Analysis
- max time kernel
93s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 15:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_48c0fc0e8fd294f6801c8eeac8fc3e75_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-01_48c0fc0e8fd294f6801c8eeac8fc3e75_elex_emotet_stop.exe
- Size 208KB
- Sample261002-svs71atfld
- SHA256 7f81111d5699d653fbb19a6e8e2d58808b09b5c2167ba7c94d02057d8352b2e3
- MD5 48c0fc0e8fd294f6801c8eeac8fc3e75
- SHA1 d62496d3885ea7253a15a4e2413a77635b2732d5
- SHA512 7219d97e87f490f4e615df0101e2c2b0441b7713040da42b1f7d8a88f3c88f33bd44f93497eaca0bbc4b19b743daa2f08e0c8b68cb66e97b6cdd3a33f02ecfa0
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlqdL+LOfU4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlq5+LOckEj1
- TLSH T1BC247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4080 WRGI.exe 1272 KMW.exe 1528 GSQXY.exe 4624 CQOUFLC.exe 5784 CDO.exe 5944 QGWHDB.exe 5820 STBRFBP.exe 5416 QPASK.exe 4344 WPIFTG.exe 1112 CPQ.exe 1104 VSUXPQJ.exe 1416 XFYG.exe 2580 FWZFY.exe 5020 FZDB.exe 764 VUNGXWE.exe 3948 YCBO.exe 2164 VCD.exe 5916 ZSKQZD.exe 5788 PILP.exe 4544 UJSDPT.exe 5236 EJU.exe 3500 QZBQE.exe 3164 KMGAPIA.exe 692 UMI.exe 1200 OINOC.exe 4888 FNX.exe 2236 AACQ.exe 2412 GWBQZNJ.exe 3940 BJGI.exe 1288 VELRTN.exe 2052 QSP.exe 1896 HFA.exe 2500 HKSH.exe 3460 CYXQXO.exe 2464 YDDOEYJ.exe 5672 EEKBV.exe 4928 CZJCSD.exe 6056 IZR.exe 4128 CNWZT.exe 5452 UNQEXC.exe 5792 ANY.exe 6124 LGBL.exe 1148 JGIYX.exe 5740 VWPG.exe 3960 GPS.exe 4772 PPUEVDP.exe 5008 VPBSEFZ.exe 5464 SVZH.exe 5800 GAFEA.exe 3756 JOKODZJ.exe 2876 DLDQJO.exe 2780 JML.exe 5824 AMNJ.exe 3424 ECTR.exe 3240 ZPYAS.exe 2996 TDDJCFU.exe 3184 OQIT.exe 2932 KWOQ.exe 4896 UTT.exe 3096 QBVSEWP.exe 2788 DMRRJN.exe 4568 FPBYCB.exe 5200 BXVOFA.exe 1524 ZNUQJU.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\EJU.exe.bat UJSDPT.exe File created C:\windows\SysWOW64\ANY.exe.bat UNQEXC.exe File created C:\windows\SysWOW64\GPS.exe.bat VWPG.exe File opened for modification C:\windows\SysWOW64\GGU.exe TIULB.exe File created C:\windows\SysWOW64\JHDNY.exe QEA.exe File opened for modification C:\windows\SysWOW64\PILP.exe ZSKQZD.exe File created C:\windows\SysWOW64\FPBYCB.exe DMRRJN.exe File created C:\windows\SysWOW64\UVHCG.exe JPE.exe File created C:\windows\SysWOW64\GES.exe CAUJQ.exe File created C:\windows\SysWOW64\VCD.exe YCBO.exe File created C:\windows\SysWOW64\PPUEVDP.exe.bat GPS.exe File created C:\windows\SysWOW64\PILP.exe.bat ZSKQZD.exe File created C:\windows\SysWOW64\HFA.exe QSP.exe File opened for modification C:\windows\SysWOW64\DMRRJN.exe QBVSEWP.exe File created C:\windows\SysWOW64\EJU.exe UJSDPT.exe File created C:\windows\SysWOW64\QZBQE.exe.bat EJU.exe File opened for modification C:\windows\SysWOW64\QBVSEWP.exe UTT.exe File created C:\windows\SysWOW64\RKOB.exe.bat BUNBPB.exe File opened for modification C:\windows\SysWOW64\UMI.exe KMGAPIA.exe File created C:\windows\SysWOW64\HFA.exe.bat QSP.exe File created C:\windows\SysWOW64\GAFEA.exe SVZH.exe File created C:\windows\SysWOW64\QHAODV.exe GYYJ.exe File opened for modification C:\windows\SysWOW64\QHAODV.exe GYYJ.exe File created C:\windows\SysWOW64\JPE.exe.bat WNAQ.exe File opened for modification C:\windows\SysWOW64\BUNBPB.exe ORE.exe File created C:\windows\SysWOW64\ZZO.exe PBJWML.exe File created C:\windows\SysWOW64\WPIFTG.exe QPASK.exe File opened for modification C:\windows\SysWOW64\EJU.exe UJSDPT.exe File opened for modification C:\windows\SysWOW64\FPBYCB.exe DMRRJN.exe File created C:\windows\SysWOW64\WPIFTG.exe.bat QPASK.exe File created C:\windows\SysWOW64\KWOQ.exe.bat OQIT.exe File created C:\windows\SysWOW64\NQOQR.exe DSJVBY.exe File opened for modification C:\windows\SysWOW64\ZSKQZD.exe VCD.exe File created C:\windows\SysWOW64\QZBQE.exe EJU.exe File created C:\windows\SysWOW64\HKSH.exe.bat HFA.exe File created C:\windows\SysWOW64\QBVSEWP.exe UTT.exe File created C:\windows\SysWOW64\RKOB.exe BUNBPB.exe File opened for modification C:\windows\SysWOW64\WNOZ.exe RNEPK.exe File created C:\windows\SysWOW64\BJGI.exe GWBQZNJ.exe File opened for modification C:\windows\SysWOW64\CYXQXO.exe HKSH.exe File created C:\windows\SysWOW64\AMNJ.exe JML.exe File created C:\windows\SysWOW64\QBVSEWP.exe.bat UTT.exe File created C:\windows\SysWOW64\GGU.exe.bat TIULB.exe File created C:\windows\SysWOW64\IAAMYVE.exe JCHJ.exe File created C:\windows\SysWOW64\OINOC.exe.bat UMI.exe File created C:\windows\SysWOW64\LGBL.exe ANY.exe File created C:\windows\SysWOW64\JSQQ.exe.bat HUKWU.exe File created C:\windows\SysWOW64\LGBL.exe.bat ANY.exe File created C:\windows\SysWOW64\UVHCG.exe.bat JPE.exe File created C:\windows\SysWOW64\FPBYCB.exe.bat DMRRJN.exe File created C:\windows\SysWOW64\QHAODV.exe.bat GYYJ.exe File created C:\windows\SysWOW64\JHDNY.exe.bat QEA.exe File created C:\windows\SysWOW64\GAFEA.exe.bat SVZH.exe File opened for modification C:\windows\SysWOW64\BXVOFA.exe FPBYCB.exe File opened for modification C:\windows\SysWOW64\UVHCG.exe JPE.exe File created C:\windows\SysWOW64\NQOQR.exe.bat DSJVBY.exe File created C:\windows\SysWOW64\ZSKQZD.exe VCD.exe File opened for modification C:\windows\SysWOW64\KWOQ.exe OQIT.exe File created C:\windows\SysWOW64\BUNBPB.exe.bat ORE.exe File opened for modification C:\windows\SysWOW64\ZZO.exe PBJWML.exe File opened for modification C:\windows\SysWOW64\HKSH.exe HFA.exe File opened for modification C:\windows\SysWOW64\AMNJ.exe JML.exe File created C:\windows\SysWOW64\AMNJ.exe.bat JML.exe File created C:\windows\SysWOW64\KWOQ.exe OQIT.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\VWPG.exe JGIYX.exe File created C:\windows\system\DLDQJO.exe JOKODZJ.exe File created C:\windows\JOJLQX.exe.bat OAETG.exe File opened for modification C:\windows\UPS.exe HMWZ.exe File created C:\windows\UJSDPT.exe PILP.exe File created C:\windows\system\PDXPM.exe UPS.exe File created C:\windows\CAUJQ.exe UVHCG.exe File created C:\windows\system\YRTPBJM.exe JOJLQX.exe File opened for modification C:\windows\system\VSUXPQJ.exe CPQ.exe File opened for modification C:\windows\FZDB.exe FWZFY.exe File created C:\windows\CZJCSD.exe.bat EEKBV.exe File opened for modification C:\windows\system\HMWZ.exe QPP.exe File created C:\windows\XFYG.exe.bat VSUXPQJ.exe File created C:\windows\ZNUQJU.exe.bat BXVOFA.exe File created C:\windows\GYYJ.exe GVU.exe File created C:\windows\system\WNAQ.exe DJINKY.exe File opened for modification C:\windows\GWBQZNJ.exe AACQ.exe File created C:\windows\CZJCSD.exe EEKBV.exe File created C:\windows\CNWZT.exe IZR.exe File created C:\windows\system\DJINKY.exe QHAODV.exe File created C:\windows\system\CQOUFLC.exe.bat GSQXY.exe File created C:\windows\YUYKO.exe.bat ZWRID.exe File created C:\windows\system\QPP.exe YUYKO.exe File created C:\windows\system\HUKWU.exe REJ.exe File created C:\windows\PBJWML.exe.bat WGFAHVD.exe File created C:\windows\WRGI.exe.bat 2026-10-01_48c0fc0e8fd294f6801c8eeac8fc3e75_elex_emotet_stop.exe File created C:\windows\ECTR.exe AMNJ.exe File created C:\windows\system\WGFAHVD.exe.bat MJRG.exe File created C:\windows\OAETG.exe VXAXAH.exe File opened for modification C:\windows\system\JGIYX.exe LGBL.exe File created C:\windows\RNEPK.exe RKOB.exe File created C:\windows\WTDWSX.exe.bat XVSTFSB.exe File created C:\windows\system\STBRFBP.exe QGWHDB.exe File created C:\windows\system\STBRFBP.exe.bat QGWHDB.exe File opened for modification C:\windows\system\VUNGXWE.exe FZDB.exe File opened for modification C:\windows\ZNUQJU.exe BXVOFA.exe File opened for modification C:\windows\YLU.exe WNOZ.exe File opened for modification C:\windows\system\YDDOEYJ.exe CYXQXO.exe File created C:\windows\OQIT.exe.bat TDDJCFU.exe File created C:\windows\ZWRID.exe.bat SBUVBD.exe File created C:\windows\CAUJQ.exe.bat UVHCG.exe File created C:\windows\system\EEKBV.exe YDDOEYJ.exe File opened for modification C:\windows\system\BLVTP.exe ZNUQJU.exe File created C:\windows\VXAXAH.exe IAAMYVE.exe File opened for modification C:\windows\GSQXY.exe KMW.exe File created C:\windows\QSP.exe VELRTN.exe File created C:\windows\SVZH.exe VPBSEFZ.exe File created C:\windows\JOKODZJ.exe GAFEA.exe File opened for modification C:\windows\system\DLDQJO.exe JOKODZJ.exe File created C:\windows\system\BVIRBO.exe CKFB.exe File created C:\windows\XVIRMF.exe.bat CHDH.exe File created C:\windows\system\VELRTN.exe BJGI.exe File created C:\windows\system\UNQEXC.exe CNWZT.exe File opened for modification C:\windows\system\WGFAHVD.exe MJRG.exe File created C:\windows\system\TIULB.exe QNDC.exe File created C:\windows\system\CHDH.exe VRCIVJ.exe File created C:\windows\UTT.exe KWOQ.exe File created C:\windows\JFEM.exe HHQSK.exe File created C:\windows\UJSDPT.exe.bat PILP.exe File opened for modification C:\windows\QNDC.exe BXC.exe File opened for modification C:\windows\XFYG.exe VSUXPQJ.exe File created C:\windows\FZDB.exe.bat FWZFY.exe File created C:\windows\KMGAPIA.exe.bat QZBQE.exe File opened for modification C:\windows\CZJCSD.exe EEKBV.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 256 cmd.exe 1468 cmd.exe 1176 cmd.exe 2964 cmd.exe 3832 cmd.exe 1212 cmd.exe 1280 cmd.exe 3000 cmd.exe 3336 cmd.exe 5084 cmd.exe 4548 cmd.exe 5736 cmd.exe 3104 cmd.exe 4820 cmd.exe 6000 cmd.exe 4776 cmd.exe 4168 cmd.exe 3440 cmd.exe 4112 cmd.exe 1964 cmd.exe 2768 cmd.exe 1696 cmd.exe 2372 cmd.exe 4164 cmd.exe 5440 cmd.exe 1856 cmd.exe 3216 cmd.exe 3300 cmd.exe 412 cmd.exe 1892 cmd.exe 5768 cmd.exe 8 cmd.exe 2380 cmd.exe 2404 cmd.exe 2948 cmd.exe 4908 cmd.exe 4996 cmd.exe 2784 cmd.exe 1284 cmd.exe 4184 cmd.exe 4204 cmd.exe 2352 cmd.exe 1268 cmd.exe 2420 cmd.exe 5532 cmd.exe 1428 cmd.exe 5860 cmd.exe 1092 cmd.exe 2988 cmd.exe 1248 cmd.exe 4376 cmd.exe 5636 cmd.exe 1612 cmd.exe 4744 cmd.exe 2108 cmd.exe 4528 cmd.exe 5904 cmd.exe 5308 cmd.exe 988 cmd.exe 5412 cmd.exe 5992 cmd.exe 2040 cmd.exe 5520 cmd.exe 4380 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1148 3036 WerFault.exe 87 3360 4080 WerFault.exe 93 2720 1272 WerFault.exe 99 3672 1528 WerFault.exe 104 5668 4624 WerFault.exe 109 2904 5784 WerFault.exe 114 3680 5944 WerFault.exe 119 916 5820 WerFault.exe 124 1216 5416 WerFault.exe 129 776 4344 WerFault.exe 134 3404 1112 WerFault.exe 139 432 1104 WerFault.exe 144 3216 1416 WerFault.exe 149 5884 2580 WerFault.exe 154 1264 5020 WerFault.exe 159 5124 764 WerFault.exe 164 1080 3948 WerFault.exe 169 2284 2164 WerFault.exe 174 916 5916 WerFault.exe 179 3688 5788 WerFault.exe 184 1248 4544 WerFault.exe 189 3284 5236 WerFault.exe 194 944 3500 WerFault.exe 199 5360 3164 WerFault.exe 204 4264 692 WerFault.exe 209 5008 1200 WerFault.exe 214 2768 4888 WerFault.exe 219 364 2236 WerFault.exe 224 3756 2412 WerFault.exe 229 2908 3940 WerFault.exe 234 5660 1288 WerFault.exe 239 4688 2052 WerFault.exe 244 600 1896 WerFault.exe 249 5308 2500 WerFault.exe 254 5992 3460 WerFault.exe 259 4772 2464 WerFault.exe 264 6004 5672 WerFault.exe 269 4912 4928 WerFault.exe 274 5800 6056 WerFault.exe 279 5040 4128 WerFault.exe 284 3676 5452 WerFault.exe 289 5592 5792 WerFault.exe 294 4260 6124 WerFault.exe 299 5640 1148 WerFault.exe 304 2920 5740 WerFault.exe 309 3604 3960 WerFault.exe 314 2904 4772 WerFault.exe 319 1228 5008 WerFault.exe 324 1612 5464 WerFault.exe 329 1216 5800 WerFault.exe 334 5980 3756 WerFault.exe 339 5592 2876 WerFault.exe 344 3336 2780 WerFault.exe 349 4224 5824 WerFault.exe 354 4480 3424 WerFault.exe 359 4444 3240 WerFault.exe 364 1224 2996 WerFault.exe 369 1136 3184 WerFault.exe 374 624 2932 WerFault.exe 379 2796 4896 WerFault.exe 383 5348 3096 WerFault.exe 389 5076 2788 WerFault.exe 393 2024 4568 WerFault.exe 398 3400 5200 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQOUFLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAUJQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RKOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GES.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NQOQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XVSTFSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBVSEWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VXAXAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRCIVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSUXPQJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TDDJCFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JFEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWZFY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWBQZNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JML.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BXC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TIULB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZZO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WNOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWTDK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WNAQ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3036 2026-10-01_48c0fc0e8fd294f6801c8eeac8fc3e75_elex_emotet_stop.exe 3036 2026-10-01_48c0fc0e8fd294f6801c8eeac8fc3e75_elex_emotet_stop.exe 4080 WRGI.exe 4080 WRGI.exe 1272 KMW.exe 1272 KMW.exe 1528 GSQXY.exe 1528 GSQXY.exe 4624 CQOUFLC.exe 4624 CQOUFLC.exe 5784 CDO.exe 5784 CDO.exe 5944 QGWHDB.exe 5944 QGWHDB.exe 5820 STBRFBP.exe 5820 STBRFBP.exe 5416 QPASK.exe 5416 QPASK.exe 4344 WPIFTG.exe 4344 WPIFTG.exe 1112 CPQ.exe 1112 CPQ.exe 1104 VSUXPQJ.exe 1104 VSUXPQJ.exe 1416 XFYG.exe 1416 XFYG.exe 2580 FWZFY.exe 2580 FWZFY.exe 5020 FZDB.exe 5020 FZDB.exe 764 VUNGXWE.exe 764 VUNGXWE.exe 3948 YCBO.exe 3948 YCBO.exe 2164 VCD.exe 2164 VCD.exe 5916 ZSKQZD.exe 5916 ZSKQZD.exe 5788 PILP.exe 5788 PILP.exe 4544 UJSDPT.exe 4544 UJSDPT.exe 5236 EJU.exe 5236 EJU.exe 3500 QZBQE.exe 3500 QZBQE.exe 3164 KMGAPIA.exe 3164 KMGAPIA.exe 692 UMI.exe 692 UMI.exe 1200 OINOC.exe 1200 OINOC.exe 4888 FNX.exe 4888 FNX.exe 2236 AACQ.exe 2236 AACQ.exe 2412 GWBQZNJ.exe 2412 GWBQZNJ.exe 3940 BJGI.exe 3940 BJGI.exe 1288 VELRTN.exe 1288 VELRTN.exe 2052 QSP.exe 2052 QSP.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3036 2026-10-01_48c0fc0e8fd294f6801c8eeac8fc3e75_elex_emotet_stop.exe 3036 2026-10-01_48c0fc0e8fd294f6801c8eeac8fc3e75_elex_emotet_stop.exe 4080 WRGI.exe 4080 WRGI.exe 1272 KMW.exe 1272 KMW.exe 1528 GSQXY.exe 1528 GSQXY.exe 4624 CQOUFLC.exe 4624 CQOUFLC.exe 5784 CDO.exe 5784 CDO.exe 5944 QGWHDB.exe 5944 QGWHDB.exe 5820 STBRFBP.exe 5820 STBRFBP.exe 5416 QPASK.exe 5416 QPASK.exe 4344 WPIFTG.exe 4344 WPIFTG.exe 1112 CPQ.exe 1112 CPQ.exe 1104 VSUXPQJ.exe 1104 VSUXPQJ.exe 1416 XFYG.exe 1416 XFYG.exe 2580 FWZFY.exe 2580 FWZFY.exe 5020 FZDB.exe 5020 FZDB.exe 764 VUNGXWE.exe 764 VUNGXWE.exe 3948 YCBO.exe 3948 YCBO.exe 2164 VCD.exe 2164 VCD.exe 5916 ZSKQZD.exe 5916 ZSKQZD.exe 5788 PILP.exe 5788 PILP.exe 4544 UJSDPT.exe 4544 UJSDPT.exe 5236 EJU.exe 5236 EJU.exe 3500 QZBQE.exe 3500 QZBQE.exe 3164 KMGAPIA.exe 3164 KMGAPIA.exe 692 UMI.exe 692 UMI.exe 1200 OINOC.exe 1200 OINOC.exe 4888 FNX.exe 4888 FNX.exe 2236 AACQ.exe 2236 AACQ.exe 2412 GWBQZNJ.exe 2412 GWBQZNJ.exe 3940 BJGI.exe 3940 BJGI.exe 1288 VELRTN.exe 1288 VELRTN.exe 2052 QSP.exe 2052 QSP.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3036 wrote to memory of 3104 3036 2026-10-01_48c0fc0e8fd294f6801c8eeac8fc3e75_elex_emotet_stop.exe 89 PID 3104 wrote to memory of 4080 3104 cmd.exe 93 PID 4080 wrote to memory of 304 4080 WRGI.exe 95 PID 304 wrote to memory of 1272 304 cmd.exe 99 PID 1272 wrote to memory of 4104 1272 KMW.exe 100 PID 4104 wrote to memory of 1528 4104 cmd.exe 104 PID 1528 wrote to memory of 4736 1528 GSQXY.exe 105 PID 4736 wrote to memory of 4624 4736 cmd.exe 109 PID 4624 wrote to memory of 4800 4624 CQOUFLC.exe 110 PID 4800 wrote to memory of 5784 4800 cmd.exe 114 PID 5784 wrote to memory of 1092 5784 CDO.exe 115 PID 1092 wrote to memory of 5944 1092 cmd.exe 119 PID 5944 wrote to memory of 2004 5944 QGWHDB.exe 120 PID 2004 wrote to memory of 5820 2004 cmd.exe 124 PID 5820 wrote to memory of 2624 5820 STBRFBP.exe 125 PID 2624 wrote to memory of 5416 2624 cmd.exe 129 PID 5416 wrote to memory of 2404 5416 QPASK.exe 130 PID 2404 wrote to memory of 4344 2404 cmd.exe 134 PID 4344 wrote to memory of 1188 4344 WPIFTG.exe 135 PID 1188 wrote to memory of 1112 1188 cmd.exe 139 PID 1112 wrote to memory of 1964 1112 CPQ.exe 140 PID 1964 wrote to memory of 1104 1964 cmd.exe 144 PID 1104 wrote to memory of 836 1104 VSUXPQJ.exe 145 PID 836 wrote to memory of 1416 836 cmd.exe 149 PID 1416 wrote to memory of 2592 1416 XFYG.exe 150 PID 2592 wrote to memory of 2580 2592 cmd.exe 154 PID 2580 wrote to memory of 4820 2580 FWZFY.exe 155 PID 4820 wrote to memory of 5020 4820 cmd.exe 159 PID 5020 wrote to memory of 1728 5020 FZDB.exe 160 PID 1728 wrote to memory of 764 1728 cmd.exe 164 PID 764 wrote to memory of 2340 764 VUNGXWE.exe 165 PID 2340 wrote to memory of 3948 2340 cmd.exe 169 PID 3948 wrote to memory of 2988 3948 YCBO.exe 170 PID 2988 wrote to memory of 2164 2988 cmd.exe 174 PID 2164 wrote to memory of 884 2164 VCD.exe 175 PID 884 wrote to memory of 5916 884 cmd.exe 179 PID 5916 wrote to memory of 6116 5916 ZSKQZD.exe 180 PID 6116 wrote to memory of 5788 6116 cmd.exe 184 PID 5788 wrote to memory of 3272 5788 PILP.exe 185 PID 3272 wrote to memory of 4544 3272 cmd.exe 189 PID 4544 wrote to memory of 5768 4544 UJSDPT.exe 190 PID 5768 wrote to memory of 5236 5768 cmd.exe 194 PID 5236 wrote to memory of 5476 5236 EJU.exe 195 PID 5476 wrote to memory of 3500 5476 cmd.exe 199 PID 3500 wrote to memory of 1536 3500 QZBQE.exe 200 PID 1536 wrote to memory of 3164 1536 cmd.exe 204 PID 3164 wrote to memory of 4384 3164 KMGAPIA.exe 205 PID 4384 wrote to memory of 692 4384 cmd.exe 209 PID 692 wrote to memory of 2964 692 UMI.exe 210 PID 2964 wrote to memory of 1200 2964 cmd.exe 214 PID 1200 wrote to memory of 3308 1200 OINOC.exe 215 PID 3308 wrote to memory of 4888 3308 cmd.exe 219 PID 4888 wrote to memory of 1340 4888 FNX.exe 220 PID 1340 wrote to memory of 2236 1340 cmd.exe 224 PID 2236 wrote to memory of 4380 2236 AACQ.exe 225 PID 4380 wrote to memory of 2412 4380 cmd.exe 229 PID 2412 wrote to memory of 1032 2412 GWBQZNJ.exe 230 PID 1032 wrote to memory of 3940 1032 cmd.exe 234 PID 3940 wrote to memory of 3392 3940 BJGI.exe 235 PID 3392 wrote to memory of 1288 3392 cmd.exe 239 PID 1288 wrote to memory of 2712 1288 VELRTN.exe 240 PID 2712 wrote to memory of 2052 2712 cmd.exe 244 PID 2052 wrote to memory of 2040 2052 QSP.exe 245 PID 2040 wrote to memory of 1896 2040 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_48c0fc0e8fd294f6801c8eeac8fc3e75_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_48c0fc0e8fd294f6801c8eeac8fc3e75_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WRGI.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\windows\WRGI.exeC:\windows\WRGI.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KMW.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:304 -
C:\windows\system\KMW.exeC:\windows\system\KMW.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSQXY.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\windows\GSQXY.exeC:\windows\GSQXY.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CQOUFLC.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\windows\system\CQOUFLC.exeC:\windows\system\CQOUFLC.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDO.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\windows\system\CDO.exeC:\windows\system\CDO.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGWHDB.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\windows\QGWHDB.exeC:\windows\QGWHDB.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STBRFBP.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\windows\system\STBRFBP.exeC:\windows\system\STBRFBP.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QPASK.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\windows\system\QPASK.exeC:\windows\system\QPASK.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WPIFTG.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\windows\SysWOW64\WPIFTG.exeC:\windows\system32\WPIFTG.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPQ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\windows\system\CPQ.exeC:\windows\system\CPQ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSUXPQJ.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\windows\system\VSUXPQJ.exeC:\windows\system\VSUXPQJ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFYG.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:836 -
C:\windows\XFYG.exeC:\windows\XFYG.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWZFY.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\windows\system\FWZFY.exeC:\windows\system\FWZFY.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZDB.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\windows\FZDB.exeC:\windows\FZDB.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VUNGXWE.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\windows\system\VUNGXWE.exeC:\windows\system\VUNGXWE.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YCBO.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\windows\system\YCBO.exeC:\windows\system\YCBO.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VCD.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\windows\SysWOW64\VCD.exeC:\windows\system32\VCD.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZSKQZD.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:884 -
C:\windows\SysWOW64\ZSKQZD.exeC:\windows\system32\ZSKQZD.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PILP.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\windows\SysWOW64\PILP.exeC:\windows\system32\PILP.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UJSDPT.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\windows\UJSDPT.exeC:\windows\UJSDPT.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EJU.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\windows\SysWOW64\EJU.exeC:\windows\system32\EJU.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QZBQE.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\windows\SysWOW64\QZBQE.exeC:\windows\system32\QZBQE.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMGAPIA.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\windows\KMGAPIA.exeC:\windows\KMGAPIA.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UMI.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\windows\SysWOW64\UMI.exeC:\windows\system32\UMI.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OINOC.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\windows\SysWOW64\OINOC.exeC:\windows\system32\OINOC.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FNX.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\windows\system\FNX.exeC:\windows\system\FNX.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AACQ.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\windows\AACQ.exeC:\windows\AACQ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWBQZNJ.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\windows\GWBQZNJ.exeC:\windows\GWBQZNJ.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BJGI.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\windows\SysWOW64\BJGI.exeC:\windows\system32\BJGI.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VELRTN.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\windows\system\VELRTN.exeC:\windows\system\VELRTN.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSP.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\windows\QSP.exeC:\windows\QSP.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HFA.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\windows\SysWOW64\HFA.exeC:\windows\system32\HFA.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKSH.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5520 -
C:\windows\SysWOW64\HKSH.exeC:\windows\system32\HKSH.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYXQXO.exe.bat" "68⤵PID:4600
-
C:\windows\SysWOW64\CYXQXO.exeC:\windows\system32\CYXQXO.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDDOEYJ.exe.bat" "70⤵PID:4924
-
C:\windows\system\YDDOEYJ.exeC:\windows\system\YDDOEYJ.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EEKBV.exe.bat" "72⤵PID:472
-
C:\windows\system\EEKBV.exeC:\windows\system\EEKBV.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZJCSD.exe.bat" "74⤵PID:704
-
C:\windows\CZJCSD.exeC:\windows\CZJCSD.exe75⤵
- Executes dropped EXE
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZR.exe.bat" "76⤵
- Executes a command shell one-liner
PID:4112 -
C:\windows\IZR.exeC:\windows\IZR.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNWZT.exe.bat" "78⤵PID:3420
-
C:\windows\CNWZT.exeC:\windows\CNWZT.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNQEXC.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:6132 -
C:\windows\system\UNQEXC.exeC:\windows\system\UNQEXC.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANY.exe.bat" "82⤵PID:1792
-
C:\windows\SysWOW64\ANY.exeC:\windows\system32\ANY.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGBL.exe.bat" "84⤵
- Executes a command shell one-liner
PID:8 -
C:\windows\SysWOW64\LGBL.exeC:\windows\system32\LGBL.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JGIYX.exe.bat" "86⤵PID:1840
-
C:\windows\system\JGIYX.exeC:\windows\system\JGIYX.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VWPG.exe.bat" "88⤵PID:4724
-
C:\windows\VWPG.exeC:\windows\VWPG.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GPS.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2976 -
C:\windows\SysWOW64\GPS.exeC:\windows\system32\GPS.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PPUEVDP.exe.bat" "92⤵PID:1544
-
C:\windows\SysWOW64\PPUEVDP.exeC:\windows\system32\PPUEVDP.exe93⤵
- Executes dropped EXE
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPBSEFZ.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:928 -
C:\windows\VPBSEFZ.exeC:\windows\VPBSEFZ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVZH.exe.bat" "96⤵
- Executes a command shell one-liner
PID:2352 -
C:\windows\SVZH.exeC:\windows\SVZH.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GAFEA.exe.bat" "98⤵PID:3532
-
C:\windows\SysWOW64\GAFEA.exeC:\windows\system32\GAFEA.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JOKODZJ.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5736 -
C:\windows\JOKODZJ.exeC:\windows\JOKODZJ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLDQJO.exe.bat" "102⤵
- Executes a command shell one-liner
PID:1268 -
C:\windows\system\DLDQJO.exeC:\windows\system\DLDQJO.exe103⤵
- Executes dropped EXE
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JML.exe.bat" "104⤵PID:3292
-
C:\windows\JML.exeC:\windows\JML.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AMNJ.exe.bat" "106⤵PID:4176
-
C:\windows\SysWOW64\AMNJ.exeC:\windows\system32\AMNJ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ECTR.exe.bat" "108⤵
- Executes a command shell one-liner
PID:1856 -
C:\windows\ECTR.exeC:\windows\ECTR.exe109⤵
- Executes dropped EXE
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPYAS.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5992 -
C:\windows\system\ZPYAS.exeC:\windows\system\ZPYAS.exe111⤵
- Executes dropped EXE
PID:3240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDDJCFU.exe.bat" "112⤵PID:4264
-
C:\windows\system\TDDJCFU.exeC:\windows\system\TDDJCFU.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQIT.exe.bat" "114⤵PID:1580
-
C:\windows\OQIT.exeC:\windows\OQIT.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWOQ.exe.bat" "116⤵
- Executes a command shell one-liner
PID:2768 -
C:\windows\SysWOW64\KWOQ.exeC:\windows\system32\KWOQ.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UTT.exe.bat" "118⤵PID:1308
-
C:\windows\UTT.exeC:\windows\UTT.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QBVSEWP.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3832 -
C:\windows\SysWOW64\QBVSEWP.exeC:\windows\system32\QBVSEWP.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-