Analysis
- max time kernel
100s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 07:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_d3eda9ffd3e0bb200ead692481845bb3_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-11-01_d3eda9ffd3e0bb200ead692481845bb3_elex_emotet_stop.exe
- Size 208KB
- Sample261102-jgzyysas7p
- SHA256 89f89c34a068f6d659e5fd2f6ad58e323763fa1c4f665b5e8f1e6be5445348b5
- MD5 d3eda9ffd3e0bb200ead692481845bb3
- SHA1 45d6cbb50fe2f44d383e9de012a221ca732cdffa
- SHA512 8052b335946da4981287de1c452a83cec4a183f1a45f2b5d91eb0ec2240c0fbe0dbcaa63191bea0ec2901aff599cf194a41dfe883edf108a4bce4108e8d63cff
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOf84pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOkkEj1
- TLSH T127247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5372 LFB.exe 3420 AAZQRNG.exe 420 SSJ.exe 1640 FDROKS.exe 5128 OETUN.exe 4352 SUACAQP.exe 568 ECGCM.exe 3088 PUJUUQ.exe 5464 ZCLZYNV.exe 2904 FDTN.exe 2076 QVWGP.exe 3868 UDC.exe 5096 LMET.exe 880 URPLUJQ.exe 620 AMG.exe 4456 ECVMD.exe 2500 ZQADOEQ.exe 3008 FQZR.exe 3340 FTL.exe 4076 RMGG.exe 2360 LZLPVE.exe 4552 XROID.exe 3660 RFTRFLB.exe 2884 XFAF.exe 4212 DFITFHE.exe 4628 XTN.exe 3524 QWQGV.exe 4168 NBOVCHE.exe 4348 YUR.exe 604 THWXU.exe 4184 UFPZ.exe 5132 AFXNKN.exe 4420 CVYPIC.exe 252 IVGD.exe 6008 TOBOZ.exe 1168 ROIJQ.exe 3316 OUOYXPT.exe 6048 FCQ.exe 5968 QVTW.exe 4468 AAEOZ.exe 3708 LSZHZG.exe 4964 NQAJGDW.exe 4656 TRHX.exe 5408 ZRPLYAZ.exe 5380 KJKDGH.exe 1592 OAZDS.exe 5536 KXXBZ.exe 4284 BIVQZ.exe 3876 WDAIJVO.exe 5912 NIKSZ.exe 2128 NWCGA.exe 2560 FRGKGVP.exe 2692 WERCW.exe 3944 MUSTCN.exe 1636 XNVMKUH.exe 5568 DNCAU.exe 2036 STIXBG.exe 3040 XTQLKBL.exe 2868 OEGJRVH.exe 4724 DZPNC.exe 4152 AFVKJS.exe 1324 USA.exe 2180 CXAI.exe 2476 MLLAL.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\SUACAQP.exe.bat OETUN.exe File created C:\windows\SysWOW64\LMET.exe.bat UDC.exe File created C:\windows\SysWOW64\ZQADOEQ.exe ECVMD.exe File opened for modification C:\windows\SysWOW64\OUOYXPT.exe ROIJQ.exe File opened for modification C:\windows\SysWOW64\HWSKD.exe JWKWURJ.exe File opened for modification C:\windows\SysWOW64\CYDRXYU.exe AACP.exe File opened for modification C:\windows\SysWOW64\AAZQRNG.exe LFB.exe File created C:\windows\SysWOW64\WERCW.exe.bat FRGKGVP.exe File created C:\windows\SysWOW64\BNRKZ.exe KFP.exe File created C:\windows\SysWOW64\NBOVCHE.exe QWQGV.exe File opened for modification C:\windows\SysWOW64\HZMLQWL.exe YMCT.exe File created C:\windows\SysWOW64\FDROKS.exe SSJ.exe File opened for modification C:\windows\SysWOW64\NBOVCHE.exe QWQGV.exe File created C:\windows\SysWOW64\CYDRXYU.exe AACP.exe File created C:\windows\SysWOW64\JPN.exe.bat HZMLQWL.exe File created C:\windows\SysWOW64\FTL.exe FQZR.exe File created C:\windows\SysWOW64\RFTRFLB.exe XROID.exe File opened for modification C:\windows\SysWOW64\WTFVPMG.exe NFUDHQ.exe File created C:\windows\SysWOW64\HZMLQWL.exe YMCT.exe File opened for modification C:\windows\SysWOW64\FDROKS.exe SSJ.exe File opened for modification C:\windows\SysWOW64\FCQ.exe OUOYXPT.exe File created C:\windows\SysWOW64\MVBE.exe.bat BDY.exe File opened for modification C:\windows\SysWOW64\EXU.exe PCKYN.exe File created C:\windows\SysWOW64\WTFVPMG.exe.bat NFUDHQ.exe File created C:\windows\SysWOW64\ECVMD.exe.bat AMG.exe File created C:\windows\SysWOW64\KXXBZ.exe.bat OAZDS.exe File opened for modification C:\windows\SysWOW64\ZYZJKY.exe QQXE.exe File created C:\windows\SysWOW64\YVZDMUO.exe NCWKDN.exe File created C:\windows\SysWOW64\AAEOZ.exe.bat QVTW.exe File opened for modification C:\windows\SysWOW64\SUACAQP.exe OETUN.exe File created C:\windows\SysWOW64\OUOYXPT.exe ROIJQ.exe File created C:\windows\SysWOW64\MVBE.exe BDY.exe File opened for modification C:\windows\SysWOW64\WPWJHN.exe WXOPTB.exe File opened for modification C:\windows\SysWOW64\ECVMD.exe AMG.exe File opened for modification C:\windows\SysWOW64\ZQADOEQ.exe ECVMD.exe File created C:\windows\SysWOW64\MUSTCN.exe WERCW.exe File opened for modification C:\windows\SysWOW64\MUSTCN.exe WERCW.exe File created C:\windows\SysWOW64\HWSKD.exe.bat JWKWURJ.exe File created C:\windows\SysWOW64\BNRKZ.exe.bat KFP.exe File created C:\windows\SysWOW64\QVWGP.exe FDTN.exe File created C:\windows\SysWOW64\QVWGP.exe.bat FDTN.exe File created C:\windows\SysWOW64\LMET.exe UDC.exe File created C:\windows\SysWOW64\VHRIOBH.exe TMNZE.exe File created C:\windows\SysWOW64\FCQ.exe OUOYXPT.exe File created C:\windows\SysWOW64\OAZDS.exe KJKDGH.exe File created C:\windows\SysWOW64\BFXDKTG.exe KSML.exe File created C:\windows\SysWOW64\QKVSRD.exe BFXDKTG.exe File created C:\windows\SysWOW64\QKVSRD.exe.bat BFXDKTG.exe File opened for modification C:\windows\SysWOW64\WDEGRIH.exe ZYZJKY.exe File opened for modification C:\windows\SysWOW64\HKMWSR.exe DUF.exe File opened for modification C:\windows\SysWOW64\YVZDMUO.exe NCWKDN.exe File created C:\windows\SysWOW64\XFAF.exe RFTRFLB.exe File created C:\windows\SysWOW64\AAEOZ.exe QVTW.exe File opened for modification C:\windows\SysWOW64\XNVMKUH.exe MUSTCN.exe File created C:\windows\SysWOW64\WDEGRIH.exe ZYZJKY.exe File created C:\windows\SysWOW64\JLLU.exe.bat NGFWLMO.exe File opened for modification C:\windows\SysWOW64\JGT.exe YNYLNCH.exe File created C:\windows\SysWOW64\AAZQRNG.exe.bat LFB.exe File created C:\windows\SysWOW64\SUACAQP.exe OETUN.exe File created C:\windows\SysWOW64\XFAF.exe.bat RFTRFLB.exe File opened for modification C:\windows\SysWOW64\KXXBZ.exe OAZDS.exe File created C:\windows\SysWOW64\EWDJL.exe.bat MVBE.exe File created C:\windows\SysWOW64\ZQADOEQ.exe.bat ECVMD.exe File created C:\windows\SysWOW64\XNVMKUH.exe.bat MUSTCN.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\BDY.exe.bat QKVSRD.exe File created C:\windows\system\JWKWURJ.exe EWDJL.exe File created C:\windows\system\XKVP.exe EPSLZBG.exe File created C:\windows\system\OETUN.exe FDROKS.exe File created C:\windows\system\FDTN.exe.bat ZCLZYNV.exe File opened for modification C:\windows\BIVQZ.exe KXXBZ.exe File created C:\windows\NRJFVU.exe KDEW.exe File created C:\windows\WDAIJVO.exe BIVQZ.exe File created C:\windows\XRIW.exe LBBOO.exe File opened for modification C:\windows\system\RMGG.exe FTL.exe File opened for modification C:\windows\system\NIKSZ.exe WDAIJVO.exe File created C:\windows\system\NGFWLMO.exe.bat UDBTG.exe File created C:\windows\ZCLZYNV.exe PUJUUQ.exe File created C:\windows\system\CXAI.exe.bat USA.exe File opened for modification C:\windows\system\BDY.exe QKVSRD.exe File created C:\windows\BEM.exe WDEGRIH.exe File created C:\windows\TMNZE.exe JLLU.exe File opened for modification C:\windows\NRJFVU.exe KDEW.exe File created C:\windows\system\AMG.exe URPLUJQ.exe File created C:\windows\system\ECGCM.exe.bat SUACAQP.exe File opened for modification C:\windows\XTN.exe DFITFHE.exe File opened for modification C:\windows\system\DZPNC.exe OEGJRVH.exe File opened for modification C:\windows\TMNZE.exe JLLU.exe File opened for modification C:\windows\SQL.exe WTFVPMG.exe File created C:\windows\system\YMCT.exe.bat SQL.exe File opened for modification C:\windows\EJHFW.exe EVHRV.exe File created C:\windows\PUJUUQ.exe.bat ECGCM.exe File created C:\windows\NQAJGDW.exe LSZHZG.exe File created C:\windows\system\PPV.exe.bat JPN.exe File created C:\windows\system\QBCYEJH.exe EJHFW.exe File created C:\windows\system\NGFWLMO.exe UDBTG.exe File opened for modification C:\windows\system\NCWKDN.exe EXMSO.exe File created C:\windows\FMWCO.exe LRRT.exe File opened for modification C:\windows\PUJUUQ.exe ECGCM.exe File created C:\windows\YUR.exe.bat NBOVCHE.exe File created C:\windows\system\TOBOZ.exe.bat IVGD.exe File opened for modification C:\windows\STIXBG.exe DNCAU.exe File created C:\windows\LBBOO.exe.bat UQDZ.exe File opened for modification C:\windows\BEM.exe WDEGRIH.exe File opened for modification C:\windows\FMWCO.exe LRRT.exe File created C:\windows\system\VGIFNGZ.exe PGASE.exe File created C:\windows\AFXNKN.exe.bat UFPZ.exe File created C:\windows\QVTW.exe.bat FCQ.exe File created C:\windows\system\DZPNC.exe OEGJRVH.exe File created C:\windows\MDXIBZB.exe BLC.exe File created C:\windows\system\QBCYEJH.exe.bat EJHFW.exe File created C:\windows\PGASE.exe.bat JGT.exe File created C:\windows\system\FQZR.exe.bat ZQADOEQ.exe File created C:\windows\system\FRGKGVP.exe NWCGA.exe File created C:\windows\STIXBG.exe.bat DNCAU.exe File created C:\windows\UDBTG.exe.bat YFV.exe File opened for modification C:\windows\UFPZ.exe THWXU.exe File opened for modification C:\windows\UDBTG.exe YFV.exe File opened for modification C:\windows\system\QBCYEJH.exe EJHFW.exe File opened for modification C:\windows\system\ECGCM.exe SUACAQP.exe File created C:\windows\system\FQZR.exe ZQADOEQ.exe File opened for modification C:\windows\system\IVGD.exe CVYPIC.exe File opened for modification C:\windows\XDGTTI.exe MLLAL.exe File opened for modification C:\windows\system\YNYLNCH.exe WPWJHN.exe File opened for modification C:\windows\DNCAU.exe XNVMKUH.exe File opened for modification C:\windows\system\TOBOZ.exe IVGD.exe File created C:\windows\system\NWCGA.exe NIKSZ.exe File created C:\windows\system\DXA.exe USQAH.exe File created C:\windows\QQXE.exe EXU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5836 cmd.exe 4804 cmd.exe 5420 cmd.exe 5348 cmd.exe 3252 cmd.exe 804 cmd.exe 5424 cmd.exe 1652 cmd.exe 4644 cmd.exe 5860 cmd.exe 5732 cmd.exe 5656 cmd.exe 2172 cmd.exe 3968 cmd.exe 4188 cmd.exe 3432 cmd.exe 6128 cmd.exe 4820 cmd.exe 5744 cmd.exe 996 cmd.exe 4408 cmd.exe 1032 cmd.exe 1912 cmd.exe 2848 cmd.exe 4936 cmd.exe 1896 cmd.exe 3736 cmd.exe 1072 cmd.exe 3196 cmd.exe 2448 cmd.exe 2968 cmd.exe 1108 cmd.exe 4876 cmd.exe 3588 cmd.exe 5820 cmd.exe 2324 cmd.exe 4164 cmd.exe 2100 cmd.exe 1044 cmd.exe 5616 cmd.exe 688 cmd.exe 1464 cmd.exe 2964 cmd.exe 5076 cmd.exe 1680 cmd.exe 1260 cmd.exe 4516 cmd.exe 3296 cmd.exe 6060 cmd.exe 1280 cmd.exe 5548 cmd.exe 4768 cmd.exe 5944 cmd.exe 5608 cmd.exe 3896 cmd.exe 4268 cmd.exe 3684 cmd.exe 2796 cmd.exe 3808 cmd.exe 5980 cmd.exe 5976 cmd.exe 3264 cmd.exe 5376 cmd.exe 2040 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2468 5780 WerFault.exe 87 4640 5372 WerFault.exe 93 3940 3420 WerFault.exe 99 456 420 WerFault.exe 104 4456 1640 WerFault.exe 109 3600 5128 WerFault.exe 114 5536 4352 WerFault.exe 119 3340 568 WerFault.exe 124 6128 3088 WerFault.exe 129 1140 5464 WerFault.exe 134 5168 2904 WerFault.exe 139 3476 2076 WerFault.exe 144 5200 3868 WerFault.exe 149 5924 5096 WerFault.exe 154 5528 880 WerFault.exe 159 3308 620 WerFault.exe 164 4228 4456 WerFault.exe 169 2068 2500 WerFault.exe 174 3780 3008 WerFault.exe 179 4088 3340 WerFault.exe 184 2004 4076 WerFault.exe 189 4524 2360 WerFault.exe 194 4692 4552 WerFault.exe 199 252 3660 WerFault.exe 204 1880 2884 WerFault.exe 209 2428 4212 WerFault.exe 214 2876 4628 WerFault.exe 219 4820 3524 WerFault.exe 224 3432 4168 WerFault.exe 229 3696 4348 WerFault.exe 234 536 604 WerFault.exe 239 5052 4184 WerFault.exe 244 2560 5132 WerFault.exe 249 2120 4420 WerFault.exe 254 5692 252 WerFault.exe 259 5672 6008 WerFault.exe 264 4752 1168 WerFault.exe 269 1748 3316 WerFault.exe 274 1696 6048 WerFault.exe 279 5444 5968 WerFault.exe 285 5820 4468 WerFault.exe 290 5848 3708 WerFault.exe 295 5136 4964 WerFault.exe 300 1756 4656 WerFault.exe 305 6036 5408 WerFault.exe 310 3144 5380 WerFault.exe 315 4820 1592 WerFault.exe 320 4768 5536 WerFault.exe 325 3120 4284 WerFault.exe 330 2776 3876 WerFault.exe 335 4652 5912 WerFault.exe 340 2412 2128 WerFault.exe 345 5708 2560 WerFault.exe 350 932 2692 WerFault.exe 355 3108 3944 WerFault.exe 360 4288 1636 WerFault.exe 365 3152 5568 WerFault.exe 370 1696 2036 WerFault.exe 375 4740 3040 WerFault.exe 380 4364 2868 WerFault.exe 385 4408 4724 WerFault.exe 390 4692 4152 WerFault.exe 395 5020 1324 WerFault.exe 400 5108 2180 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZYZJKY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XDGTTI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TMNZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJHFW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXOPTB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QWQGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIVQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDROKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUSTCN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVWGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZPNC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-01_d3eda9ffd3e0bb200ead692481845bb3_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OETUN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NQAJGDW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QKVSRD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVTW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAZQRNG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FQZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LZLPVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKJY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSFBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XBQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YVZDMUO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSML.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFXDKTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNRKZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGASE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUJUUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5780 2026-11-01_d3eda9ffd3e0bb200ead692481845bb3_elex_emotet_stop.exe 5780 2026-11-01_d3eda9ffd3e0bb200ead692481845bb3_elex_emotet_stop.exe 5372 LFB.exe 5372 LFB.exe 3420 AAZQRNG.exe 3420 AAZQRNG.exe 420 SSJ.exe 420 SSJ.exe 1640 FDROKS.exe 1640 FDROKS.exe 5128 OETUN.exe 5128 OETUN.exe 4352 SUACAQP.exe 4352 SUACAQP.exe 568 ECGCM.exe 568 ECGCM.exe 3088 PUJUUQ.exe 3088 PUJUUQ.exe 5464 ZCLZYNV.exe 5464 ZCLZYNV.exe 2904 FDTN.exe 2904 FDTN.exe 2076 QVWGP.exe 2076 QVWGP.exe 3868 UDC.exe 3868 UDC.exe 5096 LMET.exe 5096 LMET.exe 880 URPLUJQ.exe 880 URPLUJQ.exe 620 AMG.exe 620 AMG.exe 4456 ECVMD.exe 4456 ECVMD.exe 2500 ZQADOEQ.exe 2500 ZQADOEQ.exe 3008 FQZR.exe 3008 FQZR.exe 3340 FTL.exe 3340 FTL.exe 4076 RMGG.exe 4076 RMGG.exe 2360 LZLPVE.exe 2360 LZLPVE.exe 4552 XROID.exe 4552 XROID.exe 3660 RFTRFLB.exe 3660 RFTRFLB.exe 2884 XFAF.exe 2884 XFAF.exe 4212 DFITFHE.exe 4212 DFITFHE.exe 4628 XTN.exe 4628 XTN.exe 3524 QWQGV.exe 3524 QWQGV.exe 4168 NBOVCHE.exe 4168 NBOVCHE.exe 4348 YUR.exe 4348 YUR.exe 604 THWXU.exe 604 THWXU.exe 4184 UFPZ.exe 4184 UFPZ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5780 2026-11-01_d3eda9ffd3e0bb200ead692481845bb3_elex_emotet_stop.exe 5780 2026-11-01_d3eda9ffd3e0bb200ead692481845bb3_elex_emotet_stop.exe 5372 LFB.exe 5372 LFB.exe 3420 AAZQRNG.exe 3420 AAZQRNG.exe 420 SSJ.exe 420 SSJ.exe 1640 FDROKS.exe 1640 FDROKS.exe 5128 OETUN.exe 5128 OETUN.exe 4352 SUACAQP.exe 4352 SUACAQP.exe 568 ECGCM.exe 568 ECGCM.exe 3088 PUJUUQ.exe 3088 PUJUUQ.exe 5464 ZCLZYNV.exe 5464 ZCLZYNV.exe 2904 FDTN.exe 2904 FDTN.exe 2076 QVWGP.exe 2076 QVWGP.exe 3868 UDC.exe 3868 UDC.exe 5096 LMET.exe 5096 LMET.exe 880 URPLUJQ.exe 880 URPLUJQ.exe 620 AMG.exe 620 AMG.exe 4456 ECVMD.exe 4456 ECVMD.exe 2500 ZQADOEQ.exe 2500 ZQADOEQ.exe 3008 FQZR.exe 3008 FQZR.exe 3340 FTL.exe 3340 FTL.exe 4076 RMGG.exe 4076 RMGG.exe 2360 LZLPVE.exe 2360 LZLPVE.exe 4552 XROID.exe 4552 XROID.exe 3660 RFTRFLB.exe 3660 RFTRFLB.exe 2884 XFAF.exe 2884 XFAF.exe 4212 DFITFHE.exe 4212 DFITFHE.exe 4628 XTN.exe 4628 XTN.exe 3524 QWQGV.exe 3524 QWQGV.exe 4168 NBOVCHE.exe 4168 NBOVCHE.exe 4348 YUR.exe 4348 YUR.exe 604 THWXU.exe 604 THWXU.exe 4184 UFPZ.exe 4184 UFPZ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5780 wrote to memory of 5836 5780 2026-11-01_d3eda9ffd3e0bb200ead692481845bb3_elex_emotet_stop.exe 89 PID 5836 wrote to memory of 5372 5836 cmd.exe 93 PID 5372 wrote to memory of 1664 5372 LFB.exe 95 PID 1664 wrote to memory of 3420 1664 cmd.exe 99 PID 3420 wrote to memory of 4648 3420 AAZQRNG.exe 100 PID 4648 wrote to memory of 420 4648 cmd.exe 104 PID 420 wrote to memory of 4360 420 SSJ.exe 105 PID 4360 wrote to memory of 1640 4360 cmd.exe 109 PID 1640 wrote to memory of 2968 1640 FDROKS.exe 110 PID 2968 wrote to memory of 5128 2968 cmd.exe 114 PID 5128 wrote to memory of 1184 5128 OETUN.exe 115 PID 1184 wrote to memory of 4352 1184 cmd.exe 119 PID 4352 wrote to memory of 4528 4352 SUACAQP.exe 120 PID 4528 wrote to memory of 568 4528 cmd.exe 124 PID 568 wrote to memory of 5024 568 ECGCM.exe 125 PID 5024 wrote to memory of 3088 5024 cmd.exe 129 PID 3088 wrote to memory of 3728 3088 PUJUUQ.exe 130 PID 3728 wrote to memory of 5464 3728 cmd.exe 134 PID 5464 wrote to memory of 2328 5464 ZCLZYNV.exe 135 PID 2328 wrote to memory of 2904 2328 cmd.exe 139 PID 2904 wrote to memory of 1108 2904 FDTN.exe 140 PID 1108 wrote to memory of 2076 1108 cmd.exe 144 PID 2076 wrote to memory of 5532 2076 QVWGP.exe 145 PID 5532 wrote to memory of 3868 5532 cmd.exe 149 PID 3868 wrote to memory of 1460 3868 UDC.exe 150 PID 1460 wrote to memory of 5096 1460 cmd.exe 154 PID 5096 wrote to memory of 5560 5096 LMET.exe 155 PID 5560 wrote to memory of 880 5560 cmd.exe 159 PID 880 wrote to memory of 4188 880 URPLUJQ.exe 160 PID 4188 wrote to memory of 620 4188 cmd.exe 164 PID 620 wrote to memory of 4268 620 AMG.exe 165 PID 4268 wrote to memory of 4456 4268 cmd.exe 169 PID 4456 wrote to memory of 4876 4456 ECVMD.exe 170 PID 4876 wrote to memory of 2500 4876 cmd.exe 174 PID 2500 wrote to memory of 4160 2500 ZQADOEQ.exe 175 PID 4160 wrote to memory of 3008 4160 cmd.exe 179 PID 3008 wrote to memory of 5500 3008 FQZR.exe 180 PID 5500 wrote to memory of 3340 5500 cmd.exe 184 PID 3340 wrote to memory of 5424 3340 FTL.exe 185 PID 5424 wrote to memory of 4076 5424 cmd.exe 189 PID 4076 wrote to memory of 4660 4076 RMGG.exe 190 PID 4660 wrote to memory of 2360 4660 cmd.exe 194 PID 2360 wrote to memory of 4300 2360 LZLPVE.exe 195 PID 4300 wrote to memory of 4552 4300 cmd.exe 199 PID 4552 wrote to memory of 4556 4552 XROID.exe 200 PID 4556 wrote to memory of 3660 4556 cmd.exe 204 PID 3660 wrote to memory of 688 3660 RFTRFLB.exe 205 PID 688 wrote to memory of 2884 688 cmd.exe 209 PID 2884 wrote to memory of 2080 2884 XFAF.exe 210 PID 2080 wrote to memory of 4212 2080 cmd.exe 214 PID 4212 wrote to memory of 2040 4212 DFITFHE.exe 215 PID 2040 wrote to memory of 4628 2040 cmd.exe 219 PID 4628 wrote to memory of 4600 4628 XTN.exe 220 PID 4600 wrote to memory of 3524 4600 cmd.exe 224 PID 3524 wrote to memory of 2748 3524 QWQGV.exe 225 PID 2748 wrote to memory of 4168 2748 cmd.exe 229 PID 4168 wrote to memory of 1956 4168 NBOVCHE.exe 230 PID 1956 wrote to memory of 4348 1956 cmd.exe 234 PID 4348 wrote to memory of 3780 4348 YUR.exe 235 PID 3780 wrote to memory of 604 3780 cmd.exe 239 PID 604 wrote to memory of 4792 604 THWXU.exe 240 PID 4792 wrote to memory of 4184 4792 cmd.exe 244 PID 4184 wrote to memory of 6084 4184 UFPZ.exe 245 PID 6084 wrote to memory of 5132 6084 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_d3eda9ffd3e0bb200ead692481845bb3_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_d3eda9ffd3e0bb200ead692481845bb3_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFB.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\windows\system\LFB.exeC:\windows\system\LFB.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAZQRNG.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\windows\SysWOW64\AAZQRNG.exeC:\windows\system32\AAZQRNG.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SSJ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\windows\system\SSJ.exeC:\windows\system\SSJ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FDROKS.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\windows\SysWOW64\FDROKS.exeC:\windows\system32\FDROKS.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OETUN.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\windows\system\OETUN.exeC:\windows\system\OETUN.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUACAQP.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\windows\SysWOW64\SUACAQP.exeC:\windows\system32\SUACAQP.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECGCM.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\windows\system\ECGCM.exeC:\windows\system\ECGCM.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUJUUQ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\windows\PUJUUQ.exeC:\windows\PUJUUQ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZCLZYNV.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\windows\ZCLZYNV.exeC:\windows\ZCLZYNV.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FDTN.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\windows\system\FDTN.exeC:\windows\system\FDTN.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVWGP.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\windows\SysWOW64\QVWGP.exeC:\windows\system32\QVWGP.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UDC.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\windows\UDC.exeC:\windows\UDC.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LMET.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\windows\SysWOW64\LMET.exeC:\windows\system32\LMET.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\URPLUJQ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\windows\URPLUJQ.exeC:\windows\URPLUJQ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMG.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\windows\system\AMG.exeC:\windows\system\AMG.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ECVMD.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\windows\SysWOW64\ECVMD.exeC:\windows\system32\ECVMD.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQADOEQ.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\windows\SysWOW64\ZQADOEQ.exeC:\windows\system32\ZQADOEQ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQZR.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\windows\system\FQZR.exeC:\windows\system\FQZR.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FTL.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\windows\SysWOW64\FTL.exeC:\windows\system32\FTL.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RMGG.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\windows\system\RMGG.exeC:\windows\system\RMGG.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LZLPVE.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\windows\system\LZLPVE.exeC:\windows\system\LZLPVE.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XROID.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\windows\system\XROID.exeC:\windows\system\XROID.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RFTRFLB.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\windows\SysWOW64\RFTRFLB.exeC:\windows\system32\RFTRFLB.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFAF.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:688 -
C:\windows\SysWOW64\XFAF.exeC:\windows\system32\XFAF.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DFITFHE.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\windows\DFITFHE.exeC:\windows\DFITFHE.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTN.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\windows\XTN.exeC:\windows\XTN.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWQGV.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\windows\system\QWQGV.exeC:\windows\system\QWQGV.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NBOVCHE.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\windows\SysWOW64\NBOVCHE.exeC:\windows\system32\NBOVCHE.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUR.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\windows\YUR.exeC:\windows\YUR.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THWXU.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\windows\THWXU.exeC:\windows\THWXU.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFPZ.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\windows\UFPZ.exeC:\windows\UFPZ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFXNKN.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\windows\AFXNKN.exeC:\windows\AFXNKN.exe65⤵
- Executes dropped EXE
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CVYPIC.exe.bat" "66⤵PID:4220
-
C:\windows\system\CVYPIC.exeC:\windows\system\CVYPIC.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IVGD.exe.bat" "68⤵PID:3344
-
C:\windows\system\IVGD.exeC:\windows\system\IVGD.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TOBOZ.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:5588 -
C:\windows\system\TOBOZ.exeC:\windows\system\TOBOZ.exe71⤵
- Executes dropped EXE
PID:6008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ROIJQ.exe.bat" "72⤵
- Executes a command shell one-liner
PID:1652 -
C:\windows\system\ROIJQ.exeC:\windows\system\ROIJQ.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUOYXPT.exe.bat" "74⤵PID:6004
-
C:\windows\SysWOW64\OUOYXPT.exeC:\windows\system32\OUOYXPT.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCQ.exe.bat" "76⤵PID:1080
-
C:\windows\SysWOW64\FCQ.exeC:\windows\system32\FCQ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVTW.exe.bat" "78⤵
- Executes a command shell one-liner
PID:3432 -
C:\windows\QVTW.exeC:\windows\QVTW.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAEOZ.exe.bat" "80⤵PID:1772
-
C:\windows\SysWOW64\AAEOZ.exeC:\windows\system32\AAEOZ.exe81⤵
- Executes dropped EXE
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LSZHZG.exe.bat" "82⤵
- Executes a command shell one-liner
PID:1912 -
C:\windows\LSZHZG.exeC:\windows\LSZHZG.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NQAJGDW.exe.bat" "84⤵PID:3956
-
C:\windows\NQAJGDW.exeC:\windows\NQAJGDW.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRHX.exe.bat" "86⤵PID:6076
-
C:\windows\system\TRHX.exeC:\windows\system\TRHX.exe87⤵
- Executes dropped EXE
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRPLYAZ.exe.bat" "88⤵PID:108
-
C:\windows\system\ZRPLYAZ.exeC:\windows\system\ZRPLYAZ.exe89⤵
- Executes dropped EXE
PID:5408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJKDGH.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2468 -
C:\windows\SysWOW64\KJKDGH.exeC:\windows\system32\KJKDGH.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OAZDS.exe.bat" "92⤵
- Executes a command shell one-liner
PID:2848 -
C:\windows\SysWOW64\OAZDS.exeC:\windows\system32\OAZDS.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXXBZ.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3684 -
C:\windows\SysWOW64\KXXBZ.exeC:\windows\system32\KXXBZ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BIVQZ.exe.bat" "96⤵PID:2032
-
C:\windows\BIVQZ.exeC:\windows\BIVQZ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDAIJVO.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3296 -
C:\windows\WDAIJVO.exeC:\windows\WDAIJVO.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NIKSZ.exe.bat" "100⤵PID:4952
-
C:\windows\system\NIKSZ.exeC:\windows\system\NIKSZ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NWCGA.exe.bat" "102⤵PID:2004
-
C:\windows\system\NWCGA.exeC:\windows\system\NWCGA.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FRGKGVP.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4644 -
C:\windows\system\FRGKGVP.exeC:\windows\system\FRGKGVP.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WERCW.exe.bat" "106⤵PID:2756
-
C:\windows\SysWOW64\WERCW.exeC:\windows\system32\WERCW.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUSTCN.exe.bat" "108⤵PID:4144
-
C:\windows\SysWOW64\MUSTCN.exeC:\windows\system32\MUSTCN.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNVMKUH.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:1052 -
C:\windows\SysWOW64\XNVMKUH.exeC:\windows\system32\XNVMKUH.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNCAU.exe.bat" "112⤵PID:5688
-
C:\windows\DNCAU.exeC:\windows\DNCAU.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\STIXBG.exe.bat" "114⤵PID:4320
-
C:\windows\STIXBG.exeC:\windows\STIXBG.exe115⤵
- Executes dropped EXE
PID:2036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTQLKBL.exe.bat" "116⤵PID:5100
-
C:\windows\XTQLKBL.exeC:\windows\XTQLKBL.exe117⤵
- Executes dropped EXE
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OEGJRVH.exe.bat" "118⤵PID:4136
-
C:\windows\SysWOW64\OEGJRVH.exeC:\windows\system32\OEGJRVH.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DZPNC.exe.bat" "120⤵
- Executes a command shell one-liner
PID:4804 -
C:\windows\system\DZPNC.exeC:\windows\system\DZPNC.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-