Analysis
- max time kernel
80s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/09/2026, 09:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-01_7ad372c071ec918030074bb7e91d1f0d_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-01_7ad372c071ec918030074bb7e91d1f0d_elex_emotet_stop.exe
- Size 208KB
- Sample260903-ld6y7stdme
- SHA256 becce7a21384deafe283fed05695f7dec0eb96fe359e135eec00406db83d66f2
- MD5 7ad372c071ec918030074bb7e91d1f0d
- SHA1 a6a80384911a58097c78ef2829f80ed2d901c632
- SHA512 adf4a6e1e5fba3769551f07f05510d4fa8e7027841da43bcd4e1b451108617c07e689781c4bf8051b7deffa1eacc3ca7bc184b6e52de75da5b68643bebdbec56
- SSDEEP 3072:jLQaL9tbLkRIgd1Lye9yjE2hWAN5Xbsl9dL+LOfL4pLthEjQT6j:vlZtbLWIgd1LZ9oECZbsl95+LODkEj1
- TLSH T155247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 96 SXNEPCP.exe 1732 NNVRFRF.exe 5380 TBHKSOO.exe 5756 GMRX.exe 2760 SPCKLF.exe 3060 MKTUWQ.exe 3292 LVWCF.exe 5220 ENM.exe 4992 KIPOC.exe 5196 SWCUM.exe 2412 GUC.exe 5832 ZMR.exe 460 SFZCPY.exe 1704 IVIBW.exe 1676 AYLX.exe 1504 DLDH.exe 3204 JHUIR.exe 3836 UZJSJ.exe 2016 MHYQV.exe 4584 UNCEY.exe 5996 ELQR.exe 5148 HBRN.exe 2692 UEHM.exe 2752 JUVW.exe 2588 KXY.exe 3024 SKLGHXF.exe 2920 YXC.exe 5892 FAUTWM.exe 6132 PYZFM.exe 8 OJCV.exe 2816 HEGZAZ.exe 2136 LFQBE.exe 1184 AAZ.exe 3128 OFZRZTC.exe 4544 DAREK.exe 3180 CLTM.exe 1956 PWCKGFV.exe 1476 PCCZIJP.exe 2544 VCKNR.exe 2736 EKMSCJ.exe 3740 QSSAH.exe 112 PDVQPPL.exe 3260 TTKQCAZ.exe 724 ZTJELCA.exe 1164 RWVHYS.exe 4464 BMB.exe 3944 JAN.exe 3000 CDREWPQ.exe 4116 DYVA.exe 2472 FWB.exe 5952 FZEYW.exe 3240 VPFP.exe 4368 ZXUXPR.exe 3068 CNB.exe 1864 MNDCEHK.exe 2456 YDJK.exe 1924 CLQKVR.exe 4424 IGPL.exe 5496 CUUCKU.exe 4652 BRFX.exe 4984 KSHDAX.exe 2040 BAJQMCL.exe 2964 JVTUX.exe 2100 PQS.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\JAN.exe BMB.exe File created C:\windows\SysWOW64\KWSO.exe.bat EVLAKZU.exe File opened for modification C:\windows\SysWOW64\LAVDTZ.exe DUIWISJ.exe File opened for modification C:\windows\SysWOW64\RBWRBV.exe JOJLQX.exe File opened for modification C:\windows\SysWOW64\JFO.exe DJC.exe File opened for modification C:\windows\SysWOW64\OFZRZTC.exe AAZ.exe File created C:\windows\SysWOW64\BMB.exe.bat RWVHYS.exe File opened for modification C:\windows\SysWOW64\UYF.exe CDBCXB.exe File opened for modification C:\windows\SysWOW64\GVANV.exe LAVDTZ.exe File created C:\windows\SysWOW64\SPCKLF.exe.bat GMRX.exe File created C:\windows\SysWOW64\MKTUWQ.exe SPCKLF.exe File created C:\windows\SysWOW64\JUVW.exe UEHM.exe File created C:\windows\SysWOW64\PDVQPPL.exe.bat QSSAH.exe File opened for modification C:\windows\SysWOW64\BRFX.exe CUUCKU.exe File created C:\windows\SysWOW64\ZZGQXEY.exe.bat ELBZNF.exe File created C:\windows\SysWOW64\LAVDTZ.exe.bat DUIWISJ.exe File created C:\windows\SysWOW64\GVANV.exe LAVDTZ.exe File created C:\windows\SysWOW64\LVWCF.exe.bat MKTUWQ.exe File created C:\windows\SysWOW64\SWCUM.exe KIPOC.exe File created C:\windows\SysWOW64\HEGZAZ.exe OJCV.exe File created C:\windows\SysWOW64\OFZRZTC.exe AAZ.exe File opened for modification C:\windows\SysWOW64\VCKNR.exe PCCZIJP.exe File created C:\windows\SysWOW64\CUUCKU.exe.bat IGPL.exe File created C:\windows\SysWOW64\BRFX.exe.bat CUUCKU.exe File created C:\windows\SysWOW64\GVANV.exe.bat LAVDTZ.exe File opened for modification C:\windows\SysWOW64\MHYQV.exe UZJSJ.exe File opened for modification C:\windows\SysWOW64\HEGZAZ.exe OJCV.exe File opened for modification C:\windows\SysWOW64\PWCKGFV.exe CLTM.exe File opened for modification C:\windows\SysWOW64\JAN.exe BMB.exe File created C:\windows\SysWOW64\CPNRJ.exe ZZGQXEY.exe File created C:\windows\SysWOW64\FHH.exe.bat FBH.exe File created C:\windows\SysWOW64\LFXI.exe BISOGSF.exe File opened for modification C:\windows\SysWOW64\LVWCF.exe MKTUWQ.exe File created C:\windows\SysWOW64\JUVW.exe.bat UEHM.exe File created C:\windows\SysWOW64\YXC.exe SKLGHXF.exe File created C:\windows\SysWOW64\PWCKGFV.exe.bat CLTM.exe File created C:\windows\SysWOW64\ZTJELCA.exe TTKQCAZ.exe File created C:\windows\SysWOW64\UYF.exe.bat CDBCXB.exe File created C:\windows\SysWOW64\KWSO.exe EVLAKZU.exe File created C:\windows\SysWOW64\JFO.exe.bat DJC.exe File opened for modification C:\windows\SysWOW64\CLTM.exe DAREK.exe File created C:\windows\SysWOW64\PDVQPPL.exe QSSAH.exe File opened for modification C:\windows\SysWOW64\TTKQCAZ.exe PDVQPPL.exe File opened for modification C:\windows\SysWOW64\ZZGQXEY.exe ELBZNF.exe File opened for modification C:\windows\SysWOW64\FHH.exe FBH.exe File created C:\windows\SysWOW64\LFXI.exe.bat BISOGSF.exe File created C:\windows\SysWOW64\HEGZAZ.exe.bat OJCV.exe File created C:\windows\SysWOW64\AAZ.exe LFQBE.exe File opened for modification C:\windows\SysWOW64\AAZ.exe LFQBE.exe File created C:\windows\SysWOW64\TTKQCAZ.exe.bat PDVQPPL.exe File created C:\windows\SysWOW64\JAN.exe.bat BMB.exe File created C:\windows\SysWOW64\JPN.exe FHH.exe File created C:\windows\SysWOW64\BWDC.exe FWM.exe File created C:\windows\SysWOW64\RBWRBV.exe.bat JOJLQX.exe File opened for modification C:\windows\SysWOW64\SWCUM.exe KIPOC.exe File created C:\windows\SysWOW64\TTKQCAZ.exe PDVQPPL.exe File opened for modification C:\windows\SysWOW64\BMB.exe RWVHYS.exe File opened for modification C:\windows\SysWOW64\CPNRJ.exe ZZGQXEY.exe File opened for modification C:\windows\SysWOW64\LFXI.exe BISOGSF.exe File created C:\windows\SysWOW64\MHYQV.exe.bat UZJSJ.exe File created C:\windows\SysWOW64\AAZ.exe.bat LFQBE.exe File created C:\windows\SysWOW64\VCKNR.exe PCCZIJP.exe File created C:\windows\SysWOW64\BMB.exe RWVHYS.exe File created C:\windows\SysWOW64\CPNRJ.exe.bat ZZGQXEY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\PYZFM.exe.bat FAUTWM.exe File created C:\windows\DAREK.exe.bat OFZRZTC.exe File opened for modification C:\windows\GVRDHF.exe CNLDVND.exe File created C:\windows\ABZDALB.exe.bat ZYV.exe File opened for modification C:\windows\ENM.exe LVWCF.exe File created C:\windows\system\CDREWPQ.exe.bat JAN.exe File created C:\windows\CNB.exe ZXUXPR.exe File opened for modification C:\windows\CLQKVR.exe YDJK.exe File opened for modification C:\windows\JVTUX.exe BAJQMCL.exe File opened for modification C:\windows\EVLAKZU.exe UYF.exe File opened for modification C:\windows\SFZCPY.exe ZMR.exe File created C:\windows\IVIBW.exe.bat SFZCPY.exe File opened for modification C:\windows\OJCV.exe PYZFM.exe File opened for modification C:\windows\system\VPFP.exe FZEYW.exe File created C:\windows\YDJK.exe.bat MNDCEHK.exe File created C:\windows\system\KSRJC.exe JPN.exe File created C:\windows\system\AYLX.exe.bat IVIBW.exe File created C:\windows\system\DYVA.exe CDREWPQ.exe File created C:\windows\ZYV.exe.bat GVRDHF.exe File opened for modification C:\windows\KIPOC.exe ENM.exe File created C:\windows\PYZFM.exe FAUTWM.exe File created C:\windows\system\ZXUXPR.exe VPFP.exe File created C:\windows\system\NXKEOZ.exe JHV.exe File created C:\windows\system\DLDH.exe.bat AYLX.exe File created C:\windows\JVTUX.exe BAJQMCL.exe File created C:\windows\FWB.exe.bat DYVA.exe File opened for modification C:\windows\CNB.exe ZXUXPR.exe File created C:\windows\system\JHV.exe KWSO.exe File created C:\windows\SFZCPY.exe ZMR.exe File created C:\windows\SFZCPY.exe.bat ZMR.exe File opened for modification C:\windows\system\DLDH.exe AYLX.exe File created C:\windows\UNCEY.exe.bat MHYQV.exe File created C:\windows\system\VPFP.exe.bat FZEYW.exe File opened for modification C:\windows\BAJQMCL.exe KSHDAX.exe File opened for modification C:\windows\system\PCCZIJP.exe PWCKGFV.exe File created C:\windows\system\VPFP.exe FZEYW.exe File created C:\windows\EVLAKZU.exe UYF.exe File created C:\windows\FWM.exe QGDDWB.exe File opened for modification C:\windows\system\DJC.exe RBWRBV.exe File opened for modification C:\windows\system\AYLX.exe IVIBW.exe File opened for modification C:\windows\system\MNDCEHK.exe CNB.exe File opened for modification C:\windows\YDJK.exe MNDCEHK.exe File created C:\windows\GVRDHF.exe.bat CNLDVND.exe File opened for modification C:\windows\system\KSRJC.exe JPN.exe File opened for modification C:\windows\system\DVVFHY.exe KSRJC.exe File created C:\windows\JOJLQX.exe QTFHKHC.exe File opened for modification C:\windows\system\GUC.exe SWCUM.exe File created C:\windows\ELBZNF.exe PQS.exe File created C:\windows\ELBZNF.exe.bat PQS.exe File created C:\windows\EVLAKZU.exe.bat UYF.exe File opened for modification C:\windows\system\JHV.exe KWSO.exe File created C:\windows\GVRDHF.exe CNLDVND.exe File opened for modification C:\windows\DUIWISJ.exe BWDC.exe File created C:\windows\JOJLQX.exe.bat QTFHKHC.exe File created C:\windows\system\NNVRFRF.exe.bat SXNEPCP.exe File created C:\windows\system\TBHKSOO.exe.bat NNVRFRF.exe File created C:\windows\GMRX.exe TBHKSOO.exe File created C:\windows\KXY.exe JUVW.exe File created C:\windows\FWB.exe DYVA.exe File created C:\windows\system\PQS.exe JVTUX.exe File created C:\windows\system\KSRJC.exe.bat JPN.exe File opened for modification C:\windows\FWM.exe QGDDWB.exe File opened for modification C:\windows\system\LFQBE.exe HEGZAZ.exe File opened for modification C:\windows\system\ZXUXPR.exe VPFP.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2392 cmd.exe 3372 cmd.exe 1264 cmd.exe 5820 cmd.exe 2652 cmd.exe 1860 cmd.exe 3212 cmd.exe 4120 cmd.exe 2120 cmd.exe 916 cmd.exe 6112 cmd.exe 4828 cmd.exe 3256 cmd.exe 4520 cmd.exe 5804 cmd.exe 2824 cmd.exe 4416 cmd.exe 1576 cmd.exe 1208 cmd.exe 1980 cmd.exe 5684 cmd.exe 3280 cmd.exe 5692 cmd.exe 5588 cmd.exe 4272 cmd.exe 4932 cmd.exe 4104 cmd.exe 4204 cmd.exe 1536 cmd.exe 4784 cmd.exe 1848 cmd.exe 2584 cmd.exe 4788 cmd.exe 2520 cmd.exe 3924 cmd.exe 2284 cmd.exe 1288 cmd.exe 4680 cmd.exe 2468 cmd.exe 5688 cmd.exe 5036 cmd.exe 3536 cmd.exe 4220 cmd.exe 696 cmd.exe 3412 cmd.exe 5472 cmd.exe 5740 cmd.exe 6096 cmd.exe 4760 cmd.exe 1804 cmd.exe 3780 cmd.exe 3988 cmd.exe 3696 cmd.exe 4312 cmd.exe 4348 cmd.exe 4836 cmd.exe 4324 cmd.exe 4664 cmd.exe 1472 cmd.exe 3948 cmd.exe 5988 cmd.exe 4484 cmd.exe 1356 cmd.exe 5116 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5792 1052 WerFault.exe 88 3212 96 WerFault.exe 94 1120 1732 WerFault.exe 100 2688 5380 WerFault.exe 105 3280 5756 WerFault.exe 110 1812 2760 WerFault.exe 115 4976 3060 WerFault.exe 120 3836 3292 WerFault.exe 125 1924 5220 WerFault.exe 130 5688 4992 WerFault.exe 135 3188 5196 WerFault.exe 140 4800 2412 WerFault.exe 145 1884 5832 WerFault.exe 150 5764 460 WerFault.exe 155 4628 1704 WerFault.exe 160 5400 1676 WerFault.exe 165 4464 1504 WerFault.exe 170 3768 3204 WerFault.exe 175 2820 3836 WerFault.exe 180 1888 2016 WerFault.exe 185 4844 4584 WerFault.exe 190 4412 5996 WerFault.exe 195 5852 5148 WerFault.exe 200 3144 2692 WerFault.exe 205 3320 2752 WerFault.exe 210 3340 2588 WerFault.exe 215 2964 3024 WerFault.exe 220 4648 2920 WerFault.exe 225 3036 5892 WerFault.exe 230 1888 6132 WerFault.exe 235 5496 8 WerFault.exe 240 5732 2816 WerFault.exe 245 2784 2136 WerFault.exe 250 5328 1184 WerFault.exe 255 4864 3128 WerFault.exe 261 5456 4544 WerFault.exe 266 1228 3180 WerFault.exe 271 5388 1956 WerFault.exe 276 4784 1476 WerFault.exe 281 968 2544 WerFault.exe 286 4320 2736 WerFault.exe 291 2976 3740 WerFault.exe 296 1516 112 WerFault.exe 301 2672 3260 WerFault.exe 306 1348 724 WerFault.exe 311 960 1164 WerFault.exe 316 4348 4464 WerFault.exe 321 6036 3944 WerFault.exe 326 620 3000 WerFault.exe 331 5344 4116 WerFault.exe 336 244 2472 WerFault.exe 341 936 5952 WerFault.exe 346 5392 3240 WerFault.exe 351 1344 4368 WerFault.exe 356 4344 3068 WerFault.exe 361 4108 1864 WerFault.exe 366 1036 2456 WerFault.exe 371 5416 1924 WerFault.exe 376 3528 4424 WerFault.exe 381 4676 5496 WerFault.exe 386 4408 4652 WerFault.exe 391 4364 4984 WerFault.exe 396 2576 2040 WerFault.exe 401 3844 2964 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDBCXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DVVFHY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDJK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUUCKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVTUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZTJELCA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVLAKZU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXKEOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABZDALB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UNCEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKLGHXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSRJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVWCF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXNEPCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHYQV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAUTWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDVQPPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGDDWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OFZRZTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKMSCJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPCKLF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BWDC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBWRBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-01_7ad372c071ec918030074bb7e91d1f0d_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IGPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UZJSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1052 2026-09-01_7ad372c071ec918030074bb7e91d1f0d_elex_emotet_stop.exe 1052 2026-09-01_7ad372c071ec918030074bb7e91d1f0d_elex_emotet_stop.exe 96 SXNEPCP.exe 96 SXNEPCP.exe 1732 NNVRFRF.exe 1732 NNVRFRF.exe 5380 TBHKSOO.exe 5380 TBHKSOO.exe 5756 GMRX.exe 5756 GMRX.exe 2760 SPCKLF.exe 2760 SPCKLF.exe 3060 MKTUWQ.exe 3060 MKTUWQ.exe 3292 LVWCF.exe 3292 LVWCF.exe 5220 ENM.exe 5220 ENM.exe 4992 KIPOC.exe 4992 KIPOC.exe 5196 SWCUM.exe 5196 SWCUM.exe 2412 GUC.exe 2412 GUC.exe 5832 ZMR.exe 5832 ZMR.exe 460 SFZCPY.exe 460 SFZCPY.exe 1704 IVIBW.exe 1704 IVIBW.exe 1676 AYLX.exe 1676 AYLX.exe 1504 DLDH.exe 1504 DLDH.exe 3204 JHUIR.exe 3204 JHUIR.exe 3836 UZJSJ.exe 3836 UZJSJ.exe 2016 MHYQV.exe 2016 MHYQV.exe 4584 UNCEY.exe 4584 UNCEY.exe 5996 ELQR.exe 5996 ELQR.exe 5148 HBRN.exe 5148 HBRN.exe 2692 UEHM.exe 2692 UEHM.exe 2752 JUVW.exe 2752 JUVW.exe 2588 KXY.exe 2588 KXY.exe 3024 SKLGHXF.exe 3024 SKLGHXF.exe 2920 YXC.exe 2920 YXC.exe 5892 FAUTWM.exe 5892 FAUTWM.exe 6132 PYZFM.exe 6132 PYZFM.exe 8 OJCV.exe 8 OJCV.exe 2816 HEGZAZ.exe 2816 HEGZAZ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1052 2026-09-01_7ad372c071ec918030074bb7e91d1f0d_elex_emotet_stop.exe 1052 2026-09-01_7ad372c071ec918030074bb7e91d1f0d_elex_emotet_stop.exe 96 SXNEPCP.exe 96 SXNEPCP.exe 1732 NNVRFRF.exe 1732 NNVRFRF.exe 5380 TBHKSOO.exe 5380 TBHKSOO.exe 5756 GMRX.exe 5756 GMRX.exe 2760 SPCKLF.exe 2760 SPCKLF.exe 3060 MKTUWQ.exe 3060 MKTUWQ.exe 3292 LVWCF.exe 3292 LVWCF.exe 5220 ENM.exe 5220 ENM.exe 4992 KIPOC.exe 4992 KIPOC.exe 5196 SWCUM.exe 5196 SWCUM.exe 2412 GUC.exe 2412 GUC.exe 5832 ZMR.exe 5832 ZMR.exe 460 SFZCPY.exe 460 SFZCPY.exe 1704 IVIBW.exe 1704 IVIBW.exe 1676 AYLX.exe 1676 AYLX.exe 1504 DLDH.exe 1504 DLDH.exe 3204 JHUIR.exe 3204 JHUIR.exe 3836 UZJSJ.exe 3836 UZJSJ.exe 2016 MHYQV.exe 2016 MHYQV.exe 4584 UNCEY.exe 4584 UNCEY.exe 5996 ELQR.exe 5996 ELQR.exe 5148 HBRN.exe 5148 HBRN.exe 2692 UEHM.exe 2692 UEHM.exe 2752 JUVW.exe 2752 JUVW.exe 2588 KXY.exe 2588 KXY.exe 3024 SKLGHXF.exe 3024 SKLGHXF.exe 2920 YXC.exe 2920 YXC.exe 5892 FAUTWM.exe 5892 FAUTWM.exe 6132 PYZFM.exe 6132 PYZFM.exe 8 OJCV.exe 8 OJCV.exe 2816 HEGZAZ.exe 2816 HEGZAZ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1052 wrote to memory of 6052 1052 2026-09-01_7ad372c071ec918030074bb7e91d1f0d_elex_emotet_stop.exe 90 PID 6052 wrote to memory of 96 6052 cmd.exe 94 PID 96 wrote to memory of 3728 96 SXNEPCP.exe 96 PID 3728 wrote to memory of 1732 3728 cmd.exe 100 PID 1732 wrote to memory of 1972 1732 NNVRFRF.exe 101 PID 1972 wrote to memory of 5380 1972 cmd.exe 105 PID 5380 wrote to memory of 4760 5380 TBHKSOO.exe 106 PID 4760 wrote to memory of 5756 4760 cmd.exe 110 PID 5756 wrote to memory of 2652 5756 GMRX.exe 111 PID 2652 wrote to memory of 2760 2652 cmd.exe 115 PID 2760 wrote to memory of 1208 2760 SPCKLF.exe 116 PID 1208 wrote to memory of 3060 1208 cmd.exe 120 PID 3060 wrote to memory of 5244 3060 MKTUWQ.exe 121 PID 5244 wrote to memory of 3292 5244 cmd.exe 125 PID 3292 wrote to memory of 5424 3292 LVWCF.exe 126 PID 5424 wrote to memory of 5220 5424 cmd.exe 130 PID 5220 wrote to memory of 5588 5220 ENM.exe 131 PID 5588 wrote to memory of 4992 5588 cmd.exe 135 PID 4992 wrote to memory of 4232 4992 KIPOC.exe 136 PID 4232 wrote to memory of 5196 4232 cmd.exe 140 PID 5196 wrote to memory of 2836 5196 SWCUM.exe 141 PID 2836 wrote to memory of 2412 2836 cmd.exe 145 PID 2412 wrote to memory of 1204 2412 GUC.exe 146 PID 1204 wrote to memory of 5832 1204 cmd.exe 150 PID 5832 wrote to memory of 4100 5832 ZMR.exe 151 PID 4100 wrote to memory of 460 4100 cmd.exe 155 PID 460 wrote to memory of 2356 460 SFZCPY.exe 156 PID 2356 wrote to memory of 1704 2356 cmd.exe 160 PID 1704 wrote to memory of 2572 1704 IVIBW.exe 161 PID 2572 wrote to memory of 1676 2572 cmd.exe 165 PID 1676 wrote to memory of 6108 1676 AYLX.exe 166 PID 6108 wrote to memory of 1504 6108 cmd.exe 170 PID 1504 wrote to memory of 2072 1504 DLDH.exe 171 PID 2072 wrote to memory of 3204 2072 cmd.exe 175 PID 3204 wrote to memory of 3908 3204 JHUIR.exe 176 PID 3908 wrote to memory of 3836 3908 cmd.exe 180 PID 3836 wrote to memory of 4828 3836 UZJSJ.exe 181 PID 4828 wrote to memory of 2016 4828 cmd.exe 185 PID 2016 wrote to memory of 1064 2016 MHYQV.exe 186 PID 1064 wrote to memory of 4584 1064 cmd.exe 190 PID 4584 wrote to memory of 4208 4584 UNCEY.exe 191 PID 4208 wrote to memory of 5996 4208 cmd.exe 195 PID 5996 wrote to memory of 4296 5996 ELQR.exe 196 PID 4296 wrote to memory of 5148 4296 cmd.exe 200 PID 5148 wrote to memory of 3964 5148 HBRN.exe 201 PID 3964 wrote to memory of 2692 3964 cmd.exe 205 PID 2692 wrote to memory of 3712 2692 UEHM.exe 206 PID 3712 wrote to memory of 2752 3712 cmd.exe 210 PID 2752 wrote to memory of 2584 2752 JUVW.exe 211 PID 2584 wrote to memory of 2588 2584 cmd.exe 215 PID 2588 wrote to memory of 4504 2588 KXY.exe 216 PID 4504 wrote to memory of 3024 4504 cmd.exe 220 PID 3024 wrote to memory of 3536 3024 SKLGHXF.exe 221 PID 3536 wrote to memory of 2920 3536 cmd.exe 225 PID 2920 wrote to memory of 2272 2920 YXC.exe 226 PID 2272 wrote to memory of 5892 2272 cmd.exe 230 PID 5892 wrote to memory of 5960 5892 FAUTWM.exe 231 PID 5960 wrote to memory of 6132 5960 cmd.exe 235 PID 6132 wrote to memory of 3476 6132 PYZFM.exe 236 PID 3476 wrote to memory of 8 3476 cmd.exe 240 PID 8 wrote to memory of 3256 8 OJCV.exe 241 PID 3256 wrote to memory of 2816 3256 cmd.exe 245 PID 2816 wrote to memory of 4220 2816 HEGZAZ.exe 246 PID 4220 wrote to memory of 2136 4220 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-01_7ad372c071ec918030074bb7e91d1f0d_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_7ad372c071ec918030074bb7e91d1f0d_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SXNEPCP.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\windows\SXNEPCP.exeC:\windows\SXNEPCP.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:96 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NNVRFRF.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\windows\system\NNVRFRF.exeC:\windows\system\NNVRFRF.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TBHKSOO.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\windows\system\TBHKSOO.exeC:\windows\system\TBHKSOO.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMRX.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\windows\GMRX.exeC:\windows\GMRX.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SPCKLF.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\windows\SysWOW64\SPCKLF.exeC:\windows\system32\SPCKLF.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MKTUWQ.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\windows\SysWOW64\MKTUWQ.exeC:\windows\system32\MKTUWQ.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LVWCF.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\windows\SysWOW64\LVWCF.exeC:\windows\system32\LVWCF.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENM.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\windows\ENM.exeC:\windows\ENM.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIPOC.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\windows\KIPOC.exeC:\windows\KIPOC.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SWCUM.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\windows\SysWOW64\SWCUM.exeC:\windows\system32\SWCUM.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GUC.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\windows\system\GUC.exeC:\windows\system\GUC.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMR.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\windows\system\ZMR.exeC:\windows\system\ZMR.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFZCPY.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\windows\SFZCPY.exeC:\windows\SFZCPY.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IVIBW.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\windows\IVIBW.exeC:\windows\IVIBW.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AYLX.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\windows\system\AYLX.exeC:\windows\system\AYLX.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLDH.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\windows\system\DLDH.exeC:\windows\system\DLDH.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JHUIR.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\windows\system\JHUIR.exeC:\windows\system\JHUIR.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UZJSJ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\windows\SysWOW64\UZJSJ.exeC:\windows\system32\UZJSJ.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MHYQV.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\windows\SysWOW64\MHYQV.exeC:\windows\system32\MHYQV.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UNCEY.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\windows\UNCEY.exeC:\windows\UNCEY.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ELQR.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\windows\SysWOW64\ELQR.exeC:\windows\system32\ELQR.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBRN.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\windows\system\HBRN.exeC:\windows\system\HBRN.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UEHM.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\windows\SysWOW64\UEHM.exeC:\windows\system32\UEHM.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUVW.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\windows\SysWOW64\JUVW.exeC:\windows\system32\JUVW.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KXY.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\windows\KXY.exeC:\windows\KXY.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SKLGHXF.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\windows\SKLGHXF.exeC:\windows\SKLGHXF.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXC.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\windows\SysWOW64\YXC.exeC:\windows\system32\YXC.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FAUTWM.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\windows\FAUTWM.exeC:\windows\FAUTWM.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PYZFM.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\windows\PYZFM.exeC:\windows\PYZFM.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJCV.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\windows\OJCV.exeC:\windows\OJCV.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HEGZAZ.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\windows\SysWOW64\HEGZAZ.exeC:\windows\system32\HEGZAZ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFQBE.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\windows\system\LFQBE.exeC:\windows\system\LFQBE.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAZ.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4272 -
C:\windows\SysWOW64\AAZ.exeC:\windows\system32\AAZ.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OFZRZTC.exe.bat" "68⤵PID:4972
-
C:\windows\SysWOW64\OFZRZTC.exeC:\windows\system32\OFZRZTC.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DAREK.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:3304 -
C:\windows\DAREK.exeC:\windows\DAREK.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CLTM.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:5632 -
C:\windows\SysWOW64\CLTM.exeC:\windows\system32\CLTM.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PWCKGFV.exe.bat" "74⤵PID:1104
-
C:\windows\SysWOW64\PWCKGFV.exeC:\windows\system32\PWCKGFV.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PCCZIJP.exe.bat" "76⤵PID:5240
-
C:\windows\system\PCCZIJP.exeC:\windows\system\PCCZIJP.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VCKNR.exe.bat" "78⤵
- Executes a command shell one-liner
PID:1980 -
C:\windows\SysWOW64\VCKNR.exeC:\windows\system32\VCKNR.exe79⤵
- Executes dropped EXE
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EKMSCJ.exe.bat" "80⤵PID:1964
-
C:\windows\system\EKMSCJ.exeC:\windows\system\EKMSCJ.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSSAH.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5320 -
C:\windows\QSSAH.exeC:\windows\QSSAH.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDVQPPL.exe.bat" "84⤵PID:1100
-
C:\windows\SysWOW64\PDVQPPL.exeC:\windows\system32\PDVQPPL.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTKQCAZ.exe.bat" "86⤵
- Executes a command shell one-liner
PID:696 -
C:\windows\SysWOW64\TTKQCAZ.exeC:\windows\system32\TTKQCAZ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZTJELCA.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:4628 -
C:\windows\SysWOW64\ZTJELCA.exeC:\windows\system32\ZTJELCA.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RWVHYS.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4932 -
C:\windows\RWVHYS.exeC:\windows\RWVHYS.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMB.exe.bat" "92⤵
- Executes a command shell one-liner
PID:5036 -
C:\windows\SysWOW64\BMB.exeC:\windows\system32\BMB.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JAN.exe.bat" "94⤵PID:5596
-
C:\windows\SysWOW64\JAN.exeC:\windows\system32\JAN.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDREWPQ.exe.bat" "96⤵PID:3768
-
C:\windows\system\CDREWPQ.exeC:\windows\system\CDREWPQ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYVA.exe.bat" "98⤵PID:1468
-
C:\windows\system\DYVA.exeC:\windows\system\DYVA.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWB.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5688 -
C:\windows\FWB.exeC:\windows\FWB.exe101⤵
- Executes dropped EXE
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZEYW.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4104 -
C:\windows\FZEYW.exeC:\windows\FZEYW.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VPFP.exe.bat" "104⤵PID:1372
-
C:\windows\system\VPFP.exeC:\windows\system\VPFP.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZXUXPR.exe.bat" "106⤵PID:3268
-
C:\windows\system\ZXUXPR.exeC:\windows\system\ZXUXPR.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNB.exe.bat" "108⤵PID:2128
-
C:\windows\CNB.exeC:\windows\CNB.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MNDCEHK.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4204 -
C:\windows\system\MNDCEHK.exeC:\windows\system\MNDCEHK.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDJK.exe.bat" "112⤵PID:5864
-
C:\windows\YDJK.exeC:\windows\YDJK.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CLQKVR.exe.bat" "114⤵PID:3036
-
C:\windows\CLQKVR.exeC:\windows\CLQKVR.exe115⤵
- Executes dropped EXE
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IGPL.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1804 -
C:\windows\system\IGPL.exeC:\windows\system\IGPL.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CUUCKU.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5860 -
C:\windows\SysWOW64\CUUCKU.exeC:\windows\system32\CUUCKU.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRFX.exe.bat" "120⤵
- Executes a command shell one-liner
PID:3212 -
C:\windows\SysWOW64\BRFX.exeC:\windows\system32\BRFX.exe121⤵
- Executes dropped EXE
PID:4652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-