Analysis
- max time kernel
87s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 04:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_b97c08fa86f8413d34236e65956d68c0_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-01_b97c08fa86f8413d34236e65956d68c0_elex_emotet_stop.exe
- Size 208KB
- Sample261002-fa3vgsytev
- SHA256 1428459bd58990563f5373e4a228d3e6f4dbb9d35b9bd2f3a209c4667fb2550b
- MD5 b97c08fa86f8413d34236e65956d68c0
- SHA1 c6a6813e9cc4b1bc4385792f4d524a285072743a
- SHA512 2e42b23dca4cc61a0e6e396b47cfd137f69ad9118a7baeaca596fed1c4758836b1fffc8c0ae1110e69d0eb0f041ae7ed91311aa14738647263bbca51647d30c7
- SSDEEP 3072:jLQaL9tbLkRIgd1Lye9yjE2hWAN5Xbsl9dL+LOfa4pLthEjQT6j:vlZtbLWIgd1LZ9oECZbsl95+LOCkEj1
- TLSH T104247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1316 UUZWEUA.exe 5524 IKPCGD.exe 3212 SDLTUR.exe 3360 ELSU.exe 5584 XOV.exe 2784 UPFAXEM.exe 1788 SEQDK.exe 2808 MSXB.exe 5384 EVB.exe 3044 HIS.exe 5960 GBVWXAD.exe 2924 GEM.exe 3280 UCLVNVH.exe 5212 NUBOFOP.exe 4736 DKC.exe 3440 QVK.exe 1964 FLTWY.exe 5992 CRELO.exe 4556 GJNV.exe 4876 VPLLZR.exe 3188 KFUK.exe 1696 EXCVXFY.exe 3460 CQELYT.exe 4572 VLQHM.exe 3876 ARAW.exe 3988 SUE.exe 5412 RFPQQ.exe 5360 GVQ.exe 3056 FSBKJJT.exe 4016 YNFGPZ.exe 1804 EJEOUC.exe 5288 YWJ.exe 5440 TJOHO.exe 5116 IMX.exe 1344 HXICIUS.exe 624 RVOW.exe 552 TTTQ.exe 5816 RDE.exe 3480 VMLGS.exe 4440 DZDVTW.exe 4340 RCTTHH.exe 4192 NCVWT.exe 4612 SIO.exe 2876 KLRHPWX.exe 3016 RGR.exe 2944 LUVZW.exe 2456 PCCZIJP.exe 5068 KPHI.exe 2936 UNMD.exe 4644 CAZ.exe 5160 PLHIYB.exe 1312 GLJNC.exe 1812 IJXHRHP.exe 4928 JMBDXF.exe 1140 IXETF.exe 4824 LFKBKDA.exe 3536 GAPL.exe 1756 QYVXJLY.exe 5428 JTHBP.exe 4872 YJIAVXW.exe 2644 CZOAAH.exe 1056 XMT.exe 4604 HKZEZ.exe 4256 LSF.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\ILV.exe.bat PIRCKF.exe File created C:\windows\SysWOW64\HPKZBQH.exe.bat MBGQR.exe File created C:\windows\SysWOW64\QDPAIT.exe IXP.exe File created C:\windows\SysWOW64\ELSU.exe SDLTUR.exe File opened for modification C:\windows\SysWOW64\VMLGS.exe RDE.exe File created C:\windows\SysWOW64\XOV.exe ELSU.exe File created C:\windows\SysWOW64\UCLVNVH.exe.bat GEM.exe File created C:\windows\SysWOW64\EXETRBV.exe.bat EJEEHOS.exe File created C:\windows\SysWOW64\OGGPMOD.exe.bat NDDMH.exe File opened for modification C:\windows\SysWOW64\EXCVXFY.exe KFUK.exe File created C:\windows\SysWOW64\EXETRBV.exe EJEEHOS.exe File created C:\windows\SysWOW64\SDLTUR.exe IKPCGD.exe File opened for modification C:\windows\SysWOW64\YNFGPZ.exe FSBKJJT.exe File created C:\windows\SysWOW64\RCTTHH.exe.bat DZDVTW.exe File created C:\windows\SysWOW64\IXETF.exe.bat JMBDXF.exe File created C:\windows\SysWOW64\EBFYIMO.exe KGAOYM.exe File opened for modification C:\windows\SysWOW64\ABXE.exe OLQWREI.exe File created C:\windows\SysWOW64\MSEWQ.exe.bat DJC.exe File opened for modification C:\windows\SysWOW64\EJEOUC.exe YNFGPZ.exe File created C:\windows\SysWOW64\HXICIUS.exe IMX.exe File opened for modification C:\windows\SysWOW64\LSF.exe HKZEZ.exe File opened for modification C:\windows\SysWOW64\KGAOYM.exe ULR.exe File created C:\windows\SysWOW64\ABXE.exe OLQWREI.exe File created C:\windows\SysWOW64\IXP.exe MSEWQ.exe File created C:\windows\SysWOW64\SDLTUR.exe.bat IKPCGD.exe File created C:\windows\SysWOW64\GAPL.exe.bat LFKBKDA.exe File created C:\windows\SysWOW64\HKZEZ.exe.bat XMT.exe File created C:\windows\SysWOW64\QDPAIT.exe.bat IXP.exe File opened for modification C:\windows\SysWOW64\XOV.exe ELSU.exe File created C:\windows\SysWOW64\YNFGPZ.exe.bat FSBKJJT.exe File opened for modification C:\windows\SysWOW64\RCTTHH.exe DZDVTW.exe File opened for modification C:\windows\SysWOW64\GAPL.exe LFKBKDA.exe File created C:\windows\SysWOW64\KGAOYM.exe ULR.exe File opened for modification C:\windows\SysWOW64\OLQWREI.exe KDKWF.exe File created C:\windows\SysWOW64\WTFVPMG.exe.bat DQBRJ.exe File created C:\windows\SysWOW64\VMLGS.exe RDE.exe File created C:\windows\SysWOW64\QZG.exe IJFHO.exe File opened for modification C:\windows\SysWOW64\ULR.exe LKPXJC.exe File created C:\windows\SysWOW64\OGGPMOD.exe NDDMH.exe File created C:\windows\SysWOW64\SEQDK.exe.bat UPFAXEM.exe File created C:\windows\SysWOW64\YNFGPZ.exe FSBKJJT.exe File created C:\windows\SysWOW64\TZTUU.exe.bat MEKQJYE.exe File opened for modification C:\windows\SysWOW64\IXP.exe MSEWQ.exe File created C:\windows\SysWOW64\GBVWXAD.exe HIS.exe File created C:\windows\SysWOW64\GVQ.exe RFPQQ.exe File created C:\windows\SysWOW64\QZG.exe.bat IJFHO.exe File opened for modification C:\windows\SysWOW64\OGGPMOD.exe NDDMH.exe File created C:\windows\SysWOW64\HXICIUS.exe.bat IMX.exe File created C:\windows\SysWOW64\LSF.exe HKZEZ.exe File created C:\windows\SysWOW64\MBGQR.exe OGGPMOD.exe File created C:\windows\SysWOW64\IXP.exe.bat MSEWQ.exe File created C:\windows\SysWOW64\EVB.exe.bat MSXB.exe File created C:\windows\SysWOW64\VMLGS.exe.bat RDE.exe File opened for modification C:\windows\SysWOW64\WTFVPMG.exe DQBRJ.exe File opened for modification C:\windows\SysWOW64\MSEWQ.exe DJC.exe File created C:\windows\SysWOW64\RCTTHH.exe DZDVTW.exe File created C:\windows\SysWOW64\OLQWREI.exe KDKWF.exe File created C:\windows\SysWOW64\IGBLJG.exe EYND.exe File created C:\windows\SysWOW64\WTFVPMG.exe DQBRJ.exe File opened for modification C:\windows\SysWOW64\CYI.exe ULV.exe File created C:\windows\SysWOW64\RFPQQ.exe SUE.exe File created C:\windows\SysWOW64\KGAOYM.exe.bat ULR.exe File created C:\windows\SysWOW64\ELSU.exe.bat SDLTUR.exe File created C:\windows\SysWOW64\XOV.exe.bat ELSU.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\NUBOFOP.exe UCLVNVH.exe File created C:\windows\IMX.exe.bat TJOHO.exe File opened for modification C:\windows\DZDVTW.exe VMLGS.exe File created C:\windows\system\SIO.exe NCVWT.exe File created C:\windows\KPHI.exe.bat PCCZIJP.exe File created C:\windows\LFKBKDA.exe.bat IXETF.exe File opened for modification C:\windows\system\CZOAAH.exe YJIAVXW.exe File created C:\windows\system\VPIPJ.exe.bat LRUUBY.exe File created C:\windows\IKPCGD.exe.bat UUZWEUA.exe File created C:\windows\system\RGR.exe.bat KLRHPWX.exe File created C:\windows\UNMD.exe.bat KPHI.exe File created C:\windows\PLHIYB.exe CAZ.exe File opened for modification C:\windows\JMBDXF.exe IJXHRHP.exe File created C:\windows\YJIAVXW.exe.bat JTHBP.exe File opened for modification C:\windows\LKPXJC.exe QZG.exe File created C:\windows\system\ESIWWR.exe EXETRBV.exe File opened for modification C:\windows\system\GJNV.exe CRELO.exe File created C:\windows\JTHBP.exe QYVXJLY.exe File opened for modification C:\windows\system\PCFYTHD.exe VPIPJ.exe File created C:\windows\DQBRJ.exe ESIWWR.exe File created C:\windows\HLA.exe.bat WTFVPMG.exe File created C:\windows\system\PIRCKF.exe.bat TZTUU.exe File created C:\windows\system\NDDMH.exe ILV.exe File created C:\windows\system\OVMFEKM.exe RPU.exe File created C:\windows\system\CZOAAH.exe YJIAVXW.exe File opened for modification C:\windows\system\XMT.exe CZOAAH.exe File created C:\windows\system\OZTSPUW.exe.bat EBFYIMO.exe File created C:\windows\system\PCFYTHD.exe VPIPJ.exe File opened for modification C:\windows\HLA.exe WTFVPMG.exe File created C:\windows\system\DLNEL.exe OVMFEKM.exe File opened for modification C:\windows\system\DJC.exe CGZW.exe File created C:\windows\HIS.exe EVB.exe File created C:\windows\system\YWJ.exe EJEOUC.exe File opened for modification C:\windows\CAZ.exe UNMD.exe File created C:\windows\IJFHO.exe.bat IGBLJG.exe File created C:\windows\EJEEHOS.exe.bat ABXE.exe File created C:\windows\system\NDDMH.exe.bat ILV.exe File opened for modification C:\windows\RPU.exe FMWCO.exe File created C:\windows\ULV.exe QDPAIT.exe File created C:\windows\IKPCGD.exe UUZWEUA.exe File opened for modification C:\windows\HIS.exe EVB.exe File created C:\windows\VPLLZR.exe GJNV.exe File created C:\windows\system\QYVXJLY.exe.bat GAPL.exe File created C:\windows\FMWCO.exe.bat HPKZBQH.exe File created C:\windows\UPFAXEM.exe.bat XOV.exe File created C:\windows\NUBOFOP.exe UCLVNVH.exe File created C:\windows\system\FLTWY.exe QVK.exe File created C:\windows\system\GJNV.exe CRELO.exe File created C:\windows\DZDVTW.exe VMLGS.exe File opened for modification C:\windows\system\PCCZIJP.exe LUVZW.exe File created C:\windows\JMBDXF.exe IJXHRHP.exe File created C:\windows\system\QYVXJLY.exe GAPL.exe File created C:\windows\CAZ.exe UNMD.exe File opened for modification C:\windows\system\GLJNC.exe PLHIYB.exe File opened for modification C:\windows\EYND.exe DVJIRXF.exe File opened for modification C:\windows\KDKWF.exe PQF.exe File created C:\windows\system\FSBKJJT.exe.bat GVQ.exe File created C:\windows\UNMD.exe KPHI.exe File opened for modification C:\windows\ULV.exe QDPAIT.exe File created C:\windows\ULV.exe.bat QDPAIT.exe File created C:\windows\NUBOFOP.exe.bat UCLVNVH.exe File created C:\windows\RVOW.exe HXICIUS.exe File created C:\windows\RDE.exe.bat TTTQ.exe File created C:\windows\system\RGR.exe KLRHPWX.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1592 cmd.exe 4240 cmd.exe 4512 cmd.exe 1572 cmd.exe 1356 cmd.exe 5436 cmd.exe 5736 cmd.exe 796 cmd.exe 4812 cmd.exe 1608 cmd.exe 5620 cmd.exe 3444 cmd.exe 5064 cmd.exe 4436 cmd.exe 4784 cmd.exe 2616 cmd.exe 5968 cmd.exe 5240 cmd.exe 2544 cmd.exe 2072 cmd.exe 252 cmd.exe 5952 cmd.exe 1072 cmd.exe 4692 cmd.exe 4464 cmd.exe 472 cmd.exe 5520 cmd.exe 3232 cmd.exe 4536 cmd.exe 5680 cmd.exe 1908 cmd.exe 3548 cmd.exe 5928 cmd.exe 3436 cmd.exe 2908 cmd.exe 1620 cmd.exe 3916 cmd.exe 5328 cmd.exe 2084 cmd.exe 1428 cmd.exe 5832 cmd.exe 2892 cmd.exe 4940 cmd.exe 1920 cmd.exe 3272 cmd.exe 544 cmd.exe 3312 cmd.exe 4632 cmd.exe 5908 cmd.exe 360 cmd.exe 2576 cmd.exe 2740 cmd.exe 1732 cmd.exe 5504 cmd.exe 1708 cmd.exe 3184 cmd.exe 2336 cmd.exe 2564 cmd.exe 896 cmd.exe 3408 cmd.exe 5516 cmd.exe 460 cmd.exe 4008 cmd.exe 5904 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4024 4672 WerFault.exe 88 4632 1316 WerFault.exe 93 1592 5524 WerFault.exe 99 3880 3212 WerFault.exe 104 3440 3360 WerFault.exe 109 4028 5584 WerFault.exe 114 1232 2784 WerFault.exe 119 2216 1788 WerFault.exe 124 3540 2808 WerFault.exe 129 5344 5384 WerFault.exe 134 5532 3044 WerFault.exe 139 5728 5960 WerFault.exe 144 852 2924 WerFault.exe 149 4980 3280 WerFault.exe 154 5744 5212 WerFault.exe 159 5256 4736 WerFault.exe 164 2920 3440 WerFault.exe 169 2604 1964 WerFault.exe 174 2936 5992 WerFault.exe 179 3496 4556 WerFault.exe 184 4372 4876 WerFault.exe 189 1048 3188 WerFault.exe 194 4996 1696 WerFault.exe 199 4604 3460 WerFault.exe 204 2556 4572 WerFault.exe 209 2456 3876 WerFault.exe 214 2712 3988 WerFault.exe 219 5816 5412 WerFault.exe 224 3040 5360 WerFault.exe 229 4724 3056 WerFault.exe 234 3024 4016 WerFault.exe 239 436 1804 WerFault.exe 244 2664 5288 WerFault.exe 249 4280 5440 WerFault.exe 254 5652 5116 WerFault.exe 259 4020 1344 WerFault.exe 264 5388 624 WerFault.exe 270 1628 552 WerFault.exe 275 2544 5816 WerFault.exe 280 4724 3480 WerFault.exe 285 6060 4440 WerFault.exe 290 4324 4340 WerFault.exe 295 5532 4192 WerFault.exe 300 4356 4612 WerFault.exe 305 5948 2876 WerFault.exe 310 5552 3016 WerFault.exe 315 5388 2944 WerFault.exe 320 5776 2456 WerFault.exe 325 1200 5068 WerFault.exe 330 3020 2936 WerFault.exe 335 1384 4644 WerFault.exe 340 3096 5160 WerFault.exe 345 3904 1312 WerFault.exe 350 3364 1812 WerFault.exe 355 2752 4928 WerFault.exe 360 2712 1140 WerFault.exe 365 1636 4824 WerFault.exe 370 4940 3536 WerFault.exe 375 2964 1756 WerFault.exe 380 1096 5428 WerFault.exe 385 352 4872 WerFault.exe 390 5216 2644 WerFault.exe 395 2660 1056 WerFault.exe 400 2556 4604 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FSBKJJT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KPHI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLQWREI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKPCGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXICIUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TZTUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSEWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ULR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPIPJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MEKQJYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VMLGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXETF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QZG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HPKZBQH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVMFEKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WTFVPMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ULV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFPQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQBRJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QDPAIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLRHPWX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFKBKDA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJFHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RCTTHH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLJNC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GEM.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4672 2026-10-01_b97c08fa86f8413d34236e65956d68c0_elex_emotet_stop.exe 4672 2026-10-01_b97c08fa86f8413d34236e65956d68c0_elex_emotet_stop.exe 1316 UUZWEUA.exe 1316 UUZWEUA.exe 5524 IKPCGD.exe 5524 IKPCGD.exe 3212 SDLTUR.exe 3212 SDLTUR.exe 3360 ELSU.exe 3360 ELSU.exe 5584 XOV.exe 5584 XOV.exe 2784 UPFAXEM.exe 2784 UPFAXEM.exe 1788 SEQDK.exe 1788 SEQDK.exe 2808 MSXB.exe 2808 MSXB.exe 5384 EVB.exe 5384 EVB.exe 3044 HIS.exe 3044 HIS.exe 5960 GBVWXAD.exe 5960 GBVWXAD.exe 2924 GEM.exe 2924 GEM.exe 3280 UCLVNVH.exe 3280 UCLVNVH.exe 5212 NUBOFOP.exe 5212 NUBOFOP.exe 4736 DKC.exe 4736 DKC.exe 3440 QVK.exe 3440 QVK.exe 1964 FLTWY.exe 1964 FLTWY.exe 5992 CRELO.exe 5992 CRELO.exe 4556 GJNV.exe 4556 GJNV.exe 4876 VPLLZR.exe 4876 VPLLZR.exe 3188 KFUK.exe 3188 KFUK.exe 1696 EXCVXFY.exe 1696 EXCVXFY.exe 3460 CQELYT.exe 3460 CQELYT.exe 4572 VLQHM.exe 4572 VLQHM.exe 3876 ARAW.exe 3876 ARAW.exe 3988 SUE.exe 3988 SUE.exe 5412 RFPQQ.exe 5412 RFPQQ.exe 5360 GVQ.exe 5360 GVQ.exe 3056 FSBKJJT.exe 3056 FSBKJJT.exe 4016 YNFGPZ.exe 4016 YNFGPZ.exe 1804 EJEOUC.exe 1804 EJEOUC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4672 2026-10-01_b97c08fa86f8413d34236e65956d68c0_elex_emotet_stop.exe 4672 2026-10-01_b97c08fa86f8413d34236e65956d68c0_elex_emotet_stop.exe 1316 UUZWEUA.exe 1316 UUZWEUA.exe 5524 IKPCGD.exe 5524 IKPCGD.exe 3212 SDLTUR.exe 3212 SDLTUR.exe 3360 ELSU.exe 3360 ELSU.exe 5584 XOV.exe 5584 XOV.exe 2784 UPFAXEM.exe 2784 UPFAXEM.exe 1788 SEQDK.exe 1788 SEQDK.exe 2808 MSXB.exe 2808 MSXB.exe 5384 EVB.exe 5384 EVB.exe 3044 HIS.exe 3044 HIS.exe 5960 GBVWXAD.exe 5960 GBVWXAD.exe 2924 GEM.exe 2924 GEM.exe 3280 UCLVNVH.exe 3280 UCLVNVH.exe 5212 NUBOFOP.exe 5212 NUBOFOP.exe 4736 DKC.exe 4736 DKC.exe 3440 QVK.exe 3440 QVK.exe 1964 FLTWY.exe 1964 FLTWY.exe 5992 CRELO.exe 5992 CRELO.exe 4556 GJNV.exe 4556 GJNV.exe 4876 VPLLZR.exe 4876 VPLLZR.exe 3188 KFUK.exe 3188 KFUK.exe 1696 EXCVXFY.exe 1696 EXCVXFY.exe 3460 CQELYT.exe 3460 CQELYT.exe 4572 VLQHM.exe 4572 VLQHM.exe 3876 ARAW.exe 3876 ARAW.exe 3988 SUE.exe 3988 SUE.exe 5412 RFPQQ.exe 5412 RFPQQ.exe 5360 GVQ.exe 5360 GVQ.exe 3056 FSBKJJT.exe 3056 FSBKJJT.exe 4016 YNFGPZ.exe 4016 YNFGPZ.exe 1804 EJEOUC.exe 1804 EJEOUC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4672 wrote to memory of 5908 4672 2026-10-01_b97c08fa86f8413d34236e65956d68c0_elex_emotet_stop.exe 89 PID 5908 wrote to memory of 1316 5908 cmd.exe 93 PID 1316 wrote to memory of 5620 1316 UUZWEUA.exe 95 PID 5620 wrote to memory of 5524 5620 cmd.exe 99 PID 5524 wrote to memory of 3528 5524 IKPCGD.exe 100 PID 3528 wrote to memory of 3212 3528 cmd.exe 104 PID 3212 wrote to memory of 3004 3212 SDLTUR.exe 105 PID 3004 wrote to memory of 3360 3004 cmd.exe 109 PID 3360 wrote to memory of 5568 3360 ELSU.exe 110 PID 5568 wrote to memory of 5584 5568 cmd.exe 114 PID 5584 wrote to memory of 6044 5584 XOV.exe 115 PID 6044 wrote to memory of 2784 6044 cmd.exe 119 PID 2784 wrote to memory of 1072 2784 UPFAXEM.exe 120 PID 1072 wrote to memory of 1788 1072 cmd.exe 124 PID 1788 wrote to memory of 3272 1788 SEQDK.exe 125 PID 3272 wrote to memory of 2808 3272 cmd.exe 129 PID 2808 wrote to memory of 2832 2808 MSXB.exe 130 PID 2832 wrote to memory of 5384 2832 cmd.exe 134 PID 5384 wrote to memory of 1328 5384 EVB.exe 135 PID 1328 wrote to memory of 3044 1328 cmd.exe 139 PID 3044 wrote to memory of 4168 3044 HIS.exe 140 PID 4168 wrote to memory of 5960 4168 cmd.exe 144 PID 5960 wrote to memory of 3840 5960 GBVWXAD.exe 145 PID 3840 wrote to memory of 2924 3840 cmd.exe 149 PID 2924 wrote to memory of 480 2924 GEM.exe 150 PID 480 wrote to memory of 3280 480 cmd.exe 154 PID 3280 wrote to memory of 3488 3280 UCLVNVH.exe 155 PID 3488 wrote to memory of 5212 3488 cmd.exe 159 PID 5212 wrote to memory of 5788 5212 NUBOFOP.exe 160 PID 5788 wrote to memory of 4736 5788 cmd.exe 164 PID 4736 wrote to memory of 1284 4736 DKC.exe 165 PID 1284 wrote to memory of 3440 1284 cmd.exe 169 PID 3440 wrote to memory of 2912 3440 QVK.exe 170 PID 2912 wrote to memory of 1964 2912 cmd.exe 174 PID 1964 wrote to memory of 3064 1964 FLTWY.exe 175 PID 3064 wrote to memory of 5992 3064 cmd.exe 179 PID 5992 wrote to memory of 3444 5992 CRELO.exe 180 PID 3444 wrote to memory of 4556 3444 cmd.exe 184 PID 4556 wrote to memory of 3380 4556 GJNV.exe 185 PID 3380 wrote to memory of 4876 3380 cmd.exe 189 PID 4876 wrote to memory of 1908 4876 VPLLZR.exe 190 PID 1908 wrote to memory of 3188 1908 cmd.exe 194 PID 3188 wrote to memory of 360 3188 KFUK.exe 195 PID 1696 wrote to memory of 460 1696 EXCVXFY.exe 200 PID 460 wrote to memory of 3460 460 cmd.exe 204 PID 3460 wrote to memory of 2708 3460 CQELYT.exe 205 PID 2708 wrote to memory of 4572 2708 cmd.exe 209 PID 4572 wrote to memory of 2904 4572 VLQHM.exe 210 PID 2904 wrote to memory of 3876 2904 cmd.exe 214 PID 3876 wrote to memory of 4008 3876 ARAW.exe 215 PID 4008 wrote to memory of 3988 4008 cmd.exe 219 PID 3988 wrote to memory of 2940 3988 SUE.exe 220 PID 2940 wrote to memory of 5412 2940 cmd.exe 224 PID 5412 wrote to memory of 1708 5412 RFPQQ.exe 225 PID 1708 wrote to memory of 5360 1708 cmd.exe 229 PID 5360 wrote to memory of 5064 5360 GVQ.exe 230 PID 5064 wrote to memory of 3056 5064 cmd.exe 234 PID 3056 wrote to memory of 3696 3056 FSBKJJT.exe 235 PID 3696 wrote to memory of 4016 3696 cmd.exe 239 PID 4016 wrote to memory of 5444 4016 YNFGPZ.exe 240 PID 5444 wrote to memory of 1804 5444 cmd.exe 244 PID 1804 wrote to memory of 5136 1804 EJEOUC.exe 245 PID 5136 wrote to memory of 5288 5136 cmd.exe 249 PID 5288 wrote to memory of 2000 5288 YWJ.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_b97c08fa86f8413d34236e65956d68c0_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_b97c08fa86f8413d34236e65956d68c0_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UUZWEUA.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\windows\SysWOW64\UUZWEUA.exeC:\windows\system32\UUZWEUA.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IKPCGD.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\windows\IKPCGD.exeC:\windows\IKPCGD.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDLTUR.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\windows\SysWOW64\SDLTUR.exeC:\windows\system32\SDLTUR.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ELSU.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\windows\SysWOW64\ELSU.exeC:\windows\system32\ELSU.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOV.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\windows\SysWOW64\XOV.exeC:\windows\system32\XOV.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPFAXEM.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\windows\UPFAXEM.exeC:\windows\UPFAXEM.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEQDK.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\windows\SysWOW64\SEQDK.exeC:\windows\system32\SEQDK.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MSXB.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\windows\system\MSXB.exeC:\windows\system\MSXB.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EVB.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\windows\SysWOW64\EVB.exeC:\windows\system32\EVB.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIS.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\windows\HIS.exeC:\windows\HIS.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GBVWXAD.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\windows\SysWOW64\GBVWXAD.exeC:\windows\system32\GBVWXAD.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GEM.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\windows\system\GEM.exeC:\windows\system\GEM.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCLVNVH.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:480 -
C:\windows\SysWOW64\UCLVNVH.exeC:\windows\system32\UCLVNVH.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NUBOFOP.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\windows\NUBOFOP.exeC:\windows\NUBOFOP.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DKC.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\windows\DKC.exeC:\windows\DKC.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVK.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\windows\QVK.exeC:\windows\QVK.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FLTWY.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\windows\system\FLTWY.exeC:\windows\system\FLTWY.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CRELO.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\windows\CRELO.exeC:\windows\CRELO.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GJNV.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\windows\system\GJNV.exeC:\windows\system\GJNV.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPLLZR.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\windows\VPLLZR.exeC:\windows\VPLLZR.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KFUK.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\windows\KFUK.exeC:\windows\KFUK.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXCVXFY.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:360 -
C:\windows\SysWOW64\EXCVXFY.exeC:\windows\system32\EXCVXFY.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CQELYT.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:460 -
C:\windows\CQELYT.exeC:\windows\CQELYT.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VLQHM.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\windows\VLQHM.exeC:\windows\VLQHM.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ARAW.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\windows\system\ARAW.exeC:\windows\system\ARAW.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUE.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\windows\SysWOW64\SUE.exeC:\windows\system32\SUE.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RFPQQ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\windows\SysWOW64\RFPQQ.exeC:\windows\system32\RFPQQ.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GVQ.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\windows\SysWOW64\GVQ.exeC:\windows\system32\GVQ.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FSBKJJT.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\windows\system\FSBKJJT.exeC:\windows\system\FSBKJJT.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNFGPZ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\windows\SysWOW64\YNFGPZ.exeC:\windows\system32\YNFGPZ.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EJEOUC.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\windows\SysWOW64\EJEOUC.exeC:\windows\system32\EJEOUC.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YWJ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\windows\system\YWJ.exeC:\windows\system\YWJ.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJOHO.exe.bat" "66⤵PID:2000
-
C:\windows\system\TJOHO.exeC:\windows\system\TJOHO.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMX.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4692 -
C:\windows\IMX.exeC:\windows\IMX.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXICIUS.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:6032 -
C:\windows\SysWOW64\HXICIUS.exeC:\windows\system32\HXICIUS.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RVOW.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2084 -
C:\windows\RVOW.exeC:\windows\RVOW.exe73⤵
- Executes dropped EXE
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TTTQ.exe.bat" "74⤵PID:4808
-
C:\windows\TTTQ.exeC:\windows\TTTQ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDE.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:5316 -
C:\windows\RDE.exeC:\windows\RDE.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VMLGS.exe.bat" "78⤵PID:2216
-
C:\windows\SysWOW64\VMLGS.exeC:\windows\system32\VMLGS.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZDVTW.exe.bat" "80⤵PID:2448
-
C:\windows\DZDVTW.exeC:\windows\DZDVTW.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RCTTHH.exe.bat" "82⤵PID:2260
-
C:\windows\SysWOW64\RCTTHH.exeC:\windows\system32\RCTTHH.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NCVWT.exe.bat" "84⤵PID:3368
-
C:\windows\NCVWT.exeC:\windows\NCVWT.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SIO.exe.bat" "86⤵PID:2552
-
C:\windows\system\SIO.exeC:\windows\system\SIO.exe87⤵
- Executes dropped EXE
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KLRHPWX.exe.bat" "88⤵
- Executes a command shell one-liner
PID:544 -
C:\windows\system\KLRHPWX.exeC:\windows\system\KLRHPWX.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGR.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3548 -
C:\windows\system\RGR.exeC:\windows\system\RGR.exe91⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LUVZW.exe.bat" "92⤵PID:5132
-
C:\windows\LUVZW.exeC:\windows\LUVZW.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PCCZIJP.exe.bat" "94⤵PID:5352
-
C:\windows\system\PCCZIJP.exeC:\windows\system\PCCZIJP.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPHI.exe.bat" "96⤵
- Executes a command shell one-liner
PID:4464 -
C:\windows\KPHI.exeC:\windows\KPHI.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UNMD.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:472 -
C:\windows\UNMD.exeC:\windows\UNMD.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAZ.exe.bat" "100⤵PID:2100
-
C:\windows\CAZ.exeC:\windows\CAZ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PLHIYB.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:5368 -
C:\windows\PLHIYB.exeC:\windows\PLHIYB.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GLJNC.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1428 -
C:\windows\system\GLJNC.exeC:\windows\system\GLJNC.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IJXHRHP.exe.bat" "106⤵PID:2684
-
C:\windows\system\IJXHRHP.exeC:\windows\system\IJXHRHP.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMBDXF.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4716 -
C:\windows\JMBDXF.exeC:\windows\JMBDXF.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXETF.exe.bat" "110⤵PID:5948
-
C:\windows\SysWOW64\IXETF.exeC:\windows\system32\IXETF.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFKBKDA.exe.bat" "112⤵PID:5072
-
C:\windows\LFKBKDA.exeC:\windows\LFKBKDA.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GAPL.exe.bat" "114⤵PID:3836
-
C:\windows\SysWOW64\GAPL.exeC:\windows\system32\GAPL.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QYVXJLY.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5832 -
C:\windows\system\QYVXJLY.exeC:\windows\system\QYVXJLY.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JTHBP.exe.bat" "118⤵
- Executes a command shell one-liner
PID:5904 -
C:\windows\JTHBP.exeC:\windows\JTHBP.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YJIAVXW.exe.bat" "120⤵PID:4372
-
C:\windows\YJIAVXW.exeC:\windows\YJIAVXW.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-