Analysis
- max time kernel
110s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 00:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-25_713aa4cd630e9b8b163c65db66078008_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-25_713aa4cd630e9b8b163c65db66078008_elex_emotet_stop.exe
- Size 208KB
- Sample261027-aj1htshv21
- SHA256 b81095d30dc1ca4747130800a5ade020953ab8d7e1faab090d9a6a2dc3051852
- MD5 713aa4cd630e9b8b163c65db66078008
- SHA1 19ab74e2f1f3821dfe68218e8a6d5d96a67e3ada
- SHA512 78b326eebd628e7332a7ab749d830889b0bdf5c125dbd8a4b462198015aa8e5b2ce1ffe774f3156608360bdd6c74d034fa35dfb45dc735b5a775c2a0d2b228eb
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfx4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LO5QEj6
- TLSH T1F7247D2236D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4432 QXTTW.exe 5740 HGJF.exe 2968 BTOPOI.exe 3000 HTW.exe 2376 HZOR.exe 4400 WUYDSKB.exe 4792 WAYSTXE.exe 3384 CAFFC.exe 3160 GQMGOKC.exe 3892 GWM.exe 5872 DBKRFZY.exe 5036 JBSFO.exe 2912 SCUKRY.exe 5800 YCB.exe 5500 GQBM.exe 1996 PVMEAKU.exe 880 VQL.exe 5604 KLVRP.exe 5796 ABWJ.exe 3144 NMEHCYC.exe 1900 WMGMG.exe 5396 ACN.exe 2708 GDU.exe 4472 AQZSL.exe 6088 SYB.exe 5124 DREP.exe 4616 YEJZHD.exe 1788 CMP.exe 4180 NFSS.exe 5384 IQBQIFN.exe 3068 IVB.exe 864 DQGOU.exe 5540 HYMOGKT.exe 4580 SRHH.exe 5652 OXNEV.exe 3896 ESX.exe 4796 UCV.exe 3472 PQAQQ.exe 1156 TGHQCBR.exe 3928 ZGO.exe 4348 KZJW.exe 2208 SJSYHO.exe 5932 SPSMJTZ.exe 4356 DHV.exe 2340 JIV.exe 3168 NYJ.exe 2764 NDB.exe 2560 TEJV.exe 3096 NROEH.exe 5008 TRW.exe 5640 LZYX.exe 1376 WSBQC.exe 1920 CSIDTLR.exe 3924 UNMH.exe 2452 RTKWGL.exe 240 XTR.exe 444 IMUD.exe 5148 DZZMHV.exe 4588 XUE.exe 4848 USK.exe 5704 ONPCJ.exe 5312 DLMZQG.exe 2056 EOQ.exe 264 KJPEAZ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\KXCBT.exe.bat PJX.exe File created C:\windows\SysWOW64\WUYDSKB.exe HZOR.exe File opened for modification C:\windows\SysWOW64\NMEHCYC.exe ABWJ.exe File created C:\windows\SysWOW64\KXCBT.exe PJX.exe File created C:\windows\SysWOW64\JAN.exe.bat NUH.exe File opened for modification C:\windows\SysWOW64\UKTJJ.exe JSQQ.exe File created C:\windows\SysWOW64\WUYDSKB.exe.bat HZOR.exe File created C:\windows\SysWOW64\GQBM.exe.bat YCB.exe File created C:\windows\SysWOW64\AOLA.exe UOEM.exe File created C:\windows\SysWOW64\TECDE.exe YJX.exe File opened for modification C:\windows\SysWOW64\DLMZQG.exe ONPCJ.exe File opened for modification C:\windows\SysWOW64\JBSFO.exe DBKRFZY.exe File opened for modification C:\windows\SysWOW64\QPCOUNK.exe URWRNEI.exe File created C:\windows\SysWOW64\LSF.exe.bat FSY.exe File created C:\windows\SysWOW64\GWM.exe GQMGOKC.exe File created C:\windows\SysWOW64\SRHH.exe.bat HYMOGKT.exe File created C:\windows\SysWOW64\ZCPUWUK.exe ARZX.exe File created C:\windows\SysWOW64\UKTJJ.exe.bat JSQQ.exe File opened for modification C:\windows\SysWOW64\PMW.exe URZJON.exe File created C:\windows\SysWOW64\AOLA.exe.bat UOEM.exe File created C:\windows\SysWOW64\YCB.exe.bat SCUKRY.exe File created C:\windows\SysWOW64\GDU.exe.bat ACN.exe File opened for modification C:\windows\SysWOW64\SRHH.exe HYMOGKT.exe File created C:\windows\SysWOW64\DLMZQG.exe.bat ONPCJ.exe File created C:\windows\SysWOW64\QPCOUNK.exe.bat URWRNEI.exe File created C:\windows\SysWOW64\YOZ.exe NVWVFIZ.exe File created C:\windows\SysWOW64\HGJF.exe QXTTW.exe File created C:\windows\SysWOW64\DBKRFZY.exe.bat GWM.exe File created C:\windows\SysWOW64\IZQM.exe.bat WGV.exe File created C:\windows\SysWOW64\NZXAWBA.exe.bat IZQM.exe File created C:\windows\SysWOW64\XNZ.exe.bat VPG.exe File created C:\windows\SysWOW64\UOEM.exe LVGY.exe File created C:\windows\SysWOW64\UOEM.exe.bat LVGY.exe File opened for modification C:\windows\SysWOW64\AOLA.exe UOEM.exe File opened for modification C:\windows\SysWOW64\GQBM.exe YCB.exe File created C:\windows\SysWOW64\IZQM.exe WGV.exe File created C:\windows\SysWOW64\YOZ.exe.bat NVWVFIZ.exe File created C:\windows\SysWOW64\GWM.exe.bat GQMGOKC.exe File created C:\windows\SysWOW64\JSQQ.exe.bat XZV.exe File created C:\windows\SysWOW64\UKTJJ.exe JSQQ.exe File created C:\windows\SysWOW64\HGJF.exe.bat QXTTW.exe File created C:\windows\SysWOW64\DBKRFZY.exe GWM.exe File created C:\windows\SysWOW64\GDU.exe ACN.exe File created C:\windows\SysWOW64\TGHQCBR.exe PQAQQ.exe File created C:\windows\SysWOW64\PMW.exe URZJON.exe File created C:\windows\SysWOW64\LSF.exe FSY.exe File created C:\windows\SysWOW64\JSQQ.exe XZV.exe File created C:\windows\SysWOW64\JBSFO.exe.bat DBKRFZY.exe File opened for modification C:\windows\SysWOW64\YCB.exe SCUKRY.exe File opened for modification C:\windows\SysWOW64\GDU.exe ACN.exe File opened for modification C:\windows\SysWOW64\KXCBT.exe PJX.exe File opened for modification C:\windows\SysWOW64\OUW.exe IUP.exe File created C:\windows\SysWOW64\QPCOUNK.exe URWRNEI.exe File created C:\windows\SysWOW64\NVWVFIZ.exe NIEHWV.exe File opened for modification C:\windows\SysWOW64\VQL.exe PVMEAKU.exe File created C:\windows\SysWOW64\UCV.exe.bat ESX.exe File opened for modification C:\windows\SysWOW64\TGHQCBR.exe PQAQQ.exe File created C:\windows\SysWOW64\JAN.exe NUH.exe File created C:\windows\SysWOW64\VQL.exe PVMEAKU.exe File created C:\windows\SysWOW64\CSIDTLR.exe.bat WSBQC.exe File created C:\windows\SysWOW64\OUW.exe IUP.exe File created C:\windows\SysWOW64\NUH.exe QPCOUNK.exe File created C:\windows\SysWOW64\ZPYI.exe ICO.exe File opened for modification C:\windows\SysWOW64\TECDE.exe YJX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\FSY.exe DCEWOQM.exe File opened for modification C:\windows\system\AQZSL.exe GDU.exe File created C:\windows\QFWWUWW.exe.bat XCSB.exe File created C:\windows\WHYDC.exe.bat CLTM.exe File opened for modification C:\windows\system\XZV.exe OZTSPUW.exe File opened for modification C:\windows\system\RRP.exe TBEXQ.exe File created C:\windows\system\LVGY.exe FVYKLBZ.exe File created C:\windows\ENKSA.exe.bat JAN.exe File created C:\windows\system\RCX.exe PMW.exe File created C:\windows\JYOQFQ.exe.bat ENKSA.exe File created C:\windows\WGV.exe.bat QGNGWP.exe File created C:\windows\system\VPG.exe.bat ZSATFI.exe File created C:\windows\system\KJPEAZ.exe EOQ.exe File created C:\windows\MJPI.exe GJHUPWE.exe File opened for modification C:\windows\system\GVU.exe JYOQFQ.exe File created C:\windows\system\ABWJ.exe KLVRP.exe File opened for modification C:\windows\SJSYHO.exe KZJW.exe File created C:\windows\system\XTR.exe RTKWGL.exe File created C:\windows\system\IMUD.exe.bat XTR.exe File created C:\windows\IUP.exe XBUZDV.exe File created C:\windows\system\UPUE.exe ZCPUWUK.exe File created C:\windows\system\QGNGWP.exe.bat UBHJPN.exe File created C:\windows\system\OZTSPUW.exe GGKRJ.exe File opened for modification C:\windows\system\CAFFC.exe WAYSTXE.exe File opened for modification C:\windows\system\PJX.exe KJPEAZ.exe File created C:\windows\system\KDHN.exe.bat CXHZ.exe File created C:\windows\system\GVU.exe JYOQFQ.exe File created C:\windows\system\UPUE.exe.bat ZCPUWUK.exe File created C:\windows\system\QGNGWP.exe UBHJPN.exe File created C:\windows\IQBQIFN.exe.bat NFSS.exe File created C:\windows\system\KZJW.exe.bat ZGO.exe File opened for modification C:\windows\system\UNMH.exe CSIDTLR.exe File created C:\windows\DZZMHV.exe IMUD.exe File opened for modification C:\windows\ENKSA.exe JAN.exe File created C:\windows\system\GVU.exe.bat JYOQFQ.exe File opened for modification C:\windows\system\UBHJPN.exe LSF.exe File created C:\windows\system\TBEXQ.exe YOZ.exe File opened for modification C:\windows\GQMGOKC.exe CAFFC.exe File opened for modification C:\windows\system\XTR.exe RTKWGL.exe File created C:\windows\YTTM.exe.bat YBLT.exe File opened for modification C:\windows\system\IDOBLUD.exe KDHN.exe File opened for modification C:\windows\system\URWRNEI.exe ZWRID.exe File created C:\windows\HYMOGKT.exe DQGOU.exe File created C:\windows\MJPI.exe.bat GJHUPWE.exe File created C:\windows\HTW.exe.bat BTOPOI.exe File created C:\windows\system\HZOR.exe HTW.exe File created C:\windows\IVB.exe IQBQIFN.exe File opened for modification C:\windows\XBUZDV.exe MJRHD.exe File created C:\windows\JYOQFQ.exe ENKSA.exe File created C:\windows\system\WMGMG.exe NMEHCYC.exe File created C:\windows\system\MJRHD.exe GIJ.exe File opened for modification C:\windows\system\VSHNGKF.exe TECDE.exe File created C:\windows\ZYPCIUL.exe LSJNB.exe File created C:\windows\system\LVGY.exe.bat FVYKLBZ.exe File created C:\windows\WAYSTXE.exe.bat WUYDSKB.exe File created C:\windows\JIV.exe.bat DHV.exe File created C:\windows\EDPMJFR.exe.bat ZCIYA.exe File created C:\windows\WFDKD.exe.bat QFWWUWW.exe File opened for modification C:\windows\system\WRHXIG.exe WHYDC.exe File created C:\windows\system\XZV.exe OZTSPUW.exe File opened for modification C:\windows\system\TEJV.exe NDB.exe File created C:\windows\system\NROEH.exe.bat TEJV.exe File opened for modification C:\windows\WFDKD.exe QFWWUWW.exe File created C:\windows\WHYDC.exe CLTM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3316 cmd.exe 4564 cmd.exe 5072 cmd.exe 5964 cmd.exe 4960 cmd.exe 2896 cmd.exe 2628 cmd.exe 3856 cmd.exe 1608 cmd.exe 3172 cmd.exe 3468 cmd.exe 2268 cmd.exe 3580 cmd.exe 3908 cmd.exe 1412 cmd.exe 4508 cmd.exe 4820 cmd.exe 1208 cmd.exe 5692 cmd.exe 2176 cmd.exe 5896 cmd.exe 1352 cmd.exe 1508 cmd.exe 4292 cmd.exe 3400 cmd.exe 960 cmd.exe 4828 cmd.exe 1880 cmd.exe 252 cmd.exe 3508 cmd.exe 5056 cmd.exe 5836 cmd.exe 1036 cmd.exe 1456 cmd.exe 2344 cmd.exe 3076 cmd.exe 2524 cmd.exe 1464 cmd.exe 2788 cmd.exe 680 cmd.exe 2984 cmd.exe 5724 cmd.exe 5644 cmd.exe 3252 cmd.exe 5412 cmd.exe 4748 cmd.exe 2804 cmd.exe 3740 cmd.exe 5308 cmd.exe 4100 cmd.exe 2284 cmd.exe 2736 cmd.exe 4280 cmd.exe 936 cmd.exe 6072 cmd.exe 4332 cmd.exe 4768 cmd.exe 3344 cmd.exe 4148 cmd.exe 1072 cmd.exe 1524 cmd.exe 1424 cmd.exe 4984 cmd.exe 3568 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5396 2900 WerFault.exe 88 5736 4432 WerFault.exe 94 4636 5740 WerFault.exe 100 5392 2968 WerFault.exe 105 3572 3000 WerFault.exe 110 4752 2376 WerFault.exe 115 5148 4400 WerFault.exe 120 5916 4792 WerFault.exe 125 5936 3384 WerFault.exe 130 4348 3160 WerFault.exe 135 2496 3892 WerFault.exe 140 1944 5872 WerFault.exe 145 4148 5036 WerFault.exe 150 4964 2912 WerFault.exe 155 1424 5800 WerFault.exe 160 3568 5500 WerFault.exe 165 4716 1996 WerFault.exe 170 5976 880 WerFault.exe 175 992 5604 WerFault.exe 180 2952 5796 WerFault.exe 185 3172 3144 WerFault.exe 190 3924 1900 WerFault.exe 195 4924 5396 WerFault.exe 200 4356 2708 WerFault.exe 205 2572 4472 WerFault.exe 210 2464 6088 WerFault.exe 215 3024 5124 WerFault.exe 220 3592 4616 WerFault.exe 225 2172 1788 WerFault.exe 230 936 4180 WerFault.exe 235 608 5384 WerFault.exe 240 4372 3068 WerFault.exe 245 1936 864 WerFault.exe 250 4528 5540 WerFault.exe 255 2340 4580 WerFault.exe 260 4828 5652 WerFault.exe 265 4888 3896 WerFault.exe 270 4244 4796 WerFault.exe 275 4188 3472 WerFault.exe 280 1872 1156 WerFault.exe 285 4152 3928 WerFault.exe 291 1556 4348 WerFault.exe 296 1920 2208 WerFault.exe 301 2332 5932 WerFault.exe 306 5980 4356 WerFault.exe 311 2464 2340 WerFault.exe 316 4496 3168 WerFault.exe 321 4244 2764 WerFault.exe 326 5112 2560 WerFault.exe 331 5984 3096 WerFault.exe 336 1820 5008 WerFault.exe 341 5320 5640 WerFault.exe 346 3340 1376 WerFault.exe 351 5584 1920 WerFault.exe 356 3316 3924 WerFault.exe 361 468 2452 WerFault.exe 366 848 240 WerFault.exe 371 4956 444 WerFault.exe 376 6104 5148 WerFault.exe 381 5836 4588 WerFault.exe 386 2772 4848 WerFault.exe 391 2824 5704 WerFault.exe 396 5420 5312 WerFault.exe 401 3380 2056 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LZYX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CSIDTLR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAFRDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WHYDC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NZXAWBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NIEHWV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UNMH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENKSA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DREP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GDU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URWRNEI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSATFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCEWOQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ONPCJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2900 2026-10-25_713aa4cd630e9b8b163c65db66078008_elex_emotet_stop.exe 2900 2026-10-25_713aa4cd630e9b8b163c65db66078008_elex_emotet_stop.exe 4432 QXTTW.exe 4432 QXTTW.exe 5740 HGJF.exe 5740 HGJF.exe 2968 BTOPOI.exe 2968 BTOPOI.exe 3000 HTW.exe 3000 HTW.exe 2376 HZOR.exe 2376 HZOR.exe 4400 WUYDSKB.exe 4400 WUYDSKB.exe 4792 WAYSTXE.exe 4792 WAYSTXE.exe 3384 CAFFC.exe 3384 CAFFC.exe 3160 GQMGOKC.exe 3160 GQMGOKC.exe 3892 GWM.exe 3892 GWM.exe 5872 DBKRFZY.exe 5872 DBKRFZY.exe 5036 JBSFO.exe 5036 JBSFO.exe 2912 SCUKRY.exe 2912 SCUKRY.exe 5800 YCB.exe 5800 YCB.exe 5500 GQBM.exe 5500 GQBM.exe 1996 PVMEAKU.exe 1996 PVMEAKU.exe 880 VQL.exe 880 VQL.exe 5604 KLVRP.exe 5604 KLVRP.exe 5796 ABWJ.exe 5796 ABWJ.exe 3144 NMEHCYC.exe 3144 NMEHCYC.exe 1900 WMGMG.exe 1900 WMGMG.exe 5396 ACN.exe 5396 ACN.exe 2708 GDU.exe 2708 GDU.exe 4472 AQZSL.exe 4472 AQZSL.exe 6088 SYB.exe 6088 SYB.exe 5124 DREP.exe 5124 DREP.exe 4616 YEJZHD.exe 4616 YEJZHD.exe 1788 CMP.exe 1788 CMP.exe 4180 NFSS.exe 4180 NFSS.exe 5384 IQBQIFN.exe 5384 IQBQIFN.exe 3068 IVB.exe 3068 IVB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2900 2026-10-25_713aa4cd630e9b8b163c65db66078008_elex_emotet_stop.exe 2900 2026-10-25_713aa4cd630e9b8b163c65db66078008_elex_emotet_stop.exe 4432 QXTTW.exe 4432 QXTTW.exe 5740 HGJF.exe 5740 HGJF.exe 2968 BTOPOI.exe 2968 BTOPOI.exe 3000 HTW.exe 3000 HTW.exe 2376 HZOR.exe 2376 HZOR.exe 4400 WUYDSKB.exe 4400 WUYDSKB.exe 4792 WAYSTXE.exe 4792 WAYSTXE.exe 3384 CAFFC.exe 3384 CAFFC.exe 3160 GQMGOKC.exe 3160 GQMGOKC.exe 3892 GWM.exe 3892 GWM.exe 5872 DBKRFZY.exe 5872 DBKRFZY.exe 5036 JBSFO.exe 5036 JBSFO.exe 2912 SCUKRY.exe 2912 SCUKRY.exe 5800 YCB.exe 5800 YCB.exe 5500 GQBM.exe 5500 GQBM.exe 1996 PVMEAKU.exe 1996 PVMEAKU.exe 880 VQL.exe 880 VQL.exe 5604 KLVRP.exe 5604 KLVRP.exe 5796 ABWJ.exe 5796 ABWJ.exe 3144 NMEHCYC.exe 3144 NMEHCYC.exe 1900 WMGMG.exe 1900 WMGMG.exe 5396 ACN.exe 5396 ACN.exe 2708 GDU.exe 2708 GDU.exe 4472 AQZSL.exe 4472 AQZSL.exe 6088 SYB.exe 6088 SYB.exe 5124 DREP.exe 5124 DREP.exe 4616 YEJZHD.exe 4616 YEJZHD.exe 1788 CMP.exe 1788 CMP.exe 4180 NFSS.exe 4180 NFSS.exe 5384 IQBQIFN.exe 5384 IQBQIFN.exe 3068 IVB.exe 3068 IVB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2900 wrote to memory of 3364 2900 2026-10-25_713aa4cd630e9b8b163c65db66078008_elex_emotet_stop.exe 90 PID 3364 wrote to memory of 4432 3364 cmd.exe 94 PID 4432 wrote to memory of 1728 4432 QXTTW.exe 96 PID 1728 wrote to memory of 5740 1728 cmd.exe 100 PID 5740 wrote to memory of 252 5740 HGJF.exe 101 PID 252 wrote to memory of 2968 252 cmd.exe 105 PID 2968 wrote to memory of 4512 2968 BTOPOI.exe 106 PID 4512 wrote to memory of 3000 4512 cmd.exe 110 PID 3000 wrote to memory of 4932 3000 HTW.exe 111 PID 4932 wrote to memory of 2376 4932 cmd.exe 115 PID 2376 wrote to memory of 3508 2376 HZOR.exe 116 PID 3508 wrote to memory of 4400 3508 cmd.exe 120 PID 4400 wrote to memory of 1116 4400 WUYDSKB.exe 121 PID 1116 wrote to memory of 4792 1116 cmd.exe 125 PID 4792 wrote to memory of 5056 4792 WAYSTXE.exe 126 PID 5056 wrote to memory of 3384 5056 cmd.exe 130 PID 3384 wrote to memory of 960 3384 CAFFC.exe 131 PID 960 wrote to memory of 3160 960 cmd.exe 135 PID 3160 wrote to memory of 3740 3160 GQMGOKC.exe 136 PID 3740 wrote to memory of 3892 3740 cmd.exe 140 PID 3892 wrote to memory of 2456 3892 GWM.exe 141 PID 2456 wrote to memory of 5872 2456 cmd.exe 145 PID 5872 wrote to memory of 4764 5872 DBKRFZY.exe 146 PID 4764 wrote to memory of 5036 4764 cmd.exe 150 PID 5036 wrote to memory of 4408 5036 JBSFO.exe 151 PID 4408 wrote to memory of 2912 4408 cmd.exe 155 PID 2912 wrote to memory of 5724 2912 SCUKRY.exe 156 PID 5724 wrote to memory of 5800 5724 cmd.exe 160 PID 5800 wrote to memory of 2904 5800 YCB.exe 161 PID 2904 wrote to memory of 5500 2904 cmd.exe 165 PID 5500 wrote to memory of 4564 5500 GQBM.exe 166 PID 4564 wrote to memory of 1996 4564 cmd.exe 170 PID 1996 wrote to memory of 4100 1996 PVMEAKU.exe 171 PID 4100 wrote to memory of 880 4100 cmd.exe 175 PID 880 wrote to memory of 5920 880 VQL.exe 176 PID 5920 wrote to memory of 5604 5920 cmd.exe 180 PID 5604 wrote to memory of 4736 5604 KLVRP.exe 181 PID 4736 wrote to memory of 5796 4736 cmd.exe 185 PID 5796 wrote to memory of 2776 5796 ABWJ.exe 186 PID 2776 wrote to memory of 3144 2776 cmd.exe 190 PID 3144 wrote to memory of 1776 3144 NMEHCYC.exe 191 PID 1776 wrote to memory of 1900 1776 cmd.exe 195 PID 1900 wrote to memory of 3596 1900 WMGMG.exe 196 PID 3596 wrote to memory of 5396 3596 cmd.exe 200 PID 5396 wrote to memory of 5220 5396 ACN.exe 201 PID 5220 wrote to memory of 2708 5220 cmd.exe 205 PID 2708 wrote to memory of 4984 2708 GDU.exe 206 PID 4984 wrote to memory of 4472 4984 cmd.exe 210 PID 4472 wrote to memory of 4768 4472 AQZSL.exe 211 PID 4768 wrote to memory of 6088 4768 cmd.exe 215 PID 6088 wrote to memory of 4284 6088 SYB.exe 216 PID 4284 wrote to memory of 5124 4284 cmd.exe 220 PID 5124 wrote to memory of 3568 5124 DREP.exe 221 PID 3568 wrote to memory of 4616 3568 cmd.exe 225 PID 4616 wrote to memory of 4716 4616 YEJZHD.exe 226 PID 4716 wrote to memory of 1788 4716 cmd.exe 230 PID 1788 wrote to memory of 4800 1788 CMP.exe 231 PID 4800 wrote to memory of 4180 4800 cmd.exe 235 PID 4180 wrote to memory of 5428 4180 NFSS.exe 236 PID 5428 wrote to memory of 5384 5428 cmd.exe 240 PID 5384 wrote to memory of 5612 5384 IQBQIFN.exe 241 PID 5612 wrote to memory of 3068 5612 cmd.exe 245 PID 3068 wrote to memory of 5824 3068 IVB.exe 246 PID 5824 wrote to memory of 864 5824 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_713aa4cd630e9b8b163c65db66078008_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_713aa4cd630e9b8b163c65db66078008_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QXTTW.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\windows\system\QXTTW.exeC:\windows\system\QXTTW.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HGJF.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\windows\SysWOW64\HGJF.exeC:\windows\system32\HGJF.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BTOPOI.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:252 -
C:\windows\BTOPOI.exeC:\windows\BTOPOI.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HTW.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\windows\HTW.exeC:\windows\HTW.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HZOR.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\windows\system\HZOR.exeC:\windows\system\HZOR.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WUYDSKB.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\windows\SysWOW64\WUYDSKB.exeC:\windows\system32\WUYDSKB.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WAYSTXE.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\windows\WAYSTXE.exeC:\windows\WAYSTXE.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CAFFC.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\windows\system\CAFFC.exeC:\windows\system\CAFFC.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GQMGOKC.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:960 -
C:\windows\GQMGOKC.exeC:\windows\GQMGOKC.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GWM.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\windows\SysWOW64\GWM.exeC:\windows\system32\GWM.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBKRFZY.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\windows\SysWOW64\DBKRFZY.exeC:\windows\system32\DBKRFZY.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JBSFO.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\windows\SysWOW64\JBSFO.exeC:\windows\system32\JBSFO.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SCUKRY.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\windows\SCUKRY.exeC:\windows\SCUKRY.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YCB.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\windows\SysWOW64\YCB.exeC:\windows\system32\YCB.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GQBM.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\windows\SysWOW64\GQBM.exeC:\windows\system32\GQBM.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PVMEAKU.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\windows\system\PVMEAKU.exeC:\windows\system\PVMEAKU.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VQL.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\windows\SysWOW64\VQL.exeC:\windows\system32\VQL.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KLVRP.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\windows\KLVRP.exeC:\windows\KLVRP.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABWJ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\windows\system\ABWJ.exeC:\windows\system\ABWJ.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NMEHCYC.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\windows\SysWOW64\NMEHCYC.exeC:\windows\system32\NMEHCYC.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WMGMG.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\windows\system\WMGMG.exeC:\windows\system\WMGMG.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ACN.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\windows\ACN.exeC:\windows\ACN.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GDU.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\windows\SysWOW64\GDU.exeC:\windows\system32\GDU.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQZSL.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\windows\system\AQZSL.exeC:\windows\system\AQZSL.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SYB.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\windows\SysWOW64\SYB.exeC:\windows\system32\SYB.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DREP.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\windows\SysWOW64\DREP.exeC:\windows\system32\DREP.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YEJZHD.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\windows\system\YEJZHD.exeC:\windows\system\YEJZHD.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CMP.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\windows\system\CMP.exeC:\windows\system\CMP.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFSS.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\windows\system\NFSS.exeC:\windows\system\NFSS.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQBQIFN.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\windows\IQBQIFN.exeC:\windows\IQBQIFN.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IVB.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\windows\IVB.exeC:\windows\IVB.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DQGOU.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\windows\DQGOU.exeC:\windows\DQGOU.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYMOGKT.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5316 -
C:\windows\HYMOGKT.exeC:\windows\HYMOGKT.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRHH.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5644 -
C:\windows\SysWOW64\SRHH.exeC:\windows\system32\SRHH.exe69⤵
- Executes dropped EXE
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXNEV.exe.bat" "70⤵PID:4668
-
C:\windows\system\OXNEV.exeC:\windows\system\OXNEV.exe71⤵
- Executes dropped EXE
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ESX.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3252 -
C:\windows\system\ESX.exeC:\windows\system\ESX.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCV.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:3560 -
C:\windows\SysWOW64\UCV.exeC:\windows\system32\UCV.exe75⤵
- Executes dropped EXE
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PQAQQ.exe.bat" "76⤵PID:1308
-
C:\windows\PQAQQ.exeC:\windows\PQAQQ.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGHQCBR.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5352 -
C:\windows\SysWOW64\TGHQCBR.exeC:\windows\system32\TGHQCBR.exe79⤵
- Executes dropped EXE
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGO.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5072 -
C:\windows\ZGO.exeC:\windows\ZGO.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KZJW.exe.bat" "82⤵PID:2564
-
C:\windows\system\KZJW.exeC:\windows\system\KZJW.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SJSYHO.exe.bat" "84⤵PID:4640
-
C:\windows\SJSYHO.exeC:\windows\SJSYHO.exe85⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SPSMJTZ.exe.bat" "86⤵PID:4224
-
C:\windows\system\SPSMJTZ.exeC:\windows\system\SPSMJTZ.exe87⤵
- Executes dropped EXE
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DHV.exe.bat" "88⤵PID:3704
-
C:\windows\system\DHV.exeC:\windows\system\DHV.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JIV.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4292 -
C:\windows\JIV.exeC:\windows\JIV.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NYJ.exe.bat" "92⤵PID:1568
-
C:\windows\NYJ.exeC:\windows\NYJ.exe93⤵
- Executes dropped EXE
PID:3168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDB.exe.bat" "94⤵
- Executes a command shell one-liner
PID:5964 -
C:\windows\NDB.exeC:\windows\NDB.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEJV.exe.bat" "96⤵
- Executes a command shell one-liner
PID:1208 -
C:\windows\system\TEJV.exeC:\windows\system\TEJV.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NROEH.exe.bat" "98⤵PID:5976
-
C:\windows\system\NROEH.exeC:\windows\system\NROEH.exe99⤵
- Executes dropped EXE
PID:3096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRW.exe.bat" "100⤵PID:2188
-
C:\windows\TRW.exeC:\windows\TRW.exe101⤵
- Executes dropped EXE
PID:5008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LZYX.exe.bat" "102⤵PID:1096
-
C:\windows\LZYX.exeC:\windows\LZYX.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WSBQC.exe.bat" "104⤵
- Executes a command shell one-liner
PID:3172 -
C:\windows\WSBQC.exeC:\windows\WSBQC.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CSIDTLR.exe.bat" "106⤵
- Executes a command shell one-liner
PID:3344 -
C:\windows\SysWOW64\CSIDTLR.exeC:\windows\system32\CSIDTLR.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNMH.exe.bat" "108⤵PID:5624
-
C:\windows\system\UNMH.exeC:\windows\system\UNMH.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RTKWGL.exe.bat" "110⤵
- Executes a command shell one-liner
PID:3400 -
C:\windows\system\RTKWGL.exeC:\windows\system\RTKWGL.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XTR.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3076 -
C:\windows\system\XTR.exeC:\windows\system\XTR.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IMUD.exe.bat" "114⤵PID:3744
-
C:\windows\system\IMUD.exeC:\windows\system\IMUD.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZZMHV.exe.bat" "116⤵
- Executes a command shell one-liner
PID:5308 -
C:\windows\DZZMHV.exeC:\windows\DZZMHV.exe117⤵
- Executes dropped EXE
PID:5148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUE.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4960 -
C:\windows\system\XUE.exeC:\windows\system\XUE.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USK.exe.bat" "120⤵PID:1868
-
C:\windows\system\USK.exeC:\windows\system\USK.exe121⤵
- Executes dropped EXE
PID:4848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-