Analysis
- max time kernel
54s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 11:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_77b3ea6cec6509cdcb8005cc133cb1e9_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-01_77b3ea6cec6509cdcb8005cc133cb1e9_elex_emotet_stop.exe
- Size 208KB
- Sample261002-nlc27stsfv
- SHA256 49aa9fbe24b1771b8174298c6736d6f662a0ce67a54ddf17c028f7577d788bd2
- MD5 77b3ea6cec6509cdcb8005cc133cb1e9
- SHA1 6ceea2f72477c2bb0589c043bbfdfa34fdc13cc6
- SHA512 20d12ff22606376617efc3fe6151f9f552e731cff560f3d039035b282af5ab3181e35771e6f65289df8f69da507ef07cf0502d5146aeee8d931814f471055515
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFleKL+LOfD4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFleS+LOLkEj1
- TLSH T17A247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 62 IoCs
pid Process 1524 XRRTUJP.exe 3032 ZPLLWA.exe 2984 WPVVA.exe 5772 SQXYEI.exe 1832 AVJEOH.exe 760 SEYCBY.exe 2956 LWFMSR.exe 5816 AMG.exe 1164 CKUGGUO.exe 5956 WDBRQVW.exe 2928 EQOYBUS.exe 4508 OOTS.exe 4536 WTGZ.exe 4256 YRM.exe 1444 LXUFKVO.exe 1056 GACVY.exe 2168 DAMGCC.exe 4824 WTTR.exe 3724 VEW.exe 2484 GEM.exe 4876 OKY.exe 5352 TNWLWB.exe 1300 VIOVHU.exe 5760 JGOHR.exe 1996 HDZ.exe 5720 WMABLZR.exe 4704 VELRTN.exe 4756 IHTI.exe 6092 SFZCPY.exe 3472 RYJSY.exe 5752 HOKR.exe 2504 KWRSJS.exe 2904 JHUIR.exe 2096 RUGOC.exe 5636 EXP.exe 948 DQADZNZ.exe 5648 WIHOIOH.exe 3160 PDLK.exe 3844 IGXNBBS.exe 1136 UWDNN.exe 4240 CCIU.exe 3716 TKWZD.exe 3812 MFA.exe 4364 SAZW.exe 1792 QYL.exe 4488 TGTV.exe 4264 VEH.exe 2848 UPKYF.exe 4868 WCBHQB.exe 4644 VVEPZ.exe 2948 QIJHJPW.exe 4972 WEUA.exe 4516 AMBABW.exe 3504 IZOOMU.exe 3564 GKQWU.exe 3192 MKYSE.exe 4056 QNW.exe 4912 RQMBAF.exe 2712 UYVQZ.exe 4180 HJEON.exe 1912 IMHSBSY.exe 1288 BFXDKTG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\WTGZ.exe.bat OOTS.exe File opened for modification C:\windows\SysWOW64\MFA.exe TKWZD.exe File created C:\windows\SysWOW64\WCBHQB.exe UPKYF.exe File created C:\windows\SysWOW64\RQMBAF.exe QNW.exe File opened for modification C:\windows\SysWOW64\UYVQZ.exe RQMBAF.exe File created C:\windows\SysWOW64\UYVQZ.exe.bat RQMBAF.exe File created C:\windows\SysWOW64\MKYSE.exe GKQWU.exe File opened for modification C:\windows\SysWOW64\VIOVHU.exe TNWLWB.exe File created C:\windows\SysWOW64\IHTI.exe.bat VELRTN.exe File created C:\windows\SysWOW64\QYL.exe.bat SAZW.exe File created C:\windows\SysWOW64\BFXDKTG.exe.bat IMHSBSY.exe File opened for modification C:\windows\SysWOW64\YRM.exe WTGZ.exe File created C:\windows\SysWOW64\MFA.exe.bat TKWZD.exe File opened for modification C:\windows\SysWOW64\VVEPZ.exe WCBHQB.exe File created C:\windows\SysWOW64\WEUA.exe QIJHJPW.exe File created C:\windows\SysWOW64\OOTS.exe.bat EQOYBUS.exe File created C:\windows\SysWOW64\VIOVHU.exe TNWLWB.exe File opened for modification C:\windows\SysWOW64\WMABLZR.exe HDZ.exe File created C:\windows\SysWOW64\UWDNN.exe.bat IGXNBBS.exe File created C:\windows\SysWOW64\VVEPZ.exe WCBHQB.exe File created C:\windows\SysWOW64\VVEPZ.exe.bat WCBHQB.exe File created C:\windows\SysWOW64\RQMBAF.exe.bat QNW.exe File created C:\windows\SysWOW64\UYVQZ.exe RQMBAF.exe File opened for modification C:\windows\SysWOW64\WPVVA.exe ZPLLWA.exe File created C:\windows\SysWOW64\MFA.exe TKWZD.exe File opened for modification C:\windows\SysWOW64\MKYSE.exe GKQWU.exe File created C:\windows\SysWOW64\QNW.exe.bat MKYSE.exe File created C:\windows\SysWOW64\XRRTUJP.exe.bat 2026-10-01_77b3ea6cec6509cdcb8005cc133cb1e9_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\QNW.exe MKYSE.exe File opened for modification C:\windows\SysWOW64\OOTS.exe EQOYBUS.exe File opened for modification C:\windows\SysWOW64\WTGZ.exe OOTS.exe File created C:\windows\SysWOW64\YRM.exe WTGZ.exe File created C:\windows\SysWOW64\TGTV.exe QYL.exe File created C:\windows\SysWOW64\BFXDKTG.exe IMHSBSY.exe File created C:\windows\SysWOW64\YRM.exe.bat WTGZ.exe File created C:\windows\SysWOW64\WMABLZR.exe HDZ.exe File created C:\windows\SysWOW64\UWDNN.exe IGXNBBS.exe File created C:\windows\SysWOW64\IZOOMU.exe AMBABW.exe File opened for modification C:\windows\SysWOW64\XRRTUJP.exe 2026-10-01_77b3ea6cec6509cdcb8005cc133cb1e9_elex_emotet_stop.exe File created C:\windows\SysWOW64\WPVVA.exe ZPLLWA.exe File created C:\windows\SysWOW64\QYL.exe SAZW.exe File opened for modification C:\windows\SysWOW64\IZOOMU.exe AMBABW.exe File created C:\windows\SysWOW64\IZOOMU.exe.bat AMBABW.exe File created C:\windows\SysWOW64\HJEON.exe UYVQZ.exe File created C:\windows\SysWOW64\HJEON.exe.bat UYVQZ.exe File created C:\windows\SysWOW64\XRRTUJP.exe 2026-10-01_77b3ea6cec6509cdcb8005cc133cb1e9_elex_emotet_stop.exe File created C:\windows\SysWOW64\WPVVA.exe.bat ZPLLWA.exe File opened for modification C:\windows\SysWOW64\CKUGGUO.exe AMG.exe File created C:\windows\SysWOW64\WTGZ.exe OOTS.exe File opened for modification C:\windows\SysWOW64\QYL.exe SAZW.exe File created C:\windows\SysWOW64\TGTV.exe.bat QYL.exe File created C:\windows\SysWOW64\WCBHQB.exe.bat UPKYF.exe File created C:\windows\SysWOW64\QNW.exe MKYSE.exe File created C:\windows\SysWOW64\IHTI.exe VELRTN.exe File opened for modification C:\windows\SysWOW64\UWDNN.exe IGXNBBS.exe File opened for modification C:\windows\SysWOW64\HJEON.exe UYVQZ.exe File opened for modification C:\windows\SysWOW64\BFXDKTG.exe IMHSBSY.exe File created C:\windows\SysWOW64\CKUGGUO.exe AMG.exe File created C:\windows\SysWOW64\WMABLZR.exe.bat HDZ.exe File opened for modification C:\windows\SysWOW64\WCBHQB.exe UPKYF.exe File created C:\windows\SysWOW64\VIOVHU.exe.bat TNWLWB.exe File created C:\windows\SysWOW64\WEUA.exe.bat QIJHJPW.exe File created C:\windows\SysWOW64\CKUGGUO.exe.bat AMG.exe File opened for modification C:\windows\SysWOW64\WEUA.exe QIJHJPW.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\GEM.exe VEW.exe File created C:\windows\system\RYJSY.exe.bat SFZCPY.exe File created C:\windows\IGXNBBS.exe PDLK.exe File opened for modification C:\windows\SAZW.exe MFA.exe File created C:\windows\system\AVJEOH.exe.bat SQXYEI.exe File created C:\windows\CCIU.exe UWDNN.exe File created C:\windows\SAZW.exe.bat MFA.exe File created C:\windows\system\AMBABW.exe.bat WEUA.exe File opened for modification C:\windows\system\AVJEOH.exe SQXYEI.exe File opened for modification C:\windows\WIHOIOH.exe DQADZNZ.exe File opened for modification C:\windows\system\TKWZD.exe CCIU.exe File created C:\windows\PDLK.exe WIHOIOH.exe File created C:\windows\system\TKWZD.exe CCIU.exe File opened for modification C:\windows\system\QIJHJPW.exe VVEPZ.exe File opened for modification C:\windows\DDDX.exe BFXDKTG.exe File created C:\windows\system\GACVY.exe.bat LXUFKVO.exe File created C:\windows\WTTR.exe DAMGCC.exe File created C:\windows\system\TNWLWB.exe.bat OKY.exe File opened for modification C:\windows\SFZCPY.exe IHTI.exe File opened for modification C:\windows\system\GEM.exe VEW.exe File opened for modification C:\windows\system\VELRTN.exe WMABLZR.exe File opened for modification C:\windows\RUGOC.exe JHUIR.exe File created C:\windows\system\EXP.exe RUGOC.exe File created C:\windows\system\AVJEOH.exe SQXYEI.exe File created C:\windows\system\AMG.exe.bat LWFMSR.exe File opened for modification C:\windows\system\LXUFKVO.exe YRM.exe File created C:\windows\VEH.exe TGTV.exe File created C:\windows\UPKYF.exe.bat VEH.exe File created C:\windows\ZPLLWA.exe XRRTUJP.exe File created C:\windows\VEW.exe WTTR.exe File created C:\windows\HDZ.exe JGOHR.exe File created C:\windows\system\HOKR.exe RYJSY.exe File opened for modification C:\windows\SQXYEI.exe WPVVA.exe File created C:\windows\system\SEYCBY.exe AVJEOH.exe File created C:\windows\system\LXUFKVO.exe YRM.exe File created C:\windows\system\JGOHR.exe VIOVHU.exe File opened for modification C:\windows\system\JGOHR.exe VIOVHU.exe File created C:\windows\system\TKWZD.exe.bat CCIU.exe File opened for modification C:\windows\system\GKQWU.exe IZOOMU.exe File created C:\windows\ZPLLWA.exe.bat XRRTUJP.exe File created C:\windows\EQOYBUS.exe.bat WDBRQVW.exe File created C:\windows\system\DAMGCC.exe.bat GACVY.exe File opened for modification C:\windows\system\OKY.exe GEM.exe File opened for modification C:\windows\system\TNWLWB.exe OKY.exe File created C:\windows\WIHOIOH.exe.bat DQADZNZ.exe File created C:\windows\PDLK.exe.bat WIHOIOH.exe File opened for modification C:\windows\VEW.exe WTTR.exe File created C:\windows\RUGOC.exe.bat JHUIR.exe File created C:\windows\WDBRQVW.exe CKUGGUO.exe File created C:\windows\system\DQADZNZ.exe.bat EXP.exe File created C:\windows\system\GACVY.exe LXUFKVO.exe File created C:\windows\system\EXP.exe.bat RUGOC.exe File created C:\windows\system\QIJHJPW.exe VVEPZ.exe File created C:\windows\system\IMHSBSY.exe.bat HJEON.exe File created C:\windows\DDDX.exe BFXDKTG.exe File opened for modification C:\windows\EQOYBUS.exe WDBRQVW.exe File created C:\windows\SFZCPY.exe.bat IHTI.exe File opened for modification C:\windows\system\RYJSY.exe SFZCPY.exe File opened for modification C:\windows\system\JHUIR.exe KWRSJS.exe File opened for modification C:\windows\CCIU.exe UWDNN.exe File created C:\windows\system\JHUIR.exe KWRSJS.exe File created C:\windows\IGXNBBS.exe.bat PDLK.exe File opened for modification C:\windows\system\AMBABW.exe WEUA.exe File created C:\windows\system\VELRTN.exe WMABLZR.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5204 cmd.exe 5600 cmd.exe 4676 cmd.exe 4904 cmd.exe 3908 cmd.exe 3496 cmd.exe 2400 cmd.exe 1904 cmd.exe 1900 cmd.exe 1112 cmd.exe 5000 cmd.exe 2508 cmd.exe 1496 cmd.exe 4812 cmd.exe 1504 cmd.exe 3792 cmd.exe 1284 cmd.exe 2396 cmd.exe 6048 cmd.exe 4528 cmd.exe 5464 cmd.exe 5744 cmd.exe 2920 cmd.exe 5044 cmd.exe 3408 cmd.exe 2940 cmd.exe 4420 cmd.exe 2872 cmd.exe 5016 cmd.exe 1616 cmd.exe 3040 cmd.exe 2104 cmd.exe 5608 cmd.exe 4344 cmd.exe 4472 cmd.exe 3312 cmd.exe 2592 cmd.exe 3036 cmd.exe 3872 cmd.exe 2700 cmd.exe 5824 cmd.exe 3376 cmd.exe 4136 cmd.exe 1968 cmd.exe 1088 cmd.exe 624 cmd.exe 4440 cmd.exe 2528 cmd.exe 4092 cmd.exe 2696 cmd.exe 4668 cmd.exe 5376 cmd.exe 5880 cmd.exe 2888 cmd.exe 2756 cmd.exe 4608 cmd.exe 480 cmd.exe 2512 cmd.exe 2424 cmd.exe 2980 cmd.exe 2996 cmd.exe 5984 cmd.exe 2916 cmd.exe 1956 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2420 1176 WerFault.exe 87 5848 1524 WerFault.exe 93 5160 3032 WerFault.exe 98 5340 2984 WerFault.exe 104 5556 5772 WerFault.exe 109 5996 1832 WerFault.exe 114 3948 760 WerFault.exe 119 1412 2956 WerFault.exe 124 3044 5816 WerFault.exe 129 5624 1164 WerFault.exe 134 1328 5956 WerFault.exe 139 2364 2928 WerFault.exe 144 2420 4508 WerFault.exe 149 5524 4536 WerFault.exe 154 3564 4256 WerFault.exe 159 948 1444 WerFault.exe 164 5596 1056 WerFault.exe 169 1516 2168 WerFault.exe 174 5548 4824 WerFault.exe 179 4500 3724 WerFault.exe 184 4136 2484 WerFault.exe 189 3420 4876 WerFault.exe 194 3524 5352 WerFault.exe 199 624 1300 WerFault.exe 204 1208 5760 WerFault.exe 209 4864 1996 WerFault.exe 214 4264 5720 WerFault.exe 219 1620 4704 WerFault.exe 224 5016 4756 WerFault.exe 229 4692 6092 WerFault.exe 234 4700 3472 WerFault.exe 239 6056 5752 WerFault.exe 244 2812 2504 WerFault.exe 249 4244 2904 WerFault.exe 254 2568 2096 WerFault.exe 259 4272 5636 WerFault.exe 265 5824 948 WerFault.exe 270 5716 5648 WerFault.exe 275 3508 3160 WerFault.exe 280 2396 3844 WerFault.exe 285 5832 1136 WerFault.exe 290 5612 4240 WerFault.exe 295 2916 3716 WerFault.exe 300 1688 3812 WerFault.exe 305 1812 4364 WerFault.exe 310 4504 1792 WerFault.exe 315 1392 4488 WerFault.exe 320 3700 4264 WerFault.exe 325 5464 2848 WerFault.exe 330 4432 4868 WerFault.exe 335 4136 4644 WerFault.exe 339 4512 2948 WerFault.exe 345 2912 4972 WerFault.exe 350 3220 4516 WerFault.exe 355 4676 3504 WerFault.exe 360 5340 3564 WerFault.exe 365 1552 3192 WerFault.exe 370 1516 4056 WerFault.exe 375 4412 4912 WerFault.exe 380 3908 2712 WerFault.exe 385 4452 4180 WerFault.exe 390 6088 1912 WerFault.exe 395 2776 1288 WerFault.exe 400 1280 2736 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMABLZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDBRQVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWRSJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQADZNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDLK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQXYEI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HOKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QNW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNWLWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXUFKVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHUIR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WTTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAZW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JGOHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVJEOH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EQOYBUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GACVY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKYSE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPLLWA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WTGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUGOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAMGCC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IGXNBBS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WEUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQMBAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMBABW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKUGGUO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPKYF.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1176 2026-10-01_77b3ea6cec6509cdcb8005cc133cb1e9_elex_emotet_stop.exe 1176 2026-10-01_77b3ea6cec6509cdcb8005cc133cb1e9_elex_emotet_stop.exe 1524 XRRTUJP.exe 1524 XRRTUJP.exe 3032 ZPLLWA.exe 3032 ZPLLWA.exe 2984 WPVVA.exe 2984 WPVVA.exe 5772 SQXYEI.exe 5772 SQXYEI.exe 1832 AVJEOH.exe 1832 AVJEOH.exe 760 SEYCBY.exe 760 SEYCBY.exe 2956 LWFMSR.exe 2956 LWFMSR.exe 5816 AMG.exe 5816 AMG.exe 1164 CKUGGUO.exe 1164 CKUGGUO.exe 5956 WDBRQVW.exe 5956 WDBRQVW.exe 2928 EQOYBUS.exe 2928 EQOYBUS.exe 4508 OOTS.exe 4508 OOTS.exe 4536 WTGZ.exe 4536 WTGZ.exe 4256 YRM.exe 4256 YRM.exe 1444 LXUFKVO.exe 1444 LXUFKVO.exe 1056 GACVY.exe 1056 GACVY.exe 2168 DAMGCC.exe 2168 DAMGCC.exe 4824 WTTR.exe 4824 WTTR.exe 3724 VEW.exe 3724 VEW.exe 2484 GEM.exe 2484 GEM.exe 4876 OKY.exe 4876 OKY.exe 5352 TNWLWB.exe 5352 TNWLWB.exe 1300 VIOVHU.exe 1300 VIOVHU.exe 5760 JGOHR.exe 5760 JGOHR.exe 1996 HDZ.exe 1996 HDZ.exe 5720 WMABLZR.exe 5720 WMABLZR.exe 4704 VELRTN.exe 4704 VELRTN.exe 4756 IHTI.exe 4756 IHTI.exe 6092 SFZCPY.exe 6092 SFZCPY.exe 3472 RYJSY.exe 3472 RYJSY.exe 5752 HOKR.exe 5752 HOKR.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1176 2026-10-01_77b3ea6cec6509cdcb8005cc133cb1e9_elex_emotet_stop.exe 1176 2026-10-01_77b3ea6cec6509cdcb8005cc133cb1e9_elex_emotet_stop.exe 1524 XRRTUJP.exe 1524 XRRTUJP.exe 3032 ZPLLWA.exe 3032 ZPLLWA.exe 2984 WPVVA.exe 2984 WPVVA.exe 5772 SQXYEI.exe 5772 SQXYEI.exe 1832 AVJEOH.exe 1832 AVJEOH.exe 760 SEYCBY.exe 760 SEYCBY.exe 2956 LWFMSR.exe 2956 LWFMSR.exe 5816 AMG.exe 5816 AMG.exe 1164 CKUGGUO.exe 1164 CKUGGUO.exe 5956 WDBRQVW.exe 5956 WDBRQVW.exe 2928 EQOYBUS.exe 2928 EQOYBUS.exe 4508 OOTS.exe 4508 OOTS.exe 4536 WTGZ.exe 4536 WTGZ.exe 4256 YRM.exe 4256 YRM.exe 1444 LXUFKVO.exe 1444 LXUFKVO.exe 1056 GACVY.exe 1056 GACVY.exe 2168 DAMGCC.exe 2168 DAMGCC.exe 4824 WTTR.exe 4824 WTTR.exe 3724 VEW.exe 3724 VEW.exe 2484 GEM.exe 2484 GEM.exe 4876 OKY.exe 4876 OKY.exe 5352 TNWLWB.exe 5352 TNWLWB.exe 1300 VIOVHU.exe 1300 VIOVHU.exe 5760 JGOHR.exe 5760 JGOHR.exe 1996 HDZ.exe 1996 HDZ.exe 5720 WMABLZR.exe 5720 WMABLZR.exe 4704 VELRTN.exe 4704 VELRTN.exe 4756 IHTI.exe 4756 IHTI.exe 6092 SFZCPY.exe 6092 SFZCPY.exe 3472 RYJSY.exe 3472 RYJSY.exe 5752 HOKR.exe 5752 HOKR.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1176 wrote to memory of 2296 1176 2026-10-01_77b3ea6cec6509cdcb8005cc133cb1e9_elex_emotet_stop.exe 89 PID 2296 wrote to memory of 1524 2296 cmd.exe 93 PID 1524 wrote to memory of 3312 1524 XRRTUJP.exe 95 PID 3312 wrote to memory of 3032 3312 cmd.exe 98 PID 3032 wrote to memory of 6128 3032 ZPLLWA.exe 100 PID 6128 wrote to memory of 2984 6128 cmd.exe 104 PID 2984 wrote to memory of 3636 2984 WPVVA.exe 105 PID 3636 wrote to memory of 5772 3636 cmd.exe 109 PID 5772 wrote to memory of 2308 5772 SQXYEI.exe 110 PID 2308 wrote to memory of 1832 2308 cmd.exe 114 PID 1832 wrote to memory of 5664 1832 AVJEOH.exe 115 PID 5664 wrote to memory of 760 5664 cmd.exe 119 PID 760 wrote to memory of 2592 760 SEYCBY.exe 120 PID 2592 wrote to memory of 2956 2592 cmd.exe 124 PID 2956 wrote to memory of 5632 2956 LWFMSR.exe 125 PID 5632 wrote to memory of 5816 5632 cmd.exe 129 PID 5816 wrote to memory of 5376 5816 AMG.exe 130 PID 5376 wrote to memory of 1164 5376 cmd.exe 134 PID 1164 wrote to memory of 2596 1164 CKUGGUO.exe 135 PID 2596 wrote to memory of 5956 2596 cmd.exe 139 PID 5956 wrote to memory of 5332 5956 WDBRQVW.exe 140 PID 5332 wrote to memory of 2928 5332 cmd.exe 144 PID 2928 wrote to memory of 5936 2928 EQOYBUS.exe 145 PID 5936 wrote to memory of 4508 5936 cmd.exe 149 PID 4508 wrote to memory of 3824 4508 OOTS.exe 150 PID 3824 wrote to memory of 4536 3824 cmd.exe 154 PID 4536 wrote to memory of 260 4536 WTGZ.exe 155 PID 260 wrote to memory of 4256 260 cmd.exe 159 PID 4256 wrote to memory of 1968 4256 YRM.exe 160 PID 1968 wrote to memory of 1444 1968 cmd.exe 164 PID 1444 wrote to memory of 1496 1444 LXUFKVO.exe 165 PID 1496 wrote to memory of 1056 1496 cmd.exe 169 PID 1056 wrote to memory of 5672 1056 GACVY.exe 170 PID 5672 wrote to memory of 2168 5672 cmd.exe 174 PID 2168 wrote to memory of 5892 2168 DAMGCC.exe 175 PID 5892 wrote to memory of 4824 5892 cmd.exe 179 PID 4824 wrote to memory of 5008 4824 WTTR.exe 180 PID 5008 wrote to memory of 3724 5008 cmd.exe 184 PID 3724 wrote to memory of 2832 3724 VEW.exe 185 PID 2832 wrote to memory of 2484 2832 cmd.exe 189 PID 2484 wrote to memory of 1616 2484 GEM.exe 190 PID 1616 wrote to memory of 4876 1616 cmd.exe 194 PID 4876 wrote to memory of 6136 4876 OKY.exe 195 PID 6136 wrote to memory of 5352 6136 cmd.exe 199 PID 5352 wrote to memory of 2588 5352 TNWLWB.exe 200 PID 2588 wrote to memory of 1300 2588 cmd.exe 204 PID 1300 wrote to memory of 2076 1300 VIOVHU.exe 205 PID 2076 wrote to memory of 5760 2076 cmd.exe 209 PID 5760 wrote to memory of 5044 5760 JGOHR.exe 210 PID 5044 wrote to memory of 1996 5044 cmd.exe 214 PID 1996 wrote to memory of 1380 1996 HDZ.exe 215 PID 1380 wrote to memory of 5720 1380 cmd.exe 219 PID 5720 wrote to memory of 1808 5720 WMABLZR.exe 220 PID 1808 wrote to memory of 4704 1808 cmd.exe 224 PID 4704 wrote to memory of 5104 4704 VELRTN.exe 225 PID 5104 wrote to memory of 4756 5104 cmd.exe 229 PID 4756 wrote to memory of 4528 4756 IHTI.exe 230 PID 4528 wrote to memory of 6092 4528 cmd.exe 234 PID 6092 wrote to memory of 6028 6092 SFZCPY.exe 235 PID 6028 wrote to memory of 3472 6028 cmd.exe 239 PID 3472 wrote to memory of 1224 3472 RYJSY.exe 240 PID 1224 wrote to memory of 5752 1224 cmd.exe 244 PID 5752 wrote to memory of 5220 5752 HOKR.exe 245 PID 5220 wrote to memory of 2504 5220 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_77b3ea6cec6509cdcb8005cc133cb1e9_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_77b3ea6cec6509cdcb8005cc133cb1e9_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XRRTUJP.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\windows\SysWOW64\XRRTUJP.exeC:\windows\system32\XRRTUJP.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPLLWA.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\windows\ZPLLWA.exeC:\windows\ZPLLWA.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WPVVA.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\windows\SysWOW64\WPVVA.exeC:\windows\system32\WPVVA.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SQXYEI.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\windows\SQXYEI.exeC:\windows\SQXYEI.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AVJEOH.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\windows\system\AVJEOH.exeC:\windows\system\AVJEOH.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEYCBY.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\windows\system\SEYCBY.exeC:\windows\system\SEYCBY.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LWFMSR.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\windows\system\LWFMSR.exeC:\windows\system\LWFMSR.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMG.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\windows\system\AMG.exeC:\windows\system\AMG.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CKUGGUO.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\windows\SysWOW64\CKUGGUO.exeC:\windows\system32\CKUGGUO.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDBRQVW.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\windows\WDBRQVW.exeC:\windows\WDBRQVW.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQOYBUS.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\windows\EQOYBUS.exeC:\windows\EQOYBUS.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OOTS.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\windows\SysWOW64\OOTS.exeC:\windows\system32\OOTS.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WTGZ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\windows\SysWOW64\WTGZ.exeC:\windows\system32\WTGZ.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YRM.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:260 -
C:\windows\SysWOW64\YRM.exeC:\windows\system32\YRM.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LXUFKVO.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\windows\system\LXUFKVO.exeC:\windows\system\LXUFKVO.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GACVY.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\windows\system\GACVY.exeC:\windows\system\GACVY.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAMGCC.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\windows\system\DAMGCC.exeC:\windows\system\DAMGCC.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WTTR.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\windows\WTTR.exeC:\windows\WTTR.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEW.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\windows\VEW.exeC:\windows\VEW.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GEM.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\windows\system\GEM.exeC:\windows\system\GEM.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKY.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\windows\system\OKY.exeC:\windows\system\OKY.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TNWLWB.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\windows\system\TNWLWB.exeC:\windows\system\TNWLWB.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VIOVHU.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\windows\SysWOW64\VIOVHU.exeC:\windows\system32\VIOVHU.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JGOHR.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\windows\system\JGOHR.exeC:\windows\system\JGOHR.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HDZ.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\windows\HDZ.exeC:\windows\HDZ.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WMABLZR.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\windows\SysWOW64\WMABLZR.exeC:\windows\system32\WMABLZR.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VELRTN.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\windows\system\VELRTN.exeC:\windows\system\VELRTN.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHTI.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\windows\SysWOW64\IHTI.exeC:\windows\system32\IHTI.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFZCPY.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\windows\SFZCPY.exeC:\windows\SFZCPY.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RYJSY.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\windows\system\RYJSY.exeC:\windows\system\RYJSY.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOKR.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\windows\system\HOKR.exeC:\windows\system\HOKR.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWRSJS.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\windows\system\KWRSJS.exeC:\windows\system\KWRSJS.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JHUIR.exe.bat" "66⤵PID:4940
-
C:\windows\system\JHUIR.exeC:\windows\system\JHUIR.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RUGOC.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1728 -
C:\windows\RUGOC.exeC:\windows\RUGOC.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXP.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5204 -
C:\windows\system\EXP.exeC:\windows\system\EXP.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQADZNZ.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:1068 -
C:\windows\system\DQADZNZ.exeC:\windows\system\DQADZNZ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WIHOIOH.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:3060 -
C:\windows\WIHOIOH.exeC:\windows\WIHOIOH.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PDLK.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:2724 -
C:\windows\PDLK.exeC:\windows\PDLK.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IGXNBBS.exe.bat" "78⤵
- Executes a command shell one-liner
PID:1900 -
C:\windows\IGXNBBS.exeC:\windows\IGXNBBS.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UWDNN.exe.bat" "80⤵PID:4168
-
C:\windows\SysWOW64\UWDNN.exeC:\windows\system32\UWDNN.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCIU.exe.bat" "82⤵PID:4480
-
C:\windows\CCIU.exeC:\windows\CCIU.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TKWZD.exe.bat" "84⤵PID:2564
-
C:\windows\system\TKWZD.exeC:\windows\system\TKWZD.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MFA.exe.bat" "86⤵
- Executes a command shell one-liner
PID:4812 -
C:\windows\SysWOW64\MFA.exeC:\windows\system32\MFA.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SAZW.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2424 -
C:\windows\SAZW.exeC:\windows\SAZW.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QYL.exe.bat" "90⤵PID:5688
-
C:\windows\SysWOW64\QYL.exeC:\windows\system32\QYL.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGTV.exe.bat" "92⤵PID:5160
-
C:\windows\SysWOW64\TGTV.exeC:\windows\system32\TGTV.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEH.exe.bat" "94⤵
- Executes a command shell one-liner
PID:2980 -
C:\windows\VEH.exeC:\windows\VEH.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPKYF.exe.bat" "96⤵PID:5108
-
C:\windows\UPKYF.exeC:\windows\UPKYF.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCBHQB.exe.bat" "98⤵PID:5548
-
C:\windows\SysWOW64\WCBHQB.exeC:\windows\system32\WCBHQB.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VVEPZ.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5880 -
C:\windows\SysWOW64\VVEPZ.exeC:\windows\system32\VVEPZ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIJHJPW.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2888 -
C:\windows\system\QIJHJPW.exeC:\windows\system\QIJHJPW.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WEUA.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:1340 -
C:\windows\SysWOW64\WEUA.exeC:\windows\system32\WEUA.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMBABW.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3228 -
C:\windows\system\AMBABW.exeC:\windows\system\AMBABW.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IZOOMU.exe.bat" "108⤵
- Executes a command shell one-liner
PID:3408 -
C:\windows\SysWOW64\IZOOMU.exeC:\windows\system32\IZOOMU.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKQWU.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:3332 -
C:\windows\system\GKQWU.exeC:\windows\system\GKQWU.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MKYSE.exe.bat" "112⤵PID:2128
-
C:\windows\SysWOW64\MKYSE.exeC:\windows\system32\MKYSE.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QNW.exe.bat" "114⤵PID:2952
-
C:\windows\SysWOW64\QNW.exeC:\windows\system32\QNW.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RQMBAF.exe.bat" "116⤵PID:1184
-
C:\windows\SysWOW64\RQMBAF.exeC:\windows\system32\RQMBAF.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UYVQZ.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:2716 -
C:\windows\SysWOW64\UYVQZ.exeC:\windows\system32\UYVQZ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HJEON.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3040 -
C:\windows\SysWOW64\HJEON.exeC:\windows\system32\HJEON.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4180
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-