Analysis
- max time kernel
90s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 17:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-02_fd5d6ac2762d6ba8c86b3fdd44bb3ab5_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-11-02_fd5d6ac2762d6ba8c86b3fdd44bb3ab5_elex_emotet_stop.exe
- Size 208KB
- Sample261102-vtrznaxy4m
- SHA256 99fb15dc1ae40de5f34e3822d3e7ff8d968ddc066e5f9894c7cafe2f8ff5130a
- MD5 fd5d6ac2762d6ba8c86b3fdd44bb3ab5
- SHA1 094df969d7db160074f0f4343c1fc91d4232a15e
- SHA512 9bd56438c486536e746da1f661c78e85432bc0390f1605d2f960b8b427085cbd7d91563889a36a548db552957400e7777483d2c0edae83e532c28a46bed820b8
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfT4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOLkEj1
- TLSH T149247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1220 VMBYOSU.exe 1956 EKVZHWD.exe 2188 TFFDS.exe 5524 TTXSUW.exe 2300 ELALCDW.exe 2740 ROIJQ.exe 3204 JXKO.exe 5268 NFROGD.exe 4308 QVG.exe 5576 CNBHT.exe 5116 AYLX.exe 6024 BBPBH.exe 3164 ARAW.exe 5520 YMAFYHO.exe 4780 SZE.exe 2872 OKNFXS.exe 2728 GNZ.exe 4492 YNTNOFC.exe 2920 BEHW.exe 1068 UZLRFN.exe 4864 XUQ.exe 5656 RHVK.exe 2524 GCEWLIL.exe 2420 FYDXI.exe 2400 KYLLZ.exe 3968 QYL.exe 4992 QEL.exe 684 LOB.exe 3068 CZEUGDQ.exe 2032 XQNHWT.exe 4060 BYT.exe 900 WLYYK.exe 1260 NTADWQT.exe 5036 IHF.exe 2076 VRN.exe 3716 QFSVW.exe 5004 SSXEHTG.exe 6036 SFX.exe 1960 BLI.exe 5344 EGMUI.exe 1604 VRDSI.exe 2000 IULJW.exe 5388 OUTWFC.exe 5628 OIT.exe 4692 SQATTZ.exe 4368 JQCYWEX.exe 5828 PQJM.exe 5384 YZLRRE.exe 3308 PMW.exe 4436 BER.exe 4836 VSWL.exe 6112 OVH.exe 4292 UVHCG.exe 4108 DVJIRXF.exe 2260 WOM.exe 5852 IGPL.exe 3704 PBYXL.exe 124 GKA.exe 2376 GUJE.exe 4580 RNEPK.exe 3936 JVGCOD.exe 4344 SIRU.exe 5436 MWVDOA.exe 4940 SRVESD.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\ZAB.exe.bat ZXXGJK.exe File opened for modification C:\windows\SysWOW64\HTU.exe BTMQGWW.exe File opened for modification C:\windows\SysWOW64\XPXJ.exe QTGAUS.exe File opened for modification C:\windows\SysWOW64\TTXSUW.exe TFFDS.exe File opened for modification C:\windows\SysWOW64\QYL.exe KYLLZ.exe File created C:\windows\SysWOW64\QYL.exe KYLLZ.exe File created C:\windows\SysWOW64\NTADWQT.exe WLYYK.exe File created C:\windows\SysWOW64\QFSVW.exe.bat VRN.exe File created C:\windows\SysWOW64\VRDSI.exe EGMUI.exe File opened for modification C:\windows\SysWOW64\HGF.exe ZAB.exe File created C:\windows\SysWOW64\OOTX.exe QNLJNMJ.exe File created C:\windows\SysWOW64\XCMF.exe AWGHHDW.exe File created C:\windows\SysWOW64\FGZBO.exe.bat KSU.exe File opened for modification C:\windows\SysWOW64\SZE.exe YMAFYHO.exe File opened for modification C:\windows\SysWOW64\TFFDS.exe EKVZHWD.exe File created C:\windows\SysWOW64\QFSVW.exe VRN.exe File created C:\windows\SysWOW64\IULJW.exe.bat VRDSI.exe File created C:\windows\SysWOW64\KSU.exe PXPIUC.exe File created C:\windows\SysWOW64\GKCZG.exe IUIWTJ.exe File created C:\windows\SysWOW64\GKCZG.exe.bat IUIWTJ.exe File created C:\windows\SysWOW64\TFFDS.exe.bat EKVZHWD.exe File created C:\windows\SysWOW64\RHVK.exe.bat XUQ.exe File created C:\windows\SysWOW64\IHF.exe.bat NTADWQT.exe File opened for modification C:\windows\SysWOW64\IULJW.exe VRDSI.exe File created C:\windows\SysWOW64\HGF.exe.bat ZAB.exe File created C:\windows\SysWOW64\NZUGIF.exe CGZW.exe File opened for modification C:\windows\SysWOW64\OOTX.exe QNLJNMJ.exe File created C:\windows\SysWOW64\XPXJ.exe QTGAUS.exe File created C:\windows\SysWOW64\SZE.exe YMAFYHO.exe File opened for modification C:\windows\SysWOW64\GKA.exe PBYXL.exe File created C:\windows\SysWOW64\GQVJ.exe XPT.exe File created C:\windows\SysWOW64\HTU.exe.bat BTMQGWW.exe File opened for modification C:\windows\SysWOW64\NZUGIF.exe CGZW.exe File created C:\windows\SysWOW64\ADB.exe FIWMCW.exe File opened for modification C:\windows\SysWOW64\FGZBO.exe KSU.exe File opened for modification C:\windows\SysWOW64\GKCZG.exe IUIWTJ.exe File created C:\windows\SysWOW64\RHVK.exe XUQ.exe File created C:\windows\SysWOW64\KYLLZ.exe.bat FYDXI.exe File created C:\windows\SysWOW64\QEL.exe QYL.exe File created C:\windows\SysWOW64\GKA.exe PBYXL.exe File created C:\windows\SysWOW64\AWWJ.exe NMNKSO.exe File opened for modification C:\windows\SysWOW64\AWWJ.exe NMNKSO.exe File created C:\windows\SysWOW64\FIWMCW.exe TAQM.exe File opened for modification C:\windows\SysWOW64\ADB.exe FIWMCW.exe File opened for modification C:\windows\SysWOW64\IHF.exe NTADWQT.exe File opened for modification C:\windows\SysWOW64\VRDSI.exe EGMUI.exe File created C:\windows\SysWOW64\FIWMCW.exe.bat TAQM.exe File created C:\windows\SysWOW64\VRN.exe IHF.exe File created C:\windows\SysWOW64\OUTWFC.exe IULJW.exe File created C:\windows\SysWOW64\OUTWFC.exe.bat IULJW.exe File opened for modification C:\windows\SysWOW64\YJCS.exe SRVESD.exe File created C:\windows\SysWOW64\AWWJ.exe.bat NMNKSO.exe File created C:\windows\SysWOW64\XPXJ.exe.bat QTGAUS.exe File created C:\windows\SysWOW64\ADB.exe.bat FIWMCW.exe File opened for modification C:\windows\SysWOW64\XCMF.exe AWGHHDW.exe File created C:\windows\SysWOW64\VRN.exe.bat IHF.exe File created C:\windows\SysWOW64\VRDSI.exe.bat EGMUI.exe File opened for modification C:\windows\SysWOW64\GQVJ.exe XPT.exe File created C:\windows\SysWOW64\GQVJ.exe.bat XPT.exe File opened for modification C:\windows\SysWOW64\DJGDE.exe SQL.exe File opened for modification C:\windows\SysWOW64\RHVK.exe XUQ.exe File created C:\windows\SysWOW64\IHF.exe NTADWQT.exe File opened for modification C:\windows\SysWOW64\QFSVW.exe VRN.exe File created C:\windows\SysWOW64\UVHCG.exe.bat OVH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\PBJWML.exe.bat DJGDE.exe File created C:\windows\system\PXPIUC.exe XCMF.exe File opened for modification C:\windows\system\GCEWLIL.exe RHVK.exe File created C:\windows\system\ELALCDW.exe TTXSUW.exe File opened for modification C:\windows\system\ROIJQ.exe ELALCDW.exe File opened for modification C:\windows\FTLY.exe BLFYVM.exe File created C:\windows\system\JQCYWEX.exe.bat SQATTZ.exe File created C:\windows\BBPBH.exe.bat AYLX.exe File created C:\windows\PQJM.exe.bat JQCYWEX.exe File created C:\windows\system\SIRU.exe JVGCOD.exe File created C:\windows\PBJWML.exe DJGDE.exe File created C:\windows\system\VCQJVN.exe.bat PBJWML.exe File created C:\windows\system\HAH.exe MPZCO.exe File created C:\windows\BER.exe.bat PMW.exe File opened for modification C:\windows\system\VSWL.exe BER.exe File opened for modification C:\windows\system\XCHG.exe CGCXXAR.exe File created C:\windows\TZB.exe.bat NZUGIF.exe File opened for modification C:\windows\TZB.exe NZUGIF.exe File created C:\windows\system\ELALCDW.exe.bat TTXSUW.exe File created C:\windows\SQATTZ.exe OIT.exe File created C:\windows\system\QTGAUS.exe.bat ZGWQEV.exe File opened for modification C:\windows\IUIWTJ.exe IGQIS.exe File opened for modification C:\windows\system\ELALCDW.exe TTXSUW.exe File created C:\windows\system\UZLRFN.exe.bat BEHW.exe File opened for modification C:\windows\system\GUJE.exe GKA.exe File opened for modification C:\windows\system\TFHBM.exe YJCS.exe File created C:\windows\system\VCQJVN.exe PBJWML.exe File created C:\windows\system\KYKI.exe EXCUMEQ.exe File created C:\windows\system\BEHW.exe.bat YNTNOFC.exe File created C:\windows\system\YDGBTWT.exe.bat GQVJ.exe File created C:\windows\system\AYLX.exe CNBHT.exe File opened for modification C:\windows\EGMUI.exe BLI.exe File opened for modification C:\windows\SQATTZ.exe OIT.exe File created C:\windows\system\QTGAUS.exe ZGWQEV.exe File created C:\windows\XUQ.exe UZLRFN.exe File opened for modification C:\windows\system\SFX.exe SSXEHTG.exe File created C:\windows\SSKL.exe.bat HAH.exe File created C:\windows\QVG.exe.bat NFROGD.exe File opened for modification C:\windows\YNTNOFC.exe GNZ.exe File created C:\windows\GJBYXD.exe GDJKW.exe File created C:\windows\system\YMAFYHO.exe.bat ARAW.exe File created C:\windows\system\GNZ.exe.bat OKNFXS.exe File created C:\windows\XQNHWT.exe UAGH.exe File opened for modification C:\windows\system\OVH.exe VSWL.exe File created C:\windows\system\GUJE.exe GKA.exe File opened for modification C:\windows\system\CGCXXAR.exe GJWAQRX.exe File opened for modification C:\windows\GJBYXD.exe GDJKW.exe File created C:\windows\BLFYVM.exe.bat FGZBO.exe File created C:\windows\system\IGPL.exe.bat WOM.exe File created C:\windows\system\ZNJWJO.exe TNBJ.exe File created C:\windows\system\VMBYOSU.exe.bat 2026-11-02_fd5d6ac2762d6ba8c86b3fdd44bb3ab5_elex_emotet_stop.exe File created C:\windows\XUQ.exe.bat UZLRFN.exe File created C:\windows\system\LOB.exe QEL.exe File created C:\windows\EGMUI.exe BLI.exe File opened for modification C:\windows\EXCUMEQ.exe TFHBM.exe File created C:\windows\system\CZEUGDQ.exe.bat LOB.exe File created C:\windows\RNEPK.exe GUJE.exe File opened for modification C:\windows\SSKL.exe HAH.exe File created C:\windows\system\VMBYOSU.exe 2026-11-02_fd5d6ac2762d6ba8c86b3fdd44bb3ab5_elex_emotet_stop.exe File created C:\windows\FYDXI.exe.bat GCEWLIL.exe File created C:\windows\system\SRVESD.exe.bat MWVDOA.exe File created C:\windows\EXCUMEQ.exe.bat TFHBM.exe File created C:\windows\SSKL.exe HAH.exe File created C:\windows\BLFYVM.exe FGZBO.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1456 cmd.exe 5804 cmd.exe 3020 cmd.exe 4516 cmd.exe 4524 cmd.exe 5584 cmd.exe 2836 cmd.exe 1392 cmd.exe 1008 cmd.exe 3360 cmd.exe 5504 cmd.exe 5788 cmd.exe 2184 cmd.exe 3956 cmd.exe 4280 cmd.exe 4140 cmd.exe 4644 cmd.exe 2360 cmd.exe 3708 cmd.exe 2760 cmd.exe 1164 cmd.exe 4472 cmd.exe 5884 cmd.exe 4244 cmd.exe 4916 cmd.exe 2924 cmd.exe 5912 cmd.exe 3392 cmd.exe 1268 cmd.exe 5744 cmd.exe 3112 cmd.exe 3580 cmd.exe 3556 cmd.exe 1180 cmd.exe 1548 cmd.exe 5972 cmd.exe 5336 cmd.exe 976 cmd.exe 5592 cmd.exe 2640 cmd.exe 120 cmd.exe 3684 cmd.exe 3116 cmd.exe 792 cmd.exe 3344 cmd.exe 5820 cmd.exe 4652 cmd.exe 260 cmd.exe 3276 cmd.exe 1536 cmd.exe 2280 cmd.exe 5508 cmd.exe 3004 cmd.exe 236 cmd.exe 4388 cmd.exe 3128 cmd.exe 4264 cmd.exe 2480 cmd.exe 4372 cmd.exe 3424 cmd.exe 5960 cmd.exe 5616 cmd.exe 5416 cmd.exe 5860 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5068 1264 WerFault.exe 86 5796 1220 WerFault.exe 92 5216 1956 WerFault.exe 98 2488 2188 WerFault.exe 103 4292 5524 WerFault.exe 108 6096 2300 WerFault.exe 113 5996 2740 WerFault.exe 118 4192 3204 WerFault.exe 123 980 5268 WerFault.exe 128 4508 4308 WerFault.exe 133 260 5576 WerFault.exe 138 4116 5116 WerFault.exe 143 4432 6024 WerFault.exe 148 6000 3164 WerFault.exe 153 6112 5520 WerFault.exe 158 984 4780 WerFault.exe 163 4992 2872 WerFault.exe 168 684 2728 WerFault.exe 173 3068 4492 WerFault.exe 178 5584 2920 WerFault.exe 183 5068 1068 WerFault.exe 188 2724 4864 WerFault.exe 193 3184 5656 WerFault.exe 198 1536 2524 WerFault.exe 203 1052 2420 WerFault.exe 208 6096 2400 WerFault.exe 213 3592 3968 WerFault.exe 218 5840 4992 WerFault.exe 223 1856 684 WerFault.exe 228 5416 3068 WerFault.exe 233 260 1200 WerFault.exe 238 4064 2032 WerFault.exe 243 5884 4060 WerFault.exe 248 1520 900 WerFault.exe 253 5544 1260 WerFault.exe 258 2768 5036 WerFault.exe 263 768 2076 WerFault.exe 268 4644 3716 WerFault.exe 273 4808 5004 WerFault.exe 278 3020 6036 WerFault.exe 284 3276 1960 WerFault.exe 289 4076 5344 WerFault.exe 294 2672 1604 WerFault.exe 299 4920 2000 WerFault.exe 304 4416 5388 WerFault.exe 309 3744 5628 WerFault.exe 314 4168 4692 WerFault.exe 319 2592 4368 WerFault.exe 324 5584 5828 WerFault.exe 329 3628 5384 WerFault.exe 334 4568 3308 WerFault.exe 339 5044 4436 WerFault.exe 344 4904 4836 WerFault.exe 349 4132 6112 WerFault.exe 354 1184 4292 WerFault.exe 359 4772 4108 WerFault.exe 364 5876 2260 WerFault.exe 369 1124 5852 WerFault.exe 374 4616 3704 WerFault.exe 379 5716 124 WerFault.exe 384 2804 2376 WerFault.exe 389 5776 4580 WerFault.exe 394 1920 3936 WerFault.exe 399 2964 4344 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROIJQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYLX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FGZBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EGMUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TAQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCQJVN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWGHHDW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YMAFYHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRVESD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UAGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUTWFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IGPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HTU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OOTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLFYVM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DVJIRXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IULJW.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1264 2026-11-02_fd5d6ac2762d6ba8c86b3fdd44bb3ab5_elex_emotet_stop.exe 1264 2026-11-02_fd5d6ac2762d6ba8c86b3fdd44bb3ab5_elex_emotet_stop.exe 1220 VMBYOSU.exe 1220 VMBYOSU.exe 1956 EKVZHWD.exe 1956 EKVZHWD.exe 2188 TFFDS.exe 2188 TFFDS.exe 5524 TTXSUW.exe 5524 TTXSUW.exe 2300 ELALCDW.exe 2300 ELALCDW.exe 2740 ROIJQ.exe 2740 ROIJQ.exe 3204 JXKO.exe 3204 JXKO.exe 5268 NFROGD.exe 5268 NFROGD.exe 4308 QVG.exe 4308 QVG.exe 5576 CNBHT.exe 5576 CNBHT.exe 5116 AYLX.exe 5116 AYLX.exe 6024 BBPBH.exe 6024 BBPBH.exe 3164 ARAW.exe 3164 ARAW.exe 5520 YMAFYHO.exe 5520 YMAFYHO.exe 4780 SZE.exe 4780 SZE.exe 2872 OKNFXS.exe 2872 OKNFXS.exe 2728 GNZ.exe 2728 GNZ.exe 4492 YNTNOFC.exe 4492 YNTNOFC.exe 2920 BEHW.exe 2920 BEHW.exe 1068 UZLRFN.exe 1068 UZLRFN.exe 4864 XUQ.exe 4864 XUQ.exe 5656 RHVK.exe 5656 RHVK.exe 2524 GCEWLIL.exe 2524 GCEWLIL.exe 2420 FYDXI.exe 2420 FYDXI.exe 2400 KYLLZ.exe 2400 KYLLZ.exe 3968 QYL.exe 3968 QYL.exe 4992 QEL.exe 4992 QEL.exe 684 LOB.exe 684 LOB.exe 1200 UAGH.exe 1200 UAGH.exe 2032 XQNHWT.exe 2032 XQNHWT.exe 4060 BYT.exe 4060 BYT.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1264 2026-11-02_fd5d6ac2762d6ba8c86b3fdd44bb3ab5_elex_emotet_stop.exe 1264 2026-11-02_fd5d6ac2762d6ba8c86b3fdd44bb3ab5_elex_emotet_stop.exe 1220 VMBYOSU.exe 1220 VMBYOSU.exe 1956 EKVZHWD.exe 1956 EKVZHWD.exe 2188 TFFDS.exe 2188 TFFDS.exe 5524 TTXSUW.exe 5524 TTXSUW.exe 2300 ELALCDW.exe 2300 ELALCDW.exe 2740 ROIJQ.exe 2740 ROIJQ.exe 3204 JXKO.exe 3204 JXKO.exe 5268 NFROGD.exe 5268 NFROGD.exe 4308 QVG.exe 4308 QVG.exe 5576 CNBHT.exe 5576 CNBHT.exe 5116 AYLX.exe 5116 AYLX.exe 6024 BBPBH.exe 6024 BBPBH.exe 3164 ARAW.exe 3164 ARAW.exe 5520 YMAFYHO.exe 5520 YMAFYHO.exe 4780 SZE.exe 4780 SZE.exe 2872 OKNFXS.exe 2872 OKNFXS.exe 2728 GNZ.exe 2728 GNZ.exe 4492 YNTNOFC.exe 4492 YNTNOFC.exe 2920 BEHW.exe 2920 BEHW.exe 1068 UZLRFN.exe 1068 UZLRFN.exe 4864 XUQ.exe 4864 XUQ.exe 5656 RHVK.exe 5656 RHVK.exe 2524 GCEWLIL.exe 2524 GCEWLIL.exe 2420 FYDXI.exe 2420 FYDXI.exe 2400 KYLLZ.exe 2400 KYLLZ.exe 3968 QYL.exe 3968 QYL.exe 4992 QEL.exe 4992 QEL.exe 684 LOB.exe 684 LOB.exe 1200 UAGH.exe 1200 UAGH.exe 2032 XQNHWT.exe 2032 XQNHWT.exe 4060 BYT.exe 4060 BYT.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1264 wrote to memory of 3200 1264 2026-11-02_fd5d6ac2762d6ba8c86b3fdd44bb3ab5_elex_emotet_stop.exe 88 PID 3200 wrote to memory of 1220 3200 cmd.exe 92 PID 1220 wrote to memory of 4140 1220 VMBYOSU.exe 94 PID 4140 wrote to memory of 1956 4140 cmd.exe 98 PID 1956 wrote to memory of 6032 1956 EKVZHWD.exe 99 PID 6032 wrote to memory of 2188 6032 cmd.exe 103 PID 2188 wrote to memory of 1164 2188 TFFDS.exe 104 PID 1164 wrote to memory of 5524 1164 cmd.exe 108 PID 5524 wrote to memory of 6008 5524 TTXSUW.exe 109 PID 6008 wrote to memory of 2300 6008 cmd.exe 113 PID 2300 wrote to memory of 2856 2300 ELALCDW.exe 114 PID 2856 wrote to memory of 2740 2856 cmd.exe 118 PID 2740 wrote to memory of 3112 2740 ROIJQ.exe 119 PID 3112 wrote to memory of 3204 3112 cmd.exe 123 PID 3204 wrote to memory of 1544 3204 JXKO.exe 124 PID 1544 wrote to memory of 5268 1544 cmd.exe 128 PID 5268 wrote to memory of 4916 5268 NFROGD.exe 129 PID 4916 wrote to memory of 4308 4916 cmd.exe 133 PID 4308 wrote to memory of 2884 4308 QVG.exe 134 PID 2884 wrote to memory of 5576 2884 cmd.exe 138 PID 5576 wrote to memory of 2152 5576 CNBHT.exe 139 PID 2152 wrote to memory of 5116 2152 cmd.exe 143 PID 5116 wrote to memory of 5820 5116 AYLX.exe 144 PID 5820 wrote to memory of 6024 5820 cmd.exe 148 PID 6024 wrote to memory of 5860 6024 BBPBH.exe 149 PID 5860 wrote to memory of 3164 5860 cmd.exe 153 PID 3164 wrote to memory of 2840 3164 ARAW.exe 154 PID 2840 wrote to memory of 5520 2840 cmd.exe 158 PID 5520 wrote to memory of 3580 5520 YMAFYHO.exe 159 PID 3580 wrote to memory of 4780 3580 cmd.exe 163 PID 4780 wrote to memory of 5924 4780 SZE.exe 164 PID 5924 wrote to memory of 2872 5924 cmd.exe 168 PID 2872 wrote to memory of 5808 2872 OKNFXS.exe 169 PID 5808 wrote to memory of 2728 5808 cmd.exe 173 PID 2728 wrote to memory of 428 2728 GNZ.exe 174 PID 428 wrote to memory of 4492 428 cmd.exe 178 PID 4492 wrote to memory of 4324 4492 YNTNOFC.exe 179 PID 4324 wrote to memory of 2920 4324 cmd.exe 183 PID 2920 wrote to memory of 1620 2920 BEHW.exe 184 PID 1620 wrote to memory of 1068 1620 cmd.exe 188 PID 1068 wrote to memory of 5844 1068 UZLRFN.exe 189 PID 5844 wrote to memory of 4864 5844 cmd.exe 193 PID 4864 wrote to memory of 752 4864 XUQ.exe 194 PID 752 wrote to memory of 5656 752 cmd.exe 198 PID 5656 wrote to memory of 568 5656 RHVK.exe 199 PID 568 wrote to memory of 2524 568 cmd.exe 203 PID 2524 wrote to memory of 4576 2524 GCEWLIL.exe 204 PID 4576 wrote to memory of 2420 4576 cmd.exe 208 PID 2420 wrote to memory of 1140 2420 FYDXI.exe 209 PID 1140 wrote to memory of 2400 1140 cmd.exe 213 PID 2400 wrote to memory of 5688 2400 KYLLZ.exe 214 PID 5688 wrote to memory of 3968 5688 cmd.exe 218 PID 3968 wrote to memory of 4980 3968 QYL.exe 219 PID 4980 wrote to memory of 4992 4980 cmd.exe 223 PID 4992 wrote to memory of 1456 4992 QEL.exe 224 PID 1456 wrote to memory of 684 1456 cmd.exe 228 PID 684 wrote to memory of 2496 684 LOB.exe 229 PID 2496 wrote to memory of 3068 2496 cmd.exe 233 PID 5648 wrote to memory of 1200 5648 cmd.exe 238 PID 1200 wrote to memory of 4276 1200 UAGH.exe 239 PID 4276 wrote to memory of 2032 4276 cmd.exe 243 PID 2032 wrote to memory of 1448 2032 XQNHWT.exe 244 PID 1448 wrote to memory of 4060 1448 cmd.exe 248 PID 4060 wrote to memory of 944 4060 BYT.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_fd5d6ac2762d6ba8c86b3fdd44bb3ab5_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_fd5d6ac2762d6ba8c86b3fdd44bb3ab5_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMBYOSU.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\windows\system\VMBYOSU.exeC:\windows\system\VMBYOSU.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EKVZHWD.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\windows\EKVZHWD.exeC:\windows\EKVZHWD.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TFFDS.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\windows\SysWOW64\TFFDS.exeC:\windows\system32\TFFDS.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTXSUW.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\windows\SysWOW64\TTXSUW.exeC:\windows\system32\TTXSUW.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELALCDW.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\windows\system\ELALCDW.exeC:\windows\system\ELALCDW.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ROIJQ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\windows\system\ROIJQ.exeC:\windows\system\ROIJQ.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JXKO.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\windows\SysWOW64\JXKO.exeC:\windows\system32\JXKO.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFROGD.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\windows\NFROGD.exeC:\windows\NFROGD.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVG.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\windows\QVG.exeC:\windows\QVG.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNBHT.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\windows\CNBHT.exeC:\windows\CNBHT.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AYLX.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\windows\system\AYLX.exeC:\windows\system\AYLX.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BBPBH.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\windows\BBPBH.exeC:\windows\BBPBH.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ARAW.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\windows\system\ARAW.exeC:\windows\system\ARAW.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YMAFYHO.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\windows\system\YMAFYHO.exeC:\windows\system\YMAFYHO.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SZE.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\windows\SysWOW64\SZE.exeC:\windows\system32\SZE.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OKNFXS.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\windows\OKNFXS.exeC:\windows\OKNFXS.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GNZ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\windows\system\GNZ.exeC:\windows\system\GNZ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YNTNOFC.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:428 -
C:\windows\YNTNOFC.exeC:\windows\YNTNOFC.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BEHW.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\windows\system\BEHW.exeC:\windows\system\BEHW.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UZLRFN.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\windows\system\UZLRFN.exeC:\windows\system\UZLRFN.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XUQ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\windows\XUQ.exeC:\windows\XUQ.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHVK.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\windows\SysWOW64\RHVK.exeC:\windows\system32\RHVK.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCEWLIL.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:568 -
C:\windows\system\GCEWLIL.exeC:\windows\system\GCEWLIL.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYDXI.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\windows\FYDXI.exeC:\windows\FYDXI.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYLLZ.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\windows\SysWOW64\KYLLZ.exeC:\windows\system32\KYLLZ.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QYL.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\windows\SysWOW64\QYL.exeC:\windows\system32\QYL.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEL.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\windows\SysWOW64\QEL.exeC:\windows\system32\QEL.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LOB.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\windows\system\LOB.exeC:\windows\system\LOB.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZEUGDQ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\windows\system\CZEUGDQ.exeC:\windows\system\CZEUGDQ.exe59⤵
- Executes dropped EXE
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UAGH.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\windows\UAGH.exeC:\windows\UAGH.exe61⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XQNHWT.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\windows\XQNHWT.exeC:\windows\XQNHWT.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BYT.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\windows\BYT.exeC:\windows\BYT.exe65⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WLYYK.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:944 -
C:\windows\WLYYK.exeC:\windows\WLYYK.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NTADWQT.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5960 -
C:\windows\SysWOW64\NTADWQT.exeC:\windows\system32\NTADWQT.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHF.exe.bat" "70⤵PID:3408
-
C:\windows\SysWOW64\IHF.exeC:\windows\system32\IHF.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRN.exe.bat" "72⤵PID:3056
-
C:\windows\SysWOW64\VRN.exeC:\windows\system32\VRN.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QFSVW.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:4100 -
C:\windows\SysWOW64\QFSVW.exeC:\windows\system32\QFSVW.exe75⤵
- Executes dropped EXE
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSXEHTG.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:3180 -
C:\windows\SSXEHTG.exeC:\windows\SSXEHTG.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFX.exe.bat" "78⤵PID:1508
-
C:\windows\system\SFX.exeC:\windows\system\SFX.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BLI.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5592 -
C:\windows\system\BLI.exeC:\windows\system\BLI.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EGMUI.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5804 -
C:\windows\EGMUI.exeC:\windows\EGMUI.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRDSI.exe.bat" "84⤵PID:824
-
C:\windows\SysWOW64\VRDSI.exeC:\windows\system32\VRDSI.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IULJW.exe.bat" "86⤵PID:4224
-
C:\windows\SysWOW64\IULJW.exeC:\windows\system32\IULJW.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUTWFC.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1008 -
C:\windows\SysWOW64\OUTWFC.exeC:\windows\system32\OUTWFC.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OIT.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:1896 -
C:\windows\system\OIT.exeC:\windows\system\OIT.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SQATTZ.exe.bat" "92⤵
- Executes a command shell one-liner
PID:4652 -
C:\windows\SQATTZ.exeC:\windows\SQATTZ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JQCYWEX.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:2516 -
C:\windows\system\JQCYWEX.exeC:\windows\system\JQCYWEX.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PQJM.exe.bat" "96⤵PID:4112
-
C:\windows\PQJM.exeC:\windows\PQJM.exe97⤵
- Executes dropped EXE
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZLRRE.exe.bat" "98⤵PID:5424
-
C:\windows\system\YZLRRE.exeC:\windows\system\YZLRRE.exe99⤵
- Executes dropped EXE
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMW.exe.bat" "100⤵
- Executes a command shell one-liner
PID:3020 -
C:\windows\PMW.exeC:\windows\PMW.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BER.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3556 -
C:\windows\BER.exeC:\windows\BER.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSWL.exe.bat" "104⤵
- Executes a command shell one-liner
PID:1180 -
C:\windows\system\VSWL.exeC:\windows\system\VSWL.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVH.exe.bat" "106⤵PID:5216
-
C:\windows\system\OVH.exeC:\windows\system\OVH.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UVHCG.exe.bat" "108⤵
- Executes a command shell one-liner
PID:5616 -
C:\windows\SysWOW64\UVHCG.exeC:\windows\system32\UVHCG.exe109⤵
- Executes dropped EXE
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DVJIRXF.exe.bat" "110⤵
- Executes a command shell one-liner
PID:236 -
C:\windows\system\DVJIRXF.exeC:\windows\system\DVJIRXF.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WOM.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3360 -
C:\windows\WOM.exeC:\windows\WOM.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IGPL.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:1476 -
C:\windows\system\IGPL.exeC:\windows\system\IGPL.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PBYXL.exe.bat" "116⤵PID:5420
-
C:\windows\system\PBYXL.exeC:\windows\system\PBYXL.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GKA.exe.bat" "118⤵PID:5472
-
C:\windows\SysWOW64\GKA.exeC:\windows\system32\GKA.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GUJE.exe.bat" "120⤵
- Executes a command shell one-liner
PID:260 -
C:\windows\system\GUJE.exeC:\windows\system\GUJE.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-