Analysis
- max time kernel
97s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 06:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_dac261a22379f4a46e099c5790c6d31e_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-11-01_dac261a22379f4a46e099c5790c6d31e_elex_emotet_stop.exe
- Size 208KB
- Sample261102-hhmvcatt7p
- SHA256 8eb411abd23c27be6828e9fb10d65e076abd44bcd7332feaed53d9d075d117f2
- MD5 dac261a22379f4a46e099c5790c6d31e
- SHA1 f49ec84d83d3e64b99d93aed50d996d2c2a160f7
- SHA512 e558c77f2b3029e61ae844882ecf531b461faf3d514eb23170715ce14f116f365cbd9541afa1a2e4c3e134867165b801586a739563e23eb31e668c9d18b3129e
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfI4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOwkEj1
- TLSH T1E1247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1984 BCLGI.exe 2556 MKZ.exe 5308 ZQTZJ.exe 1084 FQB.exe 2076 GTEQYVD.exe 696 NBF.exe 5332 ZRMPR.exe 3048 OMV.exe 3296 YVXZNTZ.exe 5912 SIC.exe 1776 IYDIW.exe 4144 XTN.exe 920 BJTUT.exe 2560 HWT.exe 3192 ZZWYD.exe 5968 UNBIOMF.exe 4516 LAMA.exe 3928 EDPWJZ.exe 3792 GQU.exe 484 QRWSXW.exe 692 AOKE.exe 476 LHFXM.exe 5304 PXLFZEF.exe 2956 JKQP.exe 3636 CNU.exe 3948 IOC.exe 2396 ZOEDJCH.exe 3080 SRHH.exe 3376 NEMQZ.exe 2160 SFU.exe 1260 YFCSR.exe 2312 EABTVR.exe 4488 TGHQCBR.exe 5740 ZGO.exe 3332 QGQIXA.exe 4808 FMOGEC.exe 4564 WMQL.exe 6004 LPZXAUH.exe 4284 LVA.exe 2700 GIEV.exe 996 AVJEOH.exe 1296 VRO.exe 1428 THZRMM.exe 1884 ACZRQPS.exe 5752 AXCNWF.exe 1824 CVQH.exe 4840 XFYG.exe 5224 FWZFY.exe 4748 ZJEPILJ.exe 5560 PMOTT.exe 5656 XROID.exe 5760 MMX.exe 5372 ASDJV.exe 1584 DFITFHE.exe 1312 UQYQFCH.exe 1076 IWEGML.exe 256 LJJ.exe 688 UWTPMI.exe 2508 UCLVNVH.exe 796 WPQ.exe 4772 MKARJH.exe 2944 KGZSNKT.exe 5664 RYIT.exe 3944 MLMDDO.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\FMOGEC.exe QGQIXA.exe File created C:\windows\SysWOW64\VRO.exe AVJEOH.exe File created C:\windows\SysWOW64\ZQTZJ.exe MKZ.exe File opened for modification C:\windows\SysWOW64\IYDIW.exe SIC.exe File opened for modification C:\windows\SysWOW64\SRHH.exe ZOEDJCH.exe File created C:\windows\SysWOW64\LJJ.exe.bat IWEGML.exe File created C:\windows\SysWOW64\AOBBIQM.exe.bat FAERY.exe File created C:\windows\SysWOW64\SRHH.exe ZOEDJCH.exe File created C:\windows\SysWOW64\TGHQCBR.exe EABTVR.exe File created C:\windows\SysWOW64\GIEV.exe.bat LVA.exe File created C:\windows\SysWOW64\SUSH.exe BMYUVL.exe File opened for modification C:\windows\SysWOW64\EAHXASN.exe WUHJYF.exe File opened for modification C:\windows\SysWOW64\HJO.exe HEO.exe File opened for modification C:\windows\SysWOW64\AAEN.exe FMZ.exe File created C:\windows\SysWOW64\EDPWJZ.exe.bat LAMA.exe File created C:\windows\SysWOW64\UQYQFCH.exe.bat DFITFHE.exe File opened for modification C:\windows\SysWOW64\KGZSNKT.exe MKARJH.exe File created C:\windows\SysWOW64\ASLJAW.exe APHN.exe File created C:\windows\SysWOW64\DSTM.exe RAYTU.exe File created C:\windows\SysWOW64\ZOEDJCH.exe.bat IOC.exe File created C:\windows\SysWOW64\QGQIXA.exe.bat ZGO.exe File opened for modification C:\windows\SysWOW64\NBF.exe GTEQYVD.exe File opened for modification C:\windows\SysWOW64\ZOEDJCH.exe IOC.exe File created C:\windows\SysWOW64\GIEV.exe LVA.exe File created C:\windows\SysWOW64\ACZRQPS.exe.bat THZRMM.exe File created C:\windows\SysWOW64\KGZSNKT.exe MKARJH.exe File opened for modification C:\windows\SysWOW64\SUSH.exe BMYUVL.exe File created C:\windows\SysWOW64\OMV.exe ZRMPR.exe File created C:\windows\SysWOW64\IYDIW.exe SIC.exe File created C:\windows\SysWOW64\ZOEDJCH.exe IOC.exe File created C:\windows\SysWOW64\JIQAEIV.exe JDQLVVA.exe File created C:\windows\SysWOW64\AOBBIQM.exe FAERY.exe File created C:\windows\SysWOW64\UGDEKTR.exe DSTM.exe File created C:\windows\SysWOW64\HJO.exe.bat HEO.exe File opened for modification C:\windows\SysWOW64\ZZWYD.exe HWT.exe File created C:\windows\SysWOW64\KGZSNKT.exe.bat MKARJH.exe File opened for modification C:\windows\SysWOW64\MKZ.exe BCLGI.exe File opened for modification C:\windows\SysWOW64\VRO.exe AVJEOH.exe File opened for modification C:\windows\SysWOW64\DSTM.exe RAYTU.exe File created C:\windows\SysWOW64\HEO.exe.bat VOHYB.exe File created C:\windows\SysWOW64\WUHJYF.exe.bat BZCZO.exe File created C:\windows\SysWOW64\EAHXASN.exe.bat WUHJYF.exe File created C:\windows\SysWOW64\ZZZM.exe.bat BZSY.exe File opened for modification C:\windows\SysWOW64\GTEQYVD.exe FQB.exe File opened for modification C:\windows\SysWOW64\QGQIXA.exe ZGO.exe File created C:\windows\SysWOW64\LJJ.exe IWEGML.exe File created C:\windows\SysWOW64\MLMDDO.exe.bat RYIT.exe File opened for modification C:\windows\SysWOW64\AOKE.exe QRWSXW.exe File created C:\windows\SysWOW64\AXCNWF.exe.bat ACZRQPS.exe File created C:\windows\SysWOW64\LUYBBU.exe.bat ZCVQT.exe File opened for modification C:\windows\SysWOW64\CYIQ.exe BDWMDVL.exe File opened for modification C:\windows\SysWOW64\ASLJAW.exe APHN.exe File created C:\windows\SysWOW64\RKOB.exe.bat WXJRLPA.exe File created C:\windows\SysWOW64\CYIQ.exe BDWMDVL.exe File created C:\windows\SysWOW64\GTEQYVD.exe FQB.exe File created C:\windows\SysWOW64\UCLVNVH.exe.bat UWTPMI.exe File created C:\windows\SysWOW64\MLMDDO.exe RYIT.exe File created C:\windows\SysWOW64\ZZZM.exe BZSY.exe File created C:\windows\SysWOW64\NFHODSF.exe FZHHBF.exe File opened for modification C:\windows\SysWOW64\RUYE.exe CZOAAH.exe File created C:\windows\SysWOW64\FMOGEC.exe.bat QGQIXA.exe File created C:\windows\SysWOW64\AXCNWF.exe ACZRQPS.exe File created C:\windows\SysWOW64\JIQAEIV.exe.bat JDQLVVA.exe File created C:\windows\SysWOW64\RUYE.exe CZOAAH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\IWEGML.exe UQYQFCH.exe File created C:\windows\JDQLVVA.exe SPFT.exe File opened for modification C:\windows\HIZDS.exe BIR.exe File created C:\windows\system\FAERY.exe.bat UIBZ.exe File created C:\windows\RAYTU.exe RUYE.exe File created C:\windows\system\ULDSUYU.exe UGDEKTR.exe File created C:\windows\EABTVR.exe YFCSR.exe File created C:\windows\system\NEMQZ.exe.bat SRHH.exe File opened for modification C:\windows\XFYG.exe CVQH.exe File opened for modification C:\windows\system\AYLX.exe ASLJAW.exe File opened for modification C:\windows\CHVAS.exe TGTV.exe File opened for modification C:\windows\SPFT.exe IHD.exe File created C:\windows\system\APF.exe.bat LUVZW.exe File created C:\windows\LHCVMIW.exe.bat CYIQ.exe File created C:\windows\UNBIOMF.exe.bat ZZWYD.exe File created C:\windows\system\LVA.exe LPZXAUH.exe File created C:\windows\WPQ.exe UCLVNVH.exe File created C:\windows\system\FWZFY.exe XFYG.exe File created C:\windows\APHN.exe.bat LUYBBU.exe File opened for modification C:\windows\system\RYIT.exe KGZSNKT.exe File opened for modification C:\windows\system\BIR.exe QPOWBM.exe File created C:\windows\RAYTU.exe.bat RUYE.exe File opened for modification C:\windows\EABTVR.exe YFCSR.exe File opened for modification C:\windows\system\MKARJH.exe WPQ.exe File opened for modification C:\windows\BZSY.exe IGXNBBS.exe File created C:\windows\system\BIR.exe.bat QPOWBM.exe File created C:\windows\UIBZ.exe.bat FFRUFW.exe File created C:\windows\system\BJTUT.exe.bat XTN.exe File opened for modification C:\windows\YFCSR.exe SFU.exe File created C:\windows\ZGO.exe.bat TGHQCBR.exe File created C:\windows\BZSY.exe IGXNBBS.exe File created C:\windows\SCRFX.exe HJO.exe File created C:\windows\IWEGML.exe.bat UQYQFCH.exe File opened for modification C:\windows\system\CZOAAH.exe RHLHZ.exe File opened for modification C:\windows\system\WMQL.exe FMOGEC.exe File opened for modification C:\windows\IWEGML.exe UQYQFCH.exe File created C:\windows\system\PXLFZEF.exe LHFXM.exe File opened for modification C:\windows\THZRMM.exe VRO.exe File created C:\windows\system\CYR.exe.bat WYKUU.exe File opened for modification C:\windows\system\FWZFY.exe XFYG.exe File created C:\windows\system\ZCVQT.exe OJSX.exe File created C:\windows\BDWMDVL.exe.bat HIZDS.exe File opened for modification C:\windows\UNBIOMF.exe ZZWYD.exe File opened for modification C:\windows\ZGO.exe TGHQCBR.exe File created C:\windows\UWTPMI.exe LJJ.exe File created C:\windows\LHCVMIW.exe CYIQ.exe File created C:\windows\system\ACT.exe LHCVMIW.exe File opened for modification C:\windows\system\YVXZNTZ.exe OMV.exe File opened for modification C:\windows\WYKUU.exe BKFL.exe File opened for modification C:\windows\system\ULDSUYU.exe UGDEKTR.exe File created C:\windows\system\ASDJV.exe.bat MMX.exe File created C:\windows\THZRMM.exe.bat VRO.exe File created C:\windows\BZSY.exe.bat IGXNBBS.exe File opened for modification C:\windows\FOIO.exe AOBBIQM.exe File created C:\windows\XFYG.exe CVQH.exe File created C:\windows\system\FWZFY.exe.bat XFYG.exe File created C:\windows\PMOTT.exe.bat ZJEPILJ.exe File opened for modification C:\windows\LUVZW.exe LOVK.exe File created C:\windows\QPOWBM.exe.bat KPHI.exe File created C:\windows\system\NEMQZ.exe SRHH.exe File created C:\windows\YFCSR.exe.bat SFU.exe File created C:\windows\EABTVR.exe.bat YFCSR.exe File created C:\windows\system\LPZXAUH.exe WMQL.exe File created C:\windows\KPHI.exe APF.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2204 cmd.exe 3720 cmd.exe 2696 cmd.exe 4332 cmd.exe 3432 cmd.exe 1516 cmd.exe 792 cmd.exe 2872 cmd.exe 4224 cmd.exe 3272 cmd.exe 544 cmd.exe 5208 cmd.exe 3596 cmd.exe 3476 cmd.exe 5300 cmd.exe 5532 cmd.exe 1492 cmd.exe 1060 cmd.exe 5448 cmd.exe 6008 cmd.exe 3020 cmd.exe 4116 cmd.exe 5016 cmd.exe 2352 cmd.exe 2796 cmd.exe 2908 cmd.exe 464 cmd.exe 828 cmd.exe 4764 cmd.exe 5920 cmd.exe 3016 cmd.exe 704 cmd.exe 4100 cmd.exe 4400 cmd.exe 2832 cmd.exe 5900 cmd.exe 5456 cmd.exe 5944 cmd.exe 4404 cmd.exe 6104 cmd.exe 4576 cmd.exe 5032 cmd.exe 52 cmd.exe 1880 cmd.exe 2256 cmd.exe 5624 cmd.exe 4472 cmd.exe 2320 cmd.exe 4876 cmd.exe 3328 cmd.exe 3876 cmd.exe 2852 cmd.exe 1360 cmd.exe 5980 cmd.exe 3252 cmd.exe 3324 cmd.exe 4932 cmd.exe 2384 cmd.exe 3608 cmd.exe 2828 cmd.exe 960 cmd.exe 1220 cmd.exe 2040 cmd.exe 2624 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4224 2152 WerFault.exe 87 2024 1984 WerFault.exe 93 1308 2556 WerFault.exe 99 5460 5308 WerFault.exe 104 1392 1084 WerFault.exe 109 4684 2076 WerFault.exe 114 5212 696 WerFault.exe 119 5032 5332 WerFault.exe 124 2808 3048 WerFault.exe 129 4704 3296 WerFault.exe 134 4400 5912 WerFault.exe 139 1824 1776 WerFault.exe 144 4340 4144 WerFault.exe 149 3748 920 WerFault.exe 154 5008 2560 WerFault.exe 159 4580 3192 WerFault.exe 164 916 5968 WerFault.exe 169 5228 4516 WerFault.exe 174 2336 3928 WerFault.exe 179 992 3792 WerFault.exe 184 3512 484 WerFault.exe 189 2812 692 WerFault.exe 194 1824 476 WerFault.exe 199 6032 5304 WerFault.exe 204 3224 2956 WerFault.exe 209 5988 3636 WerFault.exe 214 1336 3948 WerFault.exe 219 6056 2396 WerFault.exe 224 3972 3080 WerFault.exe 229 5032 3376 WerFault.exe 234 2112 2160 WerFault.exe 239 5216 1260 WerFault.exe 244 5872 2312 WerFault.exe 249 4192 4488 WerFault.exe 254 1100 5740 WerFault.exe 259 6072 3332 WerFault.exe 264 5636 4808 WerFault.exe 269 5448 4564 WerFault.exe 274 3324 6004 WerFault.exe 279 2852 4284 WerFault.exe 284 4772 2700 WerFault.exe 289 6016 996 WerFault.exe 294 6008 1296 WerFault.exe 299 5664 1428 WerFault.exe 304 6024 1884 WerFault.exe 309 4340 5752 WerFault.exe 314 2468 1824 WerFault.exe 319 5636 4840 WerFault.exe 324 5460 5224 WerFault.exe 329 5612 4748 WerFault.exe 334 792 5560 WerFault.exe 339 3856 5656 WerFault.exe 344 1616 5760 WerFault.exe 349 1728 5372 WerFault.exe 354 4636 1584 WerFault.exe 359 5336 1312 WerFault.exe 364 2356 1076 WerFault.exe 369 4676 256 WerFault.exe 374 3324 688 WerFault.exe 379 3672 2508 WerFault.exe 384 4984 796 WerFault.exe 389 4496 4772 WerFault.exe 394 4256 2944 WerFault.exe 399 1072 5664 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRHH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UWTPMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DSTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YFCSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCLVNVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYLX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LAMA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGQIXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYDIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RYIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCLGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIEV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAHXASN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZJEPILJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXJRLPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VOHYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OMV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYKUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIHWRCW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THZRMM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IWEGML.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMYUVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IGXNBBS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFITFHE.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2152 2026-11-01_dac261a22379f4a46e099c5790c6d31e_elex_emotet_stop.exe 2152 2026-11-01_dac261a22379f4a46e099c5790c6d31e_elex_emotet_stop.exe 1984 BCLGI.exe 1984 BCLGI.exe 2556 MKZ.exe 2556 MKZ.exe 5308 ZQTZJ.exe 5308 ZQTZJ.exe 1084 FQB.exe 1084 FQB.exe 2076 GTEQYVD.exe 2076 GTEQYVD.exe 696 NBF.exe 696 NBF.exe 5332 ZRMPR.exe 5332 ZRMPR.exe 3048 OMV.exe 3048 OMV.exe 3296 YVXZNTZ.exe 3296 YVXZNTZ.exe 5912 SIC.exe 5912 SIC.exe 1776 IYDIW.exe 1776 IYDIW.exe 4144 XTN.exe 4144 XTN.exe 920 BJTUT.exe 920 BJTUT.exe 2560 HWT.exe 2560 HWT.exe 3192 ZZWYD.exe 3192 ZZWYD.exe 5968 UNBIOMF.exe 5968 UNBIOMF.exe 4516 LAMA.exe 4516 LAMA.exe 3928 EDPWJZ.exe 3928 EDPWJZ.exe 3792 GQU.exe 3792 GQU.exe 484 QRWSXW.exe 484 QRWSXW.exe 692 AOKE.exe 692 AOKE.exe 476 LHFXM.exe 476 LHFXM.exe 5304 PXLFZEF.exe 5304 PXLFZEF.exe 2956 JKQP.exe 2956 JKQP.exe 3636 CNU.exe 3636 CNU.exe 3948 IOC.exe 3948 IOC.exe 2396 ZOEDJCH.exe 2396 ZOEDJCH.exe 3080 SRHH.exe 3080 SRHH.exe 3376 NEMQZ.exe 3376 NEMQZ.exe 2160 SFU.exe 2160 SFU.exe 1260 YFCSR.exe 1260 YFCSR.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2152 2026-11-01_dac261a22379f4a46e099c5790c6d31e_elex_emotet_stop.exe 2152 2026-11-01_dac261a22379f4a46e099c5790c6d31e_elex_emotet_stop.exe 1984 BCLGI.exe 1984 BCLGI.exe 2556 MKZ.exe 2556 MKZ.exe 5308 ZQTZJ.exe 5308 ZQTZJ.exe 1084 FQB.exe 1084 FQB.exe 2076 GTEQYVD.exe 2076 GTEQYVD.exe 696 NBF.exe 696 NBF.exe 5332 ZRMPR.exe 5332 ZRMPR.exe 3048 OMV.exe 3048 OMV.exe 3296 YVXZNTZ.exe 3296 YVXZNTZ.exe 5912 SIC.exe 5912 SIC.exe 1776 IYDIW.exe 1776 IYDIW.exe 4144 XTN.exe 4144 XTN.exe 920 BJTUT.exe 920 BJTUT.exe 2560 HWT.exe 2560 HWT.exe 3192 ZZWYD.exe 3192 ZZWYD.exe 5968 UNBIOMF.exe 5968 UNBIOMF.exe 4516 LAMA.exe 4516 LAMA.exe 3928 EDPWJZ.exe 3928 EDPWJZ.exe 3792 GQU.exe 3792 GQU.exe 484 QRWSXW.exe 484 QRWSXW.exe 692 AOKE.exe 692 AOKE.exe 476 LHFXM.exe 476 LHFXM.exe 5304 PXLFZEF.exe 5304 PXLFZEF.exe 2956 JKQP.exe 2956 JKQP.exe 3636 CNU.exe 3636 CNU.exe 3948 IOC.exe 3948 IOC.exe 2396 ZOEDJCH.exe 2396 ZOEDJCH.exe 3080 SRHH.exe 3080 SRHH.exe 3376 NEMQZ.exe 3376 NEMQZ.exe 2160 SFU.exe 2160 SFU.exe 1260 YFCSR.exe 1260 YFCSR.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2152 wrote to memory of 3016 2152 2026-11-01_dac261a22379f4a46e099c5790c6d31e_elex_emotet_stop.exe 89 PID 3016 wrote to memory of 1984 3016 cmd.exe 93 PID 1984 wrote to memory of 5016 1984 BCLGI.exe 95 PID 5016 wrote to memory of 2556 5016 cmd.exe 99 PID 2556 wrote to memory of 4404 2556 MKZ.exe 100 PID 4404 wrote to memory of 5308 4404 cmd.exe 104 PID 5308 wrote to memory of 2420 5308 ZQTZJ.exe 105 PID 2420 wrote to memory of 1084 2420 cmd.exe 109 PID 1084 wrote to memory of 704 1084 FQB.exe 110 PID 704 wrote to memory of 2076 704 cmd.exe 114 PID 2076 wrote to memory of 4288 2076 GTEQYVD.exe 115 PID 4288 wrote to memory of 696 4288 cmd.exe 119 PID 696 wrote to memory of 6104 696 NBF.exe 120 PID 6104 wrote to memory of 5332 6104 cmd.exe 124 PID 5332 wrote to memory of 2204 5332 ZRMPR.exe 125 PID 2204 wrote to memory of 3048 2204 cmd.exe 129 PID 3048 wrote to memory of 924 3048 OMV.exe 130 PID 924 wrote to memory of 3296 924 cmd.exe 134 PID 3296 wrote to memory of 2040 3296 YVXZNTZ.exe 135 PID 2040 wrote to memory of 5912 2040 cmd.exe 139 PID 5912 wrote to memory of 5208 5912 SIC.exe 140 PID 5208 wrote to memory of 1776 5208 cmd.exe 144 PID 1776 wrote to memory of 2500 1776 IYDIW.exe 145 PID 2500 wrote to memory of 4144 2500 cmd.exe 149 PID 4144 wrote to memory of 468 4144 XTN.exe 150 PID 468 wrote to memory of 920 468 cmd.exe 154 PID 920 wrote to memory of 1104 920 BJTUT.exe 155 PID 1104 wrote to memory of 2560 1104 cmd.exe 159 PID 2560 wrote to memory of 4140 2560 HWT.exe 160 PID 4140 wrote to memory of 3192 4140 cmd.exe 164 PID 3192 wrote to memory of 5152 3192 ZZWYD.exe 165 PID 5152 wrote to memory of 5968 5152 cmd.exe 169 PID 5968 wrote to memory of 4780 5968 UNBIOMF.exe 170 PID 4780 wrote to memory of 4516 4780 cmd.exe 174 PID 4516 wrote to memory of 3704 4516 LAMA.exe 175 PID 3704 wrote to memory of 3928 3704 cmd.exe 179 PID 3928 wrote to memory of 2352 3928 EDPWJZ.exe 180 PID 2352 wrote to memory of 3792 2352 cmd.exe 184 PID 3792 wrote to memory of 2796 3792 GQU.exe 185 PID 2796 wrote to memory of 484 2796 cmd.exe 189 PID 484 wrote to memory of 2172 484 QRWSXW.exe 190 PID 2172 wrote to memory of 692 2172 cmd.exe 194 PID 692 wrote to memory of 4548 692 AOKE.exe 195 PID 4548 wrote to memory of 476 4548 cmd.exe 199 PID 476 wrote to memory of 2188 476 LHFXM.exe 200 PID 2188 wrote to memory of 5304 2188 cmd.exe 204 PID 5304 wrote to memory of 1532 5304 PXLFZEF.exe 205 PID 1532 wrote to memory of 2956 1532 cmd.exe 209 PID 2956 wrote to memory of 3612 2956 JKQP.exe 210 PID 3612 wrote to memory of 3636 3612 cmd.exe 214 PID 3636 wrote to memory of 292 3636 CNU.exe 215 PID 292 wrote to memory of 3948 292 cmd.exe 219 PID 3948 wrote to memory of 3596 3948 IOC.exe 220 PID 3596 wrote to memory of 2396 3596 cmd.exe 224 PID 2396 wrote to memory of 4648 2396 ZOEDJCH.exe 225 PID 4648 wrote to memory of 3080 4648 cmd.exe 229 PID 3080 wrote to memory of 2720 3080 SRHH.exe 230 PID 2720 wrote to memory of 3376 2720 cmd.exe 234 PID 3376 wrote to memory of 4332 3376 NEMQZ.exe 235 PID 4332 wrote to memory of 2160 4332 cmd.exe 239 PID 2160 wrote to memory of 5756 2160 SFU.exe 240 PID 5756 wrote to memory of 1260 5756 cmd.exe 244 PID 1260 wrote to memory of 4724 1260 YFCSR.exe 245 PID 4724 wrote to memory of 2312 4724 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_dac261a22379f4a46e099c5790c6d31e_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_dac261a22379f4a46e099c5790c6d31e_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCLGI.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\windows\BCLGI.exeC:\windows\BCLGI.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MKZ.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\windows\SysWOW64\MKZ.exeC:\windows\system32\MKZ.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQTZJ.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\windows\SysWOW64\ZQTZJ.exeC:\windows\system32\ZQTZJ.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FQB.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\windows\SysWOW64\FQB.exeC:\windows\system32\FQB.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GTEQYVD.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:704 -
C:\windows\SysWOW64\GTEQYVD.exeC:\windows\system32\GTEQYVD.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NBF.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\windows\SysWOW64\NBF.exeC:\windows\system32\NBF.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRMPR.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\windows\system\ZRMPR.exeC:\windows\system\ZRMPR.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OMV.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\windows\SysWOW64\OMV.exeC:\windows\system32\OMV.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YVXZNTZ.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:924 -
C:\windows\system\YVXZNTZ.exeC:\windows\system\YVXZNTZ.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIC.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\windows\SIC.exeC:\windows\SIC.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IYDIW.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\windows\SysWOW64\IYDIW.exeC:\windows\system32\IYDIW.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTN.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\windows\XTN.exeC:\windows\XTN.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BJTUT.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:468 -
C:\windows\system\BJTUT.exeC:\windows\system\BJTUT.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HWT.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\windows\HWT.exeC:\windows\HWT.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZZWYD.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\windows\SysWOW64\ZZWYD.exeC:\windows\system32\ZZWYD.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UNBIOMF.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\windows\UNBIOMF.exeC:\windows\UNBIOMF.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LAMA.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\windows\system\LAMA.exeC:\windows\system\LAMA.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EDPWJZ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\windows\SysWOW64\EDPWJZ.exeC:\windows\system32\EDPWJZ.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GQU.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\windows\GQU.exeC:\windows\GQU.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QRWSXW.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\windows\QRWSXW.exeC:\windows\QRWSXW.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOKE.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\windows\SysWOW64\AOKE.exeC:\windows\system32\AOKE.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LHFXM.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\windows\system\LHFXM.exeC:\windows\system\LHFXM.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PXLFZEF.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\windows\system\PXLFZEF.exeC:\windows\system\PXLFZEF.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JKQP.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\windows\JKQP.exeC:\windows\JKQP.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CNU.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\windows\SysWOW64\CNU.exeC:\windows\system32\CNU.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOC.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:292 -
C:\windows\system\IOC.exeC:\windows\system\IOC.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZOEDJCH.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\windows\SysWOW64\ZOEDJCH.exeC:\windows\system32\ZOEDJCH.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRHH.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\windows\SysWOW64\SRHH.exeC:\windows\system32\SRHH.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NEMQZ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\windows\system\NEMQZ.exeC:\windows\system\NEMQZ.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFU.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\windows\SFU.exeC:\windows\SFU.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YFCSR.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\windows\YFCSR.exeC:\windows\YFCSR.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EABTVR.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\windows\EABTVR.exeC:\windows\EABTVR.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGHQCBR.exe.bat" "66⤵PID:3236
-
C:\windows\SysWOW64\TGHQCBR.exeC:\windows\system32\TGHQCBR.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGO.exe.bat" "68⤵PID:4088
-
C:\windows\ZGO.exeC:\windows\ZGO.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QGQIXA.exe.bat" "70⤵PID:848
-
C:\windows\SysWOW64\QGQIXA.exeC:\windows\system32\QGQIXA.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FMOGEC.exe.bat" "72⤵
- Executes a command shell one-liner
PID:3432 -
C:\windows\SysWOW64\FMOGEC.exeC:\windows\system32\FMOGEC.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WMQL.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:4300 -
C:\windows\system\WMQL.exeC:\windows\system\WMQL.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LPZXAUH.exe.bat" "76⤵PID:3520
-
C:\windows\system\LPZXAUH.exeC:\windows\system\LPZXAUH.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVA.exe.bat" "78⤵PID:3564
-
C:\windows\system\LVA.exeC:\windows\system\LVA.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GIEV.exe.bat" "80⤵
- Executes a command shell one-liner
PID:2908 -
C:\windows\SysWOW64\GIEV.exeC:\windows\system32\GIEV.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AVJEOH.exe.bat" "82⤵PID:4444
-
C:\windows\system\AVJEOH.exeC:\windows\system\AVJEOH.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRO.exe.bat" "84⤵PID:2960
-
C:\windows\SysWOW64\VRO.exeC:\windows\system32\VRO.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THZRMM.exe.bat" "86⤵PID:2052
-
C:\windows\THZRMM.exeC:\windows\THZRMM.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACZRQPS.exe.bat" "88⤵PID:4948
-
C:\windows\SysWOW64\ACZRQPS.exeC:\windows\system32\ACZRQPS.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AXCNWF.exe.bat" "90⤵PID:4260
-
C:\windows\SysWOW64\AXCNWF.exeC:\windows\system32\AXCNWF.exe91⤵
- Executes dropped EXE
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CVQH.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4528 -
C:\windows\system\CVQH.exeC:\windows\system\CVQH.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFYG.exe.bat" "94⤵PID:3436
-
C:\windows\XFYG.exeC:\windows\XFYG.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWZFY.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4576 -
C:\windows\system\FWZFY.exeC:\windows\system\FWZFY.exe97⤵
- Executes dropped EXE
PID:5224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZJEPILJ.exe.bat" "98⤵
- Executes a command shell one-liner
PID:5448 -
C:\windows\system\ZJEPILJ.exeC:\windows\system\ZJEPILJ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMOTT.exe.bat" "100⤵PID:6120
-
C:\windows\PMOTT.exeC:\windows\PMOTT.exe101⤵
- Executes dropped EXE
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XROID.exe.bat" "102⤵PID:2992
-
C:\windows\system\XROID.exeC:\windows\system\XROID.exe103⤵
- Executes dropped EXE
PID:5656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMX.exe.bat" "104⤵
- Executes a command shell one-liner
PID:464 -
C:\windows\SysWOW64\MMX.exeC:\windows\system32\MMX.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASDJV.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2768 -
C:\windows\system\ASDJV.exeC:\windows\system\ASDJV.exe107⤵
- Executes dropped EXE
PID:5372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DFITFHE.exe.bat" "108⤵PID:3228
-
C:\windows\DFITFHE.exeC:\windows\DFITFHE.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UQYQFCH.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4100 -
C:\windows\SysWOW64\UQYQFCH.exeC:\windows\system32\UQYQFCH.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWEGML.exe.bat" "112⤵PID:4652
-
C:\windows\IWEGML.exeC:\windows\IWEGML.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJJ.exe.bat" "114⤵PID:4372
-
C:\windows\SysWOW64\LJJ.exeC:\windows\system32\LJJ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UWTPMI.exe.bat" "116⤵PID:3452
-
C:\windows\UWTPMI.exeC:\windows\UWTPMI.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCLVNVH.exe.bat" "118⤵PID:2528
-
C:\windows\SysWOW64\UCLVNVH.exeC:\windows\system32\UCLVNVH.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPQ.exe.bat" "120⤵PID:3280
-
C:\windows\WPQ.exeC:\windows\WPQ.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-