Analysis
- max time kernel
82s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 18:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_8825527a4391948d27be0e6f7e391c4f_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-10_8825527a4391948d27be0e6f7e391c4f_elex_emotet_stop.exe
- Size 208KB
- Sample260810-w6c7psvfpd
- SHA256 7f75d327ba3d613ebc61d23d9a4e5215488d3f6c5fc7626506a80fe274afae10
- MD5 8825527a4391948d27be0e6f7e391c4f
- SHA1 be6bc6c621707a713d084fe83678e708568bc9db
- SHA512 71a1595fdf6fe7e30c9bd9e775887ac0de1419d312a5e4d4d8b2d3d4fb62ce4bed72d1dcf4921123cf46ae4336cd74cc9372dfa12ef204c8ce18020e097749d1
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOf04NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOMQEj1
- TLSH T18A247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 396 YBSNVGK.exe 2428 TWX.exe 5688 AMYMUXQ.exe 5072 SUMKHOL.exe 4396 SXQN.exe 3380 FAHE.exe 5512 GDKIGF.exe 6064 PDMNJCT.exe 3784 DOVLYNO.exe 4832 SEW.exe 5660 RPZTNPA.exe 5908 ZCLZYNV.exe 2684 ZYPDDD.exe 3916 HLCKO.exe 1812 VWK.exe 624 THNQKSK.exe 2388 VEBLS.exe 1492 WZEP.exe 5020 PCIKLO.exe 3888 KNRJRR.exe 3564 OVF.exe 4212 NOIZMQJ.exe 1376 MCBLJNZ.exe 3280 ZAJXL.exe 3896 ADNSYPK.exe 5464 CASNGXT.exe 4860 MYYHNF.exe 3144 QGNH.exe 4740 PRP.exe 5352 VMBYOSU.exe 5724 TFEGXY.exe 5936 XNLO.exe 4316 FTX.exe 5652 ELALCDW.exe 5380 OJGFKLF.exe 4556 FJUCWCI.exe 5400 NXHJHBD.exe 4128 KQILLX.exe 4084 CYXQXO.exe 200 AJAGG.exe 5336 UJPRP.exe 2300 CPCY.exe 1120 SZE.exe 1228 CXKIYQ.exe 2936 PIBZEA.exe 672 OTD.exe 2660 EJEOUC.exe 1416 CYYJH.exe 1124 DCBN.exe 696 FZHHBF.exe 4776 UPIZI.exe 4112 YFPHULN.exe 4544 CNDH.exe 5572 KTIO.exe 1516 BBKTVHH.exe 6016 DZPNC.exe 6056 VZRSGN.exe 4056 ZPYAS.exe 5760 KIBTA.exe 4476 OQIT.exe 260 DGJKL.exe 52 HWP.exe 2676 IZBODBD.exe 780 CMY.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\RPZTNPA.exe.bat SEW.exe File created C:\windows\SysWOW64\THNQKSK.exe.bat VWK.exe File created C:\windows\SysWOW64\OVF.exe KNRJRR.exe File created C:\windows\SysWOW64\PRP.exe QGNH.exe File created C:\windows\SysWOW64\XNLO.exe TFEGXY.exe File opened for modification C:\windows\SysWOW64\PTB.exe CQL.exe File created C:\windows\SysWOW64\IGP.exe.bat GIBJ.exe File created C:\windows\SysWOW64\GXH.exe TMYIY.exe File created C:\windows\SysWOW64\SEW.exe DOVLYNO.exe File created C:\windows\SysWOW64\RPZTNPA.exe SEW.exe File created C:\windows\SysWOW64\VWK.exe HLCKO.exe File created C:\windows\SysWOW64\PIBZEA.exe CXKIYQ.exe File opened for modification C:\windows\SysWOW64\PIBZEA.exe CXKIYQ.exe File created C:\windows\SysWOW64\BBKTVHH.exe KTIO.exe File created C:\windows\SysWOW64\INGTWD.exe CMY.exe File created C:\windows\SysWOW64\PTB.exe.bat CQL.exe File opened for modification C:\windows\SysWOW64\PDMNJCT.exe GDKIGF.exe File created C:\windows\SysWOW64\THNQKSK.exe VWK.exe File created C:\windows\SysWOW64\VZRSGN.exe.bat DZPNC.exe File opened for modification C:\windows\SysWOW64\INGTWD.exe CMY.exe File opened for modification C:\windows\SysWOW64\XNRLN.exe CAM.exe File created C:\windows\SysWOW64\XNRLN.exe.bat CAM.exe File opened for modification C:\windows\SysWOW64\IGP.exe GIBJ.exe File created C:\windows\SysWOW64\PDMNJCT.exe.bat GDKIGF.exe File opened for modification C:\windows\SysWOW64\SEW.exe DOVLYNO.exe File opened for modification C:\windows\SysWOW64\THNQKSK.exe VWK.exe File opened for modification C:\windows\SysWOW64\KNRJRR.exe PCIKLO.exe File opened for modification C:\windows\SysWOW64\NOIZMQJ.exe OVF.exe File opened for modification C:\windows\SysWOW64\SZE.exe CPCY.exe File created C:\windows\SysWOW64\MVU.exe.bat INGTWD.exe File created C:\windows\SysWOW64\BNHEXE.exe XXBE.exe File created C:\windows\SysWOW64\SEW.exe.bat DOVLYNO.exe File created C:\windows\SysWOW64\VEBLS.exe.bat THNQKSK.exe File opened for modification C:\windows\SysWOW64\TFEGXY.exe VMBYOSU.exe File created C:\windows\SysWOW64\CYXQXO.exe KQILLX.exe File opened for modification C:\windows\SysWOW64\UPIZI.exe FZHHBF.exe File opened for modification C:\windows\SysWOW64\LGE.exe SDAYDI.exe File opened for modification C:\windows\SysWOW64\XFXCVC.exe TPQUJRT.exe File created C:\windows\SysWOW64\PRP.exe.bat QGNH.exe File created C:\windows\SysWOW64\TFEGXY.exe.bat VMBYOSU.exe File created C:\windows\SysWOW64\RKOB.exe.bat NHQGWV.exe File opened for modification C:\windows\SysWOW64\FVEMOE.exe AVWY.exe File created C:\windows\SysWOW64\FAHE.exe SXQN.exe File opened for modification C:\windows\SysWOW64\ZYPDDD.exe ZCLZYNV.exe File opened for modification C:\windows\SysWOW64\VEBLS.exe THNQKSK.exe File created C:\windows\SysWOW64\PCIKLO.exe WZEP.exe File opened for modification C:\windows\SysWOW64\PCIKLO.exe WZEP.exe File created C:\windows\SysWOW64\PCIKLO.exe.bat WZEP.exe File created C:\windows\SysWOW64\NOIZMQJ.exe.bat OVF.exe File created C:\windows\SysWOW64\SZE.exe.bat CPCY.exe File created C:\windows\SysWOW64\VEBLS.exe THNQKSK.exe File created C:\windows\SysWOW64\OVF.exe.bat KNRJRR.exe File created C:\windows\SysWOW64\EJEOUC.exe OTD.exe File opened for modification C:\windows\SysWOW64\EJEOUC.exe OTD.exe File created C:\windows\SysWOW64\UPIZI.exe.bat FZHHBF.exe File created C:\windows\SysWOW64\MVU.exe INGTWD.exe File created C:\windows\SysWOW64\NRDIQ.exe.bat TEY.exe File created C:\windows\SysWOW64\LGE.exe SDAYDI.exe File created C:\windows\SysWOW64\KNRJRR.exe.bat PCIKLO.exe File created C:\windows\SysWOW64\ZAJXL.exe.bat MCBLJNZ.exe File created C:\windows\SysWOW64\CPCY.exe UJPRP.exe File created C:\windows\SysWOW64\LGE.exe.bat SDAYDI.exe File opened for modification C:\windows\SysWOW64\BNHEXE.exe XXBE.exe File created C:\windows\SysWOW64\CQL.exe BNHEXE.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\MYYHNF.exe CASNGXT.exe File created C:\windows\system\CYYJH.exe.bat EJEOUC.exe File created C:\windows\YFPHULN.exe.bat UPIZI.exe File created C:\windows\system\KTIO.exe CNDH.exe File opened for modification C:\windows\system\KTIO.exe CNDH.exe File created C:\windows\SBUVBD.exe MAMI.exe File created C:\windows\CASNGXT.exe.bat ADNSYPK.exe File opened for modification C:\windows\system\ELALCDW.exe FTX.exe File opened for modification C:\windows\system\FJUCWCI.exe OJGFKLF.exe File opened for modification C:\windows\OQIT.exe KIBTA.exe File opened for modification C:\windows\XZFOUY.exe NRDIQ.exe File created C:\windows\system\MBHXW.exe LGE.exe File created C:\windows\system\YBSNVGK.exe 2026-08-10_8825527a4391948d27be0e6f7e391c4f_elex_emotet_stop.exe File created C:\windows\ZCLZYNV.exe RPZTNPA.exe File created C:\windows\system\ZPYAS.exe VZRSGN.exe File opened for modification C:\windows\CAM.exe XZFOUY.exe File created C:\windows\VOBH.exe.bat PTB.exe File created C:\windows\VAUBIH.exe RKOB.exe File created C:\windows\VAUBIH.exe.bat RKOB.exe File created C:\windows\system\ELALCDW.exe FTX.exe File opened for modification C:\windows\ZCLZYNV.exe RPZTNPA.exe File created C:\windows\WMPHDTJ.exe IGP.exe File created C:\windows\AVWY.exe.bat QVU.exe File opened for modification C:\windows\OJGFKLF.exe ELALCDW.exe File created C:\windows\SXQN.exe.bat SUMKHOL.exe File opened for modification C:\windows\system\HLCKO.exe ZYPDDD.exe File created C:\windows\DGJKL.exe OQIT.exe File opened for modification C:\windows\DGJKL.exe OQIT.exe File created C:\windows\WMPHDTJ.exe.bat IGP.exe File created C:\windows\system\TPQUJRT.exe ZBMLZ.exe File created C:\windows\system\ADNSYPK.exe.bat ZAJXL.exe File created C:\windows\DGJKL.exe.bat OQIT.exe File opened for modification C:\windows\CMY.exe IZBODBD.exe File created C:\windows\system\GXZZH.exe MBHXW.exe File opened for modification C:\windows\WMPHDTJ.exe IGP.exe File opened for modification C:\windows\TMYIY.exe IUVP.exe File created C:\windows\system\FJUCWCI.exe OJGFKLF.exe File opened for modification C:\windows\UJPRP.exe AJAGG.exe File opened for modification C:\windows\system\CYYJH.exe EJEOUC.exe File created C:\windows\system\NXHJHBD.exe FJUCWCI.exe File created C:\windows\system\MBHXW.exe.bat LGE.exe File created C:\windows\VOBH.exe PTB.exe File created C:\windows\system\XMG.exe VOBH.exe File created C:\windows\system\YBSNVGK.exe.bat 2026-08-10_8825527a4391948d27be0e6f7e391c4f_elex_emotet_stop.exe File created C:\windows\system\CXKIYQ.exe SZE.exe File created C:\windows\DCBN.exe.bat CYYJH.exe File created C:\windows\system\HTKG.exe FVEMOE.exe File created C:\windows\GDKIGF.exe FAHE.exe File created C:\windows\ZCLZYNV.exe.bat RPZTNPA.exe File created C:\windows\system\CYYJH.exe EJEOUC.exe File created C:\windows\system\KTIO.exe.bat CNDH.exe File created C:\windows\system\IZBODBD.exe HWP.exe File created C:\windows\system\GXZZH.exe.bat MBHXW.exe File opened for modification C:\windows\system\AMYMUXQ.exe TWX.exe File opened for modification C:\windows\system\GXZZH.exe MBHXW.exe File created C:\windows\system\NHQGWV.exe XMG.exe File opened for modification C:\windows\QVU.exe GXH.exe File created C:\windows\SXQN.exe SUMKHOL.exe File created C:\windows\system\HLCKO.exe ZYPDDD.exe File created C:\windows\MYYHNF.exe CASNGXT.exe File opened for modification C:\windows\system\TWX.exe YBSNVGK.exe File opened for modification C:\windows\system\SUMKHOL.exe AMYMUXQ.exe File opened for modification C:\windows\QGNH.exe MYYHNF.exe File created C:\windows\system\VMBYOSU.exe PRP.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4444 cmd.exe 2156 cmd.exe 1156 cmd.exe 900 cmd.exe 5992 cmd.exe 5548 cmd.exe 2436 cmd.exe 792 cmd.exe 3320 cmd.exe 2768 cmd.exe 2644 cmd.exe 1308 cmd.exe 2356 cmd.exe 3884 cmd.exe 2296 cmd.exe 4712 cmd.exe 5948 cmd.exe 1572 cmd.exe 5544 cmd.exe 5040 cmd.exe 3364 cmd.exe 4176 cmd.exe 5424 cmd.exe 4736 cmd.exe 2292 cmd.exe 4052 cmd.exe 236 cmd.exe 3436 cmd.exe 1508 cmd.exe 5576 cmd.exe 988 cmd.exe 1372 cmd.exe 2964 cmd.exe 3796 cmd.exe 4692 cmd.exe 4216 cmd.exe 432 cmd.exe 5600 cmd.exe 4108 cmd.exe 2744 cmd.exe 6072 cmd.exe 252 cmd.exe 3272 cmd.exe 4596 cmd.exe 4756 cmd.exe 2464 cmd.exe 1180 cmd.exe 2568 cmd.exe 5680 cmd.exe 1148 cmd.exe 1396 cmd.exe 588 cmd.exe 4952 cmd.exe 4420 cmd.exe 2424 cmd.exe 4488 cmd.exe 4644 cmd.exe 3740 cmd.exe 4992 cmd.exe 556 cmd.exe 4588 cmd.exe 4372 cmd.exe 3324 cmd.exe 3340 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 252 1160 WerFault.exe 87 2080 396 WerFault.exe 93 4644 2428 WerFault.exe 99 3896 5688 WerFault.exe 104 4572 5072 WerFault.exe 109 4468 4396 WerFault.exe 114 1084 3380 WerFault.exe 119 4696 5512 WerFault.exe 124 1584 6064 WerFault.exe 129 696 3784 WerFault.exe 134 4792 4832 WerFault.exe 139 5064 5660 WerFault.exe 144 1376 5908 WerFault.exe 149 5396 2684 WerFault.exe 154 5220 3916 WerFault.exe 159 3148 1812 WerFault.exe 164 4256 624 WerFault.exe 169 5556 2388 WerFault.exe 174 5292 1492 WerFault.exe 179 5868 5020 WerFault.exe 184 828 3888 WerFault.exe 189 5416 3564 WerFault.exe 194 3432 4212 WerFault.exe 199 588 5064 WerFault.exe 204 5396 1376 WerFault.exe 209 4644 3280 WerFault.exe 214 5544 3896 WerFault.exe 219 3776 5464 WerFault.exe 224 5836 4860 WerFault.exe 229 1668 3144 WerFault.exe 234 4228 4740 WerFault.exe 239 5876 5352 WerFault.exe 244 2420 5724 WerFault.exe 249 1808 5936 WerFault.exe 254 5472 4316 WerFault.exe 259 4440 5652 WerFault.exe 264 1516 5380 WerFault.exe 270 3832 4556 WerFault.exe 275 4108 5400 WerFault.exe 280 556 4128 WerFault.exe 285 988 4084 WerFault.exe 290 1364 200 WerFault.exe 295 1240 5336 WerFault.exe 300 5396 2300 WerFault.exe 305 3344 1120 WerFault.exe 310 2032 1228 WerFault.exe 315 3108 2936 WerFault.exe 320 3420 672 WerFault.exe 325 3744 2660 WerFault.exe 330 2872 1416 WerFault.exe 335 3384 1124 WerFault.exe 340 1528 696 WerFault.exe 345 1952 4776 WerFault.exe 350 3876 4112 WerFault.exe 355 572 4544 WerFault.exe 360 808 5572 WerFault.exe 365 5180 1516 WerFault.exe 370 4496 6016 WerFault.exe 375 3128 6056 WerFault.exe 380 5800 4056 WerFault.exe 385 2420 5760 WerFault.exe 390 2188 4476 WerFault.exe 395 5884 260 WerFault.exe 400 572 52 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDAYDI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXZZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOIZMQJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VZRSGN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MAMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVWY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLCKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZYPDDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDMNJCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THNQKSK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJEOUC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DOVLYNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXKIYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NRDIQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNRLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPZTNPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TWX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XZSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADNSYPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMPHDTJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZAJXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UJPRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KNRJRR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYXQXO.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1160 2026-08-10_8825527a4391948d27be0e6f7e391c4f_elex_emotet_stop.exe 1160 2026-08-10_8825527a4391948d27be0e6f7e391c4f_elex_emotet_stop.exe 396 YBSNVGK.exe 396 YBSNVGK.exe 2428 TWX.exe 2428 TWX.exe 5688 AMYMUXQ.exe 5688 AMYMUXQ.exe 5072 SUMKHOL.exe 5072 SUMKHOL.exe 4396 SXQN.exe 4396 SXQN.exe 3380 FAHE.exe 3380 FAHE.exe 5512 GDKIGF.exe 5512 GDKIGF.exe 6064 PDMNJCT.exe 6064 PDMNJCT.exe 3784 DOVLYNO.exe 3784 DOVLYNO.exe 4832 SEW.exe 4832 SEW.exe 5660 RPZTNPA.exe 5660 RPZTNPA.exe 5908 ZCLZYNV.exe 5908 ZCLZYNV.exe 2684 ZYPDDD.exe 2684 ZYPDDD.exe 3916 HLCKO.exe 3916 HLCKO.exe 1812 VWK.exe 1812 VWK.exe 624 THNQKSK.exe 624 THNQKSK.exe 2388 VEBLS.exe 2388 VEBLS.exe 1492 WZEP.exe 1492 WZEP.exe 5020 PCIKLO.exe 5020 PCIKLO.exe 3888 KNRJRR.exe 3888 KNRJRR.exe 3564 OVF.exe 3564 OVF.exe 5064 XZSY.exe 5064 XZSY.exe 1376 MCBLJNZ.exe 1376 MCBLJNZ.exe 3280 ZAJXL.exe 3280 ZAJXL.exe 3896 ADNSYPK.exe 3896 ADNSYPK.exe 5464 CASNGXT.exe 5464 CASNGXT.exe 4860 MYYHNF.exe 4860 MYYHNF.exe 3144 QGNH.exe 3144 QGNH.exe 4740 PRP.exe 4740 PRP.exe 5352 VMBYOSU.exe 5352 VMBYOSU.exe 5724 TFEGXY.exe 5724 TFEGXY.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1160 2026-08-10_8825527a4391948d27be0e6f7e391c4f_elex_emotet_stop.exe 1160 2026-08-10_8825527a4391948d27be0e6f7e391c4f_elex_emotet_stop.exe 396 YBSNVGK.exe 396 YBSNVGK.exe 2428 TWX.exe 2428 TWX.exe 5688 AMYMUXQ.exe 5688 AMYMUXQ.exe 5072 SUMKHOL.exe 5072 SUMKHOL.exe 4396 SXQN.exe 4396 SXQN.exe 3380 FAHE.exe 3380 FAHE.exe 5512 GDKIGF.exe 5512 GDKIGF.exe 6064 PDMNJCT.exe 6064 PDMNJCT.exe 3784 DOVLYNO.exe 3784 DOVLYNO.exe 4832 SEW.exe 4832 SEW.exe 5660 RPZTNPA.exe 5660 RPZTNPA.exe 5908 ZCLZYNV.exe 5908 ZCLZYNV.exe 2684 ZYPDDD.exe 2684 ZYPDDD.exe 3916 HLCKO.exe 3916 HLCKO.exe 1812 VWK.exe 1812 VWK.exe 624 THNQKSK.exe 624 THNQKSK.exe 2388 VEBLS.exe 2388 VEBLS.exe 1492 WZEP.exe 1492 WZEP.exe 5020 PCIKLO.exe 5020 PCIKLO.exe 3888 KNRJRR.exe 3888 KNRJRR.exe 3564 OVF.exe 3564 OVF.exe 5064 XZSY.exe 5064 XZSY.exe 1376 MCBLJNZ.exe 1376 MCBLJNZ.exe 3280 ZAJXL.exe 3280 ZAJXL.exe 3896 ADNSYPK.exe 3896 ADNSYPK.exe 5464 CASNGXT.exe 5464 CASNGXT.exe 4860 MYYHNF.exe 4860 MYYHNF.exe 3144 QGNH.exe 3144 QGNH.exe 4740 PRP.exe 4740 PRP.exe 5352 VMBYOSU.exe 5352 VMBYOSU.exe 5724 TFEGXY.exe 5724 TFEGXY.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1160 wrote to memory of 4768 1160 2026-08-10_8825527a4391948d27be0e6f7e391c4f_elex_emotet_stop.exe 89 PID 4768 wrote to memory of 396 4768 cmd.exe 93 PID 396 wrote to memory of 2680 396 YBSNVGK.exe 95 PID 2680 wrote to memory of 2428 2680 cmd.exe 99 PID 2428 wrote to memory of 4092 2428 TWX.exe 100 PID 4092 wrote to memory of 5688 4092 cmd.exe 104 PID 5688 wrote to memory of 1132 5688 AMYMUXQ.exe 105 PID 1132 wrote to memory of 5072 1132 cmd.exe 109 PID 5072 wrote to memory of 4528 5072 SUMKHOL.exe 110 PID 4528 wrote to memory of 4396 4528 cmd.exe 114 PID 4396 wrote to memory of 1784 4396 SXQN.exe 115 PID 1784 wrote to memory of 3380 1784 cmd.exe 119 PID 3380 wrote to memory of 3884 3380 FAHE.exe 120 PID 3884 wrote to memory of 5512 3884 cmd.exe 124 PID 5512 wrote to memory of 5976 5512 GDKIGF.exe 125 PID 5976 wrote to memory of 6064 5976 cmd.exe 129 PID 6064 wrote to memory of 5744 6064 PDMNJCT.exe 130 PID 5744 wrote to memory of 3784 5744 cmd.exe 134 PID 3784 wrote to memory of 4448 3784 DOVLYNO.exe 135 PID 4448 wrote to memory of 4832 4448 cmd.exe 139 PID 4832 wrote to memory of 1716 4832 SEW.exe 140 PID 1716 wrote to memory of 5660 1716 cmd.exe 144 PID 5660 wrote to memory of 6140 5660 RPZTNPA.exe 145 PID 6140 wrote to memory of 5908 6140 cmd.exe 149 PID 5908 wrote to memory of 4624 5908 ZCLZYNV.exe 150 PID 4624 wrote to memory of 2684 4624 cmd.exe 154 PID 2684 wrote to memory of 3272 2684 ZYPDDD.exe 155 PID 3272 wrote to memory of 3916 3272 cmd.exe 159 PID 3916 wrote to memory of 2296 3916 HLCKO.exe 160 PID 2296 wrote to memory of 1812 2296 cmd.exe 164 PID 1812 wrote to memory of 5604 1812 VWK.exe 165 PID 5604 wrote to memory of 624 5604 cmd.exe 169 PID 624 wrote to memory of 2848 624 THNQKSK.exe 170 PID 2848 wrote to memory of 2388 2848 cmd.exe 174 PID 2388 wrote to memory of 2108 2388 VEBLS.exe 175 PID 2108 wrote to memory of 1492 2108 cmd.exe 179 PID 1492 wrote to memory of 432 1492 WZEP.exe 180 PID 432 wrote to memory of 5020 432 cmd.exe 184 PID 5020 wrote to memory of 5488 5020 PCIKLO.exe 185 PID 5488 wrote to memory of 3888 5488 cmd.exe 189 PID 3888 wrote to memory of 5392 3888 KNRJRR.exe 190 PID 5392 wrote to memory of 3564 5392 cmd.exe 194 PID 3564 wrote to memory of 4224 3564 OVF.exe 195 PID 4224 wrote to memory of 4212 4224 cmd.exe 199 PID 352 wrote to memory of 5064 352 cmd.exe 204 PID 5064 wrote to memory of 1532 5064 XZSY.exe 205 PID 1532 wrote to memory of 1376 1532 cmd.exe 209 PID 1376 wrote to memory of 1508 1376 MCBLJNZ.exe 210 PID 1508 wrote to memory of 3280 1508 cmd.exe 214 PID 3280 wrote to memory of 2492 3280 ZAJXL.exe 215 PID 2492 wrote to memory of 3896 2492 cmd.exe 219 PID 3896 wrote to memory of 6120 3896 ADNSYPK.exe 220 PID 6120 wrote to memory of 5464 6120 cmd.exe 224 PID 5464 wrote to memory of 4176 5464 CASNGXT.exe 225 PID 4176 wrote to memory of 4860 4176 cmd.exe 229 PID 4860 wrote to memory of 5872 4860 MYYHNF.exe 230 PID 5872 wrote to memory of 3144 5872 cmd.exe 234 PID 3144 wrote to memory of 4704 3144 QGNH.exe 235 PID 4704 wrote to memory of 4740 4704 cmd.exe 239 PID 4740 wrote to memory of 1340 4740 PRP.exe 240 PID 1340 wrote to memory of 5352 1340 cmd.exe 244 PID 5352 wrote to memory of 4236 5352 VMBYOSU.exe 245 PID 4236 wrote to memory of 5724 4236 cmd.exe 249 PID 5724 wrote to memory of 4628 5724 TFEGXY.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_8825527a4391948d27be0e6f7e391c4f_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_8825527a4391948d27be0e6f7e391c4f_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBSNVGK.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\windows\system\YBSNVGK.exeC:\windows\system\YBSNVGK.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWX.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\windows\system\TWX.exeC:\windows\system\TWX.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMYMUXQ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\windows\system\AMYMUXQ.exeC:\windows\system\AMYMUXQ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SUMKHOL.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\windows\system\SUMKHOL.exeC:\windows\system\SUMKHOL.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SXQN.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\windows\SXQN.exeC:\windows\SXQN.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FAHE.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\windows\SysWOW64\FAHE.exeC:\windows\system32\FAHE.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GDKIGF.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\windows\GDKIGF.exeC:\windows\GDKIGF.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDMNJCT.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\windows\SysWOW64\PDMNJCT.exeC:\windows\system32\PDMNJCT.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOVLYNO.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\windows\system\DOVLYNO.exeC:\windows\system\DOVLYNO.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEW.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\windows\SysWOW64\SEW.exeC:\windows\system32\SEW.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RPZTNPA.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\windows\SysWOW64\RPZTNPA.exeC:\windows\system32\RPZTNPA.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZCLZYNV.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\windows\ZCLZYNV.exeC:\windows\ZCLZYNV.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZYPDDD.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\windows\SysWOW64\ZYPDDD.exeC:\windows\system32\ZYPDDD.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HLCKO.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\windows\system\HLCKO.exeC:\windows\system\HLCKO.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWK.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\windows\SysWOW64\VWK.exeC:\windows\system32\VWK.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THNQKSK.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\windows\SysWOW64\THNQKSK.exeC:\windows\system32\THNQKSK.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEBLS.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\windows\SysWOW64\VEBLS.exeC:\windows\system32\VEBLS.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZEP.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\windows\system\WZEP.exeC:\windows\system\WZEP.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCIKLO.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:432 -
C:\windows\SysWOW64\PCIKLO.exeC:\windows\system32\PCIKLO.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNRJRR.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\windows\SysWOW64\KNRJRR.exeC:\windows\system32\KNRJRR.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVF.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\windows\SysWOW64\OVF.exeC:\windows\system32\OVF.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOIZMQJ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\windows\SysWOW64\NOIZMQJ.exeC:\windows\system32\NOIZMQJ.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XZSY.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:352 -
C:\windows\system\XZSY.exeC:\windows\system\XZSY.exe47⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MCBLJNZ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\windows\system\MCBLJNZ.exeC:\windows\system\MCBLJNZ.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZAJXL.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\windows\SysWOW64\ZAJXL.exeC:\windows\system32\ZAJXL.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADNSYPK.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\windows\system\ADNSYPK.exeC:\windows\system\ADNSYPK.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CASNGXT.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\windows\CASNGXT.exeC:\windows\CASNGXT.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYYHNF.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\windows\MYYHNF.exeC:\windows\MYYHNF.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGNH.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\windows\QGNH.exeC:\windows\QGNH.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRP.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\windows\SysWOW64\PRP.exeC:\windows\system32\PRP.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMBYOSU.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\windows\system\VMBYOSU.exeC:\windows\system\VMBYOSU.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TFEGXY.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\windows\SysWOW64\TFEGXY.exeC:\windows\system32\TFEGXY.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNLO.exe.bat" "66⤵PID:4628
-
C:\windows\SysWOW64\XNLO.exeC:\windows\system32\XNLO.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTX.exe.bat" "68⤵PID:4820
-
C:\windows\FTX.exeC:\windows\FTX.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELALCDW.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5576 -
C:\windows\system\ELALCDW.exeC:\windows\system\ELALCDW.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJGFKLF.exe.bat" "72⤵PID:2552
-
C:\windows\OJGFKLF.exeC:\windows\OJGFKLF.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FJUCWCI.exe.bat" "74⤵PID:2164
-
C:\windows\system\FJUCWCI.exeC:\windows\system\FJUCWCI.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NXHJHBD.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:6044 -
C:\windows\system\NXHJHBD.exeC:\windows\system\NXHJHBD.exe77⤵
- Executes dropped EXE
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KQILLX.exe.bat" "78⤵PID:4468
-
C:\windows\system\KQILLX.exeC:\windows\system\KQILLX.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYXQXO.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:3348 -
C:\windows\SysWOW64\CYXQXO.exeC:\windows\system32\CYXQXO.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AJAGG.exe.bat" "82⤵PID:5136
-
C:\windows\AJAGG.exeC:\windows\AJAGG.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UJPRP.exe.bat" "84⤵PID:5924
-
C:\windows\UJPRP.exeC:\windows\UJPRP.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CPCY.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5424 -
C:\windows\SysWOW64\CPCY.exeC:\windows\system32\CPCY.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SZE.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:4732 -
C:\windows\SysWOW64\SZE.exeC:\windows\system32\SZE.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CXKIYQ.exe.bat" "90⤵PID:3112
-
C:\windows\system\CXKIYQ.exeC:\windows\system\CXKIYQ.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PIBZEA.exe.bat" "92⤵PID:3148
-
C:\windows\SysWOW64\PIBZEA.exeC:\windows\system32\PIBZEA.exe93⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTD.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:5412 -
C:\windows\OTD.exeC:\windows\OTD.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EJEOUC.exe.bat" "96⤵PID:2000
-
C:\windows\SysWOW64\EJEOUC.exeC:\windows\system32\EJEOUC.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYYJH.exe.bat" "98⤵PID:1220
-
C:\windows\system\CYYJH.exeC:\windows\system\CYYJH.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DCBN.exe.bat" "100⤵
- Executes a command shell one-liner
PID:3340 -
C:\windows\DCBN.exeC:\windows\DCBN.exe101⤵
- Executes dropped EXE
PID:1124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZHHBF.exe.bat" "102⤵
- Executes a command shell one-liner
PID:988 -
C:\windows\FZHHBF.exeC:\windows\FZHHBF.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UPIZI.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:2996 -
C:\windows\SysWOW64\UPIZI.exeC:\windows\system32\UPIZI.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YFPHULN.exe.bat" "106⤵
- Executes a command shell one-liner
PID:1148 -
C:\windows\YFPHULN.exeC:\windows\YFPHULN.exe107⤵
- Executes dropped EXE
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNDH.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4856 -
C:\windows\CNDH.exeC:\windows\CNDH.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTIO.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2768 -
C:\windows\system\KTIO.exeC:\windows\system\KTIO.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BBKTVHH.exe.bat" "112⤵PID:2312
-
C:\windows\SysWOW64\BBKTVHH.exeC:\windows\system32\BBKTVHH.exe113⤵
- Executes dropped EXE
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DZPNC.exe.bat" "114⤵PID:1172
-
C:\windows\system\DZPNC.exeC:\windows\system\DZPNC.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZRSGN.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:3612 -
C:\windows\SysWOW64\VZRSGN.exeC:\windows\system32\VZRSGN.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPYAS.exe.bat" "118⤵
- Executes a command shell one-liner
PID:4712 -
C:\windows\system\ZPYAS.exeC:\windows\system\ZPYAS.exe119⤵
- Executes dropped EXE
PID:4056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIBTA.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1372 -
C:\windows\KIBTA.exeC:\windows\KIBTA.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-