system\ACD.exeC:\windows\system\ACD.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JCFV.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\windows\JCFV.exeC:\windows\JCFV.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TATP.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:564 -
C:\windows\system\TATP.exeC:\windows\system\TATP.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IDCTCU.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\windows\SysWOW64\IDCTCU.exeC:\windows\system32\IDCTCU.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DQH.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\windows\SysWOW64\DQH.exeC:\windows\system32\DQH.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BBKTVHH.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\windows\SysWOW64\BBKTVHH.exeC:\windows\system32\BBKTVHH.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJQBZ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\windows\FJQBZ.exeC:\windows\FJQBZ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMUWMQE.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\windows\GMUWMQE.exeC:\windows\GMUWMQE.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSCIO.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\windows\TSCIO.exeC:\windows\TSCIO.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HVLHC.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\windows\HVLHC.exeC:\windows\HVLHC.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QDNMGB.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\windows\SysWOW64\QDNMGB.exeC:\windows\system32\QDNMGB.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LOVK.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\windows\SysWOW64\LOVK.exeC:\windows\system32\LOVK.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EJZ.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\windows\EJZ.exeC:\windows\EJZ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VRBL.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:984 -
C:\windows\system\VRBL.exeC:\windows\system\VRBL.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMKYWUL.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\windows\KMKYWUL.exeC:\windows\KMKYWUL.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FAPH.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\windows\SysWOW64\FAPH.exeC:\windows\system32\FAPH.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OIRMK.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\SysWOW64\OIRMK.exeC:\windows\system32\OIRMK.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDVQPPL.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\windows\SysWOW64\PDVQPPL.exeC:\windows\system32\PDVQPPL.exe65⤵
- Executes dropped EXE
PID:1284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IGZMDF.exe.bat" "66⤵PID:1480
-
C:\windows\system\IGZMDF.exeC:\windows\system\IGZMDF.exe67⤵
- Executes dropped EXE
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NGG.exe.bat" "68⤵
- Executes a command shell one-liner
PID:1012 -
C:\windows\system\NGG.exeC:\windows\system\NGG.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MRRPUOK.exe.bat" "70⤵PID:948
-
C:\windows\SysWOW64\MRRPUOK.exeC:\windows\system32\MRRPUOK.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OPXKC.exe.bat" "72⤵
- Executes a command shell one-liner
PID:3704 -
C:\windows\system\OPXKC.exeC:\windows\system\OPXKC.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PSBF.exe.bat" "74⤵
- Executes a command shell one-liner
PID:2092 -
C:\windows\SysWOW64\PSBF.exeC:\windows\system32\PSBF.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENKSA.exe.bat" "76⤵PID:3052
-
C:\windows\ENKSA.exeC:\windows\ENKSA.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IQI.exe.bat" "78⤵
- Executes a command shell one-liner
PID:4800 -
C:\windows\SysWOW64\IQI.exeC:\windows\system32\IQI.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KOWZIAO.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5308 -
C:\windows\KOWZIAO.exeC:\windows\KOWZIAO.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZEYW.exe.bat" "82⤵PID:4456
-
C:\windows\FZEYW.exeC:\windows\FZEYW.exe83⤵
- Executes dropped EXE
PID:1500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWSKD.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:940 -
C:\windows\SysWOW64\HWSKD.exeC:\windows\system32\HWSKD.exe85⤵
- Executes dropped EXE
PID:1772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XMT.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:592 -
C:\windows\system\XMT.exeC:\windows\system\XMT.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKZEZ.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3864 -
C:\windows\SysWOW64\HKZEZ.exeC:\windows\system32\HKZEZ.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UVHCG.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2800 -
C:\windows\SysWOW64\UVHCG.exeC:\windows\system32\UVHCG.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UQTYTQM.exe.bat" "92⤵
- Executes a command shell one-liner
PID:8 -
C:\windows\system\UQTYTQM.exeC:\windows\system\UQTYTQM.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJWOCE.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:5744 -
C:\windows\SysWOW64\LJWOCE.exeC:\windows\system32\LJWOCE.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BZXGA.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3664 -
C:\windows\SysWOW64\BZXGA.exeC:\windows\system32\BZXGA.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWP.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3568 -
C:\windows\system\FWP.exeC:\windows\system\FWP.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RKOB.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5252 -
C:\windows\SysWOW64\RKOB.exeC:\windows\system32\RKOB.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DAHTR.exe.bat" "102⤵PID:3648
-
C:\windows\SysWOW64\DAHTR.exeC:\windows\system32\DAHTR.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WNOZ.exe.bat" "104⤵PID:6000
-
C:\windows\SysWOW64\WNOZ.exeC:\windows\system32\WNOZ.exe105⤵
- Executes dropped EXE
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HGVK.exe.bat" "106⤵
- Executes a command shell one-liner
PID:2264 -
C:\windows\system\HGVK.exeC:\windows\system\HGVK.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GRG.exe.bat" "108⤵PID:5152
-
C:\windows\GRG.exeC:\windows\GRG.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FKJIXPS.exe.bat" "110⤵PID:1036
-
C:\windows\FKJIXPS.exeC:\windows\FKJIXPS.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KCXLK.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2692 -
C:\windows\KCXLK.exeC:\windows\KCXLK.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KFVGYO.exe.bat" "114⤵PID:3484
-
C:\windows\system\KFVGYO.exeC:\windows\system\KFVGYO.exe115⤵
- Executes dropped EXE
PID:5884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YLVS.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:4016 -
C:\windows\YLVS.exeC:\windows\YLVS.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NGFWLMO.exe.bat" "118⤵PID:2936
-
C:\windows\system\NGFWLMO.exeC:\windows\system\NGFWLMO.exe119⤵
- Executes dropped EXE
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AMFIVY.exe.bat" "120⤵
- Executes a command shell one-liner
PID:4604 -
C:\windows\AMFIVY.exeC:\windows\AMFIVY.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-