Analysis
- max time kernel
88s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 11:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_033b9a33fedc9858ad27c4d3f2903f11_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-28_033b9a33fedc9858ad27c4d3f2903f11_elex_emotet_stop.exe
- Size 361KB
- Sample261030-nl2essec96
- SHA256 c52b4390e15af47b11fe9948ab96f588f0b504ede31ffdaec1e68f27ecd9c179
- MD5 033b9a33fedc9858ad27c4d3f2903f11
- SHA1 097d57047b1fbe04e911228aae15cbcf96a3573a
- SHA512 543b6a7891359480b3d2ddeacdb08f8d6ddcd7c15003455e868c6d0a1e40dcf5b30bb99aeb7626df544205b5a4ce295718d2b12d985051c9d9262740d7f38540
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOdkEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LOdkmZzcukG2/
- TLSH T137748E1676C28333D1A303724CE786E5773ABCA1AB7687872794721D2B72AB44737394
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4304 YIUCAZJ.exe 4924 CLFQ.exe 4600 BWH.exe 5212 DRZH.exe 2852 DXZWN.exe 1724 YKEFXQ.exe 4864 NNNR.exe 4848 TAMSMGY.exe 1728 OWRB.exe 5608 FWXZ.exe 3640 AHOXQZK.exe 1676 RSRNYN.exe 3280 XSY.exe 240 DNYC.exe 2136 WQB.exe 1832 UGNBMNH.exe 2232 NYQ.exe 824 PWDOC.exe 2836 OHGE.exe 2588 UHORUL.exe 5808 PVS.exe 3124 HYWFJ.exe 5976 ZGY.exe 2832 IGAPQ.exe 3444 DRJ.exe 2152 LHKFLC.exe 3152 QHR.exe 3576 UPYBHP.exe 3360 KGZSNKT.exe 3408 BTJKD.exe 5732 TWNOIXJ.exe 2132 BBNCK.exe 2996 QHTR.exe 1700 FCDEKGO.exe 1180 QVG.exe 2460 YAYD.exe 5784 MLOCIMC.exe 3612 VLQHM.exe 2576 QZNQWJT.exe 5908 SUSH.exe 1092 QUZV.exe 2120 BNDGP.exe 4144 EAHXASN.exe 2028 IIOXM.exe 4100 BLS.exe 4880 STUGV.exe 4240 FWK.exe 1496 EPNNSPW.exe 4736 MUSTCN.exe 4340 SVZH.exe 5472 KYLLZ.exe 940 QYL.exe 5964 AYNELF.exe 5052 RHPJPCI.exe 2900 AMZ.exe 4968 VHEKP.exe 5700 KXF.exe 5940 VQICW.exe 2244 JTEB.exe 5240 DGJKL.exe 4316 YBOCVTV.exe 2540 ECVP.exe 1852 JCDDVXX.exe 4788 JIDSXCA.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\SUSH.exe.bat QZNQWJT.exe File created C:\windows\SysWOW64\KYLLZ.exe.bat SVZH.exe File created C:\windows\SysWOW64\JIDSXCA.exe.bat JCDDVXX.exe File opened for modification C:\windows\SysWOW64\LSHGWF.exe XNBJ.exe File created C:\windows\SysWOW64\QXWVI.exe QREH.exe File opened for modification C:\windows\SysWOW64\MREH.exe YUYKO.exe File opened for modification C:\windows\SysWOW64\MBGQR.exe DTEL.exe File created C:\windows\SysWOW64\FCDEKGO.exe.bat QHTR.exe File opened for modification C:\windows\SysWOW64\DYT.exe RQMBAF.exe File created C:\windows\SysWOW64\FVBU.exe UCG.exe File created C:\windows\SysWOW64\MUY.exe RHTHWO.exe File created C:\windows\SysWOW64\MBGQR.exe DTEL.exe File opened for modification C:\windows\SysWOW64\EPNNSPW.exe FWK.exe File opened for modification C:\windows\SysWOW64\DXZWN.exe DRZH.exe File created C:\windows\SysWOW64\RQMBAF.exe DLHE.exe File created C:\windows\SysWOW64\WQB.exe DNYC.exe File opened for modification C:\windows\SysWOW64\PVS.exe UHORUL.exe File opened for modification C:\windows\SysWOW64\QRGGEFR.exe VDBWB.exe File opened for modification C:\windows\SysWOW64\TWNOIXJ.exe BTJKD.exe File created C:\windows\SysWOW64\SUSH.exe QZNQWJT.exe File created C:\windows\SysWOW64\KYLLZ.exe SVZH.exe File opened for modification C:\windows\SysWOW64\AHOXQZK.exe FWXZ.exe File created C:\windows\SysWOW64\AHOXQZK.exe.bat FWXZ.exe File created C:\windows\SysWOW64\PVS.exe.bat UHORUL.exe File opened for modification C:\windows\SysWOW64\SUSH.exe QZNQWJT.exe File created C:\windows\SysWOW64\QYL.exe.bat KYLLZ.exe File created C:\windows\SysWOW64\KXF.exe.bat VHEKP.exe File created C:\windows\SysWOW64\RQMBAF.exe.bat DLHE.exe File created C:\windows\SysWOW64\RUKJ.exe.bat QRGGEFR.exe File created C:\windows\SysWOW64\XSY.exe.bat RSRNYN.exe File opened for modification C:\windows\SysWOW64\FCDEKGO.exe QHTR.exe File created C:\windows\SysWOW64\JIDSXCA.exe JCDDVXX.exe File created C:\windows\SysWOW64\FYIV.exe TFF.exe File created C:\windows\SysWOW64\QXWVI.exe.bat QREH.exe File created C:\windows\SysWOW64\OWRB.exe.bat TAMSMGY.exe File created C:\windows\SysWOW64\DYT.exe RQMBAF.exe File opened for modification C:\windows\SysWOW64\FVBU.exe UCG.exe File created C:\windows\SysWOW64\LSHGWF.exe XNBJ.exe File created C:\windows\SysWOW64\EPNNSPW.exe.bat FWK.exe File created C:\windows\SysWOW64\RHPJPCI.exe AYNELF.exe File opened for modification C:\windows\SysWOW64\XNBJ.exe MUY.exe File opened for modification C:\windows\SysWOW64\EKQQKVL.exe RAIZ.exe File opened for modification C:\windows\SysWOW64\XSY.exe RSRNYN.exe File created C:\windows\SysWOW64\MREH.exe.bat YUYKO.exe File created C:\windows\SysWOW64\QRGGEFR.exe VDBWB.exe File opened for modification C:\windows\SysWOW64\MUSTCN.exe EPNNSPW.exe File opened for modification C:\windows\SysWOW64\OWRB.exe TAMSMGY.exe File created C:\windows\SysWOW64\TWNOIXJ.exe.bat BTJKD.exe File created C:\windows\SysWOW64\EAHXASN.exe BNDGP.exe File created C:\windows\SysWOW64\VEWGHZ.exe MRL.exe File created C:\windows\SysWOW64\RUKJ.exe QRGGEFR.exe File created C:\windows\SysWOW64\EPNNSPW.exe FWK.exe File created C:\windows\SysWOW64\RHTHWO.exe FRNH.exe File created C:\windows\SysWOW64\KGZSNKT.exe UPYBHP.exe File created C:\windows\SysWOW64\QYL.exe KYLLZ.exe File opened for modification C:\windows\SysWOW64\RHPJPCI.exe AYNELF.exe File opened for modification C:\windows\SysWOW64\RQMBAF.exe DLHE.exe File created C:\windows\SysWOW64\QRGGEFR.exe.bat VDBWB.exe File created C:\windows\SysWOW64\QUZV.exe SUSH.exe File created C:\windows\SysWOW64\MUSTCN.exe.bat EPNNSPW.exe File created C:\windows\SysWOW64\MREH.exe YUYKO.exe File opened for modification C:\windows\SysWOW64\MUY.exe RHTHWO.exe File created C:\windows\SysWOW64\LSHGWF.exe.bat XNBJ.exe File created C:\windows\SysWOW64\XSY.exe RSRNYN.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\RSRNYN.exe AHOXQZK.exe File opened for modification C:\windows\system\IGAPQ.exe ZGY.exe File opened for modification C:\windows\system\QHR.exe LHKFLC.exe File created C:\windows\system\BNDGP.exe QUZV.exe File created C:\windows\system\JCDDVXX.exe ECVP.exe File opened for modification C:\windows\HJQT.exe HVPF.exe File opened for modification C:\windows\system\BWUDWV.exe HJQT.exe File opened for modification C:\windows\system\VCQJVN.exe RUKJ.exe File created C:\windows\system\VCQJVN.exe.bat RUKJ.exe File opened for modification C:\windows\TAMSMGY.exe NNNR.exe File created C:\windows\FWK.exe.bat STUGV.exe File opened for modification C:\windows\system\JTEB.exe VQICW.exe File opened for modification C:\windows\system\ZLNFAP.exe FYIV.exe File created C:\windows\HJQT.exe.bat HVPF.exe File created C:\windows\CARZ.exe.bat RHW.exe File created C:\windows\FWK.exe STUGV.exe File created C:\windows\XNWJVE.exe.bat CARZ.exe File created C:\windows\DTEL.exe.bat XTWXWR.exe File created C:\windows\HYWFJ.exe.bat PVS.exe File created C:\windows\system\UGNBMNH.exe WQB.exe File created C:\windows\VLQHM.exe MLOCIMC.exe File opened for modification C:\windows\ECVP.exe YBOCVTV.exe File opened for modification C:\windows\BVN.exe JIDSXCA.exe File opened for modification C:\windows\PMIRGZ.exe MREH.exe File opened for modification C:\windows\system\PGNCBG.exe ENKSA.exe File opened for modification C:\windows\system\UQTYTQM.exe FVBU.exe File created C:\windows\system\IGPL.exe.bat WOM.exe File opened for modification C:\windows\RAIZ.exe QXWVI.exe File created C:\windows\VDBWB.exe ZYV.exe File created C:\windows\ZYV.exe EKQQKVL.exe File created C:\windows\system\OHGE.exe.bat PWDOC.exe File created C:\windows\LHKFLC.exe DRJ.exe File created C:\windows\system\STUGV.exe BLS.exe File created C:\windows\OCZNJU.exe DKWUIMY.exe File created C:\windows\system\UQTYTQM.exe.bat FVBU.exe File opened for modification C:\windows\WOM.exe UQTYTQM.exe File opened for modification C:\windows\WMNI.exe IGPL.exe File created C:\windows\WMNI.exe.bat IGPL.exe File created C:\windows\system\UPYBHP.exe QHR.exe File opened for modification C:\windows\system\STUGV.exe BLS.exe File created C:\windows\system\VHEKP.exe.bat AMZ.exe File created C:\windows\WMNI.exe IGPL.exe File created C:\windows\system\INC.exe.bat EXVK.exe File created C:\windows\system\FRNH.exe.bat FLV.exe File opened for modification C:\windows\YIUCAZJ.exe 2026-10-28_033b9a33fedc9858ad27c4d3f2903f11_elex_emotet_stop.exe File created C:\windows\system\JCDDVXX.exe.bat ECVP.exe File created C:\windows\FXZPFT.exe PMIRGZ.exe File created C:\windows\DKWUIMY.exe.bat VEWGHZ.exe File created C:\windows\BVN.exe.bat JIDSXCA.exe File opened for modification C:\windows\system\MRL.exe MLT.exe File created C:\windows\YKEFXQ.exe DXZWN.exe File opened for modification C:\windows\IIOXM.exe EAHXASN.exe File created C:\windows\ECVP.exe.bat YBOCVTV.exe File created C:\windows\ZYV.exe.bat EKQQKVL.exe File created C:\windows\RHW.exe.bat VCQJVN.exe File created C:\windows\CARZ.exe RHW.exe File created C:\windows\SCNEALU.exe MBGQR.exe File opened for modification C:\windows\SVZH.exe MUSTCN.exe File opened for modification C:\windows\FWXZ.exe OWRB.exe File created C:\windows\system\QHR.exe.bat LHKFLC.exe File created C:\windows\YAYD.exe QVG.exe File created C:\windows\ECVP.exe YBOCVTV.exe File created C:\windows\DRZH.exe.bat BWH.exe File opened for modification C:\windows\YKEFXQ.exe DXZWN.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1344 cmd.exe 2528 cmd.exe 2532 cmd.exe 5088 cmd.exe 3112 cmd.exe 3404 cmd.exe 3424 cmd.exe 5948 cmd.exe 208 cmd.exe 4172 cmd.exe 5604 cmd.exe 1704 cmd.exe 5788 cmd.exe 4652 cmd.exe 2664 cmd.exe 2684 cmd.exe 5640 cmd.exe 5564 cmd.exe 3232 cmd.exe 4268 cmd.exe 5968 cmd.exe 5780 cmd.exe 3824 cmd.exe 4612 cmd.exe 4276 cmd.exe 4448 cmd.exe 5380 cmd.exe 4760 cmd.exe 1472 cmd.exe 5312 cmd.exe 5420 cmd.exe 5900 cmd.exe 1040 cmd.exe 1988 cmd.exe 828 cmd.exe 5648 cmd.exe 4996 cmd.exe 4336 cmd.exe 2052 cmd.exe 4120 cmd.exe 2876 cmd.exe 5136 cmd.exe 3008 cmd.exe 4160 cmd.exe 5864 cmd.exe 5892 cmd.exe 2560 cmd.exe 1504 cmd.exe 1484 cmd.exe 1640 cmd.exe 2776 cmd.exe 3260 cmd.exe 3188 cmd.exe 5596 cmd.exe 5840 cmd.exe 4872 cmd.exe 5592 cmd.exe 692 cmd.exe 5928 cmd.exe 4844 cmd.exe 6016 cmd.exe 1464 cmd.exe 6008 cmd.exe 3148 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5796 6036 WerFault.exe 88 1812 4304 WerFault.exe 93 1644 4924 WerFault.exe 99 1472 4600 WerFault.exe 104 3052 5212 WerFault.exe 109 5968 2852 WerFault.exe 114 3860 1724 WerFault.exe 119 3824 4864 WerFault.exe 124 5404 4848 WerFault.exe 129 4360 1728 WerFault.exe 134 5584 5608 WerFault.exe 139 4760 3640 WerFault.exe 144 5836 1676 WerFault.exe 149 1276 3280 WerFault.exe 154 6060 240 WerFault.exe 159 2340 2136 WerFault.exe 164 988 1832 WerFault.exe 169 1972 2232 WerFault.exe 174 5256 824 WerFault.exe 179 1876 2836 WerFault.exe 184 4312 2588 WerFault.exe 189 5100 5808 WerFault.exe 194 5440 3124 WerFault.exe 199 4168 5976 WerFault.exe 204 3820 2832 WerFault.exe 209 4272 3444 WerFault.exe 214 2860 2152 WerFault.exe 219 2764 3152 WerFault.exe 224 3992 3576 WerFault.exe 229 2244 3360 WerFault.exe 234 3192 3408 WerFault.exe 239 4804 5732 WerFault.exe 244 1752 2132 WerFault.exe 249 5964 2996 WerFault.exe 254 4224 1700 WerFault.exe 259 1344 1180 WerFault.exe 264 4448 2460 WerFault.exe 269 964 5784 WerFault.exe 274 5008 3612 WerFault.exe 280 1168 2576 WerFault.exe 285 4548 5908 WerFault.exe 290 5096 1092 WerFault.exe 295 2300 2120 WerFault.exe 300 5580 4144 WerFault.exe 305 4224 2028 WerFault.exe 310 4564 4100 WerFault.exe 315 2544 4880 WerFault.exe 320 5616 4240 WerFault.exe 325 1960 1496 WerFault.exe 330 2432 4736 WerFault.exe 335 1072 4340 WerFault.exe 340 5692 5472 WerFault.exe 345 4904 940 WerFault.exe 350 2124 5964 WerFault.exe 355 3004 5052 WerFault.exe 360 5760 2900 WerFault.exe 365 1996 4968 WerFault.exe 370 5132 5700 WerFault.exe 375 6048 5940 WerFault.exe 380 1056 2244 WerFault.exe 385 5980 5240 WerFault.exe 390 5820 4316 WerFault.exe 395 2720 2540 WerFault.exe 400 1884 1852 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IGPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DXZWN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YKEFXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSRNYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQMBAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MRL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBGQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QZNQWJT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHPJPCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MREH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENKSA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VLQHM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QRGGEFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNYC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNBJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMIRGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XTWXWR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDBWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BWH.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6036 2026-10-28_033b9a33fedc9858ad27c4d3f2903f11_elex_emotet_stop.exe 6036 2026-10-28_033b9a33fedc9858ad27c4d3f2903f11_elex_emotet_stop.exe 4304 YIUCAZJ.exe 4304 YIUCAZJ.exe 4924 CLFQ.exe 4924 CLFQ.exe 4600 BWH.exe 4600 BWH.exe 5212 DRZH.exe 5212 DRZH.exe 2852 DXZWN.exe 2852 DXZWN.exe 1724 YKEFXQ.exe 1724 YKEFXQ.exe 4864 NNNR.exe 4864 NNNR.exe 4848 TAMSMGY.exe 4848 TAMSMGY.exe 1728 OWRB.exe 1728 OWRB.exe 5608 FWXZ.exe 5608 FWXZ.exe 3640 AHOXQZK.exe 3640 AHOXQZK.exe 1676 RSRNYN.exe 1676 RSRNYN.exe 3280 XSY.exe 3280 XSY.exe 240 DNYC.exe 240 DNYC.exe 2136 WQB.exe 2136 WQB.exe 1832 UGNBMNH.exe 1832 UGNBMNH.exe 2232 NYQ.exe 2232 NYQ.exe 824 PWDOC.exe 824 PWDOC.exe 2836 OHGE.exe 2836 OHGE.exe 2588 UHORUL.exe 2588 UHORUL.exe 5808 PVS.exe 5808 PVS.exe 3124 HYWFJ.exe 3124 HYWFJ.exe 5976 ZGY.exe 5976 ZGY.exe 2832 IGAPQ.exe 2832 IGAPQ.exe 3444 DRJ.exe 3444 DRJ.exe 2152 LHKFLC.exe 2152 LHKFLC.exe 3152 QHR.exe 3152 QHR.exe 3576 UPYBHP.exe 3576 UPYBHP.exe 3360 KGZSNKT.exe 3360 KGZSNKT.exe 3408 BTJKD.exe 3408 BTJKD.exe 5732 TWNOIXJ.exe 5732 TWNOIXJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 6036 2026-10-28_033b9a33fedc9858ad27c4d3f2903f11_elex_emotet_stop.exe 6036 2026-10-28_033b9a33fedc9858ad27c4d3f2903f11_elex_emotet_stop.exe 4304 YIUCAZJ.exe 4304 YIUCAZJ.exe 4924 CLFQ.exe 4924 CLFQ.exe 4600 BWH.exe 4600 BWH.exe 5212 DRZH.exe 5212 DRZH.exe 2852 DXZWN.exe 2852 DXZWN.exe 1724 YKEFXQ.exe 1724 YKEFXQ.exe 4864 NNNR.exe 4864 NNNR.exe 4848 TAMSMGY.exe 4848 TAMSMGY.exe 1728 OWRB.exe 1728 OWRB.exe 5608 FWXZ.exe 5608 FWXZ.exe 3640 AHOXQZK.exe 3640 AHOXQZK.exe 1676 RSRNYN.exe 1676 RSRNYN.exe 3280 XSY.exe 3280 XSY.exe 240 DNYC.exe 240 DNYC.exe 2136 WQB.exe 2136 WQB.exe 1832 UGNBMNH.exe 1832 UGNBMNH.exe 2232 NYQ.exe 2232 NYQ.exe 824 PWDOC.exe 824 PWDOC.exe 2836 OHGE.exe 2836 OHGE.exe 2588 UHORUL.exe 2588 UHORUL.exe 5808 PVS.exe 5808 PVS.exe 3124 HYWFJ.exe 3124 HYWFJ.exe 5976 ZGY.exe 5976 ZGY.exe 2832 IGAPQ.exe 2832 IGAPQ.exe 3444 DRJ.exe 3444 DRJ.exe 2152 LHKFLC.exe 2152 LHKFLC.exe 3152 QHR.exe 3152 QHR.exe 3576 UPYBHP.exe 3576 UPYBHP.exe 3360 KGZSNKT.exe 3360 KGZSNKT.exe 3408 BTJKD.exe 3408 BTJKD.exe 5732 TWNOIXJ.exe 5732 TWNOIXJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6036 wrote to memory of 1548 6036 2026-10-28_033b9a33fedc9858ad27c4d3f2903f11_elex_emotet_stop.exe 89 PID 1548 wrote to memory of 4304 1548 cmd.exe 93 PID 4304 wrote to memory of 2216 4304 YIUCAZJ.exe 95 PID 2216 wrote to memory of 4924 2216 cmd.exe 99 PID 4924 wrote to memory of 5136 4924 CLFQ.exe 100 PID 5136 wrote to memory of 4600 5136 cmd.exe 104 PID 4600 wrote to memory of 828 4600 BWH.exe 105 PID 828 wrote to memory of 5212 828 cmd.exe 109 PID 5212 wrote to memory of 3008 5212 DRZH.exe 110 PID 3008 wrote to memory of 2852 3008 cmd.exe 114 PID 2852 wrote to memory of 5592 2852 DXZWN.exe 115 PID 5592 wrote to memory of 1724 5592 cmd.exe 119 PID 1724 wrote to memory of 1792 1724 YKEFXQ.exe 120 PID 1792 wrote to memory of 4864 1792 cmd.exe 124 PID 4864 wrote to memory of 3540 4864 NNNR.exe 125 PID 3540 wrote to memory of 4848 3540 cmd.exe 129 PID 4848 wrote to memory of 4160 4848 TAMSMGY.exe 130 PID 4160 wrote to memory of 1728 4160 cmd.exe 134 PID 1728 wrote to memory of 548 1728 OWRB.exe 135 PID 548 wrote to memory of 5608 548 cmd.exe 139 PID 5608 wrote to memory of 1948 5608 FWXZ.exe 140 PID 1948 wrote to memory of 3640 1948 cmd.exe 144 PID 3640 wrote to memory of 5648 3640 AHOXQZK.exe 145 PID 5648 wrote to memory of 1676 5648 cmd.exe 149 PID 1676 wrote to memory of 3232 1676 RSRNYN.exe 150 PID 3232 wrote to memory of 3280 3232 cmd.exe 154 PID 3280 wrote to memory of 1392 3280 XSY.exe 155 PID 1392 wrote to memory of 240 1392 cmd.exe 159 PID 240 wrote to memory of 4996 240 DNYC.exe 160 PID 4996 wrote to memory of 2136 4996 cmd.exe 164 PID 2136 wrote to memory of 4336 2136 WQB.exe 165 PID 4336 wrote to memory of 1832 4336 cmd.exe 169 PID 1832 wrote to memory of 2360 1832 UGNBMNH.exe 170 PID 2360 wrote to memory of 2232 2360 cmd.exe 174 PID 2232 wrote to memory of 5048 2232 NYQ.exe 175 PID 5048 wrote to memory of 824 5048 cmd.exe 179 PID 824 wrote to memory of 5500 824 PWDOC.exe 180 PID 5500 wrote to memory of 2836 5500 cmd.exe 184 PID 2836 wrote to memory of 4204 2836 OHGE.exe 185 PID 4204 wrote to memory of 2588 4204 cmd.exe 189 PID 2588 wrote to memory of 3452 2588 UHORUL.exe 190 PID 3452 wrote to memory of 5808 3452 cmd.exe 194 PID 5808 wrote to memory of 5312 5808 PVS.exe 195 PID 5312 wrote to memory of 3124 5312 cmd.exe 199 PID 3124 wrote to memory of 3544 3124 HYWFJ.exe 200 PID 3544 wrote to memory of 5976 3544 cmd.exe 204 PID 5976 wrote to memory of 1940 5976 ZGY.exe 205 PID 1940 wrote to memory of 2832 1940 cmd.exe 209 PID 2832 wrote to memory of 4192 2832 IGAPQ.exe 210 PID 4192 wrote to memory of 3444 4192 cmd.exe 214 PID 3444 wrote to memory of 5420 3444 DRJ.exe 215 PID 5420 wrote to memory of 2152 5420 cmd.exe 219 PID 2152 wrote to memory of 1640 2152 LHKFLC.exe 220 PID 1640 wrote to memory of 3152 1640 cmd.exe 224 PID 3152 wrote to memory of 5936 3152 QHR.exe 225 PID 5936 wrote to memory of 3576 5936 cmd.exe 229 PID 3576 wrote to memory of 5900 3576 UPYBHP.exe 230 PID 5900 wrote to memory of 3360 5900 cmd.exe 234 PID 3360 wrote to memory of 4572 3360 KGZSNKT.exe 235 PID 4572 wrote to memory of 3408 4572 cmd.exe 239 PID 3408 wrote to memory of 2776 3408 BTJKD.exe 240 PID 2776 wrote to memory of 5732 2776 cmd.exe 244 PID 5732 wrote to memory of 692 5732 TWNOIXJ.exe 245 PID 692 wrote to memory of 2132 692 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_033b9a33fedc9858ad27c4d3f2903f11_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_033b9a33fedc9858ad27c4d3f2903f11_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YIUCAZJ.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\windows\YIUCAZJ.exeC:\windows\YIUCAZJ.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLFQ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\windows\system\CLFQ.exeC:\windows\system\CLFQ.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BWH.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\windows\system\BWH.exeC:\windows\system\BWH.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DRZH.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:828 -
C:\windows\DRZH.exeC:\windows\DRZH.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DXZWN.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\windows\SysWOW64\DXZWN.exeC:\windows\system32\DXZWN.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YKEFXQ.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\windows\YKEFXQ.exeC:\windows\YKEFXQ.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NNNR.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\windows\system\NNNR.exeC:\windows\system\NNNR.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TAMSMGY.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\windows\TAMSMGY.exeC:\windows\TAMSMGY.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWRB.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\windows\SysWOW64\OWRB.exeC:\windows\system32\OWRB.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWXZ.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548 -
C:\windows\FWXZ.exeC:\windows\FWXZ.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AHOXQZK.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\windows\SysWOW64\AHOXQZK.exeC:\windows\system32\AHOXQZK.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSRNYN.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\windows\system\RSRNYN.exeC:\windows\system\RSRNYN.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSY.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\windows\SysWOW64\XSY.exeC:\windows\system32\XSY.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNYC.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\windows\system\DNYC.exeC:\windows\system\DNYC.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQB.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\windows\SysWOW64\WQB.exeC:\windows\system32\WQB.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGNBMNH.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\windows\system\UGNBMNH.exeC:\windows\system\UGNBMNH.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYQ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\windows\SysWOW64\NYQ.exeC:\windows\system32\NYQ.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWDOC.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\windows\system\PWDOC.exeC:\windows\system\PWDOC.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHGE.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\windows\system\OHGE.exeC:\windows\system\OHGE.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UHORUL.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\windows\system\UHORUL.exeC:\windows\system\UHORUL.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVS.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\windows\SysWOW64\PVS.exeC:\windows\system32\PVS.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYWFJ.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\windows\HYWFJ.exeC:\windows\HYWFJ.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGY.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\windows\ZGY.exeC:\windows\ZGY.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IGAPQ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\windows\system\IGAPQ.exeC:\windows\system\IGAPQ.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DRJ.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\windows\system\DRJ.exeC:\windows\system\DRJ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LHKFLC.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\windows\LHKFLC.exeC:\windows\LHKFLC.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHR.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\windows\system\QHR.exeC:\windows\system\QHR.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UPYBHP.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\windows\system\UPYBHP.exeC:\windows\system\UPYBHP.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGZSNKT.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\windows\SysWOW64\KGZSNKT.exeC:\windows\system32\KGZSNKT.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTJKD.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\windows\system\BTJKD.exeC:\windows\system\BTJKD.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TWNOIXJ.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\windows\SysWOW64\TWNOIXJ.exeC:\windows\system32\TWNOIXJ.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BBNCK.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:692 -
C:\windows\SysWOW64\BBNCK.exeC:\windows\system32\BBNCK.exe65⤵
- Executes dropped EXE
PID:2132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHTR.exe.bat" "66⤵PID:2688
-
C:\windows\system\QHTR.exeC:\windows\system\QHTR.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCDEKGO.exe.bat" "68⤵PID:4308
-
C:\windows\SysWOW64\FCDEKGO.exeC:\windows\system32\FCDEKGO.exe69⤵
- Executes dropped EXE
PID:1700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVG.exe.bat" "70⤵PID:5932
-
C:\windows\QVG.exeC:\windows\QVG.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YAYD.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:2744 -
C:\windows\YAYD.exeC:\windows\YAYD.exe73⤵
- Executes dropped EXE
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MLOCIMC.exe.bat" "74⤵PID:4464
-
C:\windows\MLOCIMC.exeC:\windows\MLOCIMC.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VLQHM.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:4632 -
C:\windows\VLQHM.exeC:\windows\VLQHM.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QZNQWJT.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:988 -
C:\windows\QZNQWJT.exeC:\windows\QZNQWJT.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUSH.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1464 -
C:\windows\SysWOW64\SUSH.exeC:\windows\system32\SUSH.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUZV.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4612 -
C:\windows\SysWOW64\QUZV.exeC:\windows\system32\QUZV.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BNDGP.exe.bat" "84⤵PID:5032
-
C:\windows\system\BNDGP.exeC:\windows\system\BNDGP.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EAHXASN.exe.bat" "86⤵PID:5308
-
C:\windows\SysWOW64\EAHXASN.exeC:\windows\system32\EAHXASN.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIOXM.exe.bat" "88⤵
- Executes a command shell one-liner
PID:6008 -
C:\windows\IIOXM.exeC:\windows\IIOXM.exe89⤵
- Executes dropped EXE
PID:2028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BLS.exe.bat" "90⤵PID:3724
-
C:\windows\system\BLS.exeC:\windows\system\BLS.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STUGV.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4620 -
C:\windows\system\STUGV.exeC:\windows\system\STUGV.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWK.exe.bat" "94⤵PID:4576
-
C:\windows\FWK.exeC:\windows\FWK.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EPNNSPW.exe.bat" "96⤵
- Executes a command shell one-liner
PID:4652 -
C:\windows\SysWOW64\EPNNSPW.exeC:\windows\system32\EPNNSPW.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUSTCN.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:2764 -
C:\windows\SysWOW64\MUSTCN.exeC:\windows\system32\MUSTCN.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVZH.exe.bat" "100⤵PID:4384
-
C:\windows\SVZH.exeC:\windows\SVZH.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYLLZ.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:1356 -
C:\windows\SysWOW64\KYLLZ.exeC:\windows\system32\KYLLZ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QYL.exe.bat" "104⤵
- Executes a command shell one-liner
PID:2532 -
C:\windows\SysWOW64\QYL.exeC:\windows\system32\QYL.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AYNELF.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3856 -
C:\windows\SysWOW64\AYNELF.exeC:\windows\system32\AYNELF.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHPJPCI.exe.bat" "108⤵
- Executes a command shell one-liner
PID:2664 -
C:\windows\SysWOW64\RHPJPCI.exeC:\windows\system32\RHPJPCI.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMZ.exe.bat" "110⤵PID:4140
-
C:\windows\system\AMZ.exeC:\windows\system\AMZ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VHEKP.exe.bat" "112⤵PID:4596
-
C:\windows\system\VHEKP.exeC:\windows\system\VHEKP.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXF.exe.bat" "114⤵PID:5904
-
C:\windows\SysWOW64\KXF.exeC:\windows\system32\KXF.exe115⤵
- Executes dropped EXE
PID:5700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VQICW.exe.bat" "116⤵PID:4452
-
C:\windows\system\VQICW.exeC:\windows\system\VQICW.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JTEB.exe.bat" "118⤵
- Executes a command shell one-liner
PID:5088 -
C:\windows\system\JTEB.exeC:\windows\system\JTEB.exe119⤵
- Executes dropped EXE
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DGJKL.exe.bat" "120⤵PID:1008
-
C:\windows\DGJKL.exeC:\windows\DGJKL.exe121⤵
- Executes dropped EXE
PID:5240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-