Analysis
- max time kernel
88s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 14:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_24240e57703f02bc54e87943ba0d0e07_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_24240e57703f02bc54e87943ba0d0e07_elex_emotet_stop.exe
- Size 208KB
- Sample260809-r5ddvszelg
- SHA256 6cca41e9803042694195fa3c1ec23507d06ba246e1996f4a5b200a9f0f3df311
- MD5 24240e57703f02bc54e87943ba0d0e07
- SHA1 1b1862a758a9afa98ecd4a98d57febfaddf630a7
- SHA512 3a248045bb5b3559133babc229cbef4f57312e73ef97159454c493dff04b6fc266f0a78de27871d0443d084f02aba96315a8684c9eab920a78eae454e281bbd5
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUtL+LOfg4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUp+LOYkEj1
- TLSH T17B247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4268 EEEWRY.exe 252 ZXJCDD.exe 1784 UHRT.exe 5112 NLVXWE.exe 5984 NGZSC.exe 5764 GJDWHS.exe 1396 ZBSHZLC.exe 1540 PRTYF.exe 3680 RPZTNPA.exe 4812 VFNBZ.exe 5312 DLSH.exe 4604 YVAY.exe 4328 CYGTYBP.exe 6052 ZERIOF.exe 1320 JCEDV.exe 5788 NFD.exe 1420 YXKJNH.exe 4060 RYZUWA.exe 3424 FWZFY.exe 3960 ZJEPILJ.exe 1944 PMOTT.exe 3220 NXYJ.exe 4968 OSCFPCH.exe 1232 SIJNU.exe 6064 MVOWEUS.exe 1424 MBGLFZV.exe 3940 ILWCU.exe 1660 RUYPXHS.exe 704 XUGC.exe 5872 RHLMYJ.exe 4912 XIS.exe 3280 NYTROZ.exe 4700 AACQ.exe 236 ELALCDW.exe 5448 TGJPN.exe 3308 UJNTTGG.exe 1124 FCQ.exe 3912 DCYZKP.exe 4612 GQDJUPL.exe 2536 INIVC.exe 4288 GYTL.exe 4784 QWZ.exe 5852 AWBKD.exe 4528 EMHSPKP.exe 4308 VNJXT.exe 3176 ZDQ.exe 5772 RGUBL.exe 5288 MTZLVP.exe 980 HEPJJA.exe 5680 CRM.exe 5520 VMYOZ.exe 5836 RSVLGZR.exe 2840 XNVMKUH.exe 3952 SAZW.exe 4636 HVJIGPW.exe 4400 QEL.exe 4540 FZURUH.exe 1196 AMZ.exe 2076 IAZP.exe 3712 GAHDXO.exe 4572 VQICW.exe 5940 BQQQNEQ.exe 4676 WEUA.exe 976 NEWFA.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\EJJMBGC.exe WDRYAB.exe File created C:\windows\SysWOW64\JMXC.exe DMQOQA.exe File opened for modification C:\windows\SysWOW64\EAHXF.exe GAZ.exe File opened for modification C:\windows\SysWOW64\YVAY.exe DLSH.exe File created C:\windows\SysWOW64\YXKJNH.exe NFD.exe File created C:\windows\SysWOW64\NYTROZ.exe XIS.exe File opened for modification C:\windows\SysWOW64\IAZP.exe AMZ.exe File created C:\windows\SysWOW64\JHZIA.exe JPRPM.exe File created C:\windows\SysWOW64\DMQOQA.exe STNVI.exe File created C:\windows\SysWOW64\RPZTNPA.exe PRTYF.exe File opened for modification C:\windows\SysWOW64\RUYPXHS.exe ILWCU.exe File created C:\windows\SysWOW64\NEWFA.exe WEUA.exe File opened for modification C:\windows\SysWOW64\FXVN.exe ZXOZ.exe File created C:\windows\SysWOW64\YXKJNH.exe.bat NFD.exe File opened for modification C:\windows\SysWOW64\XIS.exe RHLMYJ.exe File created C:\windows\SysWOW64\MTZLVP.exe.bat RGUBL.exe File created C:\windows\SysWOW64\MKG.exe RAYTU.exe File opened for modification C:\windows\SysWOW64\CYGTYBP.exe YVAY.exe File created C:\windows\SysWOW64\QEL.exe.bat HVJIGPW.exe File created C:\windows\SysWOW64\DPVQGL.exe NML.exe File created C:\windows\SysWOW64\RUYPXHS.exe.bat ILWCU.exe File opened for modification C:\windows\SysWOW64\GAHDXO.exe IAZP.exe File created C:\windows\SysWOW64\WEUA.exe BQQQNEQ.exe File created C:\windows\SysWOW64\THON.exe PZHNJK.exe File opened for modification C:\windows\SysWOW64\DMQOQA.exe STNVI.exe File created C:\windows\SysWOW64\NYTROZ.exe.bat XIS.exe File created C:\windows\SysWOW64\FFPVI.exe FAPH.exe File created C:\windows\SysWOW64\YVAY.exe.bat DLSH.exe File created C:\windows\SysWOW64\EAHXF.exe.bat GAZ.exe File created C:\windows\SysWOW64\DJGDE.exe.bat JVB.exe File opened for modification C:\windows\SysWOW64\NGZSC.exe NLVXWE.exe File opened for modification C:\windows\SysWOW64\HVJIGPW.exe SAZW.exe File opened for modification C:\windows\SysWOW64\WEUA.exe BQQQNEQ.exe File created C:\windows\SysWOW64\AWBKD.exe.bat QWZ.exe File created C:\windows\SysWOW64\EAHXF.exe GAZ.exe File opened for modification C:\windows\SysWOW64\VNJXT.exe EMHSPKP.exe File created C:\windows\SysWOW64\IAZP.exe AMZ.exe File created C:\windows\SysWOW64\DVTGLJ.exe.bat SDYN.exe File created C:\windows\SysWOW64\HXXA.exe.bat MKA.exe File created C:\windows\SysWOW64\ZXJCDD.exe.bat EEEWRY.exe File created C:\windows\SysWOW64\CYGTYBP.exe.bat YVAY.exe File created C:\windows\SysWOW64\GAHDXO.exe IAZP.exe File created C:\windows\SysWOW64\NEWFA.exe.bat WEUA.exe File created C:\windows\SysWOW64\MKG.exe.bat RAYTU.exe File created C:\windows\SysWOW64\ZXOZ.exe.bat JMXC.exe File created C:\windows\SysWOW64\ZXJCDD.exe EEEWRY.exe File opened for modification C:\windows\SysWOW64\RPZTNPA.exe PRTYF.exe File created C:\windows\SysWOW64\VFNBZ.exe RPZTNPA.exe File opened for modification C:\windows\SysWOW64\MVOWEUS.exe SIJNU.exe File created C:\windows\SysWOW64\XIS.exe.bat RHLMYJ.exe File opened for modification C:\windows\SysWOW64\DJGDE.exe JVB.exe File opened for modification C:\windows\SysWOW64\DPVQGL.exe NML.exe File created C:\windows\SysWOW64\MVOWEUS.exe.bat SIJNU.exe File opened for modification C:\windows\SysWOW64\NYTROZ.exe XIS.exe File created C:\windows\SysWOW64\QEL.exe HVJIGPW.exe File opened for modification C:\windows\SysWOW64\NEWFA.exe WEUA.exe File opened for modification C:\windows\SysWOW64\ZXOZ.exe JMXC.exe File opened for modification C:\windows\SysWOW64\UDFCDZR.exe JKCJVR.exe File created C:\windows\SysWOW64\FFPVI.exe.bat FAPH.exe File created C:\windows\SysWOW64\THON.exe.bat PZHNJK.exe File created C:\windows\SysWOW64\UDFCDZR.exe JKCJVR.exe File created C:\windows\SysWOW64\DPVQGL.exe.bat NML.exe File opened for modification C:\windows\SysWOW64\VFNBZ.exe RPZTNPA.exe File created C:\windows\SysWOW64\ZERIOF.exe CYGTYBP.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\WDRYAB.exe.bat MQG.exe File opened for modification C:\windows\system\NML.exe EMJHRTZ.exe File created C:\windows\system\VKHUT.exe DPVQGL.exe File created C:\windows\system\RYZUWA.exe YXKJNH.exe File opened for modification C:\windows\NXYJ.exe PMOTT.exe File opened for modification C:\windows\SIJNU.exe OSCFPCH.exe File created C:\windows\system\TGJPN.exe.bat ELALCDW.exe File opened for modification C:\windows\system\RGUBL.exe ZDQ.exe File opened for modification C:\windows\system\VMYOZ.exe CRM.exe File created C:\windows\system\BQQQNEQ.exe VQICW.exe File created C:\windows\system\BQQQNEQ.exe.bat VQICW.exe File created C:\windows\NLVXWE.exe UHRT.exe File created C:\windows\PMOTT.exe.bat ZJEPILJ.exe File created C:\windows\NXYJ.exe.bat PMOTT.exe File created C:\windows\system\RHLMYJ.exe XUGC.exe File opened for modification C:\windows\AACQ.exe NYTROZ.exe File created C:\windows\system\UJNTTGG.exe TGJPN.exe File opened for modification C:\windows\system\ZDQ.exe VNJXT.exe File created C:\windows\CRM.exe HEPJJA.exe File created C:\windows\GJDWHS.exe NGZSC.exe File opened for modification C:\windows\OSCFPCH.exe NXYJ.exe File created C:\windows\GYTL.exe.bat INIVC.exe File created C:\windows\system\VMYOZ.exe CRM.exe File created C:\windows\system\PCCZIJP.exe NEWFA.exe File created C:\windows\system\EXLDT.exe PCCZIJP.exe File opened for modification C:\windows\GVIV.exe UDFCDZR.exe File opened for modification C:\windows\system\GOMGPJH.exe EAHXF.exe File created C:\windows\CRM.exe.bat HEPJJA.exe File created C:\windows\system\PCCZIJP.exe.bat NEWFA.exe File opened for modification C:\windows\system\EXLDT.exe PCCZIJP.exe File opened for modification C:\windows\MKA.exe THON.exe File opened for modification C:\windows\ABNYBS.exe UBF.exe File opened for modification C:\windows\system\JPRPM.exe JJRAKIE.exe File opened for modification C:\windows\PIHWRCW.exe JHZIA.exe File created C:\windows\OZQBBMG.exe IMRA.exe File created C:\windows\system\MBGLFZV.exe MVOWEUS.exe File created C:\windows\system\RHLMYJ.exe.bat XUGC.exe File created C:\windows\system\ELALCDW.exe.bat AACQ.exe File opened for modification C:\windows\CRM.exe HEPJJA.exe File created C:\windows\system\FZURUH.exe.bat QEL.exe File created C:\windows\PZHNJK.exe AWYB.exe File opened for modification C:\windows\system\UBF.exe GVIV.exe File created C:\windows\system\GHVA.exe.bat VPSHMSR.exe File created C:\windows\system\FWZFY.exe.bat RYZUWA.exe File created C:\windows\system\ELALCDW.exe AACQ.exe File opened for modification C:\windows\system\JKCJVR.exe HXXA.exe File opened for modification C:\windows\system\XUGC.exe RUYPXHS.exe File created C:\windows\system\UJNTTGG.exe.bat TGJPN.exe File opened for modification C:\windows\system\BQQQNEQ.exe VQICW.exe File created C:\windows\system\EMJHRTZ.exe DJGDE.exe File created C:\windows\system\NML.exe EMJHRTZ.exe File created C:\windows\EEEWRY.exe 2026-08-09_24240e57703f02bc54e87943ba0d0e07_elex_emotet_stop.exe File opened for modification C:\windows\system\QWZ.exe GYTL.exe File created C:\windows\system\RGUBL.exe.bat ZDQ.exe File created C:\windows\system\JKCJVR.exe HXXA.exe File created C:\windows\system\JPRPM.exe.bat JJRAKIE.exe File created C:\windows\MTF.exe GTX.exe File created C:\windows\system\ECANM.exe OZQBBMG.exe File opened for modification C:\windows\system\EMJHRTZ.exe DJGDE.exe File created C:\windows\AACQ.exe.bat NYTROZ.exe File created C:\windows\system\TGJPN.exe ELALCDW.exe File created C:\windows\system\JKCJVR.exe.bat HXXA.exe File created C:\windows\system\GAZ.exe FXVN.exe File created C:\windows\system\IMRA.exe GOMGPJH.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1988 cmd.exe 1604 cmd.exe 5336 cmd.exe 4892 cmd.exe 2932 cmd.exe 2484 cmd.exe 3508 cmd.exe 6008 cmd.exe 3056 cmd.exe 6124 cmd.exe 3540 cmd.exe 900 cmd.exe 5428 cmd.exe 1192 cmd.exe 5920 cmd.exe 3700 cmd.exe 2504 cmd.exe 5588 cmd.exe 4824 cmd.exe 2232 cmd.exe 5992 cmd.exe 1256 cmd.exe 4712 cmd.exe 4240 cmd.exe 1288 cmd.exe 3500 cmd.exe 1828 cmd.exe 4524 cmd.exe 4256 cmd.exe 4220 cmd.exe 720 cmd.exe 4644 cmd.exe 540 cmd.exe 932 cmd.exe 5600 cmd.exe 2680 cmd.exe 4656 cmd.exe 3868 cmd.exe 4432 cmd.exe 4556 cmd.exe 2456 cmd.exe 1768 cmd.exe 3536 cmd.exe 4760 cmd.exe 4368 cmd.exe 5976 cmd.exe 4516 cmd.exe 4104 cmd.exe 1360 cmd.exe 1688 cmd.exe 4260 cmd.exe 4284 cmd.exe 604 cmd.exe 1692 cmd.exe 3284 cmd.exe 4640 cmd.exe 3464 cmd.exe 712 cmd.exe 5096 cmd.exe 5916 cmd.exe 4856 cmd.exe 4068 cmd.exe 4388 cmd.exe 1648 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 972 2436 WerFault.exe 87 4816 4268 WerFault.exe 92 5956 252 WerFault.exe 99 4592 1784 WerFault.exe 104 824 5112 WerFault.exe 109 2656 5984 WerFault.exe 114 2528 5764 WerFault.exe 119 620 1396 WerFault.exe 124 2008 1540 WerFault.exe 128 4820 3680 WerFault.exe 134 2644 4812 WerFault.exe 139 984 5312 WerFault.exe 144 2388 4604 WerFault.exe 149 6112 4328 WerFault.exe 154 4284 6052 WerFault.exe 159 2392 1320 WerFault.exe 164 2524 5788 WerFault.exe 169 1640 1420 WerFault.exe 174 620 4060 WerFault.exe 179 3652 3424 WerFault.exe 184 4820 3960 WerFault.exe 189 3440 1944 WerFault.exe 194 5248 3220 WerFault.exe 199 5576 4968 WerFault.exe 204 4744 1232 WerFault.exe 209 692 6064 WerFault.exe 214 4456 1424 WerFault.exe 219 3132 3940 WerFault.exe 224 5684 1660 WerFault.exe 229 944 704 WerFault.exe 234 4460 5872 WerFault.exe 239 2484 4912 WerFault.exe 244 2548 3280 WerFault.exe 249 972 4700 WerFault.exe 254 4428 236 WerFault.exe 259 5392 5448 WerFault.exe 264 820 3308 WerFault.exe 269 2664 1124 WerFault.exe 275 3840 3912 WerFault.exe 280 752 4612 WerFault.exe 285 5372 2536 WerFault.exe 290 3444 4288 WerFault.exe 295 5940 4784 WerFault.exe 300 4648 5852 WerFault.exe 305 1620 4528 WerFault.exe 310 4712 4308 WerFault.exe 315 5340 3176 WerFault.exe 320 2852 5772 WerFault.exe 325 4068 5288 WerFault.exe 330 6100 980 WerFault.exe 335 2936 5680 WerFault.exe 340 3632 5520 WerFault.exe 345 2684 5836 WerFault.exe 350 6012 2840 WerFault.exe 355 2848 3952 WerFault.exe 360 4352 4636 WerFault.exe 365 1076 4400 WerFault.exe 370 936 4540 WerFault.exe 375 2176 1196 WerFault.exe 380 1664 2076 WerFault.exe 385 3660 3712 WerFault.exe 390 256 4572 WerFault.exe 395 5912 5940 WerFault.exe 400 1164 4676 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RYZUWA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWBKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VMYOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMJHRTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RAYTU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXKJNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGUBL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZJEPILJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGJPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMQOQA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_24240e57703f02bc54e87943ba0d0e07_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSCFPCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DVTGLJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUYPXHS.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2436 2026-08-09_24240e57703f02bc54e87943ba0d0e07_elex_emotet_stop.exe 2436 2026-08-09_24240e57703f02bc54e87943ba0d0e07_elex_emotet_stop.exe 4268 EEEWRY.exe 4268 EEEWRY.exe 252 ZXJCDD.exe 252 ZXJCDD.exe 1784 UHRT.exe 1784 UHRT.exe 5112 NLVXWE.exe 5112 NLVXWE.exe 5984 NGZSC.exe 5984 NGZSC.exe 5764 GJDWHS.exe 5764 GJDWHS.exe 1396 ZBSHZLC.exe 1396 ZBSHZLC.exe 1540 PRTYF.exe 1540 PRTYF.exe 3680 RPZTNPA.exe 3680 RPZTNPA.exe 4812 VFNBZ.exe 4812 VFNBZ.exe 5312 DLSH.exe 5312 DLSH.exe 4604 YVAY.exe 4604 YVAY.exe 4328 CYGTYBP.exe 4328 CYGTYBP.exe 6052 ZERIOF.exe 6052 ZERIOF.exe 1320 JCEDV.exe 1320 JCEDV.exe 5788 NFD.exe 5788 NFD.exe 1420 YXKJNH.exe 1420 YXKJNH.exe 4060 RYZUWA.exe 4060 RYZUWA.exe 3424 FWZFY.exe 3424 FWZFY.exe 3960 ZJEPILJ.exe 3960 ZJEPILJ.exe 1944 PMOTT.exe 1944 PMOTT.exe 3220 NXYJ.exe 3220 NXYJ.exe 4968 OSCFPCH.exe 4968 OSCFPCH.exe 1232 SIJNU.exe 1232 SIJNU.exe 6064 MVOWEUS.exe 6064 MVOWEUS.exe 1424 MBGLFZV.exe 1424 MBGLFZV.exe 3940 ILWCU.exe 3940 ILWCU.exe 1660 RUYPXHS.exe 1660 RUYPXHS.exe 704 XUGC.exe 704 XUGC.exe 5872 RHLMYJ.exe 5872 RHLMYJ.exe 4912 XIS.exe 4912 XIS.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2436 2026-08-09_24240e57703f02bc54e87943ba0d0e07_elex_emotet_stop.exe 2436 2026-08-09_24240e57703f02bc54e87943ba0d0e07_elex_emotet_stop.exe 4268 EEEWRY.exe 4268 EEEWRY.exe 252 ZXJCDD.exe 252 ZXJCDD.exe 1784 UHRT.exe 1784 UHRT.exe 5112 NLVXWE.exe 5112 NLVXWE.exe 5984 NGZSC.exe 5984 NGZSC.exe 5764 GJDWHS.exe 5764 GJDWHS.exe 1396 ZBSHZLC.exe 1396 ZBSHZLC.exe 1540 PRTYF.exe 1540 PRTYF.exe 3680 RPZTNPA.exe 3680 RPZTNPA.exe 4812 VFNBZ.exe 4812 VFNBZ.exe 5312 DLSH.exe 5312 DLSH.exe 4604 YVAY.exe 4604 YVAY.exe 4328 CYGTYBP.exe 4328 CYGTYBP.exe 6052 ZERIOF.exe 6052 ZERIOF.exe 1320 JCEDV.exe 1320 JCEDV.exe 5788 NFD.exe 5788 NFD.exe 1420 YXKJNH.exe 1420 YXKJNH.exe 4060 RYZUWA.exe 4060 RYZUWA.exe 3424 FWZFY.exe 3424 FWZFY.exe 3960 ZJEPILJ.exe 3960 ZJEPILJ.exe 1944 PMOTT.exe 1944 PMOTT.exe 3220 NXYJ.exe 3220 NXYJ.exe 4968 OSCFPCH.exe 4968 OSCFPCH.exe 1232 SIJNU.exe 1232 SIJNU.exe 6064 MVOWEUS.exe 6064 MVOWEUS.exe 1424 MBGLFZV.exe 1424 MBGLFZV.exe 3940 ILWCU.exe 3940 ILWCU.exe 1660 RUYPXHS.exe 1660 RUYPXHS.exe 704 XUGC.exe 704 XUGC.exe 5872 RHLMYJ.exe 5872 RHLMYJ.exe 4912 XIS.exe 4912 XIS.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2436 wrote to memory of 1648 2436 2026-08-09_24240e57703f02bc54e87943ba0d0e07_elex_emotet_stop.exe 89 PID 1648 wrote to memory of 4268 1648 cmd.exe 92 PID 4268 wrote to memory of 5992 4268 EEEWRY.exe 95 PID 5992 wrote to memory of 252 5992 cmd.exe 99 PID 252 wrote to memory of 4680 252 ZXJCDD.exe 100 PID 4680 wrote to memory of 1784 4680 cmd.exe 104 PID 1784 wrote to memory of 4576 1784 UHRT.exe 105 PID 4576 wrote to memory of 5112 4576 cmd.exe 109 PID 5112 wrote to memory of 720 5112 NLVXWE.exe 110 PID 720 wrote to memory of 5984 720 cmd.exe 114 PID 5984 wrote to memory of 2376 5984 NGZSC.exe 115 PID 2376 wrote to memory of 5764 2376 cmd.exe 119 PID 5764 wrote to memory of 3796 5764 GJDWHS.exe 120 PID 3796 wrote to memory of 1396 3796 cmd.exe 124 PID 1396 wrote to memory of 5972 1396 ZBSHZLC.exe 125 PID 5972 wrote to memory of 1540 5972 cmd.exe 128 PID 1540 wrote to memory of 3924 1540 PRTYF.exe 130 PID 3924 wrote to memory of 3680 3924 cmd.exe 134 PID 3680 wrote to memory of 1604 3680 RPZTNPA.exe 135 PID 1604 wrote to memory of 4812 1604 cmd.exe 139 PID 4812 wrote to memory of 3540 4812 VFNBZ.exe 140 PID 3540 wrote to memory of 5312 3540 cmd.exe 144 PID 5312 wrote to memory of 2504 5312 DLSH.exe 145 PID 2504 wrote to memory of 4604 2504 cmd.exe 149 PID 4604 wrote to memory of 4644 4604 YVAY.exe 150 PID 4644 wrote to memory of 4328 4644 cmd.exe 154 PID 4328 wrote to memory of 2920 4328 CYGTYBP.exe 155 PID 2920 wrote to memory of 6052 2920 cmd.exe 159 PID 6052 wrote to memory of 6084 6052 ZERIOF.exe 160 PID 6084 wrote to memory of 1320 6084 cmd.exe 164 PID 1320 wrote to memory of 1132 1320 JCEDV.exe 165 PID 1132 wrote to memory of 5788 1132 cmd.exe 169 PID 5788 wrote to memory of 6056 5788 NFD.exe 170 PID 6056 wrote to memory of 1420 6056 cmd.exe 174 PID 1420 wrote to memory of 1940 1420 YXKJNH.exe 175 PID 1940 wrote to memory of 4060 1940 cmd.exe 179 PID 4060 wrote to memory of 2180 4060 RYZUWA.exe 180 PID 2180 wrote to memory of 3424 2180 cmd.exe 184 PID 3424 wrote to memory of 4548 3424 FWZFY.exe 185 PID 4548 wrote to memory of 3960 4548 cmd.exe 189 PID 3960 wrote to memory of 4104 3960 ZJEPILJ.exe 190 PID 4104 wrote to memory of 1944 4104 cmd.exe 194 PID 1944 wrote to memory of 856 1944 PMOTT.exe 195 PID 856 wrote to memory of 3220 856 cmd.exe 199 PID 3220 wrote to memory of 2828 3220 NXYJ.exe 200 PID 2828 wrote to memory of 4968 2828 cmd.exe 204 PID 4968 wrote to memory of 5156 4968 OSCFPCH.exe 205 PID 5156 wrote to memory of 1232 5156 cmd.exe 209 PID 1232 wrote to memory of 2500 1232 SIJNU.exe 210 PID 2500 wrote to memory of 6064 2500 cmd.exe 214 PID 6064 wrote to memory of 5532 6064 MVOWEUS.exe 215 PID 5532 wrote to memory of 1424 5532 cmd.exe 219 PID 1424 wrote to memory of 4332 1424 MBGLFZV.exe 220 PID 4332 wrote to memory of 3940 4332 cmd.exe 224 PID 3940 wrote to memory of 4368 3940 ILWCU.exe 225 PID 4368 wrote to memory of 1660 4368 cmd.exe 229 PID 1660 wrote to memory of 4228 1660 RUYPXHS.exe 230 PID 4228 wrote to memory of 704 4228 cmd.exe 234 PID 704 wrote to memory of 3868 704 XUGC.exe 235 PID 3868 wrote to memory of 5872 3868 cmd.exe 239 PID 5872 wrote to memory of 3456 5872 RHLMYJ.exe 240 PID 3456 wrote to memory of 4912 3456 cmd.exe 244 PID 4912 wrote to memory of 4904 4912 XIS.exe 245 PID 4904 wrote to memory of 3280 4904 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_24240e57703f02bc54e87943ba0d0e07_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_24240e57703f02bc54e87943ba0d0e07_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEEWRY.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\windows\EEEWRY.exeC:\windows\EEEWRY.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZXJCDD.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\windows\SysWOW64\ZXJCDD.exeC:\windows\system32\ZXJCDD.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UHRT.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\windows\UHRT.exeC:\windows\UHRT.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NLVXWE.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\windows\NLVXWE.exeC:\windows\NLVXWE.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NGZSC.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:720 -
C:\windows\SysWOW64\NGZSC.exeC:\windows\system32\NGZSC.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJDWHS.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\windows\GJDWHS.exeC:\windows\GJDWHS.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBSHZLC.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\windows\ZBSHZLC.exeC:\windows\ZBSHZLC.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRTYF.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\windows\SysWOW64\PRTYF.exeC:\windows\system32\PRTYF.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RPZTNPA.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\windows\SysWOW64\RPZTNPA.exeC:\windows\system32\RPZTNPA.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFNBZ.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\windows\SysWOW64\VFNBZ.exeC:\windows\system32\VFNBZ.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLSH.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\windows\system\DLSH.exeC:\windows\system\DLSH.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YVAY.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\windows\SysWOW64\YVAY.exeC:\windows\system32\YVAY.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYGTYBP.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\windows\SysWOW64\CYGTYBP.exeC:\windows\system32\CYGTYBP.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZERIOF.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\windows\SysWOW64\ZERIOF.exeC:\windows\system32\ZERIOF.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JCEDV.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\windows\system\JCEDV.exeC:\windows\system\JCEDV.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFD.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\windows\system\NFD.exeC:\windows\system\NFD.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXKJNH.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\windows\SysWOW64\YXKJNH.exeC:\windows\system32\YXKJNH.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RYZUWA.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\windows\system\RYZUWA.exeC:\windows\system\RYZUWA.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWZFY.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\windows\system\FWZFY.exeC:\windows\system\FWZFY.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZJEPILJ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\windows\system\ZJEPILJ.exeC:\windows\system\ZJEPILJ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMOTT.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\windows\PMOTT.exeC:\windows\PMOTT.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXYJ.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:856 -
C:\windows\NXYJ.exeC:\windows\NXYJ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OSCFPCH.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\windows\OSCFPCH.exeC:\windows\OSCFPCH.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIJNU.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\windows\SIJNU.exeC:\windows\SIJNU.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVOWEUS.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\windows\SysWOW64\MVOWEUS.exeC:\windows\system32\MVOWEUS.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MBGLFZV.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\windows\system\MBGLFZV.exeC:\windows\system\MBGLFZV.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ILWCU.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\windows\ILWCU.exeC:\windows\ILWCU.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUYPXHS.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\windows\SysWOW64\RUYPXHS.exeC:\windows\system32\RUYPXHS.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUGC.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\windows\system\XUGC.exeC:\windows\system\XUGC.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHLMYJ.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\windows\system\RHLMYJ.exeC:\windows\system\RHLMYJ.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XIS.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\windows\SysWOW64\XIS.exeC:\windows\system32\XIS.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYTROZ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\windows\SysWOW64\NYTROZ.exeC:\windows\system32\NYTROZ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AACQ.exe.bat" "66⤵PID:1896
-
C:\windows\AACQ.exeC:\windows\AACQ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELALCDW.exe.bat" "68⤵PID:4436
-
C:\windows\system\ELALCDW.exeC:\windows\system\ELALCDW.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGJPN.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2208 -
C:\windows\system\TGJPN.exeC:\windows\system\TGJPN.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UJNTTGG.exe.bat" "72⤵PID:2756
-
C:\windows\system\UJNTTGG.exeC:\windows\system\UJNTTGG.exe73⤵
- Executes dropped EXE
PID:3308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCQ.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:4672 -
C:\windows\SysWOW64\FCQ.exeC:\windows\system32\FCQ.exe75⤵
- Executes dropped EXE
PID:1124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DCYZKP.exe.bat" "76⤵PID:5944
-
C:\windows\system\DCYZKP.exeC:\windows\system\DCYZKP.exe77⤵
- Executes dropped EXE
PID:3912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GQDJUPL.exe.bat" "78⤵
- Executes a command shell one-liner
PID:3500 -
C:\windows\GQDJUPL.exeC:\windows\GQDJUPL.exe79⤵
- Executes dropped EXE
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\INIVC.exe.bat" "80⤵
- Executes a command shell one-liner
PID:1360 -
C:\windows\system\INIVC.exeC:\windows\system\INIVC.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYTL.exe.bat" "82⤵PID:2460
-
C:\windows\GYTL.exeC:\windows\GYTL.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWZ.exe.bat" "84⤵PID:5292
-
C:\windows\system\QWZ.exeC:\windows\system\QWZ.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AWBKD.exe.bat" "86⤵PID:4160
-
C:\windows\SysWOW64\AWBKD.exeC:\windows\system32\AWBKD.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMHSPKP.exe.bat" "88⤵
- Executes a command shell one-liner
PID:1688 -
C:\windows\system\EMHSPKP.exeC:\windows\system\EMHSPKP.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNJXT.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:3264 -
C:\windows\SysWOW64\VNJXT.exeC:\windows\system32\VNJXT.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZDQ.exe.bat" "92⤵PID:3352
-
C:\windows\system\ZDQ.exeC:\windows\system\ZDQ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGUBL.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:2560 -
C:\windows\system\RGUBL.exeC:\windows\system\RGUBL.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MTZLVP.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:1160 -
C:\windows\SysWOW64\MTZLVP.exeC:\windows\system32\MTZLVP.exe97⤵
- Executes dropped EXE
PID:5288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HEPJJA.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:2792 -
C:\windows\system\HEPJJA.exeC:\windows\system\HEPJJA.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CRM.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5328 -
C:\windows\CRM.exeC:\windows\CRM.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMYOZ.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4260 -
C:\windows\system\VMYOZ.exeC:\windows\system\VMYOZ.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSVLGZR.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:1284 -
C:\windows\system\RSVLGZR.exeC:\windows\system\RSVLGZR.exe105⤵
- Executes dropped EXE
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNVMKUH.exe.bat" "106⤵PID:2072
-
C:\windows\SysWOW64\XNVMKUH.exeC:\windows\system32\XNVMKUH.exe107⤵
- Executes dropped EXE
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SAZW.exe.bat" "108⤵PID:4316
-
C:\windows\SAZW.exeC:\windows\SAZW.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVJIGPW.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4284 -
C:\windows\SysWOW64\HVJIGPW.exeC:\windows\system32\HVJIGPW.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEL.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:3776 -
C:\windows\SysWOW64\QEL.exeC:\windows\system32\QEL.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZURUH.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4432 -
C:\windows\system\FZURUH.exeC:\windows\system\FZURUH.exe115⤵
- Executes dropped EXE
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMZ.exe.bat" "116⤵PID:3288
-
C:\windows\system\AMZ.exeC:\windows\system\AMZ.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAZP.exe.bat" "118⤵PID:3728
-
C:\windows\SysWOW64\IAZP.exeC:\windows\system32\IAZP.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GAHDXO.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:2016 -
C:\windows\SysWOW64\GAHDXO.exeC:\windows\system32\GAHDXO.exe121⤵
- Executes dropped EXE
PID:3712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-