Analysis
- max time kernel
78s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 21:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-10_0a660293e1e283ccec84deaf27c15a34_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-10_0a660293e1e283ccec84deaf27c15a34_elex_emotet_stop.exe
- Size 208KB
- Sample261011-1spqsshf55
- SHA256 26fc53fa68a92848aec71299a5a9692c1096b327979206bac71e23e6b64560a6
- MD5 0a660293e1e283ccec84deaf27c15a34
- SHA1 f8c36365bfac741ab4a4378889f19b6ef6e5a052
- SHA512 81a1e1ba0fdf77064cf7e7e08d0f3ab6d5b57c5aab6c987c0e9360d1c7eaa40805f3d52f9e19ceac1c3fd256519c84f984668e00bbca11fa05252e7db0fcc37c
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFleKL+LOf44pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFleS+LOAkEj1
- TLSH T1EC247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4456 HAW.exe 4136 HVOIAHG.exe 1840 YDDOEYJ.exe 4180 HEFT.exe 3416 NEMGZX.exe 3824 RUT.exe 4508 CNWZT.exe 4660 UNQEXC.exe 372 WLEZE.exe 1616 QYIIPLP.exe 3648 GBSUA.exe 4764 BZSY.exe 1352 YEKNSEC.exe 2840 CHIIZ.exe 5788 GXPIMQS.exe 2252 QVUDTYB.exe 2860 ZVW.exe 3280 XTQLKBL.exe 5008 WESBSP.exe 5400 TECDE.exe 5544 FNJL.exe 5984 MDKDPY.exe 2580 RIUSFU.exe 2968 GYD.exe 1852 XJGHVVH.exe 4468 VHRCI.exe 3560 BUQ.exe 4576 PFHCAO.exe 5416 RSM.exe 4824 MNIU.exe 5840 QVXCZYR.exe 4704 UYVQZ.exe 3692 YPCY.exe 2564 RHJJDLY.exe 3108 MUOS.exe 4796 VDQXQIP.exe 1156 OVGIA.exe 204 OBYWBW.exe 2032 ITNHTX.exe 5888 GEQXT.exe 6000 BZVHECS.exe 4440 FHBP.exe 4184 RXQPCFC.exe 2336 LLV.exe 5244 NIA.exe 3452 MTDJCBO.exe 3460 BJEAJ.exe 1756 REWMUJ.exe 5160 CXRFCRB.exe 2052 GNXFH.exe 2568 RGAYPQ.exe 4976 ODG.exe 3764 XLIA.exe 2984 YOM.exe 2728 HUWO.exe 4132 JSQQ.exe 1988 FXVN.exe 2352 LXDBZL.exe 3724 GLI.exe 6132 CQGHQ.exe 1412 AMFIVY.exe 5508 BHJE.exe 4252 HHQSK.exe 5968 JFEM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\ODG.exe.bat RGAYPQ.exe File created C:\windows\SysWOW64\BHJE.exe AMFIVY.exe File opened for modification C:\windows\SysWOW64\QWY.exe DYYI.exe File created C:\windows\SysWOW64\XURXAX.exe QWY.exe File opened for modification C:\windows\SysWOW64\KUJ.exe AWWJ.exe File created C:\windows\SysWOW64\NIA.exe.bat LLV.exe File opened for modification C:\windows\SysWOW64\GNXFH.exe CXRFCRB.exe File opened for modification C:\windows\SysWOW64\ODG.exe RGAYPQ.exe File created C:\windows\SysWOW64\YOM.exe.bat XLIA.exe File opened for modification C:\windows\SysWOW64\XURXAX.exe QWY.exe File opened for modification C:\windows\SysWOW64\SYIB.exe YLESFOD.exe File opened for modification C:\windows\SysWOW64\CVEL.exe JSAPMET.exe File created C:\windows\SysWOW64\CVEL.exe.bat JSAPMET.exe File created C:\windows\SysWOW64\GNXFH.exe CXRFCRB.exe File created C:\windows\SysWOW64\FXVN.exe.bat JSQQ.exe File created C:\windows\SysWOW64\JSAPMET.exe ZUN.exe File opened for modification C:\windows\SysWOW64\WDYN.exe BPTDLLE.exe File created C:\windows\SysWOW64\ZVILJ.exe VNB.exe File opened for modification C:\windows\SysWOW64\TECDE.exe WESBSP.exe File created C:\windows\SysWOW64\TECDE.exe.bat WESBSP.exe File opened for modification C:\windows\SysWOW64\VDQXQIP.exe MUOS.exe File opened for modification C:\windows\SysWOW64\FXVN.exe JSQQ.exe File created C:\windows\SysWOW64\KUJ.exe AWWJ.exe File opened for modification C:\windows\SysWOW64\TPNTM.exe KBDB.exe File opened for modification C:\windows\SysWOW64\HWHO.exe SBXKBP.exe File opened for modification C:\windows\SysWOW64\QYIIPLP.exe WLEZE.exe File created C:\windows\SysWOW64\QYIIPLP.exe.bat WLEZE.exe File opened for modification C:\windows\SysWOW64\FNJL.exe TECDE.exe File created C:\windows\SysWOW64\UYVQZ.exe QVXCZYR.exe File created C:\windows\SysWOW64\JSQQ.exe.bat HUWO.exe File opened for modification C:\windows\SysWOW64\BHJE.exe AMFIVY.exe File opened for modification C:\windows\SysWOW64\VALANWA.exe ANGRC.exe File opened for modification C:\windows\SysWOW64\DYYI.exe EOVSV.exe File created C:\windows\SysWOW64\NEMGZX.exe.bat HEFT.exe File opened for modification C:\windows\SysWOW64\QVUDTYB.exe GXPIMQS.exe File created C:\windows\SysWOW64\VHRCI.exe.bat XJGHVVH.exe File created C:\windows\SysWOW64\ODG.exe RGAYPQ.exe File created C:\windows\SysWOW64\YOM.exe XLIA.exe File opened for modification C:\windows\SysWOW64\YOM.exe XLIA.exe File created C:\windows\SysWOW64\AWWJ.exe GJRAWZN.exe File created C:\windows\SysWOW64\IWMZIO.exe CVEL.exe File created C:\windows\SysWOW64\NIA.exe LLV.exe File opened for modification C:\windows\SysWOW64\NIA.exe LLV.exe File created C:\windows\SysWOW64\GNXFH.exe.bat CXRFCRB.exe File created C:\windows\SysWOW64\QWY.exe DYYI.exe File created C:\windows\SysWOW64\SYIB.exe YLESFOD.exe File created C:\windows\SysWOW64\AWWJ.exe.bat GJRAWZN.exe File opened for modification C:\windows\SysWOW64\IWMZIO.exe CVEL.exe File opened for modification C:\windows\SysWOW64\ZVILJ.exe VNB.exe File created C:\windows\SysWOW64\WESBSP.exe XTQLKBL.exe File created C:\windows\SysWOW64\OVGIA.exe VDQXQIP.exe File created C:\windows\SysWOW64\JSQQ.exe HUWO.exe File created C:\windows\SysWOW64\WDYN.exe.bat BPTDLLE.exe File created C:\windows\SysWOW64\SBXKBP.exe.bat KOLVRQT.exe File created C:\windows\SysWOW64\HWHO.exe.bat SBXKBP.exe File created C:\windows\SysWOW64\DYYI.exe.bat EOVSV.exe File created C:\windows\SysWOW64\IWMZIO.exe.bat CVEL.exe File created C:\windows\SysWOW64\QBENKBZ.exe IWMZIO.exe File created C:\windows\SysWOW64\WESBSP.exe.bat XTQLKBL.exe File created C:\windows\SysWOW64\UYVQZ.exe.bat QVXCZYR.exe File created C:\windows\SysWOW64\OVGIA.exe.bat VDQXQIP.exe File created C:\windows\SysWOW64\FXVN.exe JSQQ.exe File created C:\windows\SysWOW64\QBENKBZ.exe.bat IWMZIO.exe File created C:\windows\SysWOW64\ZVILJ.exe.bat VNB.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\AMFIVY.exe CQGHQ.exe File created C:\windows\JFEM.exe HHQSK.exe File created C:\windows\IIYDSF.exe OQISBE.exe File created C:\windows\BPTDLLE.exe.bat QXQKDD.exe File opened for modification C:\windows\system\RSM.exe PFHCAO.exe File opened for modification C:\windows\system\FHBP.exe BZVHECS.exe File created C:\windows\system\REWMUJ.exe BJEAJ.exe File opened for modification C:\windows\system\VNB.exe WDYN.exe File created C:\windows\BZSY.exe.bat GBSUA.exe File opened for modification C:\windows\system\HVOIAHG.exe HAW.exe File opened for modification C:\windows\system\WLEZE.exe UNQEXC.exe File created C:\windows\system\YPCY.exe.bat UYVQZ.exe File created C:\windows\KBDB.exe.bat IOYRUKE.exe File created C:\windows\system\KOLVRQT.exe.bat ZVILJ.exe File created C:\windows\system\HVOIAHG.exe HAW.exe File opened for modification C:\windows\system\HEFT.exe YDDOEYJ.exe File opened for modification C:\windows\system\CXRFCRB.exe REWMUJ.exe File created C:\windows\system\HUWO.exe YOM.exe File created C:\windows\FHIMUW.exe.bat TPNTM.exe File opened for modification C:\windows\system\UNQEXC.exe CNWZT.exe File opened for modification C:\windows\system\MDKDPY.exe FNJL.exe File opened for modification C:\windows\system\CQGHQ.exe GLI.exe File created C:\windows\system\HHQSK.exe BHJE.exe File created C:\windows\system\GJRAWZN.exe.bat SYIB.exe File opened for modification C:\windows\QXQKDD.exe NBMB.exe File created C:\windows\system\KOLVRQT.exe ZVILJ.exe File created C:\windows\CNWZT.exe.bat RUT.exe File created C:\windows\QVXCZYR.exe.bat MNIU.exe File opened for modification C:\windows\MUOS.exe RHJJDLY.exe File created C:\windows\system\OBYWBW.exe OVGIA.exe File created C:\windows\IIYDSF.exe.bat OQISBE.exe File opened for modification C:\windows\CKMYXJ.exe HWHO.exe File created C:\windows\system\GXPIMQS.exe.bat CHIIZ.exe File created C:\windows\system\MNIU.exe.bat RSM.exe File created C:\windows\GEQXT.exe ITNHTX.exe File opened for modification C:\windows\system\XLIA.exe ODG.exe File created C:\windows\system\ANGRC.exe.bat JFEM.exe File opened for modification C:\windows\system\EOVSV.exe VALANWA.exe File created C:\windows\BXPS.exe.bat XURXAX.exe File created C:\windows\system\VNB.exe WDYN.exe File created C:\windows\CNWZT.exe RUT.exe File created C:\windows\BUQ.exe.bat VHRCI.exe File opened for modification C:\windows\system\YPCY.exe UYVQZ.exe File opened for modification C:\windows\system\OBYWBW.exe OVGIA.exe File created C:\windows\system\OBYWBW.exe.bat OVGIA.exe File created C:\windows\BXPS.exe XURXAX.exe File created C:\windows\system\IOYRUKE.exe IIYDSF.exe File created C:\windows\system\VNB.exe.bat WDYN.exe File opened for modification C:\windows\BUQ.exe VHRCI.exe File opened for modification C:\windows\QVXCZYR.exe MNIU.exe File created C:\windows\system\YPCY.exe UYVQZ.exe File created C:\windows\GLI.exe.bat LXDBZL.exe File created C:\windows\system\DVVFHY.exe.bat BXPS.exe File created C:\windows\YLESFOD.exe HDCNUR.exe File opened for modification C:\windows\KBDB.exe IOYRUKE.exe File created C:\windows\system\ZUN.exe.bat FHIMUW.exe File opened for modification C:\windows\system\YDDOEYJ.exe HVOIAHG.exe File created C:\windows\system\GXPIMQS.exe CHIIZ.exe File created C:\windows\RGAYPQ.exe.bat GNXFH.exe File created C:\windows\NBMB.exe QBENKBZ.exe File created C:\windows\system\FHBP.exe BZVHECS.exe File created C:\windows\system\CXRFCRB.exe REWMUJ.exe File opened for modification C:\windows\BZSY.exe GBSUA.exe File created C:\windows\system\YEKNSEC.exe.bat BZSY.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2524 cmd.exe 4816 cmd.exe 4648 cmd.exe 4552 cmd.exe 4800 cmd.exe 1372 cmd.exe 3904 cmd.exe 4728 cmd.exe 3740 cmd.exe 2776 cmd.exe 3924 cmd.exe 5916 cmd.exe 2544 cmd.exe 5636 cmd.exe 1312 cmd.exe 1072 cmd.exe 5900 cmd.exe 4264 cmd.exe 3876 cmd.exe 3712 cmd.exe 1772 cmd.exe 3032 cmd.exe 2680 cmd.exe 2276 cmd.exe 1888 cmd.exe 448 cmd.exe 4324 cmd.exe 4388 cmd.exe 2796 cmd.exe 5068 cmd.exe 6052 cmd.exe 2016 cmd.exe 5380 cmd.exe 5396 cmd.exe 1456 cmd.exe 4016 cmd.exe 6060 cmd.exe 5100 cmd.exe 5144 cmd.exe 2960 cmd.exe 3148 cmd.exe 1560 cmd.exe 2964 cmd.exe 5212 cmd.exe 2380 cmd.exe 4400 cmd.exe 3524 cmd.exe 5896 cmd.exe 4784 cmd.exe 3424 cmd.exe 4636 cmd.exe 1252 cmd.exe 5920 cmd.exe 4688 cmd.exe 4112 cmd.exe 4588 cmd.exe 2444 cmd.exe 1768 cmd.exe 2164 cmd.exe 1800 cmd.exe 4844 cmd.exe 1508 cmd.exe 3048 cmd.exe 3400 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4904 5620 WerFault.exe 87 2948 4456 WerFault.exe 92 5244 4136 WerFault.exe 98 2356 1840 WerFault.exe 103 5260 4180 WerFault.exe 108 4916 3416 WerFault.exe 113 6108 3824 WerFault.exe 118 5636 4508 WerFault.exe 123 4204 4660 WerFault.exe 128 4880 372 WerFault.exe 133 700 1616 WerFault.exe 138 1412 3648 WerFault.exe 143 6080 4764 WerFault.exe 148 5748 1352 WerFault.exe 153 3916 2840 WerFault.exe 158 1988 5788 WerFault.exe 163 4688 2252 WerFault.exe 168 5412 2860 WerFault.exe 173 304 3280 WerFault.exe 178 1040 5008 WerFault.exe 183 2800 5400 WerFault.exe 188 1196 5544 WerFault.exe 193 52 5984 WerFault.exe 198 2640 2580 WerFault.exe 203 3176 2968 WerFault.exe 208 3468 1852 WerFault.exe 213 4188 4468 WerFault.exe 218 2388 3560 WerFault.exe 223 1172 4576 WerFault.exe 228 5372 5416 WerFault.exe 233 4208 4824 WerFault.exe 238 2960 5840 WerFault.exe 243 5844 4704 WerFault.exe 248 2336 3692 WerFault.exe 253 5380 2564 WerFault.exe 258 1800 3108 WerFault.exe 263 5324 4796 WerFault.exe 268 5088 1156 WerFault.exe 274 2512 204 WerFault.exe 279 6048 2032 WerFault.exe 284 4204 5888 WerFault.exe 289 4328 6000 WerFault.exe 294 3372 4440 WerFault.exe 299 5516 4184 WerFault.exe 304 2072 2336 WerFault.exe 309 4132 5244 WerFault.exe 314 1308 3452 WerFault.exe 319 5088 3460 WerFault.exe 324 304 1756 WerFault.exe 329 5152 5160 WerFault.exe 334 6124 2052 WerFault.exe 339 5084 2568 WerFault.exe 344 5332 4976 WerFault.exe 349 4860 3764 WerFault.exe 354 5604 2984 WerFault.exe 359 5360 2728 WerFault.exe 364 4784 4132 WerFault.exe 369 5264 1988 WerFault.exe 374 4348 2352 WerFault.exe 379 4104 3724 WerFault.exe 384 840 6132 WerFault.exe 389 5848 1412 WerFault.exe 394 352 5508 WerFault.exe 399 5428 4252 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBXKBP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEFT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYIIPLP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIUSFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDDOEYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEMGZX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBSUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VHRCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TPNTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XTQLKBL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RXQPCFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DVVFHY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MDKDPY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SYIB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSAPMET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZVILJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVXCZYR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YLESFOD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CHIIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZVHECS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMFIVY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBENKBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVOIAHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MNIU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ITNHTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5620 2026-10-10_0a660293e1e283ccec84deaf27c15a34_elex_emotet_stop.exe 5620 2026-10-10_0a660293e1e283ccec84deaf27c15a34_elex_emotet_stop.exe 4456 HAW.exe 4456 HAW.exe 4136 HVOIAHG.exe 4136 HVOIAHG.exe 1840 YDDOEYJ.exe 1840 YDDOEYJ.exe 4180 HEFT.exe 4180 HEFT.exe 3416 NEMGZX.exe 3416 NEMGZX.exe 3824 RUT.exe 3824 RUT.exe 4508 CNWZT.exe 4508 CNWZT.exe 4660 UNQEXC.exe 4660 UNQEXC.exe 372 WLEZE.exe 372 WLEZE.exe 1616 QYIIPLP.exe 1616 QYIIPLP.exe 3648 GBSUA.exe 3648 GBSUA.exe 4764 BZSY.exe 4764 BZSY.exe 1352 YEKNSEC.exe 1352 YEKNSEC.exe 2840 CHIIZ.exe 2840 CHIIZ.exe 5788 GXPIMQS.exe 5788 GXPIMQS.exe 2252 QVUDTYB.exe 2252 QVUDTYB.exe 2860 ZVW.exe 2860 ZVW.exe 3280 XTQLKBL.exe 3280 XTQLKBL.exe 5008 WESBSP.exe 5008 WESBSP.exe 5400 TECDE.exe 5400 TECDE.exe 5544 FNJL.exe 5544 FNJL.exe 5984 MDKDPY.exe 5984 MDKDPY.exe 2580 RIUSFU.exe 2580 RIUSFU.exe 2968 GYD.exe 2968 GYD.exe 1852 XJGHVVH.exe 1852 XJGHVVH.exe 4468 VHRCI.exe 4468 VHRCI.exe 3560 BUQ.exe 3560 BUQ.exe 4576 PFHCAO.exe 4576 PFHCAO.exe 5416 RSM.exe 5416 RSM.exe 4824 MNIU.exe 4824 MNIU.exe 5840 QVXCZYR.exe 5840 QVXCZYR.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5620 2026-10-10_0a660293e1e283ccec84deaf27c15a34_elex_emotet_stop.exe 5620 2026-10-10_0a660293e1e283ccec84deaf27c15a34_elex_emotet_stop.exe 4456 HAW.exe 4456 HAW.exe 4136 HVOIAHG.exe 4136 HVOIAHG.exe 1840 YDDOEYJ.exe 1840 YDDOEYJ.exe 4180 HEFT.exe 4180 HEFT.exe 3416 NEMGZX.exe 3416 NEMGZX.exe 3824 RUT.exe 3824 RUT.exe 4508 CNWZT.exe 4508 CNWZT.exe 4660 UNQEXC.exe 4660 UNQEXC.exe 372 WLEZE.exe 372 WLEZE.exe 1616 QYIIPLP.exe 1616 QYIIPLP.exe 3648 GBSUA.exe 3648 GBSUA.exe 4764 BZSY.exe 4764 BZSY.exe 1352 YEKNSEC.exe 1352 YEKNSEC.exe 2840 CHIIZ.exe 2840 CHIIZ.exe 5788 GXPIMQS.exe 5788 GXPIMQS.exe 2252 QVUDTYB.exe 2252 QVUDTYB.exe 2860 ZVW.exe 2860 ZVW.exe 3280 XTQLKBL.exe 3280 XTQLKBL.exe 5008 WESBSP.exe 5008 WESBSP.exe 5400 TECDE.exe 5400 TECDE.exe 5544 FNJL.exe 5544 FNJL.exe 5984 MDKDPY.exe 5984 MDKDPY.exe 2580 RIUSFU.exe 2580 RIUSFU.exe 2968 GYD.exe 2968 GYD.exe 1852 XJGHVVH.exe 1852 XJGHVVH.exe 4468 VHRCI.exe 4468 VHRCI.exe 3560 BUQ.exe 3560 BUQ.exe 4576 PFHCAO.exe 4576 PFHCAO.exe 5416 RSM.exe 5416 RSM.exe 4824 MNIU.exe 4824 MNIU.exe 5840 QVXCZYR.exe 5840 QVXCZYR.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5620 wrote to memory of 5140 5620 2026-10-10_0a660293e1e283ccec84deaf27c15a34_elex_emotet_stop.exe 88 PID 5140 wrote to memory of 4456 5140 cmd.exe 92 PID 4456 wrote to memory of 5092 4456 HAW.exe 94 PID 5092 wrote to memory of 4136 5092 cmd.exe 98 PID 4136 wrote to memory of 3900 4136 HVOIAHG.exe 99 PID 3900 wrote to memory of 1840 3900 cmd.exe 103 PID 1840 wrote to memory of 2396 1840 YDDOEYJ.exe 104 PID 2396 wrote to memory of 4180 2396 cmd.exe 108 PID 4180 wrote to memory of 1952 4180 HEFT.exe 109 PID 1952 wrote to memory of 3416 1952 cmd.exe 113 PID 3416 wrote to memory of 1072 3416 NEMGZX.exe 114 PID 1072 wrote to memory of 3824 1072 cmd.exe 118 PID 3824 wrote to memory of 4780 3824 RUT.exe 119 PID 4780 wrote to memory of 4508 4780 cmd.exe 123 PID 4508 wrote to memory of 4552 4508 CNWZT.exe 124 PID 4552 wrote to memory of 4660 4552 cmd.exe 128 PID 4660 wrote to memory of 5900 4660 UNQEXC.exe 129 PID 5900 wrote to memory of 372 5900 cmd.exe 133 PID 372 wrote to memory of 5356 372 WLEZE.exe 134 PID 5356 wrote to memory of 1616 5356 cmd.exe 138 PID 1616 wrote to memory of 1100 1616 QYIIPLP.exe 139 PID 1100 wrote to memory of 3648 1100 cmd.exe 143 PID 3648 wrote to memory of 3368 3648 GBSUA.exe 144 PID 3368 wrote to memory of 4764 3368 cmd.exe 148 PID 4764 wrote to memory of 2948 4764 BZSY.exe 149 PID 2948 wrote to memory of 1352 2948 cmd.exe 153 PID 1352 wrote to memory of 1456 1352 YEKNSEC.exe 154 PID 1456 wrote to memory of 2840 1456 cmd.exe 158 PID 2840 wrote to memory of 3048 2840 CHIIZ.exe 159 PID 3048 wrote to memory of 5788 3048 cmd.exe 163 PID 5788 wrote to memory of 1584 5788 GXPIMQS.exe 164 PID 1584 wrote to memory of 2252 1584 cmd.exe 168 PID 2252 wrote to memory of 6008 2252 QVUDTYB.exe 169 PID 6008 wrote to memory of 2860 6008 cmd.exe 173 PID 2860 wrote to memory of 2680 2860 ZVW.exe 174 PID 2680 wrote to memory of 3280 2680 cmd.exe 178 PID 3280 wrote to memory of 2276 3280 XTQLKBL.exe 179 PID 2276 wrote to memory of 5008 2276 cmd.exe 183 PID 5008 wrote to memory of 3704 5008 WESBSP.exe 184 PID 3704 wrote to memory of 5400 3704 cmd.exe 188 PID 5400 wrote to memory of 2776 5400 TECDE.exe 189 PID 2776 wrote to memory of 5544 2776 cmd.exe 193 PID 5544 wrote to memory of 1340 5544 FNJL.exe 194 PID 1340 wrote to memory of 5984 1340 cmd.exe 198 PID 5984 wrote to memory of 2992 5984 MDKDPY.exe 199 PID 2992 wrote to memory of 2580 2992 cmd.exe 203 PID 2580 wrote to memory of 6080 2580 RIUSFU.exe 204 PID 6080 wrote to memory of 2968 6080 cmd.exe 208 PID 2968 wrote to memory of 1220 2968 GYD.exe 209 PID 1220 wrote to memory of 1852 1220 cmd.exe 213 PID 1852 wrote to memory of 1784 1852 XJGHVVH.exe 214 PID 1784 wrote to memory of 4468 1784 cmd.exe 218 PID 4468 wrote to memory of 5212 4468 VHRCI.exe 219 PID 5212 wrote to memory of 3560 5212 cmd.exe 223 PID 3560 wrote to memory of 2184 3560 BUQ.exe 224 PID 2184 wrote to memory of 4576 2184 cmd.exe 228 PID 4576 wrote to memory of 2656 4576 PFHCAO.exe 229 PID 2656 wrote to memory of 5416 2656 cmd.exe 233 PID 5416 wrote to memory of 5280 5416 RSM.exe 234 PID 5280 wrote to memory of 4824 5280 cmd.exe 238 PID 4824 wrote to memory of 3400 4824 MNIU.exe 239 PID 3400 wrote to memory of 5840 3400 cmd.exe 243 PID 5840 wrote to memory of 5068 5840 QVXCZYR.exe 244 PID 5068 wrote to memory of 4704 5068 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_0a660293e1e283ccec84deaf27c15a34_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_0a660293e1e283ccec84deaf27c15a34_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAW.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\windows\HAW.exeC:\windows\HAW.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HVOIAHG.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\windows\system\HVOIAHG.exeC:\windows\system\HVOIAHG.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDDOEYJ.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\windows\system\YDDOEYJ.exeC:\windows\system\YDDOEYJ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HEFT.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\windows\system\HEFT.exeC:\windows\system\HEFT.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NEMGZX.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\windows\SysWOW64\NEMGZX.exeC:\windows\system32\NEMGZX.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUT.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\windows\SysWOW64\RUT.exeC:\windows\system32\RUT.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNWZT.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\windows\CNWZT.exeC:\windows\CNWZT.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNQEXC.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\windows\system\UNQEXC.exeC:\windows\system\UNQEXC.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WLEZE.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\windows\system\WLEZE.exeC:\windows\system\WLEZE.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QYIIPLP.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\windows\SysWOW64\QYIIPLP.exeC:\windows\system32\QYIIPLP.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GBSUA.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\windows\system\GBSUA.exeC:\windows\system\GBSUA.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZSY.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\windows\BZSY.exeC:\windows\BZSY.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YEKNSEC.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\windows\system\YEKNSEC.exeC:\windows\system\YEKNSEC.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CHIIZ.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\windows\SysWOW64\CHIIZ.exeC:\windows\system32\CHIIZ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXPIMQS.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\windows\system\GXPIMQS.exeC:\windows\system\GXPIMQS.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVUDTYB.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\windows\SysWOW64\QVUDTYB.exeC:\windows\system32\QVUDTYB.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZVW.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\windows\ZVW.exeC:\windows\ZVW.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTQLKBL.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\windows\XTQLKBL.exeC:\windows\XTQLKBL.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WESBSP.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\windows\SysWOW64\WESBSP.exeC:\windows\system32\WESBSP.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TECDE.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\windows\SysWOW64\TECDE.exeC:\windows\system32\TECDE.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FNJL.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\windows\SysWOW64\FNJL.exeC:\windows\system32\FNJL.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MDKDPY.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\windows\system\MDKDPY.exeC:\windows\system\MDKDPY.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RIUSFU.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\windows\RIUSFU.exeC:\windows\RIUSFU.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYD.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\windows\GYD.exeC:\windows\GYD.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XJGHVVH.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\windows\system\XJGHVVH.exeC:\windows\system\XJGHVVH.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VHRCI.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\windows\SysWOW64\VHRCI.exeC:\windows\system32\VHRCI.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BUQ.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\windows\BUQ.exeC:\windows\BUQ.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PFHCAO.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\windows\SysWOW64\PFHCAO.exeC:\windows\system32\PFHCAO.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSM.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\windows\system\RSM.exeC:\windows\system\RSM.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MNIU.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\windows\system\MNIU.exeC:\windows\system\MNIU.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVXCZYR.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\windows\QVXCZYR.exeC:\windows\QVXCZYR.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UYVQZ.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\windows\SysWOW64\UYVQZ.exeC:\windows\system32\UYVQZ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPCY.exe.bat" "66⤵PID:4900
-
C:\windows\system\YPCY.exeC:\windows\system\YPCY.exe67⤵
- Executes dropped EXE
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHJJDLY.exe.bat" "68⤵PID:3024
-
C:\windows\system\RHJJDLY.exeC:\windows\system\RHJJDLY.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MUOS.exe.bat" "70⤵PID:5964
-
C:\windows\MUOS.exeC:\windows\MUOS.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDQXQIP.exe.bat" "72⤵PID:996
-
C:\windows\SysWOW64\VDQXQIP.exeC:\windows\system32\VDQXQIP.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVGIA.exe.bat" "74⤵PID:3248
-
C:\windows\SysWOW64\OVGIA.exeC:\windows\system32\OVGIA.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OBYWBW.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1252 -
C:\windows\system\OBYWBW.exeC:\windows\system\OBYWBW.exe77⤵
- Executes dropped EXE
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ITNHTX.exe.bat" "78⤵PID:4684
-
C:\windows\ITNHTX.exeC:\windows\ITNHTX.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GEQXT.exe.bat" "80⤵PID:4120
-
C:\windows\GEQXT.exeC:\windows\GEQXT.exe81⤵
- Executes dropped EXE
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZVHECS.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:6024 -
C:\windows\BZVHECS.exeC:\windows\BZVHECS.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FHBP.exe.bat" "84⤵PID:2596
-
C:\windows\system\FHBP.exeC:\windows\system\FHBP.exe85⤵
- Executes dropped EXE
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RXQPCFC.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2164 -
C:\windows\system\RXQPCFC.exeC:\windows\system\RXQPCFC.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LLV.exe.bat" "88⤵PID:4192
-
C:\windows\system\LLV.exeC:\windows\system\LLV.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NIA.exe.bat" "90⤵PID:4556
-
C:\windows\SysWOW64\NIA.exeC:\windows\system32\NIA.exe91⤵
- Executes dropped EXE
PID:5244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MTDJCBO.exe.bat" "92⤵PID:3224
-
C:\windows\system\MTDJCBO.exeC:\windows\system\MTDJCBO.exe93⤵
- Executes dropped EXE
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BJEAJ.exe.bat" "94⤵PID:908
-
C:\windows\system\BJEAJ.exeC:\windows\system\BJEAJ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\REWMUJ.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:5944 -
C:\windows\system\REWMUJ.exeC:\windows\system\REWMUJ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CXRFCRB.exe.bat" "98⤵PID:4360
-
C:\windows\system\CXRFCRB.exeC:\windows\system\CXRFCRB.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GNXFH.exe.bat" "100⤵PID:4340
-
C:\windows\SysWOW64\GNXFH.exeC:\windows\system32\GNXFH.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RGAYPQ.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2796 -
C:\windows\RGAYPQ.exeC:\windows\RGAYPQ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ODG.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4264 -
C:\windows\SysWOW64\ODG.exeC:\windows\system32\ODG.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XLIA.exe.bat" "106⤵PID:3160
-
C:\windows\system\XLIA.exeC:\windows\system\XLIA.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YOM.exe.bat" "108⤵PID:2788
-
C:\windows\SysWOW64\YOM.exeC:\windows\system32\YOM.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HUWO.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:1572 -
C:\windows\system\HUWO.exeC:\windows\system\HUWO.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSQQ.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:3376 -
C:\windows\SysWOW64\JSQQ.exeC:\windows\system32\JSQQ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FXVN.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4016 -
C:\windows\SysWOW64\FXVN.exeC:\windows\system32\FXVN.exe115⤵
- Executes dropped EXE
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LXDBZL.exe.bat" "116⤵
- Executes a command shell one-liner
PID:5920 -
C:\windows\SysWOW64\LXDBZL.exeC:\windows\system32\LXDBZL.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLI.exe.bat" "118⤵
- Executes a command shell one-liner
PID:3924 -
C:\windows\GLI.exeC:\windows\GLI.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CQGHQ.exe.bat" "120⤵PID:1268
-
C:\windows\system\CQGHQ.exeC:\windows\system\CQGHQ.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6132
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-