Analysis
- max time kernel
83s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 17:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_218e956b2239646961bcd14565e95ec8_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_218e956b2239646961bcd14565e95ec8_elex_emotet_stop.exe
- Size 208KB
- Sample260809-vm651aap6w
- SHA256 7acea3c1f7cfc53108fdaa53890c284f909a1d8d55ab9358da56121b6107a6dd
- MD5 218e956b2239646961bcd14565e95ec8
- SHA1 c932ea95cedd82a2050b52db3574b65a443fdae7
- SHA512 d4cad12573d6d57f013a4a4661d6730b9a74f58cd965d9cfb16d51807fdd2284693af6a3f7bcab741d2871c6da5ee44be23b73c63dc635e7893231e395de0610
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOf24NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOeQEj1
- TLSH T16C247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4384 PJKUE.exe 5640 UZRKZOI.exe 3140 DZTPD.exe 5556 WCWTIJM.exe 3428 RNNSX.exe 4556 PIMTBPX.exe 3828 EDWXM.exe 2828 MJAEX.exe 2984 SEZMCL.exe 4428 EUSFPPX.exe 5388 ZIXO.exe 5124 FDWXESB.exe 3000 JLDX.exe 5544 NBKXUV.exe 1584 EBMKG.exe 5760 IJSKKSJ.exe 3732 MZHK.exe 3632 ZXH.exe 3312 EDRL.exe 3628 NLTYA.exe 5876 XJHKHXN.exe 1508 FZIKOT.exe 956 ACQI.exe 5108 ESX.exe 5632 NSZN.exe 2024 EABTVR.exe 5392 ZOGKGRM.exe 4088 SGV.exe 4176 NBAE.exe 3920 RJGELCX.exe 1668 RPZTNPA.exe 1372 GSQXY.exe 1116 HNUB.exe 4424 BAZKOR.exe 4836 FQF.exe 1192 YTJOF.exe 380 NJKN.exe 4236 RSRNYN.exe 4104 GISN.exe 2920 BVXWPA.exe 1704 ATQRC.exe 5396 YDTH.exe 3168 QEVMO.exe 4660 IHYQUPS.exe 3764 NMRFKKN.exe 2220 FPUB.exe 3500 VFV.exe 4520 DLAHHUG.exe 700 XYFQ.exe 4372 BOLYDMR.exe 2848 REUQK.exe 3148 GZE.exe 3812 BNJMF.exe 5620 QDKDEI.exe 3300 SAPXT.exe 5416 BDGTIA.exe 5044 TGJPN.exe 480 DHLURV.exe 5312 NFROGD.exe 548 WNTTKBS.exe 3340 PFIETCA.exe 2868 XLVTEAV.exe 3584 WEYBMG.exe 4436 SJQQ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\YTJOF.exe FQF.exe File opened for modification C:\windows\SysWOW64\VFV.exe FPUB.exe File created C:\windows\SysWOW64\VFV.exe.bat FPUB.exe File created C:\windows\SysWOW64\ZIXO.exe.bat EUSFPPX.exe File created C:\windows\SysWOW64\ACQI.exe FZIKOT.exe File created C:\windows\SysWOW64\SGV.exe.bat ZOGKGRM.exe File created C:\windows\SysWOW64\RPZTNPA.exe.bat RJGELCX.exe File created C:\windows\SysWOW64\QEVMO.exe YDTH.exe File created C:\windows\SysWOW64\BPVF.exe SJQQ.exe File created C:\windows\SysWOW64\AHLOG.exe XZFOUY.exe File created C:\windows\SysWOW64\AHLOG.exe.bat XZFOUY.exe File created C:\windows\SysWOW64\FPUB.exe NMRFKKN.exe File created C:\windows\SysWOW64\XLVTEAV.exe PFIETCA.exe File created C:\windows\SysWOW64\ZNZR.exe BCXJU.exe File created C:\windows\SysWOW64\ZNZR.exe.bat BCXJU.exe File created C:\windows\SysWOW64\NDQDXY.exe XNPM.exe File opened for modification C:\windows\SysWOW64\GISN.exe RSRNYN.exe File created C:\windows\SysWOW64\PJKUE.exe 2026-08-09_218e956b2239646961bcd14565e95ec8_elex_emotet_stop.exe File created C:\windows\SysWOW64\GISN.exe RSRNYN.exe File created C:\windows\SysWOW64\ZIXO.exe EUSFPPX.exe File opened for modification C:\windows\SysWOW64\SGV.exe ZOGKGRM.exe File opened for modification C:\windows\SysWOW64\NMRFKKN.exe IHYQUPS.exe File created C:\windows\SysWOW64\FPUB.exe.bat NMRFKKN.exe File created C:\windows\SysWOW64\SJQQ.exe WEYBMG.exe File created C:\windows\SysWOW64\NRDIQ.exe.bat WRBV.exe File opened for modification C:\windows\SysWOW64\MAOGO.exe AHLOG.exe File opened for modification C:\windows\SysWOW64\EBMKG.exe NBKXUV.exe File created C:\windows\SysWOW64\VFV.exe FPUB.exe File opened for modification C:\windows\SysWOW64\BPVF.exe SJQQ.exe File opened for modification C:\windows\SysWOW64\ZNZR.exe BCXJU.exe File opened for modification C:\windows\SysWOW64\GWXPK.exe TTHQV.exe File created C:\windows\SysWOW64\NRDIQ.exe WRBV.exe File opened for modification C:\windows\SysWOW64\AHLOG.exe XZFOUY.exe File created C:\windows\SysWOW64\MJAEX.exe EDWXM.exe File created C:\windows\SysWOW64\SGV.exe ZOGKGRM.exe File created C:\windows\SysWOW64\RPZTNPA.exe RJGELCX.exe File opened for modification C:\windows\SysWOW64\FPUB.exe NMRFKKN.exe File created C:\windows\SysWOW64\DLAHHUG.exe.bat VFV.exe File created C:\windows\SysWOW64\QDKDEI.exe BNJMF.exe File created C:\windows\SysWOW64\SJQQ.exe.bat WEYBMG.exe File created C:\windows\SysWOW64\BPVF.exe.bat SJQQ.exe File opened for modification C:\windows\SysWOW64\YTJOF.exe FQF.exe File created C:\windows\SysWOW64\XJEAYG.exe OJCV.exe File opened for modification C:\windows\SysWOW64\XJEAYG.exe OJCV.exe File opened for modification C:\windows\SysWOW64\ACQI.exe FZIKOT.exe File created C:\windows\SysWOW64\DLAHHUG.exe VFV.exe File opened for modification C:\windows\SysWOW64\PFIETCA.exe WNTTKBS.exe File created C:\windows\SysWOW64\HJHYLFU.exe XMC.exe File created C:\windows\SysWOW64\GWXPK.exe.bat TTHQV.exe File created C:\windows\SysWOW64\PJKUE.exe.bat 2026-08-09_218e956b2239646961bcd14565e95ec8_elex_emotet_stop.exe File created C:\windows\SysWOW64\GISN.exe.bat RSRNYN.exe File created C:\windows\SysWOW64\REUQK.exe.bat BOLYDMR.exe File created C:\windows\SysWOW64\QDKDEI.exe.bat BNJMF.exe File opened for modification C:\windows\SysWOW64\HJHYLFU.exe XMC.exe File created C:\windows\SysWOW64\UVHCG.exe.bat ZAKL.exe File opened for modification C:\windows\SysWOW64\SJQQ.exe WEYBMG.exe File opened for modification C:\windows\SysWOW64\RPZTNPA.exe RJGELCX.exe File opened for modification C:\windows\SysWOW64\QEVMO.exe YDTH.exe File created C:\windows\SysWOW64\NMRFKKN.exe IHYQUPS.exe File opened for modification C:\windows\SysWOW64\DLAHHUG.exe VFV.exe File created C:\windows\SysWOW64\PFIETCA.exe.bat WNTTKBS.exe File opened for modification C:\windows\SysWOW64\REUQK.exe BOLYDMR.exe File created C:\windows\SysWOW64\UVHCG.exe ZAKL.exe File opened for modification C:\windows\SysWOW64\ZIXO.exe EUSFPPX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\NBAE.exe.bat SGV.exe File created C:\windows\XYFQ.exe DLAHHUG.exe File created C:\windows\system\BOLYDMR.exe.bat XYFQ.exe File opened for modification C:\windows\DHLURV.exe TGJPN.exe File opened for modification C:\windows\UNCEY.exe QFWWUWW.exe File created C:\windows\SUUZ.exe XJEAYG.exe File created C:\windows\DHLURV.exe.bat TGJPN.exe File created C:\windows\UNCEY.exe QFWWUWW.exe File opened for modification C:\windows\system\BCXJU.exe HJHYLFU.exe File created C:\windows\system\BCXJU.exe.bat HJHYLFU.exe File created C:\windows\TTHQV.exe.bat NXIP.exe File created C:\windows\OJCV.exe GWXPK.exe File opened for modification C:\windows\TFJEE.exe QPC.exe File opened for modification C:\windows\XZFOUY.exe NRDIQ.exe File created C:\windows\GZE.exe.bat REUQK.exe File created C:\windows\system\XJHKHXN.exe NLTYA.exe File opened for modification C:\windows\FDWXESB.exe ZIXO.exe File created C:\windows\EDWXM.exe PIMTBPX.exe File opened for modification C:\windows\EUSFPPX.exe SEZMCL.exe File created C:\windows\system\NSZN.exe.bat ESX.exe File created C:\windows\system\RFX.exe.bat SUUZ.exe File created C:\windows\XZFOUY.exe.bat NRDIQ.exe File created C:\windows\GSQXY.exe.bat RPZTNPA.exe File created C:\windows\BAZKOR.exe HNUB.exe File created C:\windows\system\RSRNYN.exe NJKN.exe File opened for modification C:\windows\ATQRC.exe BVXWPA.exe File created C:\windows\system\WEYBMG.exe XLVTEAV.exe File created C:\windows\PTK.exe.bat UNCEY.exe File opened for modification C:\windows\EDWXM.exe PIMTBPX.exe File opened for modification C:\windows\system\NLTYA.exe EDRL.exe File opened for modification C:\windows\system\RJGELCX.exe NBAE.exe File created C:\windows\system\RSRNYN.exe.bat NJKN.exe File created C:\windows\WRBV.exe.bat NDQDXY.exe File opened for modification C:\windows\system\CYCOFA.exe BDY.exe File created C:\windows\WTG.exe CYCOFA.exe File opened for modification C:\windows\system\FUIDT.exe WTG.exe File opened for modification C:\windows\RNNSX.exe WCWTIJM.exe File created C:\windows\MZHK.exe.bat IJSKKSJ.exe File created C:\windows\HNUB.exe GSQXY.exe File created C:\windows\NJKN.exe YTJOF.exe File created C:\windows\ATQRC.exe.bat BVXWPA.exe File created C:\windows\BNJMF.exe GZE.exe File created C:\windows\DHLURV.exe TGJPN.exe File created C:\windows\NFROGD.exe DHLURV.exe File opened for modification C:\windows\system\ZXH.exe MZHK.exe File created C:\windows\EABTVR.exe NSZN.exe File created C:\windows\HNUB.exe.bat GSQXY.exe File created C:\windows\FQF.exe BAZKOR.exe File opened for modification C:\windows\FQF.exe BAZKOR.exe File created C:\windows\system\BVXWPA.exe.bat GISN.exe File created C:\windows\SAPXT.exe.bat QDKDEI.exe File created C:\windows\NFROGD.exe.bat DHLURV.exe File opened for modification C:\windows\MZHK.exe IJSKKSJ.exe File created C:\windows\system\NLTYA.exe.bat EDRL.exe File created C:\windows\system\ESX.exe ACQI.exe File opened for modification C:\windows\YDTH.exe ATQRC.exe File created C:\windows\IHYQUPS.exe.bat QEVMO.exe File created C:\windows\XYFQ.exe.bat DLAHHUG.exe File created C:\windows\system\TGJPN.exe.bat BDGTIA.exe File created C:\windows\QFWWUWW.exe.bat BPVF.exe File created C:\windows\MZHK.exe IJSKKSJ.exe File created C:\windows\system\ZXH.exe.bat MZHK.exe File created C:\windows\ATQRC.exe BVXWPA.exe File opened for modification C:\windows\system\TGJPN.exe BDGTIA.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4308 cmd.exe 4532 cmd.exe 2680 cmd.exe 3416 cmd.exe 5816 cmd.exe 4152 cmd.exe 1160 cmd.exe 5092 cmd.exe 4192 cmd.exe 3004 cmd.exe 2000 cmd.exe 2004 cmd.exe 800 cmd.exe 1580 cmd.exe 4776 cmd.exe 4120 cmd.exe 4908 cmd.exe 1400 cmd.exe 3360 cmd.exe 5840 cmd.exe 1384 cmd.exe 708 cmd.exe 2564 cmd.exe 1412 cmd.exe 996 cmd.exe 1368 cmd.exe 4232 cmd.exe 5456 cmd.exe 4564 cmd.exe 4980 cmd.exe 4840 cmd.exe 5924 cmd.exe 5336 cmd.exe 3516 cmd.exe 612 cmd.exe 1780 cmd.exe 2020 cmd.exe 5664 cmd.exe 4976 cmd.exe 3404 cmd.exe 4444 cmd.exe 1276 cmd.exe 4304 cmd.exe 3964 cmd.exe 3700 cmd.exe 5252 cmd.exe 3800 cmd.exe 1472 cmd.exe 5512 cmd.exe 4204 cmd.exe 1244 cmd.exe 5436 cmd.exe 3936 cmd.exe 3176 cmd.exe 1208 cmd.exe 5116 cmd.exe 5616 cmd.exe 6128 cmd.exe 1608 cmd.exe 1416 cmd.exe 4716 cmd.exe 4832 cmd.exe 1124 cmd.exe 4296 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 6076 2808 WerFault.exe 87 3816 4384 WerFault.exe 93 3576 5640 WerFault.exe 99 5300 3140 WerFault.exe 104 5460 5556 WerFault.exe 109 6084 3428 WerFault.exe 114 4636 4556 WerFault.exe 119 2920 3828 WerFault.exe 124 1080 2828 WerFault.exe 129 4280 2984 WerFault.exe 134 4232 4428 WerFault.exe 139 2204 5388 WerFault.exe 144 3728 5124 WerFault.exe 149 3608 3000 WerFault.exe 154 2600 5544 WerFault.exe 159 5128 1584 WerFault.exe 164 700 5760 WerFault.exe 169 5772 3732 WerFault.exe 174 3376 3632 WerFault.exe 179 5928 3312 WerFault.exe 184 5396 3628 WerFault.exe 189 2300 5876 WerFault.exe 194 4660 1508 WerFault.exe 199 3816 956 WerFault.exe 204 4564 5108 WerFault.exe 209 1032 5632 WerFault.exe 214 5236 2024 WerFault.exe 219 2456 5392 WerFault.exe 224 2348 4088 WerFault.exe 229 5092 4176 WerFault.exe 234 2864 3920 WerFault.exe 239 1488 1668 WerFault.exe 244 2300 1372 WerFault.exe 249 1332 1116 WerFault.exe 254 2036 4424 WerFault.exe 259 4564 4836 WerFault.exe 264 928 1192 WerFault.exe 269 3940 380 WerFault.exe 275 5520 4236 WerFault.exe 280 2000 4104 WerFault.exe 285 4324 2920 WerFault.exe 290 4392 1704 WerFault.exe 295 5700 5396 WerFault.exe 300 1376 3168 WerFault.exe 305 2400 4660 WerFault.exe 310 1648 3764 WerFault.exe 315 5340 2220 WerFault.exe 320 4980 3500 WerFault.exe 325 2524 4520 WerFault.exe 330 4168 700 WerFault.exe 334 5788 4372 WerFault.exe 340 1516 2848 WerFault.exe 345 3156 3148 WerFault.exe 350 3824 3812 WerFault.exe 355 800 5620 WerFault.exe 360 4224 3300 WerFault.exe 365 3320 5416 WerFault.exe 370 4776 5044 WerFault.exe 375 2444 480 WerFault.exe 380 1972 5312 WerFault.exe 385 2864 548 WerFault.exe 390 5720 3340 WerFault.exe 395 5328 2868 WerFault.exe 400 1808 3584 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILNCPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZIXO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSRNYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWXPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCWTIJM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIMTBPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XZFOUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDGTIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFWWUWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDRL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNJMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WNTTKBS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTHQV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUUZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNZU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBKXUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDTH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REUQK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDWXESB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBMKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AHLOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJSKKSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHYUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPUB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2808 2026-08-09_218e956b2239646961bcd14565e95ec8_elex_emotet_stop.exe 2808 2026-08-09_218e956b2239646961bcd14565e95ec8_elex_emotet_stop.exe 4384 PJKUE.exe 4384 PJKUE.exe 5640 UZRKZOI.exe 5640 UZRKZOI.exe 3140 DZTPD.exe 3140 DZTPD.exe 5556 WCWTIJM.exe 5556 WCWTIJM.exe 3428 RNNSX.exe 3428 RNNSX.exe 4556 PIMTBPX.exe 4556 PIMTBPX.exe 3828 EDWXM.exe 3828 EDWXM.exe 2828 MJAEX.exe 2828 MJAEX.exe 2984 SEZMCL.exe 2984 SEZMCL.exe 4428 EUSFPPX.exe 4428 EUSFPPX.exe 5388 ZIXO.exe 5388 ZIXO.exe 5124 FDWXESB.exe 5124 FDWXESB.exe 3000 JLDX.exe 3000 JLDX.exe 5544 NBKXUV.exe 5544 NBKXUV.exe 1584 EBMKG.exe 1584 EBMKG.exe 5760 IJSKKSJ.exe 5760 IJSKKSJ.exe 3732 MZHK.exe 3732 MZHK.exe 3632 ZXH.exe 3632 ZXH.exe 3312 EDRL.exe 3312 EDRL.exe 3628 NLTYA.exe 3628 NLTYA.exe 5876 XJHKHXN.exe 5876 XJHKHXN.exe 1508 FZIKOT.exe 1508 FZIKOT.exe 956 ACQI.exe 956 ACQI.exe 5108 ESX.exe 5108 ESX.exe 5632 NSZN.exe 5632 NSZN.exe 2024 EABTVR.exe 2024 EABTVR.exe 5392 ZOGKGRM.exe 5392 ZOGKGRM.exe 4088 SGV.exe 4088 SGV.exe 4176 NBAE.exe 4176 NBAE.exe 3920 RJGELCX.exe 3920 RJGELCX.exe 1668 RPZTNPA.exe 1668 RPZTNPA.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2808 2026-08-09_218e956b2239646961bcd14565e95ec8_elex_emotet_stop.exe 2808 2026-08-09_218e956b2239646961bcd14565e95ec8_elex_emotet_stop.exe 4384 PJKUE.exe 4384 PJKUE.exe 5640 UZRKZOI.exe 5640 UZRKZOI.exe 3140 DZTPD.exe 3140 DZTPD.exe 5556 WCWTIJM.exe 5556 WCWTIJM.exe 3428 RNNSX.exe 3428 RNNSX.exe 4556 PIMTBPX.exe 4556 PIMTBPX.exe 3828 EDWXM.exe 3828 EDWXM.exe 2828 MJAEX.exe 2828 MJAEX.exe 2984 SEZMCL.exe 2984 SEZMCL.exe 4428 EUSFPPX.exe 4428 EUSFPPX.exe 5388 ZIXO.exe 5388 ZIXO.exe 5124 FDWXESB.exe 5124 FDWXESB.exe 3000 JLDX.exe 3000 JLDX.exe 5544 NBKXUV.exe 5544 NBKXUV.exe 1584 EBMKG.exe 1584 EBMKG.exe 5760 IJSKKSJ.exe 5760 IJSKKSJ.exe 3732 MZHK.exe 3732 MZHK.exe 3632 ZXH.exe 3632 ZXH.exe 3312 EDRL.exe 3312 EDRL.exe 3628 NLTYA.exe 3628 NLTYA.exe 5876 XJHKHXN.exe 5876 XJHKHXN.exe 1508 FZIKOT.exe 1508 FZIKOT.exe 956 ACQI.exe 956 ACQI.exe 5108 ESX.exe 5108 ESX.exe 5632 NSZN.exe 5632 NSZN.exe 2024 EABTVR.exe 2024 EABTVR.exe 5392 ZOGKGRM.exe 5392 ZOGKGRM.exe 4088 SGV.exe 4088 SGV.exe 4176 NBAE.exe 4176 NBAE.exe 3920 RJGELCX.exe 3920 RJGELCX.exe 1668 RPZTNPA.exe 1668 RPZTNPA.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2808 wrote to memory of 3460 2808 2026-08-09_218e956b2239646961bcd14565e95ec8_elex_emotet_stop.exe 89 PID 3460 wrote to memory of 4384 3460 cmd.exe 93 PID 4384 wrote to memory of 1244 4384 PJKUE.exe 95 PID 1244 wrote to memory of 5640 1244 cmd.exe 99 PID 5640 wrote to memory of 3132 5640 UZRKZOI.exe 100 PID 3132 wrote to memory of 3140 3132 cmd.exe 104 PID 3140 wrote to memory of 4976 3140 DZTPD.exe 105 PID 4976 wrote to memory of 5556 4976 cmd.exe 109 PID 5556 wrote to memory of 5436 5556 WCWTIJM.exe 110 PID 5436 wrote to memory of 3428 5436 cmd.exe 114 PID 3428 wrote to memory of 2004 3428 RNNSX.exe 115 PID 2004 wrote to memory of 4556 2004 cmd.exe 119 PID 4556 wrote to memory of 3700 4556 PIMTBPX.exe 120 PID 3700 wrote to memory of 3828 3700 cmd.exe 124 PID 3828 wrote to memory of 612 3828 EDWXM.exe 125 PID 612 wrote to memory of 2828 612 cmd.exe 129 PID 2828 wrote to memory of 3404 2828 MJAEX.exe 130 PID 3404 wrote to memory of 2984 3404 cmd.exe 134 PID 2984 wrote to memory of 2388 2984 SEZMCL.exe 135 PID 2388 wrote to memory of 4428 2388 cmd.exe 139 PID 4428 wrote to memory of 3616 4428 EUSFPPX.exe 140 PID 3616 wrote to memory of 5388 3616 cmd.exe 144 PID 5388 wrote to memory of 4716 5388 ZIXO.exe 145 PID 4716 wrote to memory of 5124 4716 cmd.exe 149 PID 5124 wrote to memory of 2592 5124 FDWXESB.exe 150 PID 2592 wrote to memory of 3000 2592 cmd.exe 154 PID 3000 wrote to memory of 996 3000 JLDX.exe 155 PID 996 wrote to memory of 5544 996 cmd.exe 159 PID 5544 wrote to memory of 240 5544 NBKXUV.exe 160 PID 240 wrote to memory of 1584 240 cmd.exe 164 PID 1584 wrote to memory of 812 1584 EBMKG.exe 165 PID 812 wrote to memory of 5760 812 cmd.exe 169 PID 5760 wrote to memory of 4240 5760 IJSKKSJ.exe 170 PID 4240 wrote to memory of 3732 4240 cmd.exe 174 PID 3732 wrote to memory of 4892 3732 MZHK.exe 175 PID 4892 wrote to memory of 3632 4892 cmd.exe 179 PID 3632 wrote to memory of 3872 3632 ZXH.exe 180 PID 3872 wrote to memory of 3312 3872 cmd.exe 184 PID 3312 wrote to memory of 3936 3312 EDRL.exe 185 PID 3936 wrote to memory of 3628 3936 cmd.exe 189 PID 3628 wrote to memory of 3768 3628 NLTYA.exe 190 PID 3768 wrote to memory of 5876 3768 cmd.exe 194 PID 5876 wrote to memory of 3112 5876 XJHKHXN.exe 195 PID 3112 wrote to memory of 1508 3112 cmd.exe 199 PID 1508 wrote to memory of 4444 1508 FZIKOT.exe 200 PID 4444 wrote to memory of 956 4444 cmd.exe 204 PID 956 wrote to memory of 3728 956 ACQI.exe 205 PID 3728 wrote to memory of 5108 3728 cmd.exe 209 PID 5108 wrote to memory of 5704 5108 ESX.exe 210 PID 5704 wrote to memory of 5632 5704 cmd.exe 214 PID 5632 wrote to memory of 2224 5632 NSZN.exe 215 PID 2224 wrote to memory of 2024 2224 cmd.exe 219 PID 2024 wrote to memory of 3484 2024 EABTVR.exe 220 PID 3484 wrote to memory of 5392 3484 cmd.exe 224 PID 5392 wrote to memory of 3504 5392 ZOGKGRM.exe 225 PID 3504 wrote to memory of 4088 3504 cmd.exe 229 PID 4088 wrote to memory of 4820 4088 SGV.exe 230 PID 4820 wrote to memory of 4176 4820 cmd.exe 234 PID 4176 wrote to memory of 4832 4176 NBAE.exe 235 PID 4832 wrote to memory of 3920 4832 cmd.exe 239 PID 3920 wrote to memory of 1160 3920 RJGELCX.exe 240 PID 1160 wrote to memory of 1668 1160 cmd.exe 244 PID 1668 wrote to memory of 5668 1668 RPZTNPA.exe 245 PID 5668 wrote to memory of 1372 5668 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_218e956b2239646961bcd14565e95ec8_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_218e956b2239646961bcd14565e95ec8_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJKUE.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\windows\SysWOW64\PJKUE.exeC:\windows\system32\PJKUE.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UZRKZOI.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\windows\UZRKZOI.exeC:\windows\UZRKZOI.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZTPD.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\windows\DZTPD.exeC:\windows\DZTPD.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WCWTIJM.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\windows\WCWTIJM.exeC:\windows\WCWTIJM.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RNNSX.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\RNNSX.exeC:\windows\RNNSX.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PIMTBPX.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\windows\PIMTBPX.exeC:\windows\PIMTBPX.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDWXM.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\windows\EDWXM.exeC:\windows\EDWXM.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJAEX.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:612 -
C:\windows\SysWOW64\MJAEX.exeC:\windows\system32\MJAEX.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEZMCL.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\windows\system\SEZMCL.exeC:\windows\system\SEZMCL.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUSFPPX.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\windows\EUSFPPX.exeC:\windows\EUSFPPX.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZIXO.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\windows\SysWOW64\ZIXO.exeC:\windows\system32\ZIXO.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FDWXESB.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\windows\FDWXESB.exeC:\windows\FDWXESB.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLDX.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\windows\JLDX.exeC:\windows\JLDX.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NBKXUV.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:996 -
C:\windows\system\NBKXUV.exeC:\windows\system\NBKXUV.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EBMKG.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:240 -
C:\windows\SysWOW64\EBMKG.exeC:\windows\system32\EBMKG.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IJSKKSJ.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:812 -
C:\windows\IJSKKSJ.exeC:\windows\IJSKKSJ.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MZHK.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\windows\MZHK.exeC:\windows\MZHK.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZXH.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\windows\system\ZXH.exeC:\windows\system\ZXH.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EDRL.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\windows\system\EDRL.exeC:\windows\system\EDRL.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLTYA.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\windows\system\NLTYA.exeC:\windows\system\NLTYA.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XJHKHXN.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\windows\system\XJHKHXN.exeC:\windows\system\XJHKHXN.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZIKOT.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\windows\FZIKOT.exeC:\windows\FZIKOT.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACQI.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\windows\SysWOW64\ACQI.exeC:\windows\system32\ACQI.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ESX.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\windows\system\ESX.exeC:\windows\system\ESX.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSZN.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\windows\system\NSZN.exeC:\windows\system\NSZN.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EABTVR.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\windows\EABTVR.exeC:\windows\EABTVR.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOGKGRM.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\windows\system\ZOGKGRM.exeC:\windows\system\ZOGKGRM.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SGV.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\windows\SysWOW64\SGV.exeC:\windows\system32\SGV.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NBAE.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\windows\NBAE.exeC:\windows\NBAE.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RJGELCX.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\windows\system\RJGELCX.exeC:\windows\system\RJGELCX.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RPZTNPA.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\windows\SysWOW64\RPZTNPA.exeC:\windows\system32\RPZTNPA.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSQXY.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\windows\GSQXY.exeC:\windows\GSQXY.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNUB.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5320 -
C:\windows\HNUB.exeC:\windows\HNUB.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BAZKOR.exe.bat" "68⤵PID:3412
-
C:\windows\BAZKOR.exeC:\windows\BAZKOR.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FQF.exe.bat" "70⤵
- Executes a command shell one-liner
PID:3416 -
C:\windows\FQF.exeC:\windows\FQF.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YTJOF.exe.bat" "72⤵
- Executes a command shell one-liner
PID:3176 -
C:\windows\SysWOW64\YTJOF.exeC:\windows\system32\YTJOF.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NJKN.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:5424 -
C:\windows\NJKN.exeC:\windows\NJKN.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSRNYN.exe.bat" "76⤵PID:5112
-
C:\windows\system\RSRNYN.exeC:\windows\system\RSRNYN.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GISN.exe.bat" "78⤵PID:2900
-
C:\windows\SysWOW64\GISN.exeC:\windows\system32\GISN.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BVXWPA.exe.bat" "80⤵PID:3372
-
C:\windows\system\BVXWPA.exeC:\windows\system\BVXWPA.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ATQRC.exe.bat" "82⤵
- Executes a command shell one-liner
PID:5092 -
C:\windows\ATQRC.exeC:\windows\ATQRC.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDTH.exe.bat" "84⤵
- Executes a command shell one-liner
PID:1368 -
C:\windows\YDTH.exeC:\windows\YDTH.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEVMO.exe.bat" "86⤵PID:4332
-
C:\windows\SysWOW64\QEVMO.exeC:\windows\system32\QEVMO.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IHYQUPS.exe.bat" "88⤵
- Executes a command shell one-liner
PID:5616 -
C:\windows\IHYQUPS.exeC:\windows\IHYQUPS.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NMRFKKN.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1400 -
C:\windows\SysWOW64\NMRFKKN.exeC:\windows\system32\NMRFKKN.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPUB.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1276 -
C:\windows\SysWOW64\FPUB.exeC:\windows\system32\FPUB.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFV.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:5020 -
C:\windows\SysWOW64\VFV.exeC:\windows\system32\VFV.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLAHHUG.exe.bat" "96⤵PID:928
-
C:\windows\SysWOW64\DLAHHUG.exeC:\windows\system32\DLAHHUG.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYFQ.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3360 -
C:\windows\XYFQ.exeC:\windows\XYFQ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BOLYDMR.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:2284 -
C:\windows\system\BOLYDMR.exeC:\windows\system\BOLYDMR.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\REUQK.exe.bat" "102⤵PID:1068
-
C:\windows\SysWOW64\REUQK.exeC:\windows\system32\REUQK.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZE.exe.bat" "104⤵
- Executes a command shell one-liner
PID:1124 -
C:\windows\GZE.exeC:\windows\GZE.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNJMF.exe.bat" "106⤵PID:1488
-
C:\windows\BNJMF.exeC:\windows\BNJMF.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QDKDEI.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4232 -
C:\windows\SysWOW64\QDKDEI.exeC:\windows\system32\QDKDEI.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SAPXT.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5840 -
C:\windows\SAPXT.exeC:\windows\SAPXT.exe111⤵
- Executes dropped EXE
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDGTIA.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4296 -
C:\windows\BDGTIA.exeC:\windows\BDGTIA.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGJPN.exe.bat" "114⤵PID:5420
-
C:\windows\system\TGJPN.exeC:\windows\system\TGJPN.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DHLURV.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:1212 -
C:\windows\DHLURV.exeC:\windows\DHLURV.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFROGD.exe.bat" "118⤵PID:2056
-
C:\windows\NFROGD.exeC:\windows\NFROGD.exe119⤵
- Executes dropped EXE
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WNTTKBS.exe.bat" "120⤵PID:1104
-
C:\windows\system\WNTTKBS.exeC:\windows\system\WNTTKBS.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-