Analysis
- max time kernel
37s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 09:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-25_c85cd415fe4fd2f302da1b66025d4b48_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-25_c85cd415fe4fd2f302da1b66025d4b48_elex_emotet_stop.exe
- Size 208KB
- Sample260826-ltakyatset
- SHA256 9d221dc0699d50027e755f21506252c4fd0b5a49e0960b7946076286e25a5e6b
- MD5 c85cd415fe4fd2f302da1b66025d4b48
- SHA1 bf9f88a83f524054fa60369a97604f3323f5cdc6
- SHA512 2798b977d9f68aaed702c7da03cbc66601a4cedf695cac9ac53e04e27c17d6ab19059b650e5914e6c0917b7a180d62b9627194a21dc4f2ef4c0c9e66acd135a3
- SSDEEP 3072:ILQaL9tbLkRIgd1Lye9yjE2hWAN5XbxlUKL+LOfh4pLthEjQT6j:slZtbLWIgd1LZ9oECZbxlUS+LOZkEj1
- TLSH T1CA247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 47 IoCs
pid Process 2952 VDTHJ.exe 4744 LQSG.exe 1148 KWZCI.exe 4384 GCJRZH.exe 2564 WSKQ.exe 2860 UCV.exe 4904 KXFL.exe 4636 TGHQCBR.exe 5708 IBQCV.exe 4988 JEUYBDB.exe 2916 HPXOJR.exe 4396 RPZTNPA.exe 2876 VFNBZ.exe 4216 HNUB.exe 5792 KDABQKY.exe 2524 FQF.exe 560 YTJOF.exe 2416 EHI.exe 3936 CEUSFIT.exe 2760 DIX.exe 5564 KYYNRTK.exe 4848 ATQRC.exe 800 RTKWGL.exe 1764 ABMJJJW.exe 3164 KZZWYRF.exe 1584 ZUJIK.exe 5928 YFMY.exe 2324 TNU.exe 5344 ZNCAI.exe 4608 IWEGML.exe 3100 VZA.exe 5780 GEM.exe 1544 IUFM.exe 4140 UMI.exe 2892 HXMD.exe 3860 DDKA.exe 2772 DNSCST.exe 4480 FLTWY.exe 2864 AZQ.exe 5984 RMBX.exe 1280 IXZV.exe 688 RKJNG.exe 3844 TXOXQVE.exe 4344 YAK.exe 1048 KTNW.exe 1312 VLQHM.exe 2632 DERIZ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\HPXOJR.exe JEUYBDB.exe File created C:\windows\SysWOW64\KYYNRTK.exe.bat DIX.exe File created C:\windows\SysWOW64\ABMJJJW.exe.bat RTKWGL.exe File created C:\windows\SysWOW64\YFMY.exe ZUJIK.exe File opened for modification C:\windows\SysWOW64\DDKA.exe HXMD.exe File opened for modification C:\windows\SysWOW64\YAK.exe TXOXQVE.exe File created C:\windows\SysWOW64\HXMD.exe UMI.exe File created C:\windows\SysWOW64\VDTHJ.exe.bat 2026-08-25_c85cd415fe4fd2f302da1b66025d4b48_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\TGHQCBR.exe KXFL.exe File opened for modification C:\windows\SysWOW64\HPXOJR.exe JEUYBDB.exe File created C:\windows\SysWOW64\YTJOF.exe.bat FQF.exe File created C:\windows\SysWOW64\KZZWYRF.exe ABMJJJW.exe File created C:\windows\SysWOW64\YFMY.exe.bat ZUJIK.exe File opened for modification C:\windows\SysWOW64\TNU.exe YFMY.exe File opened for modification C:\windows\SysWOW64\UCV.exe WSKQ.exe File opened for modification C:\windows\SysWOW64\RPZTNPA.exe HPXOJR.exe File created C:\windows\SysWOW64\VZA.exe IWEGML.exe File opened for modification C:\windows\SysWOW64\VZA.exe IWEGML.exe File created C:\windows\SysWOW64\RMBX.exe AZQ.exe File opened for modification C:\windows\SysWOW64\IXZV.exe RMBX.exe File created C:\windows\SysWOW64\KYYNRTK.exe DIX.exe File created C:\windows\SysWOW64\UMI.exe.bat IUFM.exe File created C:\windows\SysWOW64\ZUJIK.exe KZZWYRF.exe File opened for modification C:\windows\SysWOW64\ZUJIK.exe KZZWYRF.exe File created C:\windows\SysWOW64\ZNCAI.exe TNU.exe File created C:\windows\SysWOW64\RMBX.exe.bat AZQ.exe File created C:\windows\SysWOW64\IXZV.exe.bat RMBX.exe File created C:\windows\SysWOW64\RPZTNPA.exe.bat HPXOJR.exe File created C:\windows\SysWOW64\YTJOF.exe FQF.exe File created C:\windows\SysWOW64\TGHQCBR.exe.bat KXFL.exe File created C:\windows\SysWOW64\TXOXQVE.exe RKJNG.exe File created C:\windows\SysWOW64\VDTHJ.exe 2026-08-25_c85cd415fe4fd2f302da1b66025d4b48_elex_emotet_stop.exe File created C:\windows\SysWOW64\UCV.exe WSKQ.exe File opened for modification C:\windows\SysWOW64\HXMD.exe UMI.exe File opened for modification C:\windows\SysWOW64\RMBX.exe AZQ.exe File created C:\windows\SysWOW64\TXOXQVE.exe.bat RKJNG.exe File created C:\windows\SysWOW64\UMI.exe IUFM.exe File opened for modification C:\windows\SysWOW64\UMI.exe IUFM.exe File created C:\windows\SysWOW64\KZZWYRF.exe.bat ABMJJJW.exe File created C:\windows\SysWOW64\IXZV.exe RMBX.exe File opened for modification C:\windows\SysWOW64\VDTHJ.exe 2026-08-25_c85cd415fe4fd2f302da1b66025d4b48_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\KYYNRTK.exe DIX.exe File created C:\windows\SysWOW64\ZNCAI.exe.bat TNU.exe File created C:\windows\SysWOW64\VZA.exe.bat IWEGML.exe File created C:\windows\SysWOW64\DDKA.exe.bat HXMD.exe File created C:\windows\SysWOW64\YAK.exe TXOXQVE.exe File created C:\windows\SysWOW64\YAK.exe.bat TXOXQVE.exe File created C:\windows\SysWOW64\TGHQCBR.exe KXFL.exe File opened for modification C:\windows\SysWOW64\TXOXQVE.exe RKJNG.exe File created C:\windows\SysWOW64\UCV.exe.bat WSKQ.exe File created C:\windows\SysWOW64\VFNBZ.exe RPZTNPA.exe File created C:\windows\SysWOW64\VFNBZ.exe.bat RPZTNPA.exe File created C:\windows\SysWOW64\ABMJJJW.exe RTKWGL.exe File opened for modification C:\windows\SysWOW64\KZZWYRF.exe ABMJJJW.exe File created C:\windows\SysWOW64\ZUJIK.exe.bat KZZWYRF.exe File opened for modification C:\windows\SysWOW64\YTJOF.exe FQF.exe File opened for modification C:\windows\SysWOW64\ABMJJJW.exe RTKWGL.exe File opened for modification C:\windows\SysWOW64\YFMY.exe ZUJIK.exe File opened for modification C:\windows\SysWOW64\ZNCAI.exe TNU.exe File created C:\windows\SysWOW64\HPXOJR.exe.bat JEUYBDB.exe File created C:\windows\SysWOW64\RPZTNPA.exe HPXOJR.exe File opened for modification C:\windows\SysWOW64\VFNBZ.exe RPZTNPA.exe File created C:\windows\SysWOW64\TNU.exe YFMY.exe File created C:\windows\SysWOW64\TNU.exe.bat YFMY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\LQSG.exe VDTHJ.exe File created C:\windows\system\KWZCI.exe.bat LQSG.exe File created C:\windows\KXFL.exe UCV.exe File opened for modification C:\windows\FQF.exe KDABQKY.exe File created C:\windows\CEUSFIT.exe.bat EHI.exe File created C:\windows\DIX.exe CEUSFIT.exe File created C:\windows\system\KTNW.exe.bat YAK.exe File created C:\windows\FCSKYK.exe.bat DERIZ.exe File created C:\windows\system\RTKWGL.exe ATQRC.exe File created C:\windows\system\GEM.exe.bat VZA.exe File created C:\windows\DNSCST.exe.bat DDKA.exe File created C:\windows\system\DERIZ.exe VLQHM.exe File created C:\windows\JEUYBDB.exe IBQCV.exe File created C:\windows\system\KDABQKY.exe.bat HNUB.exe File created C:\windows\RKJNG.exe.bat IXZV.exe File created C:\windows\HNUB.exe VFNBZ.exe File created C:\windows\system\KDABQKY.exe HNUB.exe File created C:\windows\system\WSKQ.exe.bat GCJRZH.exe File opened for modification C:\windows\KXFL.exe UCV.exe File created C:\windows\system\RTKWGL.exe.bat ATQRC.exe File created C:\windows\IWEGML.exe ZNCAI.exe File created C:\windows\system\AZQ.exe.bat FLTWY.exe File created C:\windows\system\GCJRZH.exe KWZCI.exe File created C:\windows\system\IBQCV.exe.bat TGHQCBR.exe File opened for modification C:\windows\system\KDABQKY.exe HNUB.exe File created C:\windows\FQF.exe KDABQKY.exe File created C:\windows\FQF.exe.bat KDABQKY.exe File created C:\windows\system\KTNW.exe YAK.exe File created C:\windows\system\WSKQ.exe GCJRZH.exe File opened for modification C:\windows\HNUB.exe VFNBZ.exe File opened for modification C:\windows\system\RTKWGL.exe ATQRC.exe File opened for modification C:\windows\system\FLTWY.exe DNSCST.exe File created C:\windows\system\FLTWY.exe.bat DNSCST.exe File created C:\windows\system\DERIZ.exe.bat VLQHM.exe File created C:\windows\ATQRC.exe.bat KYYNRTK.exe File created C:\windows\system\KWZCI.exe LQSG.exe File opened for modification C:\windows\system\GCJRZH.exe KWZCI.exe File opened for modification C:\windows\system\KWZCI.exe LQSG.exe File opened for modification C:\windows\JEUYBDB.exe IBQCV.exe File opened for modification C:\windows\system\GEM.exe VZA.exe File created C:\windows\VLQHM.exe KTNW.exe File created C:\windows\HNUB.exe.bat VFNBZ.exe File created C:\windows\EHI.exe YTJOF.exe File opened for modification C:\windows\CEUSFIT.exe EHI.exe File opened for modification C:\windows\ATQRC.exe KYYNRTK.exe File opened for modification C:\windows\IWEGML.exe ZNCAI.exe File created C:\windows\system\GEM.exe VZA.exe File created C:\windows\system\IUFM.exe.bat GEM.exe File opened for modification C:\windows\RKJNG.exe IXZV.exe File created C:\windows\system\LQSG.exe VDTHJ.exe File opened for modification C:\windows\system\WSKQ.exe GCJRZH.exe File created C:\windows\CEUSFIT.exe EHI.exe File opened for modification C:\windows\system\KTNW.exe YAK.exe File created C:\windows\FCSKYK.exe DERIZ.exe File created C:\windows\system\IBQCV.exe TGHQCBR.exe File created C:\windows\DIX.exe.bat CEUSFIT.exe File opened for modification C:\windows\system\AZQ.exe FLTWY.exe File opened for modification C:\windows\DNSCST.exe DDKA.exe File created C:\windows\system\LQSG.exe.bat VDTHJ.exe File created C:\windows\KXFL.exe.bat UCV.exe File opened for modification C:\windows\EHI.exe YTJOF.exe File created C:\windows\EHI.exe.bat YTJOF.exe File created C:\windows\IWEGML.exe.bat ZNCAI.exe File created C:\windows\system\FLTWY.exe DNSCST.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4968 cmd.exe 1476 cmd.exe 3588 cmd.exe 3908 cmd.exe 5912 cmd.exe 4908 cmd.exe 1448 cmd.exe 1960 cmd.exe 1096 cmd.exe 3172 cmd.exe 1232 cmd.exe 2784 cmd.exe 5788 cmd.exe 5484 cmd.exe 1088 cmd.exe 6028 cmd.exe 264 cmd.exe 1516 cmd.exe 6084 cmd.exe 2604 cmd.exe 5664 cmd.exe 4124 cmd.exe 2540 cmd.exe 3452 cmd.exe 4916 cmd.exe 4496 cmd.exe 3408 cmd.exe 2992 cmd.exe 2216 cmd.exe 4508 cmd.exe 5772 cmd.exe 5412 cmd.exe 2620 cmd.exe 3828 cmd.exe 4320 cmd.exe 2396 cmd.exe 5004 cmd.exe 2856 cmd.exe 3688 cmd.exe 5216 cmd.exe 5300 cmd.exe 3920 cmd.exe 256 cmd.exe 468 cmd.exe 3128 cmd.exe 3504 cmd.exe 2284 cmd.exe 2816 cmd.exe 1768 cmd.exe 5604 cmd.exe 1800 cmd.exe 4552 cmd.exe 5372 cmd.exe 952 cmd.exe 3476 cmd.exe 260 cmd.exe 5156 cmd.exe 6056 cmd.exe 3840 cmd.exe 2644 cmd.exe 2768 cmd.exe 2104 cmd.exe 4224 cmd.exe 912 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4888 4584 WerFault.exe 87 4436 2952 WerFault.exe 93 1072 4744 WerFault.exe 99 1892 1148 WerFault.exe 104 2628 4384 WerFault.exe 109 2324 2564 WerFault.exe 114 3064 2860 WerFault.exe 119 5068 4904 WerFault.exe 124 2604 4636 WerFault.exe 129 3144 5708 WerFault.exe 134 4604 4988 WerFault.exe 139 6056 2916 WerFault.exe 144 264 4396 WerFault.exe 149 5816 2876 WerFault.exe 154 3124 4216 WerFault.exe 159 3732 5792 WerFault.exe 164 5484 2524 WerFault.exe 169 2768 560 WerFault.exe 174 4160 2416 WerFault.exe 179 2216 3936 WerFault.exe 184 1812 2760 WerFault.exe 189 4860 5564 WerFault.exe 194 3844 4848 WerFault.exe 199 3328 800 WerFault.exe 204 5864 1764 WerFault.exe 209 1072 3164 WerFault.exe 214 5472 1584 WerFault.exe 219 4660 5928 WerFault.exe 224 2408 2324 WerFault.exe 229 476 5344 WerFault.exe 234 3136 4608 WerFault.exe 238 3892 3100 WerFault.exe 243 5552 5780 WerFault.exe 248 3916 1544 WerFault.exe 253 4424 4140 WerFault.exe 258 5912 2892 WerFault.exe 263 2800 3860 WerFault.exe 269 2364 2772 WerFault.exe 273 4260 4480 WerFault.exe 280 1520 2864 WerFault.exe 284 4948 5984 WerFault.exe 289 3408 1280 WerFault.exe 294 4476 688 WerFault.exe 300 4060 3844 WerFault.exe 304 2996 4344 WerFault.exe 309 3284 1048 WerFault.exe 314 900 1312 WerFault.exe 319 912 2632 WerFault.exe 324 616 2352 WerFault.exe 329 3864 2532 WerFault.exe 334 5320 1648 WerFault.exe 339 2160 3152 WerFault.exe 344 2104 3416 WerFault.exe 349 5412 1772 WerFault.exe 355 5960 244 WerFault.exe 359 4864 5692 WerFault.exe 364 2412 3052 WerFault.exe 370 4700 424 WerFault.exe 374 2484 4260 WerFault.exe 379 3144 1320 WerFault.exe 384 4532 4324 WerFault.exe 389 1292 2200 WerFault.exe 394 5900 4868 WerFault.exe 399 5860 5696 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RMBX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZUJIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNCAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JEUYBDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXOXQVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IBQCV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VLQHM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HNUB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-25_c85cd415fe4fd2f302da1b66025d4b48_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IWEGML.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LQSG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEUSFIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ATQRC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNSCST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FQF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTKWGL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABMJJJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VZA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLTWY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RKJNG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWZCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFNBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DERIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPZTNPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KDABQKY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YTJOF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YFMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4584 2026-08-25_c85cd415fe4fd2f302da1b66025d4b48_elex_emotet_stop.exe 4584 2026-08-25_c85cd415fe4fd2f302da1b66025d4b48_elex_emotet_stop.exe 2952 VDTHJ.exe 2952 VDTHJ.exe 4744 LQSG.exe 4744 LQSG.exe 1148 KWZCI.exe 1148 KWZCI.exe 4384 GCJRZH.exe 4384 GCJRZH.exe 2564 WSKQ.exe 2564 WSKQ.exe 2860 UCV.exe 2860 UCV.exe 4904 KXFL.exe 4904 KXFL.exe 4636 TGHQCBR.exe 4636 TGHQCBR.exe 5708 IBQCV.exe 5708 IBQCV.exe 4988 JEUYBDB.exe 4988 JEUYBDB.exe 2916 HPXOJR.exe 2916 HPXOJR.exe 4396 RPZTNPA.exe 4396 RPZTNPA.exe 2876 VFNBZ.exe 2876 VFNBZ.exe 4216 HNUB.exe 4216 HNUB.exe 5792 KDABQKY.exe 5792 KDABQKY.exe 2524 FQF.exe 2524 FQF.exe 560 YTJOF.exe 560 YTJOF.exe 2416 EHI.exe 2416 EHI.exe 3936 CEUSFIT.exe 3936 CEUSFIT.exe 2760 DIX.exe 2760 DIX.exe 5564 KYYNRTK.exe 5564 KYYNRTK.exe 4848 ATQRC.exe 4848 ATQRC.exe 800 RTKWGL.exe 800 RTKWGL.exe 1764 ABMJJJW.exe 1764 ABMJJJW.exe 3164 KZZWYRF.exe 3164 KZZWYRF.exe 1584 ZUJIK.exe 1584 ZUJIK.exe 5928 YFMY.exe 5928 YFMY.exe 2324 TNU.exe 2324 TNU.exe 5344 ZNCAI.exe 5344 ZNCAI.exe 4608 IWEGML.exe 4608 IWEGML.exe 3100 VZA.exe 3100 VZA.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4584 2026-08-25_c85cd415fe4fd2f302da1b66025d4b48_elex_emotet_stop.exe 4584 2026-08-25_c85cd415fe4fd2f302da1b66025d4b48_elex_emotet_stop.exe 2952 VDTHJ.exe 2952 VDTHJ.exe 4744 LQSG.exe 4744 LQSG.exe 1148 KWZCI.exe 1148 KWZCI.exe 4384 GCJRZH.exe 4384 GCJRZH.exe 2564 WSKQ.exe 2564 WSKQ.exe 2860 UCV.exe 2860 UCV.exe 4904 KXFL.exe 4904 KXFL.exe 4636 TGHQCBR.exe 4636 TGHQCBR.exe 5708 IBQCV.exe 5708 IBQCV.exe 4988 JEUYBDB.exe 4988 JEUYBDB.exe 2916 HPXOJR.exe 2916 HPXOJR.exe 4396 RPZTNPA.exe 4396 RPZTNPA.exe 2876 VFNBZ.exe 2876 VFNBZ.exe 4216 HNUB.exe 4216 HNUB.exe 5792 KDABQKY.exe 5792 KDABQKY.exe 2524 FQF.exe 2524 FQF.exe 560 YTJOF.exe 560 YTJOF.exe 2416 EHI.exe 2416 EHI.exe 3936 CEUSFIT.exe 3936 CEUSFIT.exe 2760 DIX.exe 2760 DIX.exe 5564 KYYNRTK.exe 5564 KYYNRTK.exe 4848 ATQRC.exe 4848 ATQRC.exe 800 RTKWGL.exe 800 RTKWGL.exe 1764 ABMJJJW.exe 1764 ABMJJJW.exe 3164 KZZWYRF.exe 3164 KZZWYRF.exe 1584 ZUJIK.exe 1584 ZUJIK.exe 5928 YFMY.exe 5928 YFMY.exe 2324 TNU.exe 2324 TNU.exe 5344 ZNCAI.exe 5344 ZNCAI.exe 4608 IWEGML.exe 4608 IWEGML.exe 3100 VZA.exe 3100 VZA.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4584 wrote to memory of 4548 4584 2026-08-25_c85cd415fe4fd2f302da1b66025d4b48_elex_emotet_stop.exe 89 PID 4548 wrote to memory of 2952 4548 cmd.exe 93 PID 2952 wrote to memory of 2004 2952 VDTHJ.exe 95 PID 2004 wrote to memory of 4744 2004 cmd.exe 99 PID 4744 wrote to memory of 5396 4744 LQSG.exe 100 PID 5396 wrote to memory of 1148 5396 cmd.exe 104 PID 1148 wrote to memory of 976 1148 KWZCI.exe 105 PID 976 wrote to memory of 4384 976 cmd.exe 109 PID 4384 wrote to memory of 1540 4384 GCJRZH.exe 110 PID 1540 wrote to memory of 2564 1540 cmd.exe 114 PID 2564 wrote to memory of 2072 2564 WSKQ.exe 115 PID 2072 wrote to memory of 2860 2072 cmd.exe 119 PID 2860 wrote to memory of 4968 2860 UCV.exe 120 PID 4968 wrote to memory of 4904 4968 cmd.exe 124 PID 4904 wrote to memory of 2456 4904 KXFL.exe 125 PID 2456 wrote to memory of 4636 2456 cmd.exe 129 PID 4636 wrote to memory of 6140 4636 TGHQCBR.exe 130 PID 6140 wrote to memory of 5708 6140 cmd.exe 134 PID 5708 wrote to memory of 3212 5708 IBQCV.exe 135 PID 3212 wrote to memory of 4988 3212 cmd.exe 139 PID 4988 wrote to memory of 1984 4988 JEUYBDB.exe 140 PID 1984 wrote to memory of 2916 1984 cmd.exe 144 PID 2916 wrote to memory of 3452 2916 HPXOJR.exe 145 PID 3452 wrote to memory of 4396 3452 cmd.exe 149 PID 4396 wrote to memory of 5044 4396 RPZTNPA.exe 150 PID 5044 wrote to memory of 2876 5044 cmd.exe 154 PID 2876 wrote to memory of 1972 2876 VFNBZ.exe 155 PID 1972 wrote to memory of 4216 1972 cmd.exe 159 PID 4216 wrote to memory of 2588 4216 HNUB.exe 160 PID 2588 wrote to memory of 5792 2588 cmd.exe 164 PID 5792 wrote to memory of 3624 5792 KDABQKY.exe 165 PID 3624 wrote to memory of 2524 3624 cmd.exe 169 PID 2524 wrote to memory of 5452 2524 FQF.exe 170 PID 5452 wrote to memory of 560 5452 cmd.exe 174 PID 560 wrote to memory of 4692 560 YTJOF.exe 175 PID 4692 wrote to memory of 2416 4692 cmd.exe 179 PID 2416 wrote to memory of 1476 2416 EHI.exe 180 PID 1476 wrote to memory of 3936 1476 cmd.exe 184 PID 3936 wrote to memory of 1768 3936 CEUSFIT.exe 185 PID 1768 wrote to memory of 2760 1768 cmd.exe 189 PID 2760 wrote to memory of 3896 2760 DIX.exe 190 PID 3896 wrote to memory of 5564 3896 cmd.exe 194 PID 5564 wrote to memory of 3588 5564 KYYNRTK.exe 195 PID 3588 wrote to memory of 4848 3588 cmd.exe 199 PID 4848 wrote to memory of 2196 4848 ATQRC.exe 200 PID 2196 wrote to memory of 800 2196 cmd.exe 204 PID 800 wrote to memory of 1232 800 RTKWGL.exe 205 PID 1232 wrote to memory of 1764 1232 cmd.exe 209 PID 1764 wrote to memory of 1236 1764 ABMJJJW.exe 210 PID 1236 wrote to memory of 3164 1236 cmd.exe 214 PID 3164 wrote to memory of 3908 3164 KZZWYRF.exe 215 PID 3908 wrote to memory of 1584 3908 cmd.exe 219 PID 1584 wrote to memory of 5312 1584 ZUJIK.exe 220 PID 5312 wrote to memory of 5928 5312 cmd.exe 224 PID 5928 wrote to memory of 3712 5928 YFMY.exe 225 PID 3712 wrote to memory of 2324 3712 cmd.exe 229 PID 2324 wrote to memory of 2784 2324 TNU.exe 230 PID 2784 wrote to memory of 5344 2784 cmd.exe 234 PID 5344 wrote to memory of 3808 5344 ZNCAI.exe 235 PID 3808 wrote to memory of 4608 3808 cmd.exe 238 PID 4608 wrote to memory of 2512 4608 IWEGML.exe 240 PID 2512 wrote to memory of 3100 2512 cmd.exe 243 PID 3100 wrote to memory of 4432 3100 VZA.exe 245 PID 4432 wrote to memory of 5780 4432 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_c85cd415fe4fd2f302da1b66025d4b48_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_c85cd415fe4fd2f302da1b66025d4b48_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDTHJ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\windows\SysWOW64\VDTHJ.exeC:\windows\system32\VDTHJ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LQSG.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\windows\system\LQSG.exeC:\windows\system\LQSG.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWZCI.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\windows\system\KWZCI.exeC:\windows\system\KWZCI.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCJRZH.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:976 -
C:\windows\system\GCJRZH.exeC:\windows\system\GCJRZH.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSKQ.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\windows\system\WSKQ.exeC:\windows\system\WSKQ.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCV.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\windows\SysWOW64\UCV.exeC:\windows\system32\UCV.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KXFL.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\windows\KXFL.exeC:\windows\KXFL.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGHQCBR.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\windows\SysWOW64\TGHQCBR.exeC:\windows\system32\TGHQCBR.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBQCV.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\windows\system\IBQCV.exeC:\windows\system\IBQCV.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JEUYBDB.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\windows\JEUYBDB.exeC:\windows\JEUYBDB.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HPXOJR.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\windows\SysWOW64\HPXOJR.exeC:\windows\system32\HPXOJR.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RPZTNPA.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\windows\SysWOW64\RPZTNPA.exeC:\windows\system32\RPZTNPA.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFNBZ.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\windows\SysWOW64\VFNBZ.exeC:\windows\system32\VFNBZ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNUB.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\windows\HNUB.exeC:\windows\HNUB.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDABQKY.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\windows\system\KDABQKY.exeC:\windows\system\KDABQKY.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FQF.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\windows\FQF.exeC:\windows\FQF.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YTJOF.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\windows\SysWOW64\YTJOF.exeC:\windows\system32\YTJOF.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHI.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\windows\EHI.exeC:\windows\EHI.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEUSFIT.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\windows\CEUSFIT.exeC:\windows\CEUSFIT.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DIX.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\windows\DIX.exeC:\windows\DIX.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYYNRTK.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\windows\SysWOW64\KYYNRTK.exeC:\windows\system32\KYYNRTK.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ATQRC.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\windows\ATQRC.exeC:\windows\ATQRC.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RTKWGL.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\windows\system\RTKWGL.exeC:\windows\system\RTKWGL.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABMJJJW.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\windows\SysWOW64\ABMJJJW.exeC:\windows\system32\ABMJJJW.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZZWYRF.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\windows\SysWOW64\KZZWYRF.exeC:\windows\system32\KZZWYRF.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZUJIK.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\windows\SysWOW64\ZUJIK.exeC:\windows\system32\ZUJIK.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YFMY.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\windows\SysWOW64\YFMY.exeC:\windows\system32\YFMY.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TNU.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\windows\SysWOW64\TNU.exeC:\windows\system32\TNU.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNCAI.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\windows\SysWOW64\ZNCAI.exeC:\windows\system32\ZNCAI.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWEGML.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\windows\IWEGML.exeC:\windows\IWEGML.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZA.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\windows\SysWOW64\VZA.exeC:\windows\system32\VZA.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GEM.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\windows\system\GEM.exeC:\windows\system\GEM.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IUFM.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:3816 -
C:\windows\system\IUFM.exeC:\windows\system\IUFM.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UMI.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1108 -
C:\windows\SysWOW64\UMI.exeC:\windows\system32\UMI.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXMD.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:3760 -
C:\windows\SysWOW64\HXMD.exeC:\windows\system32\HXMD.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDKA.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:1268 -
C:\windows\SysWOW64\DDKA.exeC:\windows\system32\DDKA.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNSCST.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:4104 -
C:\windows\DNSCST.exeC:\windows\DNSCST.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FLTWY.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:1456 -
C:\windows\system\FLTWY.exeC:\windows\system\FLTWY.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZQ.exe.bat" "78⤵PID:4732
-
C:\windows\system\AZQ.exeC:\windows\system\AZQ.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RMBX.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:1696 -
C:\windows\SysWOW64\RMBX.exeC:\windows\system32\RMBX.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXZV.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:1660 -
C:\windows\SysWOW64\IXZV.exeC:\windows\system32\IXZV.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RKJNG.exe.bat" "84⤵PID:3872
-
C:\windows\RKJNG.exeC:\windows\RKJNG.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXOXQVE.exe.bat" "86⤵PID:1252
-
C:\windows\SysWOW64\TXOXQVE.exeC:\windows\system32\TXOXQVE.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAK.exe.bat" "88⤵PID:1508
-
C:\windows\SysWOW64\YAK.exeC:\windows\system32\YAK.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTNW.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1960 -
C:\windows\system\KTNW.exeC:\windows\system\KTNW.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VLQHM.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:3836 -
C:\windows\VLQHM.exeC:\windows\VLQHM.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DERIZ.exe.bat" "94⤵PID:5760
-
C:\windows\system\DERIZ.exeC:\windows\system\DERIZ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FCSKYK.exe.bat" "96⤵PID:5272
-
C:\windows\FCSKYK.exeC:\windows\FCSKYK.exe97⤵PID:2352
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TZQZFU.exe.bat" "98⤵
- Executes a command shell one-liner
PID:1096 -
C:\windows\SysWOW64\TZQZFU.exeC:\windows\system32\TZQZFU.exe99⤵PID:2532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SXXKR.exe.bat" "100⤵
- Executes a command shell one-liner
PID:468 -
C:\windows\SysWOW64\SXXKR.exeC:\windows\system32\SXXKR.exe101⤵PID:1648
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNQEXC.exe.bat" "102⤵
- Executes a command shell one-liner
PID:2216 -
C:\windows\system\UNQEXC.exeC:\windows\system\UNQEXC.exe103⤵PID:3152
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ISW.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4508 -
C:\windows\system\ISW.exeC:\windows\system\ISW.exe105⤵PID:3416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYCYLOW.exe.bat" "106⤵PID:932
-
C:\windows\SysWOW64\FYCYLOW.exeC:\windows\system32\FYCYLOW.exe107⤵PID:1772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYJMU.exe.bat" "108⤵
- Executes a command shell one-liner
PID:3172 -
C:\windows\system\LYJMU.exeC:\windows\system\LYJMU.exe109⤵PID:244
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WREFCX.exe.bat" "110⤵PID:5660
-
C:\windows\WREFCX.exeC:\windows\WREFCX.exe111⤵PID:5692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REJ.exe.bat" "112⤵PID:4436
-
C:\windows\REJ.exeC:\windows\REJ.exe113⤵PID:3052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WERCW.exe.bat" "114⤵PID:6048
-
C:\windows\SysWOW64\WERCW.exeC:\windows\system32\WERCW.exe115⤵PID:424
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TKWZD.exe.bat" "116⤵
- Executes a command shell one-liner
PID:5004 -
C:\windows\system\TKWZD.exeC:\windows\system\TKWZD.exe117⤵PID:4260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KVNPK.exe.bat" "118⤵PID:1332
-
C:\windows\KVNPK.exeC:\windows\KVNPK.exe119⤵PID:1320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GATMRF.exe.bat" "120⤵PID:4240
-
C:\windows\GATMRF.exeC:\windows\GATMRF.exe121⤵PID:4324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-