e53da8228100cdcab093325d35f4c9ff67c5a9ca555da6c1b34e2ad6a7d90120

General

Target
2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
Size 208KB
Sample260808-nxd4mswcpg
SHA256 e53da8228100cdcab093325d35f4c9ff67c5a9ca555da6c1b34e2ad6a7d90120
MD5 6c01b32643170130f16b6f05da4250f8
SHA1 463453f5dc2db579c4ce728fc7c9128033ebaa41
SHA512 44a1d37b1d5f83c0070605bf3a017a83118ea76740db95e3d8ebde0f0f8bbb108b07b7b196a042746d766c44b3fc099c85f471d7a8ccf6e3178efab53687a134
SSDEEP 3072:ALQaL9tbLkRIgd1Lye9yjE2hWAN5XbplU6L+LOftw9LthEoBHqj:UlZtbLWIgd1LZ9oECZbplUi+LO1QEog
TLSH
T124248D1235C2CC73E4B7027588F6C7787BB6BC919B3A928B7BC03B4D6E315968A25351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4596	IJU.exe
3828	JESZEO.exe
5956	GXCBI.exe
1808	XFQHVB.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\JESZEO.exe	IJU.exe
File opened for modification	C:\windows\SysWOW64\JESZEO.exe	IJU.exe
File created	C:\windows\SysWOW64\JESZEO.exe.bat	IJU.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\windows\IJU.exe	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
File created	C:\windows\system\GXCBI.exe	JESZEO.exe
File opened for modification	C:\windows\IJU.exe	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
File created	C:\windows\IJU.exe.bat	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
File opened for modification	C:\windows\system\GXCBI.exe	JESZEO.exe
File created	C:\windows\system\GXCBI.exe.bat	JESZEO.exe
File created	C:\windows\system\XFQHVB.exe	GXCBI.exe
File opened for modification	C:\windows\system\XFQHVB.exe	GXCBI.exe
File created	C:\windows\system\XFQHVB.exe.bat	GXCBI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2628	cmd.exe
5648	cmd.exe
2676	cmd.exe
2484	cmd.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2820	4600	WerFault.exe	88
4556	4596	WerFault.exe	93
5392	3828	WerFault.exe	99
4856	5956	WerFault.exe	104
4680	1808	WerFault.exe	109

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XFQHVB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IJU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JESZEO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GXCBI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4600	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
4600	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
4596	IJU.exe
4596	IJU.exe
3828	JESZEO.exe
3828	JESZEO.exe
5956	GXCBI.exe
5956	GXCBI.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4600	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
4600	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
4596	IJU.exe
4596	IJU.exe
3828	JESZEO.exe
3828	JESZEO.exe
5956	GXCBI.exe
5956	GXCBI.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 2628	4600	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe	89
PID 2628 wrote to memory of 4596	2628	cmd.exe	93
PID 4596 wrote to memory of 5648	4596	IJU.exe	95
PID 5648 wrote to memory of 3828	5648	cmd.exe	99
PID 3828 wrote to memory of 2676	3828	JESZEO.exe	100
PID 2676 wrote to memory of 5956	2676	cmd.exe	104
PID 5956 wrote to memory of 2484	5956	GXCBI.exe	105
PID 2484 wrote to memory of 1808	2484	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\IJU.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\windows\IJU.exe
    C:\windows\IJU.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\JESZEO.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5648
    - - C:\windows\SysWOW64\JESZEO.exe
        
        C:\windows\system32\JESZEO.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3828
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\GXCBI.exe.bat" "
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\windows\system\GXCBI.exe
        
        C:\windows\system\GXCBI.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\XFQHVB.exe.bat" "
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\windows\system\XFQHVB.exe
        
        C:\windows\system\XFQHVB.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 560
        10⤵
        Program crash
        
        PID:4680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 940
        8⤵
        Program crash
        
        PID:4856
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 1344
        6⤵
        Program crash
        
        PID:5392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 1000
      4⤵
      Program crash
      PID:4556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 1344
  2⤵
  - Program crash
  PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4600 -ip 4600
1⤵
PID:5196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4596 -ip 4596
1⤵
PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3828 -ip 3828
1⤵
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5956 -ip 5956
1⤵
PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1808 -ip 1808
1⤵
PID:2512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IJU.exe.bat

Path C:\Windows\IJU.exe.bat
Size 52B
SHA256 8951562ec9a593874da5e388c282dabf186ea920bf6a3b7bf90b20e8204197b5
MD5 38ef120a38be90d75c2ef804a2447b0d
SHA1 7723e2c2707874ffdc00605cb646bd3ae8d721d1
SHA512 0a284104bbb12edb380d29d2dad05371c9ea4cd68972dd2e8f0473e808ac9dcdb7c64e0647076cbcf65c23de87260e8828c73c0c63621f2c82d87eaed6344f0d
MD5 SHA1 SHA512

Submit Download

JESZEO.exe.bat

Path C:\Windows\SysWOW64\JESZEO.exe.bat
Size 76B
SHA256 5ae92b840b2d10330502c67e6460e5bdddaf6f0014d44d8af9de51c90fcfbc1e
MD5 ee919f855e3b21eff0887a23e0aca700
SHA1 dc524c3ea2537c6b2e08ddb2ff3b02207e6c987a
SHA512 51b58537f8d6a2640db2e4f18c0493e51c3bdf1dc214e50ab048c19c27d64a0bbbf7a6d5dd37df23b03cd3172c9412045315e89048ffff5a0f4ec47441ba30d9
TLSH
T106A0023C0AE1E2E2E824406DC34AB7A004ABF44A8318202012B528C2E08C44B8BA0CFC
MD5 SHA1 SHA512 TLSH

Submit Download

GXCBI.exe.bat

Path C:\Windows\System\GXCBI.exe.bat
Size 70B
SHA256 862760a49df3256b79dddd7504954f421d3d5da04fa47ec0481b48a1b0dd49e9
MD5 ccc2e6dbc0438136be66cb8eb4fd9ec8
SHA1 5030b05ebf683e28968e1873e4a6f250bad99bf0
SHA512 c65e038dd77968d0079f1b8dc298eac38b6500773750db517d003317a9e6a5ea50e01b674cdf647fcf79ffa58cd5498a0a3279a017298196105c16a1f67290dd
TLSH
T15AA002B00FC9A0F2882E606D6B4B370A04AFF6420B100020129D0083E086463AA288B8
MD5 SHA1 SHA512 TLSH

Submit Download

XFQHVB.exe.bat

Path C:\Windows\System\XFQHVB.exe.bat
Size 72B
SHA256 6257b271c0229a1d7a28078d604cb54783374d645a4e911425355e34104a7d8a
MD5 1413b522477ceff58ab81601503e61dd
SHA1 edea39e2df2734a9b4137a84acebf1eaef4648b8
SHA512 2b08dba6387de1f1f3cc4c748e3af5faaabf125780d1ead57f404250a699175b3f3862056653e7d27b401eebcd8f58505d9ba2b606f7beff8613aa791b977bd1
TLSH
T1FAA002380EC120E28C24C07D434A37002C2BF44A231200F0129D00E2E224E6BCE20BB8
MD5 SHA1 SHA512 TLSH

Submit Download

IJU.exe

Path C:\windows\IJU.exe
Size 208KB
SHA256 252bc2597c005f278d0f45cf34ae0e0d7af84bbeb19ae365bbc809da6784085d
MD5 5ff18f916a5f302ece99d837f53c8904
SHA1 bedf42e43358184a1c105f9a95ec86faacee1edb
SHA512 0bdf10b7046f03d7a7b34dd54c57b18f6f78bbc10ab77b5b40d21d174ace976518ced01f73d2ba6b8ef445d216a13743a092c72b1dd3a1440d7b54eefed1638d
SSDEEP 3072:tW/2mP4p+Mq71DoihnRxhtJOcWfon9+ESz47rTiRI0pG70w9LthEoBHqj:tW/94p+Mq711hnXhkfonhS3RI170QEog
TLSH
T101246D45BAF3E453C877C77688F9C6B49E26BC719B3B4507B508335E0CB218B8919B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JESZEO.exe

Path C:\windows\SysWOW64\JESZEO.exe
Size 208KB
SHA256 8ab6f79e458bf549924a9e6681b43cc62e989afc86b6483ee9785071f24f3e98
MD5 2fc42665b210fe3bf7654c0b97f762ad
SHA1 7378489a21aee278424645ddd9d2592ee7808595
SHA512 cc8da1a1ad667a6cb115368033753bffcb045002437c8828ff62ebaa39cf8cd68e5a0dbc1431064d74b4c2b5dbfc39e2eadebd7b1c30f5e0b3325133673289b5
SSDEEP 6144:pvQajAjYmmBfDLmvQJMWeSBJFSuXeKClQIXMaWibUlrQEog:pvQZjYmmBevg2KqMPWUlrQk
TLSH
T1C5247C413275D597D43B07358CE1A39A4FBBFC216F76E3ABB580FB1E44396268850EA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GXCBI.exe

Path C:\windows\system\GXCBI.exe
Size 208KB
SHA256 f17abd217c49cd4d39c4984bf277f5535c63cd3f75ca6e85ee7b854a89129609
MD5 a093184b9672d5d3cdc845e659688e6c
SHA1 8c87cd8d64fe89712565d18976cbe75097612895
SHA512 56ae311df48b7d3e1a2cd7973ab1bda0ee176a8e73ee34a1a8063699a27324a640f4acdc718d94581289ebd0d9c4eba33833f2043caae7b63eb8722320a93633
SSDEEP 3072:Le7iOsyAvZnZonpwRRc3UyJZ2dWi4F3Hh47JrU4MrET2yecHlFvwEfuJf6w9Lthk:YsyAvZrUJZ2w3BmZhBSyeyAAjQEog
TLSH
T1D3246CCE39D5C106E1671273C8D98DA40A7EBC476AB9020775D4B79D6E722C84E83BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XFQHVB.exe

Path C:\windows\system\XFQHVB.exe
Size 208KB
SHA256 16db11095ec0b1c5ec9bdd40e8a754cb4bb40ae0aa35c29bc5f320a7c6b382a5
MD5 c466a634a257450ad4fe01e340939163
SHA1 c56c692c264d226e7db8b867880fb8a1a9e1aa01
SHA512 7c55886a620b049ac2434b2352b480ca647196a06b4a5e05cb60580ee02f6c4980caf18beaca3e335883a9dd53dfe15f28fd9cbe1eabe883d9bc4457229f1624
SSDEEP 3072:aXt7xk3GiqAEVJr1ywi4y6t3PQHpFdM4RUo04N+Gw9LthEoBHqj:u7C3GHVmwiF6t3PYPC4/fN9QEog
TLSH
T161246C827A618E42F0A3EA304CFA5B5B2639BC22FF61535FB740779D2EB16C4181675C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads