Analysis
- max time kernel
89s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 22:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-05_6ae92f63729fe91900db164c1985bd4d_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-05_6ae92f63729fe91900db164c1985bd4d_elex_emotet_stop.exe
- Size 208KB
- Sample261006-2g543syshx
- SHA256 ed0b9dd73fae6ca4d40e0e46d8850f4cca2deeac52bd60c9794621ee387d1a09
- MD5 6ae92f63729fe91900db164c1985bd4d
- SHA1 281f6a8cc0a3a44a58ce041e50f08c9f455bea1c
- SHA512 48cb2dbc0650cef937a885b15c7fc8681c2b44df0f9be53ef383a8790413840b4c879ad675080c08ee7b004dbc6ba5cf99366ef656b9237cb5e19f273f90f193
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFliKL+LOf04pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFliS+LO8kEj1
- TLSH T140247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5524 QQUIR.exe 2272 CBRO.exe 3572 PMOTT.exe 1908 EUP.exe 2684 FXSON.exe 2540 KXACWMJ.exe 5668 UGC.exe 4184 AGKVJL.exe 3044 SBNZW.exe 5812 WRCZBUK.exe 4336 XUGC.exe 5744 QPK.exe 4900 VPR.exe 4140 NYTROZ.exe 4412 WYN.exe 3904 RLSN.exe 6076 GOKSNRY.exe 4552 ACOB.exe 1708 VPLLZR.exe 2336 KFUK.exe 3836 OVBKSXM.exe 4980 RIGT.exe 1148 PJNPMZ.exe 2836 EZOGSUR.exe 4324 ZMTQ.exe 4792 KEOJD.exe 4880 QFWWUWW.exe 5196 UNCEY.exe 1384 GDREKGG.exe 1188 EYIFP.exe 1504 IGXNBBS.exe 3088 IJBJ.exe 3796 MRHRTKI.exe 5724 EAJWW.exe 4188 YNOFHHG.exe 1996 HAY.exe 5012 CNDH.exe 4460 TWX.exe 724 MRJQQ.exe 1468 SRJDZTO.exe 1828 DKM.exe 5088 YXRGR.exe 2404 KNXGDTO.exe 6128 KTX.exe 200 OJEUR.exe 1116 MTHK.exe 2140 JZNH.exe 5904 NHT.exe 3364 HUYZV.exe 4248 JSZT.exe 5100 AIY.exe 3016 IAHXTS.exe 2488 TTKQCAZ.exe 3416 EMF.exe 1604 BRK.exe 5784 KSML.exe 2912 QSUZDR.exe 2308 WSC.exe 728 KYA.exe 3236 SDAYDI.exe 3012 EWDJL.exe 760 NJN.exe 1308 HWSKD.exe 5948 ZXUXPR.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\KNXGDTO.exe YXRGR.exe File opened for modification C:\windows\SysWOW64\EEIREJ.exe PHKUX.exe File created C:\windows\SysWOW64\GKV.exe.bat BKNHTS.exe File created C:\windows\SysWOW64\VPR.exe QPK.exe File created C:\windows\SysWOW64\HAY.exe.bat YNOFHHG.exe File opened for modification C:\windows\SysWOW64\OJEUR.exe KTX.exe File created C:\windows\SysWOW64\EMF.exe.bat TTKQCAZ.exe File created C:\windows\SysWOW64\NJN.exe EWDJL.exe File created C:\windows\SysWOW64\ULR.exe.bat AXMTCA.exe File created C:\windows\SysWOW64\DJGDE.exe.bat SQL.exe File created C:\windows\SysWOW64\NYTROZ.exe VPR.exe File opened for modification C:\windows\SysWOW64\GOKSNRY.exe RLSN.exe File created C:\windows\SysWOW64\MTHK.exe.bat OJEUR.exe File opened for modification C:\windows\SysWOW64\BBIQUU.exe BIAOGI.exe File created C:\windows\SysWOW64\XSANM.exe HPRABIA.exe File opened for modification C:\windows\SysWOW64\XSANM.exe HPRABIA.exe File opened for modification C:\windows\SysWOW64\NYTROZ.exe VPR.exe File created C:\windows\SysWOW64\VOF.exe.bat BBIQUU.exe File created C:\windows\SysWOW64\BUNBPB.exe HHIS.exe File created C:\windows\SysWOW64\AAHNYVW.exe.bat XSANM.exe File created C:\windows\SysWOW64\SBNZW.exe AGKVJL.exe File opened for modification C:\windows\SysWOW64\ULR.exe AXMTCA.exe File created C:\windows\SysWOW64\GDREKGG.exe UNCEY.exe File created C:\windows\SysWOW64\YXRGR.exe DKM.exe File created C:\windows\SysWOW64\AAHNYVW.exe XSANM.exe File created C:\windows\SysWOW64\JZNH.exe MTHK.exe File opened for modification C:\windows\SysWOW64\KTADHZ.exe LYBCC.exe File created C:\windows\SysWOW64\TWEJ.exe.bat SSANJ.exe File created C:\windows\SysWOW64\ZMTQ.exe.bat EZOGSUR.exe File created C:\windows\SysWOW64\EEIREJ.exe.bat PHKUX.exe File created C:\windows\SysWOW64\JPN.exe PBJWML.exe File created C:\windows\SysWOW64\XSANM.exe.bat HPRABIA.exe File opened for modification C:\windows\SysWOW64\YXRGR.exe DKM.exe File created C:\windows\SysWOW64\MTHK.exe OJEUR.exe File opened for modification C:\windows\SysWOW64\TWEJ.exe SSANJ.exe File created C:\windows\SysWOW64\WYN.exe.bat NYTROZ.exe File created C:\windows\SysWOW64\TTKQCAZ.exe IAHXTS.exe File created C:\windows\SysWOW64\KTADHZ.exe LYBCC.exe File opened for modification C:\windows\SysWOW64\AAHNYVW.exe XSANM.exe File created C:\windows\SysWOW64\AAJLV.exe FNE.exe File created C:\windows\SysWOW64\CBRO.exe.bat QQUIR.exe File opened for modification C:\windows\SysWOW64\EWDJL.exe SDAYDI.exe File opened for modification C:\windows\SysWOW64\DJGDE.exe SQL.exe File created C:\windows\SysWOW64\VOMW.exe.bat AAHNYVW.exe File opened for modification C:\windows\SysWOW64\ZMTQ.exe EZOGSUR.exe File created C:\windows\SysWOW64\GOKSNRY.exe.bat RLSN.exe File opened for modification C:\windows\SysWOW64\TTKQCAZ.exe IAHXTS.exe File opened for modification C:\windows\SysWOW64\AAJLV.exe FNE.exe File opened for modification C:\windows\SysWOW64\NJN.exe EWDJL.exe File created C:\windows\SysWOW64\KNXGDTO.exe YXRGR.exe File opened for modification C:\windows\SysWOW64\VOF.exe BBIQUU.exe File created C:\windows\SysWOW64\JPN.exe.bat PBJWML.exe File created C:\windows\SysWOW64\YXRGR.exe.bat DKM.exe File created C:\windows\SysWOW64\NJN.exe.bat EWDJL.exe File created C:\windows\SysWOW64\TDZAF.exe.bat VCS.exe File opened for modification C:\windows\SysWOW64\DVTGLJ.exe DQBRJ.exe File created C:\windows\SysWOW64\DVTGLJ.exe.bat DQBRJ.exe File created C:\windows\SysWOW64\QQN.exe WCQNRW.exe File created C:\windows\SysWOW64\GOKSNRY.exe RLSN.exe File created C:\windows\SysWOW64\ACOB.exe GOKSNRY.exe File created C:\windows\SysWOW64\HWSKD.exe NJN.exe File opened for modification C:\windows\SysWOW64\BKNHTS.exe EEIREJ.exe File opened for modification C:\windows\SysWOW64\KTX.exe KNXGDTO.exe File created C:\windows\SysWOW64\OJEUR.exe.bat KTX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\QQUIR.exe 2026-10-05_6ae92f63729fe91900db164c1985bd4d_elex_emotet_stop.exe File created C:\windows\FXSON.exe EUP.exe File created C:\windows\system\YNOFHHG.exe EAJWW.exe File created C:\windows\system\TWX.exe.bat CNDH.exe File opened for modification C:\windows\KSML.exe BRK.exe File created C:\windows\WNUQUD.exe.bat KUZX.exe File created C:\windows\PBJWML.exe.bat DJGDE.exe File created C:\windows\NBTIK.exe WQVKK.exe File opened for modification C:\windows\LYBCC.exe ULR.exe File opened for modification C:\windows\DQBRJ.exe GKV.exe File created C:\windows\BXPS.exe.bat JPN.exe File opened for modification C:\windows\OEHXB.exe QEA.exe File opened for modification C:\windows\system\KXACWMJ.exe FXSON.exe File opened for modification C:\windows\system\IJBJ.exe IGXNBBS.exe File created C:\windows\system\NHT.exe JZNH.exe File created C:\windows\QQUIR.exe.bat 2026-10-05_6ae92f63729fe91900db164c1985bd4d_elex_emotet_stop.exe File created C:\windows\QPPVYL.exe FWMC.exe File opened for modification C:\windows\system\DKM.exe SRJDZTO.exe File opened for modification C:\windows\system\IAHXTS.exe AIY.exe File opened for modification C:\windows\NBTIK.exe WQVKK.exe File created C:\windows\KSML.exe.bat BRK.exe File created C:\windows\system\DSOEVQ.exe BUNBPB.exe File created C:\windows\SSANJ.exe WNUQUD.exe File created C:\windows\system\KXACWMJ.exe FXSON.exe File created C:\windows\system\BMLJY.exe VBHD.exe File opened for modification C:\windows\VPLLZR.exe ACOB.exe File opened for modification C:\windows\system\MRJQQ.exe TWX.exe File created C:\windows\system\ZXUXPR.exe.bat HWSKD.exe File opened for modification C:\windows\EITVF.exe PDNH.exe File created C:\windows\OEHXB.exe.bat QEA.exe File opened for modification C:\windows\QPPVYL.exe FWMC.exe File created C:\windows\VPLLZR.exe ACOB.exe File opened for modification C:\windows\system\TWX.exe CNDH.exe File opened for modification C:\windows\system\NUSJDBG.exe BMLJY.exe File opened for modification C:\windows\system\WPYI.exe KWV.exe File created C:\windows\PMOTT.exe.bat CBRO.exe File created C:\windows\OVBKSXM.exe KFUK.exe File opened for modification C:\windows\OVBKSXM.exe KFUK.exe File created C:\windows\SRJDZTO.exe MRJQQ.exe File created C:\windows\system\HUYZV.exe NHT.exe File created C:\windows\SDAYDI.exe.bat KYA.exe File created C:\windows\LYBCC.exe ULR.exe File opened for modification C:\windows\KUZX.exe NUSJDBG.exe File created C:\windows\WSC.exe QSUZDR.exe File created C:\windows\PBJWML.exe DJGDE.exe File created C:\windows\system\KKNUJ.exe OEHXB.exe File created C:\windows\system\RLSN.exe WYN.exe File created C:\windows\KFUK.exe.bat VPLLZR.exe File opened for modification C:\windows\EYIFP.exe GDREKGG.exe File opened for modification C:\windows\system\BMLJY.exe VBHD.exe File created C:\windows\WNUQUD.exe KUZX.exe File opened for modification C:\windows\QPK.exe XUGC.exe File created C:\windows\system\RIGT.exe OVBKSXM.exe File created C:\windows\system\PJNPMZ.exe.bat RIGT.exe File created C:\windows\UNCEY.exe.bat QFWWUWW.exe File created C:\windows\system\AXMTCA.exe DSOEVQ.exe File created C:\windows\system\PHKUX.exe HTKG.exe File created C:\windows\system\TBB.exe.bat NBTIK.exe File created C:\windows\system\WPYI.exe.bat KWV.exe File created C:\windows\system\ZXUXPR.exe HWSKD.exe File created C:\windows\QPPVYL.exe.bat FWMC.exe File created C:\windows\system\BMLJY.exe.bat VBHD.exe File created C:\windows\SQL.exe DVTGLJ.exe File created C:\windows\WQVKK.exe QQN.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1768 cmd.exe 3224 cmd.exe 3296 cmd.exe 444 cmd.exe 5836 cmd.exe 3100 cmd.exe 3180 cmd.exe 2064 cmd.exe 2036 cmd.exe 3404 cmd.exe 2600 cmd.exe 3956 cmd.exe 4908 cmd.exe 1852 cmd.exe 2388 cmd.exe 1224 cmd.exe 3464 cmd.exe 1284 cmd.exe 2652 cmd.exe 5172 cmd.exe 3352 cmd.exe 2084 cmd.exe 4384 cmd.exe 3456 cmd.exe 4124 cmd.exe 4928 cmd.exe 2764 cmd.exe 2788 cmd.exe 3676 cmd.exe 2772 cmd.exe 3552 cmd.exe 1512 cmd.exe 1268 cmd.exe 4320 cmd.exe 3764 cmd.exe 1088 cmd.exe 4640 cmd.exe 5032 cmd.exe 5632 cmd.exe 1412 cmd.exe 2252 cmd.exe 3924 cmd.exe 5940 cmd.exe 4436 cmd.exe 4604 cmd.exe 5536 cmd.exe 3512 cmd.exe 4892 cmd.exe 4860 cmd.exe 720 cmd.exe 1704 cmd.exe 2088 cmd.exe 3328 cmd.exe 3284 cmd.exe 5156 cmd.exe 5152 cmd.exe 3392 cmd.exe 4456 cmd.exe 2676 cmd.exe 2012 cmd.exe 5500 cmd.exe 4508 cmd.exe 3036 cmd.exe 4848 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2000 4864 WerFault.exe 87 5260 5524 WerFault.exe 93 3424 2272 WerFault.exe 99 3916 3572 WerFault.exe 104 4128 1908 WerFault.exe 109 1984 2684 WerFault.exe 114 2700 2540 WerFault.exe 119 4200 5668 WerFault.exe 124 5932 4184 WerFault.exe 129 1828 3044 WerFault.exe 134 2036 5812 WerFault.exe 139 5916 4336 WerFault.exe 144 6108 5744 WerFault.exe 149 2744 4900 WerFault.exe 154 2596 4140 WerFault.exe 159 3484 4412 WerFault.exe 164 1172 3904 WerFault.exe 169 1364 6076 WerFault.exe 174 2768 4552 WerFault.exe 179 6028 1708 WerFault.exe 184 3012 2336 WerFault.exe 189 5992 3836 WerFault.exe 194 3600 4980 WerFault.exe 199 1348 1148 WerFault.exe 204 4404 2836 WerFault.exe 209 2252 4324 WerFault.exe 214 1212 4792 WerFault.exe 219 5704 4880 WerFault.exe 224 5824 5196 WerFault.exe 229 4124 1384 WerFault.exe 234 4528 1188 WerFault.exe 239 4572 1504 WerFault.exe 244 252 3088 WerFault.exe 249 1304 3796 WerFault.exe 254 1436 5724 WerFault.exe 259 2232 4188 WerFault.exe 264 4968 1996 WerFault.exe 269 1600 5012 WerFault.exe 274 1228 4460 WerFault.exe 279 4468 724 WerFault.exe 284 1112 1468 WerFault.exe 289 5020 1828 WerFault.exe 294 5664 5088 WerFault.exe 299 4196 2404 WerFault.exe 304 2076 6128 WerFault.exe 309 2596 200 WerFault.exe 314 5284 1116 WerFault.exe 318 5008 2140 WerFault.exe 324 5688 5904 WerFault.exe 329 3444 3364 WerFault.exe 334 1112 4248 WerFault.exe 338 1144 5100 WerFault.exe 344 4956 3016 WerFault.exe 349 5364 2488 WerFault.exe 354 1304 3416 WerFault.exe 358 4000 1604 WerFault.exe 364 2600 5784 WerFault.exe 369 1364 2912 WerFault.exe 374 4268 2308 WerFault.exe 379 3596 728 WerFault.exe 384 368 3236 WerFault.exe 389 412 3012 WerFault.exe 394 1864 760 WerFault.exe 399 1176 1308 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSUZDR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRJDZTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXRGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSML.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPLLZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EITVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEIREJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUZX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EUP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBIQUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWDJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKNUJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAHNYVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XSANM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQVKK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EZOGSUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSANJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKNHTS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KEOJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNDH.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4864 2026-10-05_6ae92f63729fe91900db164c1985bd4d_elex_emotet_stop.exe 4864 2026-10-05_6ae92f63729fe91900db164c1985bd4d_elex_emotet_stop.exe 5524 QQUIR.exe 5524 QQUIR.exe 2272 CBRO.exe 2272 CBRO.exe 3572 PMOTT.exe 3572 PMOTT.exe 1908 EUP.exe 1908 EUP.exe 2684 FXSON.exe 2684 FXSON.exe 2540 KXACWMJ.exe 2540 KXACWMJ.exe 5668 UGC.exe 5668 UGC.exe 4184 AGKVJL.exe 4184 AGKVJL.exe 3044 SBNZW.exe 3044 SBNZW.exe 5812 WRCZBUK.exe 5812 WRCZBUK.exe 4336 XUGC.exe 4336 XUGC.exe 5744 QPK.exe 5744 QPK.exe 4900 VPR.exe 4900 VPR.exe 4140 NYTROZ.exe 4140 NYTROZ.exe 4412 WYN.exe 4412 WYN.exe 3904 RLSN.exe 3904 RLSN.exe 6076 GOKSNRY.exe 6076 GOKSNRY.exe 4552 ACOB.exe 4552 ACOB.exe 1708 VPLLZR.exe 1708 VPLLZR.exe 2336 KFUK.exe 2336 KFUK.exe 3836 OVBKSXM.exe 3836 OVBKSXM.exe 4980 RIGT.exe 4980 RIGT.exe 1148 PJNPMZ.exe 1148 PJNPMZ.exe 2836 EZOGSUR.exe 2836 EZOGSUR.exe 4324 ZMTQ.exe 4324 ZMTQ.exe 4792 KEOJD.exe 4792 KEOJD.exe 4880 QFWWUWW.exe 4880 QFWWUWW.exe 5196 UNCEY.exe 5196 UNCEY.exe 1384 GDREKGG.exe 1384 GDREKGG.exe 1188 EYIFP.exe 1188 EYIFP.exe 1504 IGXNBBS.exe 1504 IGXNBBS.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4864 2026-10-05_6ae92f63729fe91900db164c1985bd4d_elex_emotet_stop.exe 4864 2026-10-05_6ae92f63729fe91900db164c1985bd4d_elex_emotet_stop.exe 5524 QQUIR.exe 5524 QQUIR.exe 2272 CBRO.exe 2272 CBRO.exe 3572 PMOTT.exe 3572 PMOTT.exe 1908 EUP.exe 1908 EUP.exe 2684 FXSON.exe 2684 FXSON.exe 2540 KXACWMJ.exe 2540 KXACWMJ.exe 5668 UGC.exe 5668 UGC.exe 4184 AGKVJL.exe 4184 AGKVJL.exe 3044 SBNZW.exe 3044 SBNZW.exe 5812 WRCZBUK.exe 5812 WRCZBUK.exe 4336 XUGC.exe 4336 XUGC.exe 5744 QPK.exe 5744 QPK.exe 4900 VPR.exe 4900 VPR.exe 4140 NYTROZ.exe 4140 NYTROZ.exe 4412 WYN.exe 4412 WYN.exe 3904 RLSN.exe 3904 RLSN.exe 6076 GOKSNRY.exe 6076 GOKSNRY.exe 4552 ACOB.exe 4552 ACOB.exe 1708 VPLLZR.exe 1708 VPLLZR.exe 2336 KFUK.exe 2336 KFUK.exe 3836 OVBKSXM.exe 3836 OVBKSXM.exe 4980 RIGT.exe 4980 RIGT.exe 1148 PJNPMZ.exe 1148 PJNPMZ.exe 2836 EZOGSUR.exe 2836 EZOGSUR.exe 4324 ZMTQ.exe 4324 ZMTQ.exe 4792 KEOJD.exe 4792 KEOJD.exe 4880 QFWWUWW.exe 4880 QFWWUWW.exe 5196 UNCEY.exe 5196 UNCEY.exe 1384 GDREKGG.exe 1384 GDREKGG.exe 1188 EYIFP.exe 1188 EYIFP.exe 1504 IGXNBBS.exe 1504 IGXNBBS.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4864 wrote to memory of 3352 4864 2026-10-05_6ae92f63729fe91900db164c1985bd4d_elex_emotet_stop.exe 89 PID 3352 wrote to memory of 5524 3352 cmd.exe 93 PID 5524 wrote to memory of 5612 5524 QQUIR.exe 95 PID 5612 wrote to memory of 2272 5612 cmd.exe 99 PID 2272 wrote to memory of 3760 2272 CBRO.exe 100 PID 3760 wrote to memory of 3572 3760 cmd.exe 104 PID 3572 wrote to memory of 4972 3572 PMOTT.exe 105 PID 4972 wrote to memory of 1908 4972 cmd.exe 109 PID 1908 wrote to memory of 5392 1908 EUP.exe 110 PID 5392 wrote to memory of 2684 5392 cmd.exe 114 PID 2684 wrote to memory of 3744 2684 FXSON.exe 115 PID 3744 wrote to memory of 2540 3744 cmd.exe 119 PID 2540 wrote to memory of 1704 2540 KXACWMJ.exe 120 PID 1704 wrote to memory of 5668 1704 cmd.exe 124 PID 5668 wrote to memory of 3764 5668 UGC.exe 125 PID 3764 wrote to memory of 4184 3764 cmd.exe 129 PID 4184 wrote to memory of 1224 4184 AGKVJL.exe 130 PID 1224 wrote to memory of 3044 1224 cmd.exe 134 PID 3044 wrote to memory of 4292 3044 SBNZW.exe 135 PID 4292 wrote to memory of 5812 4292 cmd.exe 139 PID 5812 wrote to memory of 5940 5812 WRCZBUK.exe 140 PID 5940 wrote to memory of 4336 5940 cmd.exe 144 PID 4336 wrote to memory of 2352 4336 XUGC.exe 145 PID 2352 wrote to memory of 5744 2352 cmd.exe 149 PID 5744 wrote to memory of 4836 5744 QPK.exe 150 PID 4836 wrote to memory of 4900 4836 cmd.exe 154 PID 4900 wrote to memory of 3180 4900 VPR.exe 155 PID 3180 wrote to memory of 4140 3180 cmd.exe 159 PID 4140 wrote to memory of 2072 4140 NYTROZ.exe 160 PID 2072 wrote to memory of 4412 2072 cmd.exe 164 PID 4412 wrote to memory of 5748 4412 WYN.exe 165 PID 5748 wrote to memory of 3904 5748 cmd.exe 169 PID 3904 wrote to memory of 3464 3904 RLSN.exe 170 PID 3464 wrote to memory of 6076 3464 cmd.exe 174 PID 6076 wrote to memory of 3768 6076 GOKSNRY.exe 175 PID 3768 wrote to memory of 4552 3768 cmd.exe 179 PID 4552 wrote to memory of 2764 4552 ACOB.exe 180 PID 2764 wrote to memory of 1708 2764 cmd.exe 184 PID 1708 wrote to memory of 3040 1708 VPLLZR.exe 185 PID 3040 wrote to memory of 2336 3040 cmd.exe 189 PID 2336 wrote to memory of 4436 2336 KFUK.exe 190 PID 4436 wrote to memory of 3836 4436 cmd.exe 194 PID 3836 wrote to memory of 5652 3836 OVBKSXM.exe 195 PID 5652 wrote to memory of 4980 5652 cmd.exe 199 PID 4980 wrote to memory of 3360 4980 RIGT.exe 200 PID 3360 wrote to memory of 1148 3360 cmd.exe 204 PID 1148 wrote to memory of 2084 1148 PJNPMZ.exe 205 PID 2084 wrote to memory of 2836 2084 cmd.exe 209 PID 2836 wrote to memory of 3076 2836 EZOGSUR.exe 210 PID 3076 wrote to memory of 4324 3076 cmd.exe 214 PID 4324 wrote to memory of 1376 4324 ZMTQ.exe 215 PID 1376 wrote to memory of 4792 1376 cmd.exe 219 PID 4792 wrote to memory of 2064 4792 KEOJD.exe 220 PID 2064 wrote to memory of 4880 2064 cmd.exe 224 PID 4880 wrote to memory of 1588 4880 QFWWUWW.exe 225 PID 1588 wrote to memory of 5196 1588 cmd.exe 229 PID 5196 wrote to memory of 2320 5196 UNCEY.exe 230 PID 2320 wrote to memory of 1384 2320 cmd.exe 234 PID 1384 wrote to memory of 1768 1384 GDREKGG.exe 235 PID 1768 wrote to memory of 1188 1768 cmd.exe 239 PID 1188 wrote to memory of 1508 1188 EYIFP.exe 240 PID 1508 wrote to memory of 1504 1508 cmd.exe 244 PID 1504 wrote to memory of 4908 1504 IGXNBBS.exe 245 PID 4908 wrote to memory of 3088 4908 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_6ae92f63729fe91900db164c1985bd4d_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_6ae92f63729fe91900db164c1985bd4d_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QQUIR.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\windows\QQUIR.exeC:\windows\QQUIR.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CBRO.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\windows\SysWOW64\CBRO.exeC:\windows\system32\CBRO.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMOTT.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\windows\PMOTT.exeC:\windows\PMOTT.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EUP.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\windows\system\EUP.exeC:\windows\system\EUP.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXSON.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\windows\FXSON.exeC:\windows\FXSON.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KXACWMJ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\windows\system\KXACWMJ.exeC:\windows\system\KXACWMJ.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGC.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\windows\system\UGC.exeC:\windows\system\UGC.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGKVJL.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\windows\AGKVJL.exeC:\windows\AGKVJL.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SBNZW.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\windows\SysWOW64\SBNZW.exeC:\windows\system32\SBNZW.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRCZBUK.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\windows\system\WRCZBUK.exeC:\windows\system\WRCZBUK.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUGC.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\windows\system\XUGC.exeC:\windows\system\XUGC.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPK.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\windows\QPK.exeC:\windows\QPK.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPR.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\windows\SysWOW64\VPR.exeC:\windows\system32\VPR.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYTROZ.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\windows\SysWOW64\NYTROZ.exeC:\windows\system32\NYTROZ.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYN.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\windows\SysWOW64\WYN.exeC:\windows\system32\WYN.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLSN.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\windows\system\RLSN.exeC:\windows\system\RLSN.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GOKSNRY.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\windows\SysWOW64\GOKSNRY.exeC:\windows\system32\GOKSNRY.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACOB.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\windows\SysWOW64\ACOB.exeC:\windows\system32\ACOB.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPLLZR.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\windows\VPLLZR.exeC:\windows\VPLLZR.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KFUK.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\windows\KFUK.exeC:\windows\KFUK.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OVBKSXM.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\windows\OVBKSXM.exeC:\windows\OVBKSXM.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RIGT.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\windows\system\RIGT.exeC:\windows\system\RIGT.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJNPMZ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\windows\system\PJNPMZ.exeC:\windows\system\PJNPMZ.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EZOGSUR.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\windows\system\EZOGSUR.exeC:\windows\system\EZOGSUR.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZMTQ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\windows\SysWOW64\ZMTQ.exeC:\windows\system32\ZMTQ.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KEOJD.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\windows\system\KEOJD.exeC:\windows\system\KEOJD.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QFWWUWW.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\windows\QFWWUWW.exeC:\windows\QFWWUWW.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UNCEY.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\windows\UNCEY.exeC:\windows\UNCEY.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GDREKGG.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\windows\SysWOW64\GDREKGG.exeC:\windows\system32\GDREKGG.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EYIFP.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\windows\EYIFP.exeC:\windows\EYIFP.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IGXNBBS.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\windows\IGXNBBS.exeC:\windows\IGXNBBS.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IJBJ.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\windows\system\IJBJ.exeC:\windows\system\IJBJ.exe65⤵
- Executes dropped EXE
PID:3088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRHRTKI.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2036 -
C:\windows\system\MRHRTKI.exeC:\windows\system\MRHRTKI.exe67⤵
- Executes dropped EXE
PID:3796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EAJWW.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:5920 -
C:\windows\SysWOW64\EAJWW.exeC:\windows\system32\EAJWW.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNOFHHG.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:1428 -
C:\windows\system\YNOFHHG.exeC:\windows\system\YNOFHHG.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HAY.exe.bat" "72⤵PID:1752
-
C:\windows\SysWOW64\HAY.exeC:\windows\system32\HAY.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNDH.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:3368 -
C:\windows\CNDH.exeC:\windows\CNDH.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWX.exe.bat" "76⤵PID:2968
-
C:\windows\system\TWX.exeC:\windows\system\TWX.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRJQQ.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:240 -
C:\windows\system\MRJQQ.exeC:\windows\system\MRJQQ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SRJDZTO.exe.bat" "80⤵PID:5084
-
C:\windows\SRJDZTO.exeC:\windows\SRJDZTO.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKM.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:4440 -
C:\windows\system\DKM.exeC:\windows\system\DKM.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXRGR.exe.bat" "84⤵PID:1712
-
C:\windows\SysWOW64\YXRGR.exeC:\windows\system32\YXRGR.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNXGDTO.exe.bat" "86⤵PID:800
-
C:\windows\SysWOW64\KNXGDTO.exeC:\windows\system32\KNXGDTO.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KTX.exe.bat" "88⤵PID:2840
-
C:\windows\SysWOW64\KTX.exeC:\windows\system32\KTX.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OJEUR.exe.bat" "90⤵PID:5276
-
C:\windows\SysWOW64\OJEUR.exeC:\windows\system32\OJEUR.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MTHK.exe.bat" "92⤵PID:4296
-
C:\windows\SysWOW64\MTHK.exeC:\windows\system32\MTHK.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JZNH.exe.bat" "94⤵PID:5072
-
C:\windows\SysWOW64\JZNH.exeC:\windows\system32\JZNH.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHT.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4752 -
C:\windows\system\NHT.exeC:\windows\system\NHT.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HUYZV.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3404 -
C:\windows\system\HUYZV.exeC:\windows\system\HUYZV.exe99⤵
- Executes dropped EXE
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JSZT.exe.bat" "100⤵PID:2448
-
C:\windows\JSZT.exeC:\windows\JSZT.exe101⤵
- Executes dropped EXE
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AIY.exe.bat" "102⤵PID:3824
-
C:\windows\AIY.exeC:\windows\AIY.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IAHXTS.exe.bat" "104⤵PID:4812
-
C:\windows\system\IAHXTS.exeC:\windows\system\IAHXTS.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTKQCAZ.exe.bat" "106⤵PID:1924
-
C:\windows\SysWOW64\TTKQCAZ.exeC:\windows\system32\TTKQCAZ.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EMF.exe.bat" "108⤵PID:4724
-
C:\windows\SysWOW64\EMF.exeC:\windows\system32\EMF.exe109⤵
- Executes dropped EXE
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BRK.exe.bat" "110⤵PID:3112
-
C:\windows\BRK.exeC:\windows\BRK.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KSML.exe.bat" "112⤵
- Executes a command shell one-liner
PID:1088 -
C:\windows\KSML.exeC:\windows\KSML.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QSUZDR.exe.bat" "114⤵PID:3644
-
C:\windows\system\QSUZDR.exeC:\windows\system\QSUZDR.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WSC.exe.bat" "116⤵PID:4748
-
C:\windows\WSC.exeC:\windows\WSC.exe117⤵
- Executes dropped EXE
PID:2308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYA.exe.bat" "118⤵PID:528
-
C:\windows\system\KYA.exeC:\windows\system\KYA.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SDAYDI.exe.bat" "120⤵PID:4120
-
C:\windows\SDAYDI.exeC:\windows\SDAYDI.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-