Analysis
- max time kernel
81s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 01:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_3d66e3ae5b65d04817956d9f2cfb23f3_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-12_3d66e3ae5b65d04817956d9f2cfb23f3_elex_emotet_stop.exe
- Size 208KB
- Sample260813-bryvmshl4x
- SHA256 5b6eb0d4a01d664a105e957c1a87fbfb26d809e072f9c8ab8e5f09982999a107
- MD5 3d66e3ae5b65d04817956d9f2cfb23f3
- SHA1 7d8c63b7b8dec980453a83b996adff5bf22517ca
- SHA512 45d16c3a6056bcf8fa70ed6bf2bd5870b6702f31c086508acf58f7d7598c1e6ffdc503f7cc66f40c6b0a7fa43f9ab4f9dd3921f761f974a699c36050e2a9ebc4
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFl1dL+LOfE4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFl15+LOMkEj1
- TLSH T130247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3776 YSAU.exe 1372 RGAZ.exe 1572 PQD.exe 1432 OJGFKLF.exe 2520 FJUCWCI.exe 3584 CKEFAY.exe 1960 ZPOUQ.exe 1332 OGP.exe 4860 YDDOEYJ.exe 1808 PMR.exe 956 METNDTN.exe 4516 USFUNR.exe 2428 XFXDZCX.exe 3952 KLXPBO.exe 1108 JVAFJ.exe 2448 HLT.exe 2952 KTUX.exe 5712 MRHRTKI.exe 4184 GSPCCDY.exe 3252 EDZKLR.exe 4692 DNCAU.exe 4140 UWRFG.exe 6092 MWFCT.exe 4268 ZCFO.exe 2852 HHS.exe 3160 ZPYAS.exe 4236 HVLHC.exe 1996 RTQBKMK.exe 4376 NTADWQT.exe 2760 DMRRJN.exe 2912 JIDSXCA.exe 4608 RNIYHAW.exe 4252 WTAOYE.exe 3460 DJBF.exe 716 IJL.exe 5464 DWUR.exe 1388 EUCAE.exe 6108 OSPUL.exe 4212 FAERY.exe 2116 CTGU.exe 4884 OJM.exe 5660 EUXSX.exe 3020 MZCYH.exe 1092 GARJR.exe 5104 GVH.exe 4824 UQTYTQM.exe 4640 KOGQB.exe 424 JUNLGX.exe 352 IUBQTO.exe 4112 JXSE.exe 2104 EFT.exe 4652 EIJXDB.exe 6088 YWQVI.exe 2548 PEESV.exe 2960 LKRWGRT.exe 4248 LNHSU.exe 4132 DINKVS.exe 5552 UQBHHJ.exe 5024 TBEXQ.exe 4960 APJ.exe 4796 OVJNYKW.exe 4992 FVYKLBZ.exe 1660 CVIVPX.exe 4688 GBSKFSC.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\CKEFAY.exe FJUCWCI.exe File created C:\windows\SysWOW64\DJBF.exe.bat WTAOYE.exe File created C:\windows\SysWOW64\LNHSU.exe.bat LKRWGRT.exe File opened for modification C:\windows\SysWOW64\NSIJZ.exe FMWCO.exe File created C:\windows\SysWOW64\IJGCPUZ.exe OQYR.exe File created C:\windows\SysWOW64\GARJR.exe.bat MZCYH.exe File opened for modification C:\windows\SysWOW64\IUBQTO.exe JUNLGX.exe File created C:\windows\SysWOW64\DINKVS.exe.bat LNHSU.exe File opened for modification C:\windows\SysWOW64\RCSMHRX.exe VCQJVN.exe File opened for modification C:\windows\SysWOW64\XEVAV.exe YGCXIJ.exe File created C:\windows\SysWOW64\ZPOUQ.exe.bat CKEFAY.exe File created C:\windows\SysWOW64\GSPCCDY.exe.bat MRHRTKI.exe File created C:\windows\SysWOW64\NTADWQT.exe RTQBKMK.exe File created C:\windows\SysWOW64\NTADWQT.exe.bat RTQBKMK.exe File created C:\windows\SysWOW64\KOGQB.exe.bat UQTYTQM.exe File created C:\windows\SysWOW64\NSIJZ.exe FMWCO.exe File created C:\windows\SysWOW64\XEVAV.exe YGCXIJ.exe File created C:\windows\SysWOW64\IJGCPUZ.exe.bat OQYR.exe File created C:\windows\SysWOW64\JIDSXCA.exe.bat DMRRJN.exe File opened for modification C:\windows\SysWOW64\KOGQB.exe UQTYTQM.exe File created C:\windows\SysWOW64\IUBQTO.exe.bat JUNLGX.exe File created C:\windows\SysWOW64\LKRWGRT.exe PEESV.exe File opened for modification C:\windows\SysWOW64\LKRWGRT.exe PEESV.exe File created C:\windows\SysWOW64\DMRRJN.exe MEDTWW.exe File created C:\windows\SysWOW64\IJL.exe.bat DJBF.exe File created C:\windows\SysWOW64\APJ.exe.bat TBEXQ.exe File opened for modification C:\windows\SysWOW64\ZPOUQ.exe CKEFAY.exe File created C:\windows\SysWOW64\HHS.exe ZCFO.exe File created C:\windows\SysWOW64\EUCAE.exe DWUR.exe File opened for modification C:\windows\SysWOW64\GARJR.exe MZCYH.exe File created C:\windows\SysWOW64\LKRWGRT.exe.bat PEESV.exe File created C:\windows\SysWOW64\DLAW.exe.bat HFHHEW.exe File created C:\windows\SysWOW64\DMRRJN.exe.bat MEDTWW.exe File created C:\windows\SysWOW64\PQD.exe RGAZ.exe File created C:\windows\SysWOW64\DWUR.exe IJL.exe File created C:\windows\SysWOW64\IUBQTO.exe JUNLGX.exe File created C:\windows\SysWOW64\APJ.exe TBEXQ.exe File created C:\windows\SysWOW64\RCSMHRX.exe VCQJVN.exe File created C:\windows\SysWOW64\YSAU.exe.bat 2026-08-12_3d66e3ae5b65d04817956d9f2cfb23f3_elex_emotet_stop.exe File created C:\windows\SysWOW64\CKEFAY.exe.bat FJUCWCI.exe File created C:\windows\SysWOW64\GSPCCDY.exe MRHRTKI.exe File created C:\windows\SysWOW64\MZCYH.exe.bat EUXSX.exe File opened for modification C:\windows\SysWOW64\YSAU.exe 2026-08-12_3d66e3ae5b65d04817956d9f2cfb23f3_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\EUCAE.exe DWUR.exe File created C:\windows\SysWOW64\JIDSXCA.exe DMRRJN.exe File created C:\windows\SysWOW64\IJL.exe DJBF.exe File created C:\windows\SysWOW64\NSIJZ.exe.bat FMWCO.exe File opened for modification C:\windows\SysWOW64\DLAW.exe HFHHEW.exe File created C:\windows\SysWOW64\PMR.exe YDDOEYJ.exe File opened for modification C:\windows\SysWOW64\GSPCCDY.exe MRHRTKI.exe File opened for modification C:\windows\SysWOW64\APJ.exe TBEXQ.exe File opened for modification C:\windows\SysWOW64\IJGCPUZ.exe OQYR.exe File opened for modification C:\windows\SysWOW64\IJL.exe DJBF.exe File opened for modification C:\windows\SysWOW64\DWUR.exe IJL.exe File created C:\windows\SysWOW64\GARJR.exe MZCYH.exe File created C:\windows\SysWOW64\RCSMHRX.exe.bat VCQJVN.exe File opened for modification C:\windows\SysWOW64\PMR.exe YDDOEYJ.exe File created C:\windows\SysWOW64\HHS.exe.bat ZCFO.exe File opened for modification C:\windows\SysWOW64\JIDSXCA.exe DMRRJN.exe File opened for modification C:\windows\SysWOW64\MZCYH.exe EUXSX.exe File created C:\windows\SysWOW64\KOGQB.exe UQTYTQM.exe File created C:\windows\SysWOW64\JUSJOJQ.exe MTIHKN.exe File opened for modification C:\windows\SysWOW64\JUSJOJQ.exe MTIHKN.exe File created C:\windows\SysWOW64\ZPOUQ.exe CKEFAY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\KTUX.exe HLT.exe File created C:\windows\system\ZCFO.exe MWFCT.exe File created C:\windows\system\CTGU.exe FAERY.exe File created C:\windows\PEESV.exe YWQVI.exe File created C:\windows\system\VCQJVN.exe.bat OGFQPY.exe File created C:\windows\EODAZH.exe DLAW.exe File opened for modification C:\windows\system\NTD.exe DVQ.exe File opened for modification C:\windows\system\ZPYAS.exe HHS.exe File opened for modification C:\windows\OJGFKLF.exe PQD.exe File created C:\windows\KLXPBO.exe XFXDZCX.exe File created C:\windows\system\RALAQMB.exe EUD.exe File created C:\windows\OQYR.exe.bat RALAQMB.exe File opened for modification C:\windows\system\YDDOEYJ.exe OGP.exe File opened for modification C:\windows\system\METNDTN.exe PMR.exe File created C:\windows\RTQBKMK.exe.bat HVLHC.exe File opened for modification C:\windows\EFT.exe JXSE.exe File created C:\windows\BWP.exe OMZ.exe File opened for modification C:\windows\HVLHC.exe ZPYAS.exe File opened for modification C:\windows\WTAOYE.exe RNIYHAW.exe File created C:\windows\OVJNYKW.exe.bat APJ.exe File opened for modification C:\windows\system\ODCWLN.exe RCSMHRX.exe File created C:\windows\DVQ.exe EKNO.exe File created C:\windows\JHU.exe.bat XEVAV.exe File opened for modification C:\windows\OGP.exe ZPOUQ.exe File created C:\windows\system\METNDTN.exe PMR.exe File opened for modification C:\windows\system\MWFCT.exe UWRFG.exe File created C:\windows\system\UQTYTQM.exe GVH.exe File opened for modification C:\windows\JUNLGX.exe KOGQB.exe File opened for modification C:\windows\OGFQPY.exe GBSKFSC.exe File created C:\windows\OGFQPY.exe.bat GBSKFSC.exe File created C:\windows\system\EKNO.exe.bat RAWQYI.exe File opened for modification C:\windows\system\UQTYTQM.exe GVH.exe File opened for modification C:\windows\DVQ.exe EKNO.exe File created C:\windows\system\MRHRTKI.exe KTUX.exe File created C:\windows\system\EDZKLR.exe.bat GSPCCDY.exe File created C:\windows\system\OSPUL.exe EUCAE.exe File created C:\windows\system\VCQJVN.exe OGFQPY.exe File opened for modification C:\windows\system\FJUCWCI.exe OJGFKLF.exe File created C:\windows\system\YDDOEYJ.exe.bat OGP.exe File opened for modification C:\windows\system\MRHRTKI.exe KTUX.exe File opened for modification C:\windows\GVH.exe GARJR.exe File created C:\windows\system\UQBHHJ.exe DINKVS.exe File created C:\windows\OGFQPY.exe GBSKFSC.exe File opened for modification C:\windows\system\VCQJVN.exe OGFQPY.exe File created C:\windows\system\OMZ.exe BOZS.exe File created C:\windows\XFXDZCX.exe USFUNR.exe File created C:\windows\DNCAU.exe.bat EDZKLR.exe File opened for modification C:\windows\EUXSX.exe OJM.exe File opened for modification C:\windows\PEESV.exe YWQVI.exe File created C:\windows\system\BOZS.exe.bat RQTYEHN.exe File opened for modification C:\windows\OQYR.exe RALAQMB.exe File created C:\windows\system\MWFCT.exe.bat UWRFG.exe File created C:\windows\KLXPBO.exe.bat XFXDZCX.exe File created C:\windows\UWRFG.exe DNCAU.exe File created C:\windows\system\FVYKLBZ.exe.bat OVJNYKW.exe File created C:\windows\CVIVPX.exe FVYKLBZ.exe File created C:\windows\EODAZH.exe.bat DLAW.exe File opened for modification C:\windows\DNCAU.exe EDZKLR.exe File opened for modification C:\windows\UWRFG.exe DNCAU.exe File created C:\windows\GVH.exe.bat GARJR.exe File opened for modification C:\windows\FMWCO.exe BWP.exe File opened for modification C:\windows\system\MTIHKN.exe EODAZH.exe File created C:\windows\system\YDDOEYJ.exe OGP.exe File created C:\windows\system\EDZKLR.exe GSPCCDY.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 900 cmd.exe 4360 cmd.exe 4932 cmd.exe 1052 cmd.exe 1368 cmd.exe 2028 cmd.exe 4204 cmd.exe 6000 cmd.exe 1100 cmd.exe 2872 cmd.exe 2540 cmd.exe 5076 cmd.exe 4308 cmd.exe 1656 cmd.exe 2940 cmd.exe 2856 cmd.exe 4452 cmd.exe 1172 cmd.exe 5344 cmd.exe 4588 cmd.exe 280 cmd.exe 800 cmd.exe 5192 cmd.exe 2088 cmd.exe 4996 cmd.exe 4424 cmd.exe 2640 cmd.exe 792 cmd.exe 6056 cmd.exe 2768 cmd.exe 4880 cmd.exe 4800 cmd.exe 4600 cmd.exe 3316 cmd.exe 4172 cmd.exe 4160 cmd.exe 5844 cmd.exe 5032 cmd.exe 2588 cmd.exe 5664 cmd.exe 1020 cmd.exe 3708 cmd.exe 2492 cmd.exe 3508 cmd.exe 4124 cmd.exe 2868 cmd.exe 1260 cmd.exe 1596 cmd.exe 4644 cmd.exe 3312 cmd.exe 4524 cmd.exe 2364 cmd.exe 3684 cmd.exe 4316 cmd.exe 5156 cmd.exe 2432 cmd.exe 2176 cmd.exe 3636 cmd.exe 4572 cmd.exe 5356 cmd.exe 2956 cmd.exe 6072 cmd.exe 1508 cmd.exe 5404 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2488 1912 WerFault.exe 86 5372 3776 WerFault.exe 92 3212 1372 WerFault.exe 98 2852 1572 WerFault.exe 103 1832 1432 WerFault.exe 108 2584 2520 WerFault.exe 113 3940 3584 WerFault.exe 118 6012 1960 WerFault.exe 123 3944 1332 WerFault.exe 128 756 4860 WerFault.exe 133 1396 1808 WerFault.exe 138 2116 956 WerFault.exe 143 3484 4516 WerFault.exe 148 1632 2428 WerFault.exe 153 3172 3952 WerFault.exe 158 968 1108 WerFault.exe 163 4236 2448 WerFault.exe 168 1084 2952 WerFault.exe 173 2800 5712 WerFault.exe 178 3104 4184 WerFault.exe 183 3452 3252 WerFault.exe 188 3532 4692 WerFault.exe 193 3436 4140 WerFault.exe 198 3676 6092 WerFault.exe 203 2000 4268 WerFault.exe 208 4316 2852 WerFault.exe 213 1840 3160 WerFault.exe 218 1368 4236 WerFault.exe 223 3456 1996 WerFault.exe 228 2188 4376 WerFault.exe 233 620 3516 WerFault.exe 238 3960 2760 WerFault.exe 243 3876 2912 WerFault.exe 248 4552 4608 WerFault.exe 253 2232 4252 WerFault.exe 259 4372 3460 WerFault.exe 264 2864 716 WerFault.exe 269 4744 5464 WerFault.exe 274 5964 1388 WerFault.exe 279 3264 6108 WerFault.exe 284 5024 4212 WerFault.exe 289 4728 2116 WerFault.exe 294 836 4884 WerFault.exe 299 4148 5660 WerFault.exe 304 3492 3020 WerFault.exe 309 1052 1092 WerFault.exe 314 2584 5104 WerFault.exe 319 4636 4824 WerFault.exe 324 5484 4640 WerFault.exe 329 1704 424 WerFault.exe 334 260 352 WerFault.exe 339 5100 4112 WerFault.exe 344 2308 2104 WerFault.exe 349 5080 4652 WerFault.exe 354 3716 6088 WerFault.exe 359 5456 2548 WerFault.exe 364 5392 2960 WerFault.exe 369 5724 4248 WerFault.exe 374 5236 4132 WerFault.exe 379 2856 5552 WerFault.exe 384 3960 5024 WerFault.exe 389 1632 4960 WerFault.exe 394 3080 4796 WerFault.exe 399 1392 4992 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_3d66e3ae5b65d04817956d9f2cfb23f3_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJUCWCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAERY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EUXSX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EUD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDZKLR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVLHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIDSXCA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EUCAE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KOGQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GSPCCDY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNCAU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQTYEHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSIJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJGFKLF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXSE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FVYKLBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YGCXIJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDDOEYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language METNDTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODCWLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RALAQMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPYAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQBHHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMWCO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTADWQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RCSMHRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RNIYHAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MZCYH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1912 2026-08-12_3d66e3ae5b65d04817956d9f2cfb23f3_elex_emotet_stop.exe 1912 2026-08-12_3d66e3ae5b65d04817956d9f2cfb23f3_elex_emotet_stop.exe 3776 YSAU.exe 3776 YSAU.exe 1372 RGAZ.exe 1372 RGAZ.exe 1572 PQD.exe 1572 PQD.exe 1432 OJGFKLF.exe 1432 OJGFKLF.exe 2520 FJUCWCI.exe 2520 FJUCWCI.exe 3584 CKEFAY.exe 3584 CKEFAY.exe 1960 ZPOUQ.exe 1960 ZPOUQ.exe 1332 OGP.exe 1332 OGP.exe 4860 YDDOEYJ.exe 4860 YDDOEYJ.exe 1808 PMR.exe 1808 PMR.exe 956 METNDTN.exe 956 METNDTN.exe 4516 USFUNR.exe 4516 USFUNR.exe 2428 XFXDZCX.exe 2428 XFXDZCX.exe 3952 KLXPBO.exe 3952 KLXPBO.exe 1108 JVAFJ.exe 1108 JVAFJ.exe 2448 HLT.exe 2448 HLT.exe 2952 KTUX.exe 2952 KTUX.exe 5712 MRHRTKI.exe 5712 MRHRTKI.exe 4184 GSPCCDY.exe 4184 GSPCCDY.exe 3252 EDZKLR.exe 3252 EDZKLR.exe 4692 DNCAU.exe 4692 DNCAU.exe 4140 UWRFG.exe 4140 UWRFG.exe 6092 MWFCT.exe 6092 MWFCT.exe 4268 ZCFO.exe 4268 ZCFO.exe 2852 HHS.exe 2852 HHS.exe 3160 ZPYAS.exe 3160 ZPYAS.exe 4236 HVLHC.exe 4236 HVLHC.exe 1996 RTQBKMK.exe 1996 RTQBKMK.exe 3516 MEDTWW.exe 3516 MEDTWW.exe 2760 DMRRJN.exe 2760 DMRRJN.exe 2912 JIDSXCA.exe 2912 JIDSXCA.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1912 2026-08-12_3d66e3ae5b65d04817956d9f2cfb23f3_elex_emotet_stop.exe 1912 2026-08-12_3d66e3ae5b65d04817956d9f2cfb23f3_elex_emotet_stop.exe 3776 YSAU.exe 3776 YSAU.exe 1372 RGAZ.exe 1372 RGAZ.exe 1572 PQD.exe 1572 PQD.exe 1432 OJGFKLF.exe 1432 OJGFKLF.exe 2520 FJUCWCI.exe 2520 FJUCWCI.exe 3584 CKEFAY.exe 3584 CKEFAY.exe 1960 ZPOUQ.exe 1960 ZPOUQ.exe 1332 OGP.exe 1332 OGP.exe 4860 YDDOEYJ.exe 4860 YDDOEYJ.exe 1808 PMR.exe 1808 PMR.exe 956 METNDTN.exe 956 METNDTN.exe 4516 USFUNR.exe 4516 USFUNR.exe 2428 XFXDZCX.exe 2428 XFXDZCX.exe 3952 KLXPBO.exe 3952 KLXPBO.exe 1108 JVAFJ.exe 1108 JVAFJ.exe 2448 HLT.exe 2448 HLT.exe 2952 KTUX.exe 2952 KTUX.exe 5712 MRHRTKI.exe 5712 MRHRTKI.exe 4184 GSPCCDY.exe 4184 GSPCCDY.exe 3252 EDZKLR.exe 3252 EDZKLR.exe 4692 DNCAU.exe 4692 DNCAU.exe 4140 UWRFG.exe 4140 UWRFG.exe 6092 MWFCT.exe 6092 MWFCT.exe 4268 ZCFO.exe 4268 ZCFO.exe 2852 HHS.exe 2852 HHS.exe 3160 ZPYAS.exe 3160 ZPYAS.exe 4236 HVLHC.exe 4236 HVLHC.exe 1996 RTQBKMK.exe 1996 RTQBKMK.exe 3516 MEDTWW.exe 3516 MEDTWW.exe 2760 DMRRJN.exe 2760 DMRRJN.exe 2912 JIDSXCA.exe 2912 JIDSXCA.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1912 wrote to memory of 4204 1912 2026-08-12_3d66e3ae5b65d04817956d9f2cfb23f3_elex_emotet_stop.exe 88 PID 4204 wrote to memory of 3776 4204 cmd.exe 92 PID 3776 wrote to memory of 4348 3776 YSAU.exe 94 PID 4348 wrote to memory of 1372 4348 cmd.exe 98 PID 1372 wrote to memory of 280 1372 RGAZ.exe 99 PID 280 wrote to memory of 1572 280 cmd.exe 103 PID 1572 wrote to memory of 3592 1572 PQD.exe 104 PID 3592 wrote to memory of 1432 3592 cmd.exe 108 PID 1432 wrote to memory of 3528 1432 OJGFKLF.exe 109 PID 3528 wrote to memory of 2520 3528 cmd.exe 113 PID 2520 wrote to memory of 800 2520 FJUCWCI.exe 114 PID 800 wrote to memory of 3584 800 cmd.exe 118 PID 3584 wrote to memory of 1096 3584 CKEFAY.exe 119 PID 1096 wrote to memory of 1960 1096 cmd.exe 123 PID 1960 wrote to memory of 5192 1960 ZPOUQ.exe 124 PID 5192 wrote to memory of 1332 5192 cmd.exe 128 PID 1332 wrote to memory of 3704 1332 OGP.exe 129 PID 3704 wrote to memory of 4860 3704 cmd.exe 133 PID 4860 wrote to memory of 3684 4860 YDDOEYJ.exe 134 PID 3684 wrote to memory of 1808 3684 cmd.exe 138 PID 1808 wrote to memory of 5344 1808 PMR.exe 139 PID 5344 wrote to memory of 956 5344 cmd.exe 143 PID 956 wrote to memory of 1904 956 METNDTN.exe 144 PID 1904 wrote to memory of 4516 1904 cmd.exe 148 PID 4516 wrote to memory of 2668 4516 USFUNR.exe 149 PID 2668 wrote to memory of 2428 2668 cmd.exe 153 PID 2428 wrote to memory of 4492 2428 XFXDZCX.exe 154 PID 4492 wrote to memory of 3952 4492 cmd.exe 158 PID 3952 wrote to memory of 2220 3952 KLXPBO.exe 159 PID 2220 wrote to memory of 1108 2220 cmd.exe 163 PID 1108 wrote to memory of 3336 1108 JVAFJ.exe 164 PID 3336 wrote to memory of 2448 3336 cmd.exe 168 PID 2448 wrote to memory of 5616 2448 HLT.exe 169 PID 5616 wrote to memory of 2952 5616 cmd.exe 173 PID 2952 wrote to memory of 6000 2952 KTUX.exe 174 PID 6000 wrote to memory of 5712 6000 cmd.exe 178 PID 5712 wrote to memory of 1596 5712 MRHRTKI.exe 179 PID 1596 wrote to memory of 4184 1596 cmd.exe 183 PID 4184 wrote to memory of 5032 4184 GSPCCDY.exe 184 PID 5032 wrote to memory of 3252 5032 cmd.exe 188 PID 3252 wrote to memory of 2088 3252 EDZKLR.exe 189 PID 2088 wrote to memory of 4692 2088 cmd.exe 193 PID 4692 wrote to memory of 5404 4692 DNCAU.exe 194 PID 5404 wrote to memory of 4140 5404 cmd.exe 198 PID 4140 wrote to memory of 3588 4140 UWRFG.exe 199 PID 3588 wrote to memory of 6092 3588 cmd.exe 203 PID 6092 wrote to memory of 5284 6092 MWFCT.exe 204 PID 5284 wrote to memory of 4268 5284 cmd.exe 208 PID 4268 wrote to memory of 4644 4268 ZCFO.exe 209 PID 4644 wrote to memory of 2852 4644 cmd.exe 213 PID 2852 wrote to memory of 5904 2852 HHS.exe 214 PID 5904 wrote to memory of 3160 5904 cmd.exe 218 PID 3160 wrote to memory of 5844 3160 ZPYAS.exe 219 PID 5844 wrote to memory of 4236 5844 cmd.exe 223 PID 4236 wrote to memory of 1508 4236 HVLHC.exe 224 PID 1508 wrote to memory of 1996 1508 cmd.exe 228 PID 1996 wrote to memory of 2476 1996 RTQBKMK.exe 229 PID 2476 wrote to memory of 4376 2476 cmd.exe 233 PID 2440 wrote to memory of 3516 2440 cmd.exe 238 PID 3516 wrote to memory of 3152 3516 MEDTWW.exe 239 PID 3152 wrote to memory of 2760 3152 cmd.exe 243 PID 2760 wrote to memory of 5272 2760 DMRRJN.exe 244 PID 5272 wrote to memory of 2912 5272 cmd.exe 248 PID 2912 wrote to memory of 3472 2912 JIDSXCA.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_3d66e3ae5b65d04817956d9f2cfb23f3_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_3d66e3ae5b65d04817956d9f2cfb23f3_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YSAU.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\windows\SysWOW64\YSAU.exeC:\windows\system32\YSAU.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RGAZ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\windows\RGAZ.exeC:\windows\RGAZ.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PQD.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:280 -
C:\windows\SysWOW64\PQD.exeC:\windows\system32\PQD.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJGFKLF.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\windows\OJGFKLF.exeC:\windows\OJGFKLF.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FJUCWCI.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\windows\system\FJUCWCI.exeC:\windows\system\FJUCWCI.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CKEFAY.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:800 -
C:\windows\SysWOW64\CKEFAY.exeC:\windows\system32\CKEFAY.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZPOUQ.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\windows\SysWOW64\ZPOUQ.exeC:\windows\system32\ZPOUQ.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OGP.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\windows\OGP.exeC:\windows\OGP.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDDOEYJ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\windows\system\YDDOEYJ.exeC:\windows\system\YDDOEYJ.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMR.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\windows\SysWOW64\PMR.exeC:\windows\system32\PMR.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\METNDTN.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\windows\system\METNDTN.exeC:\windows\system\METNDTN.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\USFUNR.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\windows\USFUNR.exeC:\windows\USFUNR.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFXDZCX.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\windows\XFXDZCX.exeC:\windows\XFXDZCX.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KLXPBO.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\windows\KLXPBO.exeC:\windows\KLXPBO.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVAFJ.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\windows\JVAFJ.exeC:\windows\JVAFJ.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLT.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\windows\HLT.exeC:\windows\HLT.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KTUX.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\windows\KTUX.exeC:\windows\KTUX.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRHRTKI.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\windows\system\MRHRTKI.exeC:\windows\system\MRHRTKI.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSPCCDY.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\windows\SysWOW64\GSPCCDY.exeC:\windows\system32\GSPCCDY.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EDZKLR.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\windows\system\EDZKLR.exeC:\windows\system\EDZKLR.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNCAU.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\windows\DNCAU.exeC:\windows\DNCAU.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UWRFG.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\windows\UWRFG.exeC:\windows\UWRFG.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MWFCT.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\windows\system\MWFCT.exeC:\windows\system\MWFCT.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZCFO.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\windows\system\ZCFO.exeC:\windows\system\ZCFO.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HHS.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\windows\SysWOW64\HHS.exeC:\windows\system32\HHS.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPYAS.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\windows\system\ZPYAS.exeC:\windows\system\ZPYAS.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HVLHC.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\windows\HVLHC.exeC:\windows\HVLHC.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTQBKMK.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\windows\RTQBKMK.exeC:\windows\RTQBKMK.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NTADWQT.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\windows\SysWOW64\NTADWQT.exeC:\windows\system32\NTADWQT.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEDTWW.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\windows\system\MEDTWW.exeC:\windows\system\MEDTWW.exe61⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DMRRJN.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\windows\SysWOW64\DMRRJN.exeC:\windows\system32\DMRRJN.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JIDSXCA.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\windows\SysWOW64\JIDSXCA.exeC:\windows\system32\JIDSXCA.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RNIYHAW.exe.bat" "66⤵PID:3472
-
C:\windows\RNIYHAW.exeC:\windows\RNIYHAW.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WTAOYE.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4308 -
C:\windows\WTAOYE.exeC:\windows\WTAOYE.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DJBF.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4880 -
C:\windows\SysWOW64\DJBF.exeC:\windows\system32\DJBF.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IJL.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4424 -
C:\windows\SysWOW64\IJL.exeC:\windows\system32\IJL.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DWUR.exe.bat" "74⤵PID:2032
-
C:\windows\SysWOW64\DWUR.exeC:\windows\system32\DWUR.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EUCAE.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:2368 -
C:\windows\SysWOW64\EUCAE.exeC:\windows\system32\EUCAE.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OSPUL.exe.bat" "78⤵PID:3140
-
C:\windows\system\OSPUL.exeC:\windows\system\OSPUL.exe79⤵
- Executes dropped EXE
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FAERY.exe.bat" "80⤵
- Executes a command shell one-liner
PID:1656 -
C:\windows\system\FAERY.exeC:\windows\system\FAERY.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CTGU.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:3104 -
C:\windows\system\CTGU.exeC:\windows\system\CTGU.exe83⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJM.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:2388 -
C:\windows\OJM.exeC:\windows\OJM.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUXSX.exe.bat" "86⤵PID:3784
-
C:\windows\EUXSX.exeC:\windows\EUXSX.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MZCYH.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3708 -
C:\windows\SysWOW64\MZCYH.exeC:\windows\system32\MZCYH.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GARJR.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:5400 -
C:\windows\SysWOW64\GARJR.exeC:\windows\system32\GARJR.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GVH.exe.bat" "92⤵
- Executes a command shell one-liner
PID:4316 -
C:\windows\GVH.exeC:\windows\GVH.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UQTYTQM.exe.bat" "94⤵PID:1928
-
C:\windows\system\UQTYTQM.exeC:\windows\system\UQTYTQM.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KOGQB.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:5768 -
C:\windows\SysWOW64\KOGQB.exeC:\windows\system32\KOGQB.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JUNLGX.exe.bat" "98⤵PID:3456
-
C:\windows\JUNLGX.exeC:\windows\JUNLGX.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IUBQTO.exe.bat" "100⤵
- Executes a command shell one-liner
PID:2956 -
C:\windows\SysWOW64\IUBQTO.exeC:\windows\system32\IUBQTO.exe101⤵
- Executes dropped EXE
PID:352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXSE.exe.bat" "102⤵PID:1636
-
C:\windows\JXSE.exeC:\windows\JXSE.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EFT.exe.bat" "104⤵PID:1264
-
C:\windows\EFT.exeC:\windows\EFT.exe105⤵
- Executes dropped EXE
PID:2104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EIJXDB.exe.bat" "106⤵PID:3212
-
C:\windows\system\EIJXDB.exeC:\windows\system\EIJXDB.exe107⤵
- Executes dropped EXE
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YWQVI.exe.bat" "108⤵
- Executes a command shell one-liner
PID:6072 -
C:\windows\YWQVI.exeC:\windows\YWQVI.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PEESV.exe.bat" "110⤵
- Executes a command shell one-liner
PID:900 -
C:\windows\PEESV.exeC:\windows\PEESV.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LKRWGRT.exe.bat" "112⤵PID:2564
-
C:\windows\SysWOW64\LKRWGRT.exeC:\windows\system32\LKRWGRT.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LNHSU.exe.bat" "114⤵PID:1520
-
C:\windows\SysWOW64\LNHSU.exeC:\windows\system32\LNHSU.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DINKVS.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:3548 -
C:\windows\SysWOW64\DINKVS.exeC:\windows\system32\DINKVS.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UQBHHJ.exe.bat" "118⤵PID:2800
-
C:\windows\system\UQBHHJ.exeC:\windows\system\UQBHHJ.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TBEXQ.exe.bat" "120⤵PID:2344
-
C:\windows\system\TBEXQ.exeC:\windows\system\TBEXQ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-