Analysis
- max time kernel
95s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 14:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_543474226a848245bf4706f562375fc5_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-01_543474226a848245bf4706f562375fc5_elex_emotet_stop.exe
- Size 208KB
- Sample261002-rx4aba1bqa
- SHA256 f255b37f69b1d864d0198f670e30667ad1ec0afcb92bed2a53510b5724025a3c
- MD5 543474226a848245bf4706f562375fc5
- SHA1 8814855754c519e089391fbd80c5d553e8e62b9d
- SHA512 a21e0ba68fea690fe24120cf4fc1ccfec66f46b0a7fc356afef99c8a644a92d4849ec9039234840291b2ac09566bb78c3b43fee7328b6d530e33eb0dde26cd89
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfk4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOskEj1
- TLSH T16D247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4512 IOXG.exe 3472 NGLI.exe 2668 IMKFVR.exe 912 JPO.exe 2416 QFPAPU.exe 940 LQGY.exe 3280 NOL.exe 5092 ZGO.exe 3608 MEO.exe 696 HPXOJR.exe 6088 THMZTK.exe 4844 VUR.exe 4984 QIWRN.exe 3396 ZQYXRP.exe 5868 YBANZ.exe 5240 RTQYJ.exe 2656 KWUBOMR.exe 2380 LZYX.exe 4068 YCGW.exe 5884 QFSZVD.exe 2764 IOMEZAZ.exe 3956 ROOKC.exe 5824 QMHM.exe 3360 FCIEWGY.exe 2888 GXMI.exe 4848 KNSIWOW.exe 1720 MLYCDP.exe 2100 MGK.exe 5388 CWLXPA.exe 2384 RZUB.exe 1660 EWU.exe 5624 KXCBT.exe 2724 IXKPC.exe 2776 LKOYMDE.exe 204 DNSCST.exe 3208 TDTTZGC.exe 5920 NRYKJG.exe 1140 ACOB.exe 3128 VPLLZR.exe 5184 GHODIYR.exe 4148 YQQ.exe 1732 DQYWCY.exe 2936 WLC.exe 1544 CLJOR.exe 5328 BEME.exe 5952 VRRNJW.exe 1712 HKUGSLX.exe 4288 YXE.exe 4344 SLJH.exe 5476 EDMASP.exe 4232 NDGFWMR.exe 4828 IRLO.exe 4384 CMQYQM.exe 3420 NFTRQBK.exe 4480 FKDJ.exe 4300 QCGB.exe 3080 BVBUX.exe 4960 HVJIGPW.exe 5404 SOM.exe 3188 WESBSP.exe 2904 TKYYHYB.exe 4744 NXDH.exe 468 NCVWT.exe 296 ZSCWXVP.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\TDTTZGC.exe DNSCST.exe File opened for modification C:\windows\SysWOW64\YPWP.exe DBSGPSR.exe File created C:\windows\SysWOW64\EIVUBU.exe.bat WCQNRW.exe File created C:\windows\SysWOW64\BYI.exe EIVUBU.exe File created C:\windows\SysWOW64\KWFW.exe UBWSPF.exe File opened for modification C:\windows\SysWOW64\HVJIGPW.exe BVBUX.exe File created C:\windows\SysWOW64\JHZIA.exe YPWP.exe File created C:\windows\SysWOW64\KFJGPCD.exe TFHBM.exe File created C:\windows\SysWOW64\WLC.exe.bat DQYWCY.exe File created C:\windows\SysWOW64\HVJIGPW.exe BVBUX.exe File opened for modification C:\windows\SysWOW64\LWMQL.exe MDJALL.exe File opened for modification C:\windows\SysWOW64\TKYYHYB.exe WESBSP.exe File opened for modification C:\windows\SysWOW64\CJUCI.exe HWP.exe File created C:\windows\SysWOW64\GGS.exe GDOVBP.exe File created C:\windows\SysWOW64\GGS.exe.bat GDOVBP.exe File created C:\windows\SysWOW64\LWMQL.exe.bat MDJALL.exe File created C:\windows\SysWOW64\KXCBT.exe.bat EWU.exe File created C:\windows\SysWOW64\HPXOJR.exe MEO.exe File opened for modification C:\windows\SysWOW64\PDNH.exe UUMT.exe File created C:\windows\SysWOW64\KNSIWOW.exe.bat GXMI.exe File created C:\windows\SysWOW64\RFS.exe LFKBKDA.exe File created C:\windows\SysWOW64\EEIREJ.exe LJEOZTY.exe File created C:\windows\SysWOW64\MGK.exe MLYCDP.exe File created C:\windows\SysWOW64\WRODE.exe BVR.exe File opened for modification C:\windows\SysWOW64\JHZIA.exe YPWP.exe File created C:\windows\SysWOW64\HPXOJR.exe.bat MEO.exe File opened for modification C:\windows\SysWOW64\CWLXPA.exe MGK.exe File created C:\windows\SysWOW64\ZYZJKY.exe.bat ELUZ.exe File created C:\windows\SysWOW64\YPWP.exe.bat DBSGPSR.exe File created C:\windows\SysWOW64\HEO.exe EIJXDB.exe File created C:\windows\SysWOW64\NOL.exe.bat LQGY.exe File created C:\windows\SysWOW64\KXCBT.exe EWU.exe File opened for modification C:\windows\SysWOW64\KXCBT.exe EWU.exe File created C:\windows\SysWOW64\CJUCI.exe.bat HWP.exe File created C:\windows\SysWOW64\BVR.exe.bat FYMXNS.exe File created C:\windows\SysWOW64\RFS.exe.bat LFKBKDA.exe File created C:\windows\SysWOW64\ZVTGHT.exe RFS.exe File opened for modification C:\windows\SysWOW64\KNSIWOW.exe GXMI.exe File opened for modification C:\windows\SysWOW64\THMZTK.exe HPXOJR.exe File opened for modification C:\windows\SysWOW64\RFS.exe LFKBKDA.exe File opened for modification C:\windows\SysWOW64\ZVTGHT.exe RFS.exe File created C:\windows\SysWOW64\GARJR.exe.bat CKK.exe File created C:\windows\SysWOW64\WDEGRIH.exe.bat ZYZJKY.exe File opened for modification C:\windows\SysWOW64\KFJGPCD.exe TFHBM.exe File created C:\windows\SysWOW64\FRVGPLT.exe.bat GGS.exe File created C:\windows\SysWOW64\BVR.exe FYMXNS.exe File created C:\windows\SysWOW64\GARJR.exe CKK.exe File opened for modification C:\windows\SysWOW64\BYI.exe EIVUBU.exe File created C:\windows\SysWOW64\TDTTZGC.exe.bat DNSCST.exe File created C:\windows\SysWOW64\YCGW.exe.bat LZYX.exe File created C:\windows\SysWOW64\THMZTK.exe HPXOJR.exe File opened for modification C:\windows\SysWOW64\ELUZ.exe GARJR.exe File created C:\windows\SysWOW64\CWLXPA.exe MGK.exe File opened for modification C:\windows\SysWOW64\ACOB.exe NRYKJG.exe File opened for modification C:\windows\SysWOW64\GARJR.exe CKK.exe File opened for modification C:\windows\SysWOW64\WDEGRIH.exe ZYZJKY.exe File created C:\windows\SysWOW64\LWMQL.exe MDJALL.exe File opened for modification C:\windows\SysWOW64\FRVGPLT.exe GGS.exe File opened for modification C:\windows\SysWOW64\NOL.exe LQGY.exe File opened for modification C:\windows\SysWOW64\YCGW.exe LZYX.exe File created C:\windows\SysWOW64\BEME.exe.bat CLJOR.exe File opened for modification C:\windows\SysWOW64\CMQYQM.exe IRLO.exe File created C:\windows\SysWOW64\HEO.exe.bat EIJXDB.exe File created C:\windows\SysWOW64\CWLXPA.exe.bat MGK.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\JSER.exe JXAVE.exe File opened for modification C:\windows\NCVWT.exe NXDH.exe File created C:\windows\CKK.exe.bat BHZGZK.exe File opened for modification C:\windows\system\ZLLGD.exe WDEGRIH.exe File opened for modification C:\windows\system\KWUBOMR.exe RTQYJ.exe File created C:\windows\WCQNRW.exe UECT.exe File created C:\windows\system\FKDJ.exe.bat NFTRQBK.exe File created C:\windows\system\FYMXNS.exe.bat TFJEE.exe File created C:\windows\system\FCIEWGY.exe.bat QMHM.exe File created C:\windows\system\MLYCDP.exe KNSIWOW.exe File created C:\windows\system\CLJOR.exe WLC.exe File created C:\windows\system\IMKFVR.exe NGLI.exe File created C:\windows\system\FKDJ.exe NFTRQBK.exe File created C:\windows\system\LJEOZTY.exe.bat LGAST.exe File opened for modification C:\windows\system\UECT.exe BMV.exe File opened for modification C:\windows\system\QIWRN.exe VUR.exe File opened for modification C:\windows\KOWZIAO.exe ZVTGHT.exe File created C:\windows\WCQNRW.exe.bat UECT.exe File created C:\windows\system\IOXG.exe 2026-10-01_543474226a848245bf4706f562375fc5_elex_emotet_stop.exe File created C:\windows\system\QIWRN.exe VUR.exe File created C:\windows\system\YBANZ.exe ZQYXRP.exe File created C:\windows\NDGFWMR.exe EDMASP.exe File created C:\windows\system\GDOVBP.exe.bat EGJATH.exe File created C:\windows\UUMT.exe.bat FRVGPLT.exe File created C:\windows\system\RTQYJ.exe.bat YBANZ.exe File created C:\windows\system\OTMPSV.exe JTEB.exe File opened for modification C:\windows\system\URWRNEI.exe WRODE.exe File created C:\windows\LQGY.exe QFPAPU.exe File created C:\windows\system\KWUBOMR.exe RTQYJ.exe File opened for modification C:\windows\system\HWP.exe OTMPSV.exe File created C:\windows\system\LJEOZTY.exe LGAST.exe File created C:\windows\system\JSER.exe.bat JXAVE.exe File opened for modification C:\windows\system\ZQYXRP.exe QIWRN.exe File created C:\windows\DNSCST.exe LKOYMDE.exe File created C:\windows\system\IRLO.exe.bat NDGFWMR.exe File created C:\windows\system\WEBA.exe.bat URWRNEI.exe File created C:\windows\ROOKC.exe IOMEZAZ.exe File opened for modification C:\windows\system\RZUB.exe CWLXPA.exe File created C:\windows\system\FYMXNS.exe TFJEE.exe File opened for modification C:\windows\system\VPG.exe JHZIA.exe File created C:\windows\system\IMKFVR.exe.bat NGLI.exe File created C:\windows\system\ZQYXRP.exe QIWRN.exe File opened for modification C:\windows\system\QMHM.exe ROOKC.exe File created C:\windows\system\VUR.exe.bat THMZTK.exe File opened for modification C:\windows\system\RTQYJ.exe YBANZ.exe File opened for modification C:\windows\EDMASP.exe SLJH.exe File opened for modification C:\windows\QCGB.exe FKDJ.exe File opened for modification C:\windows\system\BMV.exe LWMQL.exe File created C:\windows\system\QFSZVD.exe YCGW.exe File opened for modification C:\windows\DNSCST.exe LKOYMDE.exe File created C:\windows\NRYKJG.exe TDTTZGC.exe File opened for modification C:\windows\NRYKJG.exe TDTTZGC.exe File opened for modification C:\windows\VPLLZR.exe ACOB.exe File created C:\windows\system\RSFKH.exe WEBA.exe File created C:\windows\LGAST.exe SDWO.exe File created C:\windows\system\GXMI.exe.bat FCIEWGY.exe File opened for modification C:\windows\LKOYMDE.exe IXKPC.exe File created C:\windows\system\BMV.exe.bat LWMQL.exe File created C:\windows\GHODIYR.exe VPLLZR.exe File created C:\windows\QOEN.exe.bat KOWZIAO.exe File created C:\windows\system\ZLLGD.exe.bat WDEGRIH.exe File created C:\windows\system\TFHBM.exe KWFW.exe File created C:\windows\UUMT.exe FRVGPLT.exe File created C:\windows\system\KFEG.exe PDNH.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2624 cmd.exe 5012 cmd.exe 5804 cmd.exe 1324 cmd.exe 4160 cmd.exe 5788 cmd.exe 1448 cmd.exe 4328 cmd.exe 944 cmd.exe 2128 cmd.exe 5188 cmd.exe 5204 cmd.exe 2356 cmd.exe 4436 cmd.exe 5168 cmd.exe 3680 cmd.exe 5608 cmd.exe 3020 cmd.exe 256 cmd.exe 4380 cmd.exe 4392 cmd.exe 6104 cmd.exe 976 cmd.exe 5364 cmd.exe 3596 cmd.exe 1336 cmd.exe 2692 cmd.exe 3212 cmd.exe 3408 cmd.exe 2664 cmd.exe 1912 cmd.exe 3476 cmd.exe 5880 cmd.exe 2968 cmd.exe 5692 cmd.exe 2732 cmd.exe 4244 cmd.exe 5836 cmd.exe 4624 cmd.exe 2908 cmd.exe 5864 cmd.exe 6032 cmd.exe 4536 cmd.exe 2720 cmd.exe 3532 cmd.exe 3272 cmd.exe 2348 cmd.exe 988 cmd.exe 4708 cmd.exe 472 cmd.exe 404 cmd.exe 1888 cmd.exe 3604 cmd.exe 5480 cmd.exe 5720 cmd.exe 568 cmd.exe 1120 cmd.exe 3896 cmd.exe 5468 cmd.exe 1432 cmd.exe 200 cmd.exe 1128 cmd.exe 3600 cmd.exe 5956 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2776 5236 WerFault.exe 88 1364 4512 WerFault.exe 93 5756 3472 WerFault.exe 99 1576 2668 WerFault.exe 104 1144 912 WerFault.exe 109 4760 2416 WerFault.exe 114 6060 940 WerFault.exe 119 6100 3280 WerFault.exe 123 2720 5092 WerFault.exe 129 4264 3608 WerFault.exe 134 3596 696 WerFault.exe 139 2432 6088 WerFault.exe 144 5136 4844 WerFault.exe 149 3940 4984 WerFault.exe 154 4848 3396 WerFault.exe 159 1720 5868 WerFault.exe 164 4600 5240 WerFault.exe 169 5652 2656 WerFault.exe 174 5472 2380 WerFault.exe 179 4464 4068 WerFault.exe 184 4740 5884 WerFault.exe 189 700 2764 WerFault.exe 194 4536 3956 WerFault.exe 199 3420 5824 WerFault.exe 204 4332 3360 WerFault.exe 209 5400 2888 WerFault.exe 214 824 4848 WerFault.exe 219 5836 1720 WerFault.exe 224 984 2100 WerFault.exe 229 4312 5388 WerFault.exe 234 2892 2384 WerFault.exe 239 5028 1660 WerFault.exe 244 2968 5624 WerFault.exe 249 2476 2724 WerFault.exe 254 1620 2776 WerFault.exe 259 3084 204 WerFault.exe 264 1780 3208 WerFault.exe 269 1300 5920 WerFault.exe 275 3272 1140 WerFault.exe 280 5040 3128 WerFault.exe 285 2036 5184 WerFault.exe 290 3104 4148 WerFault.exe 295 5304 1732 WerFault.exe 300 3324 2936 WerFault.exe 305 756 1544 WerFault.exe 310 2868 5328 WerFault.exe 315 4944 5952 WerFault.exe 320 568 1712 WerFault.exe 325 4080 4288 WerFault.exe 330 2916 4344 WerFault.exe 335 4704 5476 WerFault.exe 340 4596 4232 WerFault.exe 345 3228 4828 WerFault.exe 350 5432 4384 WerFault.exe 355 3468 3420 WerFault.exe 360 2568 4480 WerFault.exe 365 2092 4300 WerFault.exe 370 3048 3080 WerFault.exe 375 3004 4960 WerFault.exe 380 5028 5404 WerFault.exe 385 4724 3188 WerFault.exe 390 4864 2904 WerFault.exe 395 4736 4744 WerFault.exe 400 1996 468 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WEBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXZLSL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QOEN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QIWRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IRLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVBUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSCWXVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJUCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFJEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGLI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEIREJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EIVUBU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KNSIWOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TKYYHYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URWRNEI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLLGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFPAPU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RZUB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FRVGPLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTEB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZVTGHT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NCVWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFKBKDA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GHODIYR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UECT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCGW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KFEG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKUGSLX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SLJH.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5236 2026-10-01_543474226a848245bf4706f562375fc5_elex_emotet_stop.exe 5236 2026-10-01_543474226a848245bf4706f562375fc5_elex_emotet_stop.exe 4512 IOXG.exe 4512 IOXG.exe 3472 NGLI.exe 3472 NGLI.exe 2668 IMKFVR.exe 2668 IMKFVR.exe 912 JPO.exe 912 JPO.exe 2416 QFPAPU.exe 2416 QFPAPU.exe 940 LQGY.exe 940 LQGY.exe 3280 NOL.exe 3280 NOL.exe 5092 ZGO.exe 5092 ZGO.exe 3608 MEO.exe 3608 MEO.exe 696 HPXOJR.exe 696 HPXOJR.exe 6088 THMZTK.exe 6088 THMZTK.exe 4844 VUR.exe 4844 VUR.exe 4984 QIWRN.exe 4984 QIWRN.exe 3396 ZQYXRP.exe 3396 ZQYXRP.exe 5868 YBANZ.exe 5868 YBANZ.exe 5240 RTQYJ.exe 5240 RTQYJ.exe 2656 KWUBOMR.exe 2656 KWUBOMR.exe 2380 LZYX.exe 2380 LZYX.exe 4068 YCGW.exe 4068 YCGW.exe 5884 QFSZVD.exe 5884 QFSZVD.exe 2764 IOMEZAZ.exe 2764 IOMEZAZ.exe 3956 ROOKC.exe 3956 ROOKC.exe 5824 QMHM.exe 5824 QMHM.exe 3360 FCIEWGY.exe 3360 FCIEWGY.exe 2888 GXMI.exe 2888 GXMI.exe 4848 KNSIWOW.exe 4848 KNSIWOW.exe 1720 MLYCDP.exe 1720 MLYCDP.exe 2100 MGK.exe 2100 MGK.exe 5388 CWLXPA.exe 5388 CWLXPA.exe 2384 RZUB.exe 2384 RZUB.exe 1660 EWU.exe 1660 EWU.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5236 2026-10-01_543474226a848245bf4706f562375fc5_elex_emotet_stop.exe 5236 2026-10-01_543474226a848245bf4706f562375fc5_elex_emotet_stop.exe 4512 IOXG.exe 4512 IOXG.exe 3472 NGLI.exe 3472 NGLI.exe 2668 IMKFVR.exe 2668 IMKFVR.exe 912 JPO.exe 912 JPO.exe 2416 QFPAPU.exe 2416 QFPAPU.exe 940 LQGY.exe 940 LQGY.exe 3280 NOL.exe 3280 NOL.exe 5092 ZGO.exe 5092 ZGO.exe 3608 MEO.exe 3608 MEO.exe 696 HPXOJR.exe 696 HPXOJR.exe 6088 THMZTK.exe 6088 THMZTK.exe 4844 VUR.exe 4844 VUR.exe 4984 QIWRN.exe 4984 QIWRN.exe 3396 ZQYXRP.exe 3396 ZQYXRP.exe 5868 YBANZ.exe 5868 YBANZ.exe 5240 RTQYJ.exe 5240 RTQYJ.exe 2656 KWUBOMR.exe 2656 KWUBOMR.exe 2380 LZYX.exe 2380 LZYX.exe 4068 YCGW.exe 4068 YCGW.exe 5884 QFSZVD.exe 5884 QFSZVD.exe 2764 IOMEZAZ.exe 2764 IOMEZAZ.exe 3956 ROOKC.exe 3956 ROOKC.exe 5824 QMHM.exe 5824 QMHM.exe 3360 FCIEWGY.exe 3360 FCIEWGY.exe 2888 GXMI.exe 2888 GXMI.exe 4848 KNSIWOW.exe 4848 KNSIWOW.exe 1720 MLYCDP.exe 1720 MLYCDP.exe 2100 MGK.exe 2100 MGK.exe 5388 CWLXPA.exe 5388 CWLXPA.exe 2384 RZUB.exe 2384 RZUB.exe 1660 EWU.exe 1660 EWU.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5236 wrote to memory of 5544 5236 2026-10-01_543474226a848245bf4706f562375fc5_elex_emotet_stop.exe 89 PID 5544 wrote to memory of 4512 5544 cmd.exe 93 PID 4512 wrote to memory of 1456 4512 IOXG.exe 95 PID 1456 wrote to memory of 3472 1456 cmd.exe 99 PID 3472 wrote to memory of 404 3472 NGLI.exe 100 PID 404 wrote to memory of 2668 404 cmd.exe 104 PID 2668 wrote to memory of 2520 2668 IMKFVR.exe 105 PID 2520 wrote to memory of 912 2520 cmd.exe 109 PID 912 wrote to memory of 4188 912 JPO.exe 110 PID 4188 wrote to memory of 2416 4188 cmd.exe 114 PID 2416 wrote to memory of 5520 2416 QFPAPU.exe 115 PID 5520 wrote to memory of 940 5520 cmd.exe 119 PID 940 wrote to memory of 2624 940 LQGY.exe 120 PID 2624 wrote to memory of 3280 2624 cmd.exe 123 PID 3280 wrote to memory of 2732 3280 NOL.exe 125 PID 2732 wrote to memory of 5092 2732 cmd.exe 129 PID 5092 wrote to memory of 5344 5092 ZGO.exe 130 PID 5344 wrote to memory of 3608 5344 cmd.exe 134 PID 3608 wrote to memory of 1416 3608 MEO.exe 135 PID 1416 wrote to memory of 696 1416 cmd.exe 139 PID 696 wrote to memory of 3116 696 HPXOJR.exe 140 PID 3116 wrote to memory of 6088 3116 cmd.exe 144 PID 6088 wrote to memory of 3304 6088 THMZTK.exe 145 PID 3304 wrote to memory of 4844 3304 cmd.exe 149 PID 4844 wrote to memory of 1892 4844 VUR.exe 150 PID 1892 wrote to memory of 4984 1892 cmd.exe 154 PID 4984 wrote to memory of 1148 4984 QIWRN.exe 155 PID 1148 wrote to memory of 3396 1148 cmd.exe 159 PID 3396 wrote to memory of 5280 3396 ZQYXRP.exe 160 PID 5280 wrote to memory of 5868 5280 cmd.exe 164 PID 5868 wrote to memory of 3340 5868 YBANZ.exe 165 PID 3340 wrote to memory of 5240 3340 cmd.exe 169 PID 5240 wrote to memory of 4856 5240 RTQYJ.exe 170 PID 4856 wrote to memory of 2656 4856 cmd.exe 174 PID 2656 wrote to memory of 1888 2656 KWUBOMR.exe 175 PID 1888 wrote to memory of 2380 1888 cmd.exe 179 PID 2380 wrote to memory of 1612 2380 LZYX.exe 180 PID 1612 wrote to memory of 4068 1612 cmd.exe 184 PID 4068 wrote to memory of 1448 4068 YCGW.exe 185 PID 1448 wrote to memory of 5884 1448 cmd.exe 189 PID 5884 wrote to memory of 2692 5884 QFSZVD.exe 190 PID 2692 wrote to memory of 2764 2692 cmd.exe 194 PID 2764 wrote to memory of 1360 2764 IOMEZAZ.exe 195 PID 1360 wrote to memory of 3956 1360 cmd.exe 199 PID 3956 wrote to memory of 2280 3956 ROOKC.exe 200 PID 2280 wrote to memory of 5824 2280 cmd.exe 204 PID 5824 wrote to memory of 2652 5824 QMHM.exe 205 PID 2652 wrote to memory of 3360 2652 cmd.exe 209 PID 3360 wrote to memory of 256 3360 FCIEWGY.exe 210 PID 256 wrote to memory of 2888 256 cmd.exe 214 PID 2888 wrote to memory of 6028 2888 GXMI.exe 215 PID 6028 wrote to memory of 4848 6028 cmd.exe 219 PID 4848 wrote to memory of 5692 4848 KNSIWOW.exe 220 PID 5692 wrote to memory of 1720 5692 cmd.exe 224 PID 1720 wrote to memory of 1392 1720 MLYCDP.exe 225 PID 1392 wrote to memory of 2100 1392 cmd.exe 229 PID 2100 wrote to memory of 2356 2100 MGK.exe 230 PID 2356 wrote to memory of 5388 2356 cmd.exe 234 PID 5388 wrote to memory of 4244 5388 CWLXPA.exe 235 PID 4244 wrote to memory of 2384 4244 cmd.exe 239 PID 2384 wrote to memory of 3184 2384 RZUB.exe 240 PID 3184 wrote to memory of 1660 3184 cmd.exe 244 PID 1660 wrote to memory of 4264 1660 EWU.exe 245 PID 4264 wrote to memory of 5624 4264 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_543474226a848245bf4706f562375fc5_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_543474226a848245bf4706f562375fc5_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOXG.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\windows\system\IOXG.exeC:\windows\system\IOXG.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NGLI.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\windows\NGLI.exeC:\windows\NGLI.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IMKFVR.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:404 -
C:\windows\system\IMKFVR.exeC:\windows\system\IMKFVR.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JPO.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\windows\JPO.exeC:\windows\JPO.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QFPAPU.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\windows\QFPAPU.exeC:\windows\QFPAPU.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LQGY.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\windows\LQGY.exeC:\windows\LQGY.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOL.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\windows\SysWOW64\NOL.exeC:\windows\system32\NOL.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGO.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\windows\ZGO.exeC:\windows\ZGO.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MEO.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\windows\MEO.exeC:\windows\MEO.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HPXOJR.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\windows\SysWOW64\HPXOJR.exeC:\windows\system32\HPXOJR.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THMZTK.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\windows\SysWOW64\THMZTK.exeC:\windows\system32\THMZTK.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VUR.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\windows\system\VUR.exeC:\windows\system\VUR.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIWRN.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\windows\system\QIWRN.exeC:\windows\system\QIWRN.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZQYXRP.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\windows\system\ZQYXRP.exeC:\windows\system\ZQYXRP.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBANZ.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\windows\system\YBANZ.exeC:\windows\system\YBANZ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RTQYJ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\windows\system\RTQYJ.exeC:\windows\system\RTQYJ.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWUBOMR.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\windows\system\KWUBOMR.exeC:\windows\system\KWUBOMR.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LZYX.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\windows\LZYX.exeC:\windows\LZYX.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YCGW.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\windows\SysWOW64\YCGW.exeC:\windows\system32\YCGW.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFSZVD.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\windows\system\QFSZVD.exeC:\windows\system\QFSZVD.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOMEZAZ.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\windows\system\IOMEZAZ.exeC:\windows\system\IOMEZAZ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ROOKC.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\windows\ROOKC.exeC:\windows\ROOKC.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QMHM.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\windows\system\QMHM.exeC:\windows\system\QMHM.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FCIEWGY.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\windows\system\FCIEWGY.exeC:\windows\system\FCIEWGY.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXMI.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:256 -
C:\windows\system\GXMI.exeC:\windows\system\GXMI.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNSIWOW.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\windows\SysWOW64\KNSIWOW.exeC:\windows\system32\KNSIWOW.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLYCDP.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\windows\system\MLYCDP.exeC:\windows\system\MLYCDP.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MGK.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\windows\SysWOW64\MGK.exeC:\windows\system32\MGK.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWLXPA.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\windows\SysWOW64\CWLXPA.exeC:\windows\system32\CWLXPA.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RZUB.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\windows\system\RZUB.exeC:\windows\system\RZUB.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EWU.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\windows\EWU.exeC:\windows\EWU.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXCBT.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\windows\SysWOW64\KXCBT.exeC:\windows\system32\KXCBT.exe65⤵
- Executes dropped EXE
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IXKPC.exe.bat" "66⤵PID:3928
-
C:\windows\system\IXKPC.exeC:\windows\system\IXKPC.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LKOYMDE.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:5728 -
C:\windows\LKOYMDE.exeC:\windows\LKOYMDE.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNSCST.exe.bat" "70⤵PID:4432
-
C:\windows\DNSCST.exeC:\windows\DNSCST.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TDTTZGC.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4436 -
C:\windows\SysWOW64\TDTTZGC.exeC:\windows\system32\TDTTZGC.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NRYKJG.exe.bat" "74⤵PID:2912
-
C:\windows\NRYKJG.exeC:\windows\NRYKJG.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACOB.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:4252 -
C:\windows\SysWOW64\ACOB.exeC:\windows\system32\ACOB.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPLLZR.exe.bat" "78⤵PID:4440
-
C:\windows\VPLLZR.exeC:\windows\VPLLZR.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GHODIYR.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:1984 -
C:\windows\GHODIYR.exeC:\windows\GHODIYR.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQQ.exe.bat" "82⤵
- Executes a command shell one-liner
PID:3212 -
C:\windows\YQQ.exeC:\windows\YQQ.exe83⤵
- Executes dropped EXE
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQYWCY.exe.bat" "84⤵PID:1932
-
C:\windows\system\DQYWCY.exeC:\windows\system\DQYWCY.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLC.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:1788 -
C:\windows\SysWOW64\WLC.exeC:\windows\system32\WLC.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLJOR.exe.bat" "88⤵
- Executes a command shell one-liner
PID:1120 -
C:\windows\system\CLJOR.exeC:\windows\system\CLJOR.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEME.exe.bat" "90⤵PID:5976
-
C:\windows\SysWOW64\BEME.exeC:\windows\system32\BEME.exe91⤵
- Executes dropped EXE
PID:5328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRRNJW.exe.bat" "92⤵PID:3084
-
C:\windows\VRRNJW.exeC:\windows\VRRNJW.exe93⤵
- Executes dropped EXE
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKUGSLX.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:2396 -
C:\windows\system\HKUGSLX.exeC:\windows\system\HKUGSLX.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YXE.exe.bat" "96⤵
- Executes a command shell one-liner
PID:5836 -
C:\windows\system\YXE.exeC:\windows\system\YXE.exe97⤵
- Executes dropped EXE
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SLJH.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3896 -
C:\windows\SLJH.exeC:\windows\SLJH.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDMASP.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:2200 -
C:\windows\EDMASP.exeC:\windows\EDMASP.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDGFWMR.exe.bat" "102⤵PID:4360
-
C:\windows\NDGFWMR.exeC:\windows\NDGFWMR.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IRLO.exe.bat" "104⤵PID:3000
-
C:\windows\system\IRLO.exeC:\windows\system\IRLO.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CMQYQM.exe.bat" "106⤵PID:3932
-
C:\windows\SysWOW64\CMQYQM.exeC:\windows\system32\CMQYQM.exe107⤵
- Executes dropped EXE
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFTRQBK.exe.bat" "108⤵PID:4752
-
C:\windows\system\NFTRQBK.exeC:\windows\system\NFTRQBK.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FKDJ.exe.bat" "110⤵PID:2460
-
C:\windows\system\FKDJ.exeC:\windows\system\FKDJ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCGB.exe.bat" "112⤵PID:2444
-
C:\windows\QCGB.exeC:\windows\QCGB.exe113⤵
- Executes dropped EXE
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BVBUX.exe.bat" "114⤵PID:1656
-
C:\windows\BVBUX.exeC:\windows\BVBUX.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVJIGPW.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4380 -
C:\windows\SysWOW64\HVJIGPW.exeC:\windows\system32\HVJIGPW.exe117⤵
- Executes dropped EXE
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SOM.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5812 -
C:\windows\system\SOM.exeC:\windows\system\SOM.exe119⤵
- Executes dropped EXE
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WESBSP.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5468 -
C:\windows\SysWOW64\WESBSP.exeC:\windows\system32\WESBSP.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-