Analysis
- max time kernel
84s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 14:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-04_31cebe84fa8bac6c2a845c65eb10bbaa_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-04_31cebe84fa8bac6c2a845c65eb10bbaa_elex_emotet_stop.exe
- Size 208KB
- Sample260905-r8sb7aee39
- SHA256 c59dfb6a6ff9638b69ef3e3997efc9ffbd27681fdf948f2b1cea1a5127b58d8b
- MD5 31cebe84fa8bac6c2a845c65eb10bbaa
- SHA1 c9ed843c7b75fd3a29dcedfafbc8b15ae3287a34
- SHA512 109c1f7a65b8c5cb11e19a44dc826fd9e66058d9a15de3f2c230a7c25714a6b23ac7130455ad3b68f50d3811ee14340a17f067b849dbdaf23af4bd264d9d1d9f
- SSDEEP 3072:cLQaL9tbLkRIgd1Lye9yjE2hWAN5XbslcdL+LOfH4pLthEjQT6j:olZtbLWIgd1LZ9oECZbslc5+LO/kEj1
- TLSH T1D8247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3308 AAXR.exe 2620 DBGII.exe 5580 LGTWS.exe 5200 IEHGABE.exe 4456 VCHRK.exe 5632 SIZHAQ.exe 3236 WLXC.exe 5340 GJDWHS.exe 1380 QGQIXA.exe 1940 DRZH.exe 5572 LXLO.exe 5792 KHO.exe 256 MFUYMYQ.exe 5600 NIXU.exe 520 JJH.exe 2072 OOAT.exe 4804 BMAFVZF.exe 1608 DKFRD.exe 5156 PAMZ.exe 5908 KNRJRR.exe 4184 OVF.exe 4620 BBFVNVW.exe 2884 AMILOB.exe 2236 KKW.exe 2664 MHB.exe 5928 ZSKQZD.exe 2392 TGRWEE.exe 4408 RVCRR.exe 2520 COFKZR.exe 2524 GEM.exe 4908 LHKFLC.exe 4144 FUP.exe 4340 AFXNKN.exe 5012 TAJRP.exe 828 STMZYJP.exe 2692 WBSHKB.exe 3528 NJUMOZF.exe 1196 AMDKC.exe 1252 SUFP.exe 3708 KQILLX.exe 2408 ZTAX.exe 5568 DBGYIK.exe 1064 EEKBV.exe 1796 NEMGZX.exe 3648 IZR.exe 5904 OAZDS.exe 564 UNQEXC.exe 4148 ANY.exe 5084 YNFGPZ.exe 4252 PWHTAWF.exe 4608 TEOT.exe 3312 TJOHO.exe 2688 KXY.exe 4768 FKDJ.exe 1432 ZFISQY.exe 4164 BVBUX.exe 4496 HVJIGPW.exe 1160 SOM.exe 2576 NJRKQ.exe 5608 TKYYHYB.exe 4452 ZXX.exe 3512 KXF.exe 2396 VQICW.exe 4988 QDNMGB.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\ANY.exe UNQEXC.exe File created C:\windows\SysWOW64\LXLO.exe.bat DRZH.exe File opened for modification C:\windows\SysWOW64\ZSKQZD.exe MHB.exe File opened for modification C:\windows\SysWOW64\NDQDXY.exe SQLU.exe File created C:\windows\SysWOW64\NEMGZX.exe.bat EEKBV.exe File created C:\windows\SysWOW64\ZSKQZD.exe.bat MHB.exe File created C:\windows\SysWOW64\NZXAWBA.exe UZQPNAK.exe File opened for modification C:\windows\SysWOW64\JFC.exe KUZX.exe File created C:\windows\SysWOW64\WLXC.exe SIZHAQ.exe File created C:\windows\SysWOW64\NEMGZX.exe EEKBV.exe File created C:\windows\SysWOW64\NIXU.exe MFUYMYQ.exe File created C:\windows\SysWOW64\QCESJ.exe.bat OOZ.exe File created C:\windows\SysWOW64\JFC.exe KUZX.exe File created C:\windows\SysWOW64\DKFRD.exe BMAFVZF.exe File created C:\windows\SysWOW64\ANY.exe UNQEXC.exe File created C:\windows\SysWOW64\NDQDXY.exe.bat SQLU.exe File created C:\windows\SysWOW64\KMM.exe.bat JJITNT.exe File created C:\windows\SysWOW64\MIJGUYF.exe RNEPK.exe File created C:\windows\SysWOW64\ZXX.exe TKYYHYB.exe File opened for modification C:\windows\SysWOW64\ZXX.exe TKYYHYB.exe File created C:\windows\SysWOW64\QDNMGB.exe.bat VQICW.exe File opened for modification C:\windows\SysWOW64\PFPJ.exe OCLFS.exe File created C:\windows\SysWOW64\ZSKQZD.exe MHB.exe File opened for modification C:\windows\SysWOW64\KMM.exe JJITNT.exe File created C:\windows\SysWOW64\QCESJ.exe OOZ.exe File created C:\windows\SysWOW64\TNGHL.exe.bat XKXRXOK.exe File opened for modification C:\windows\SysWOW64\DBGYIK.exe ZTAX.exe File created C:\windows\SysWOW64\NDQDXY.exe SQLU.exe File created C:\windows\SysWOW64\PFPJ.exe OCLFS.exe File created C:\windows\SysWOW64\JCZJGB.exe BWUDWV.exe File created C:\windows\SysWOW64\ANY.exe.bat UNQEXC.exe File created C:\windows\SysWOW64\VCHRK.exe.bat IEHGABE.exe File created C:\windows\SysWOW64\BMAFVZF.exe.bat OOAT.exe File created C:\windows\SysWOW64\PAMZ.exe DKFRD.exe File opened for modification C:\windows\SysWOW64\WBSHKB.exe STMZYJP.exe File created C:\windows\SysWOW64\DBGYIK.exe.bat ZTAX.exe File opened for modification C:\windows\SysWOW64\KIGRI.exe JFC.exe File opened for modification C:\windows\SysWOW64\OAZDS.exe IZR.exe File opened for modification C:\windows\SysWOW64\LXLO.exe DRZH.exe File opened for modification C:\windows\SysWOW64\KKW.exe AMILOB.exe File opened for modification C:\windows\SysWOW64\TKYYHYB.exe NJRKQ.exe File opened for modification C:\windows\SysWOW64\QDNMGB.exe VQICW.exe File created C:\windows\SysWOW64\TNGHL.exe XKXRXOK.exe File created C:\windows\SysWOW64\ZYHI.exe KIGRI.exe File created C:\windows\SysWOW64\WLXC.exe.bat SIZHAQ.exe File created C:\windows\SysWOW64\OVF.exe KNRJRR.exe File created C:\windows\SysWOW64\KKW.exe AMILOB.exe File created C:\windows\SysWOW64\TKYYHYB.exe NJRKQ.exe File created C:\windows\SysWOW64\YWEQK.exe.bat LUVZW.exe File created C:\windows\SysWOW64\JCZJGB.exe.bat BWUDWV.exe File opened for modification C:\windows\SysWOW64\TNGHL.exe XKXRXOK.exe File created C:\windows\SysWOW64\AVMZD.exe YXZFOX.exe File opened for modification C:\windows\SysWOW64\JCZJGB.exe BWUDWV.exe File opened for modification C:\windows\SysWOW64\NIXU.exe MFUYMYQ.exe File created C:\windows\SysWOW64\OVF.exe.bat KNRJRR.exe File created C:\windows\SysWOW64\PFPJ.exe.bat OCLFS.exe File created C:\windows\SysWOW64\ZDVVNL.exe PFPJ.exe File opened for modification C:\windows\SysWOW64\NZXAWBA.exe UZQPNAK.exe File opened for modification C:\windows\SysWOW64\XKJY.exe NMDMQKM.exe File opened for modification C:\windows\SysWOW64\XKXRXOK.exe JCZJGB.exe File created C:\windows\SysWOW64\ZXX.exe.bat TKYYHYB.exe File opened for modification C:\windows\SysWOW64\YWEQK.exe LUVZW.exe File opened for modification C:\windows\SysWOW64\MIJGUYF.exe RNEPK.exe File created C:\windows\SysWOW64\XKJY.exe NMDMQKM.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\TAJRP.exe AFXNKN.exe File created C:\windows\LUVZW.exe TRS.exe File created C:\windows\KKT.exe.bat EKMSCJ.exe File opened for modification C:\windows\YXZFOX.exe UPS.exe File created C:\windows\LGTWS.exe DBGII.exe File created C:\windows\KHO.exe.bat LXLO.exe File created C:\windows\system\GEM.exe COFKZR.exe File opened for modification C:\windows\system\UNQEXC.exe OAZDS.exe File created C:\windows\system\TEOT.exe.bat PWHTAWF.exe File created C:\windows\system\RDOFHDA.exe.bat AVMZD.exe File opened for modification C:\windows\OCLFS.exe QCESJ.exe File opened for modification C:\windows\system\HIHCXK.exe ZDVVNL.exe File created C:\windows\BVBUX.exe.bat ZFISQY.exe File created C:\windows\IEHGABE.exe.bat LGTWS.exe File created C:\windows\TGRWEE.exe.bat ZSKQZD.exe File opened for modification C:\windows\system\COFKZR.exe RVCRR.exe File opened for modification C:\windows\system\AMDKC.exe NJUMOZF.exe File created C:\windows\SUFP.exe.bat AMDKC.exe File opened for modification C:\windows\system\VQICW.exe KXF.exe File created C:\windows\system\EKMSCJ.exe EXLDT.exe File opened for modification C:\windows\GJDWHS.exe WLXC.exe File opened for modification C:\windows\AMILOB.exe BBFVNVW.exe File created C:\windows\system\FUP.exe LHKFLC.exe File created C:\windows\AFXNKN.exe FUP.exe File created C:\windows\STMZYJP.exe TAJRP.exe File created C:\windows\UPS.exe TMOBWP.exe File opened for modification C:\windows\system\UZQPNAK.exe QRJP.exe File created C:\windows\system\NMDMQKM.exe XBA.exe File created C:\windows\TGRWEE.exe ZSKQZD.exe File opened for modification C:\windows\system\RDOFHDA.exe AVMZD.exe File opened for modification C:\windows\system\EEKBV.exe DBGYIK.exe File created C:\windows\system\FKDJ.exe KXY.exe File created C:\windows\system\FKDJ.exe.bat KXY.exe File opened for modification C:\windows\system\NMDMQKM.exe XBA.exe File created C:\windows\IZR.exe NEMGZX.exe File opened for modification C:\windows\system\SOM.exe HVJIGPW.exe File created C:\windows\system\NJRKQ.exe SOM.exe File created C:\windows\system\VQICW.exe.bat KXF.exe File created C:\windows\system\TMOBWP.exe.bat KMM.exe File created C:\windows\system\XAZ.exe.bat NZXAWBA.exe File created C:\windows\KUZX.exe.bat XKJY.exe File opened for modification C:\windows\SIZHAQ.exe VCHRK.exe File created C:\windows\AMILOB.exe.bat BBFVNVW.exe File created C:\windows\system\COFKZR.exe.bat RVCRR.exe File opened for modification C:\windows\system\FKDJ.exe KXY.exe File opened for modification C:\windows\BVBUX.exe ZFISQY.exe File created C:\windows\system\SQLU.exe.bat KKT.exe File created C:\windows\system\JJITNT.exe NDQDXY.exe File created C:\windows\YXZFOX.exe.bat UPS.exe File created C:\windows\system\COFKZR.exe RVCRR.exe File created C:\windows\system\PWHTAWF.exe YNFGPZ.exe File opened for modification C:\windows\system\PWHTAWF.exe YNFGPZ.exe File created C:\windows\system\PWHTAWF.exe.bat YNFGPZ.exe File created C:\windows\LUVZW.exe.bat TRS.exe File created C:\windows\system\EKMSCJ.exe.bat EXLDT.exe File created C:\windows\GYYJ.exe.bat RDOFHDA.exe File created C:\windows\system\HIHCXK.exe.bat ZDVVNL.exe File created C:\windows\KHO.exe LXLO.exe File created C:\windows\system\JJH.exe NIXU.exe File opened for modification C:\windows\OOAT.exe JJH.exe File opened for modification C:\windows\AFXNKN.exe FUP.exe File opened for modification C:\windows\system\KQILLX.exe SUFP.exe File opened for modification C:\windows\ZTAX.exe KQILLX.exe File created C:\windows\system\QRJP.exe HIHCXK.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4752 cmd.exe 4516 cmd.exe 5512 cmd.exe 1104 cmd.exe 3792 cmd.exe 4372 cmd.exe 2880 cmd.exe 5068 cmd.exe 4072 cmd.exe 2732 cmd.exe 3332 cmd.exe 2120 cmd.exe 3204 cmd.exe 3572 cmd.exe 4896 cmd.exe 2164 cmd.exe 4876 cmd.exe 5596 cmd.exe 5552 cmd.exe 4468 cmd.exe 5888 cmd.exe 6136 cmd.exe 616 cmd.exe 976 cmd.exe 1236 cmd.exe 1248 cmd.exe 1048 cmd.exe 3568 cmd.exe 4108 cmd.exe 1128 cmd.exe 4308 cmd.exe 5416 cmd.exe 3652 cmd.exe 4368 cmd.exe 5420 cmd.exe 856 cmd.exe 4600 cmd.exe 3144 cmd.exe 4224 cmd.exe 2816 cmd.exe 1076 cmd.exe 2860 cmd.exe 756 cmd.exe 200 cmd.exe 2500 cmd.exe 3368 cmd.exe 5380 cmd.exe 716 cmd.exe 4836 cmd.exe 5728 cmd.exe 5284 cmd.exe 4584 cmd.exe 5680 cmd.exe 5436 cmd.exe 1832 cmd.exe 4052 cmd.exe 4960 cmd.exe 2900 cmd.exe 1096 cmd.exe 2844 cmd.exe 1856 cmd.exe 6032 cmd.exe 5948 cmd.exe 5064 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4736 4132 WerFault.exe 87 256 3308 WerFault.exe 93 2688 2620 WerFault.exe 99 3152 5580 WerFault.exe 104 976 5200 WerFault.exe 109 608 4456 WerFault.exe 114 4876 5632 WerFault.exe 119 2520 3236 WerFault.exe 124 5432 5340 WerFault.exe 129 5832 1380 WerFault.exe 134 2992 1940 WerFault.exe 139 4856 5572 WerFault.exe 144 3188 5792 WerFault.exe 149 616 256 WerFault.exe 154 6008 5600 WerFault.exe 159 4972 520 WerFault.exe 164 1128 2072 WerFault.exe 169 3232 4804 WerFault.exe 174 2496 1608 WerFault.exe 179 3332 5156 WerFault.exe 184 3924 5908 WerFault.exe 189 4728 4184 WerFault.exe 194 2336 4620 WerFault.exe 199 6024 2884 WerFault.exe 204 1936 2236 WerFault.exe 209 2960 2664 WerFault.exe 214 4316 5928 WerFault.exe 219 4296 2392 WerFault.exe 224 2640 4408 WerFault.exe 229 3144 2520 WerFault.exe 234 4584 2524 WerFault.exe 239 3296 4908 WerFault.exe 244 6140 4144 WerFault.exe 249 2940 4340 WerFault.exe 254 5864 5012 WerFault.exe 259 2876 828 WerFault.exe 265 2468 2692 WerFault.exe 270 1248 3528 WerFault.exe 275 1256 1196 WerFault.exe 280 4924 1252 WerFault.exe 285 2488 3708 WerFault.exe 290 2400 2408 WerFault.exe 295 4540 5568 WerFault.exe 300 4824 1064 WerFault.exe 305 2560 1796 WerFault.exe 310 4384 3648 WerFault.exe 315 2828 5904 WerFault.exe 320 5540 564 WerFault.exe 325 3212 4148 WerFault.exe 330 5460 5084 WerFault.exe 335 5608 4252 WerFault.exe 340 296 4608 WerFault.exe 345 5040 3312 WerFault.exe 350 2188 2688 WerFault.exe 355 3624 4768 WerFault.exe 360 4316 1432 WerFault.exe 365 1312 4164 WerFault.exe 370 6096 4496 WerFault.exe 375 3652 1160 WerFault.exe 380 1900 2576 WerFault.exe 385 4520 5608 WerFault.exe 390 3684 4452 WerFault.exe 395 4824 3512 WerFault.exe 400 5436 2396 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMILOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKXRXOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZFISQY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RNEPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGTWS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQICW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIHCXK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DRZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVJIGPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFXNKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJRKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQLU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SIZHAQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLXC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVCRR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KQILLX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LTMODM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHKFLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBGYIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXZFOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language COFKZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJITNT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUFP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEKBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MIJGUYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVBUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4132 2026-09-04_31cebe84fa8bac6c2a845c65eb10bbaa_elex_emotet_stop.exe 4132 2026-09-04_31cebe84fa8bac6c2a845c65eb10bbaa_elex_emotet_stop.exe 3308 AAXR.exe 3308 AAXR.exe 2620 DBGII.exe 2620 DBGII.exe 5580 LGTWS.exe 5580 LGTWS.exe 5200 IEHGABE.exe 5200 IEHGABE.exe 4456 VCHRK.exe 4456 VCHRK.exe 5632 SIZHAQ.exe 5632 SIZHAQ.exe 3236 WLXC.exe 3236 WLXC.exe 5340 GJDWHS.exe 5340 GJDWHS.exe 1380 QGQIXA.exe 1380 QGQIXA.exe 1940 DRZH.exe 1940 DRZH.exe 5572 LXLO.exe 5572 LXLO.exe 5792 KHO.exe 5792 KHO.exe 256 MFUYMYQ.exe 256 MFUYMYQ.exe 5600 NIXU.exe 5600 NIXU.exe 520 JJH.exe 520 JJH.exe 2072 OOAT.exe 2072 OOAT.exe 4804 BMAFVZF.exe 4804 BMAFVZF.exe 1608 DKFRD.exe 1608 DKFRD.exe 5156 PAMZ.exe 5156 PAMZ.exe 5908 KNRJRR.exe 5908 KNRJRR.exe 4184 OVF.exe 4184 OVF.exe 4620 BBFVNVW.exe 4620 BBFVNVW.exe 2884 AMILOB.exe 2884 AMILOB.exe 2236 KKW.exe 2236 KKW.exe 2664 MHB.exe 2664 MHB.exe 5928 ZSKQZD.exe 5928 ZSKQZD.exe 2392 TGRWEE.exe 2392 TGRWEE.exe 4408 RVCRR.exe 4408 RVCRR.exe 2520 COFKZR.exe 2520 COFKZR.exe 2524 GEM.exe 2524 GEM.exe 4908 LHKFLC.exe 4908 LHKFLC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4132 2026-09-04_31cebe84fa8bac6c2a845c65eb10bbaa_elex_emotet_stop.exe 4132 2026-09-04_31cebe84fa8bac6c2a845c65eb10bbaa_elex_emotet_stop.exe 3308 AAXR.exe 3308 AAXR.exe 2620 DBGII.exe 2620 DBGII.exe 5580 LGTWS.exe 5580 LGTWS.exe 5200 IEHGABE.exe 5200 IEHGABE.exe 4456 VCHRK.exe 4456 VCHRK.exe 5632 SIZHAQ.exe 5632 SIZHAQ.exe 3236 WLXC.exe 3236 WLXC.exe 5340 GJDWHS.exe 5340 GJDWHS.exe 1380 QGQIXA.exe 1380 QGQIXA.exe 1940 DRZH.exe 1940 DRZH.exe 5572 LXLO.exe 5572 LXLO.exe 5792 KHO.exe 5792 KHO.exe 256 MFUYMYQ.exe 256 MFUYMYQ.exe 5600 NIXU.exe 5600 NIXU.exe 520 JJH.exe 520 JJH.exe 2072 OOAT.exe 2072 OOAT.exe 4804 BMAFVZF.exe 4804 BMAFVZF.exe 1608 DKFRD.exe 1608 DKFRD.exe 5156 PAMZ.exe 5156 PAMZ.exe 5908 KNRJRR.exe 5908 KNRJRR.exe 4184 OVF.exe 4184 OVF.exe 4620 BBFVNVW.exe 4620 BBFVNVW.exe 2884 AMILOB.exe 2884 AMILOB.exe 2236 KKW.exe 2236 KKW.exe 2664 MHB.exe 2664 MHB.exe 5928 ZSKQZD.exe 5928 ZSKQZD.exe 2392 TGRWEE.exe 2392 TGRWEE.exe 4408 RVCRR.exe 4408 RVCRR.exe 2520 COFKZR.exe 2520 COFKZR.exe 2524 GEM.exe 2524 GEM.exe 4908 LHKFLC.exe 4908 LHKFLC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4132 wrote to memory of 5888 4132 2026-09-04_31cebe84fa8bac6c2a845c65eb10bbaa_elex_emotet_stop.exe 89 PID 5888 wrote to memory of 3308 5888 cmd.exe 93 PID 3308 wrote to memory of 4888 3308 AAXR.exe 95 PID 4888 wrote to memory of 2620 4888 cmd.exe 99 PID 2620 wrote to memory of 1096 2620 DBGII.exe 100 PID 1096 wrote to memory of 5580 1096 cmd.exe 104 PID 5580 wrote to memory of 2280 5580 LGTWS.exe 105 PID 2280 wrote to memory of 5200 2280 cmd.exe 109 PID 5200 wrote to memory of 1496 5200 IEHGABE.exe 110 PID 1496 wrote to memory of 4456 1496 cmd.exe 114 PID 4456 wrote to memory of 4652 4456 VCHRK.exe 115 PID 4652 wrote to memory of 5632 4652 cmd.exe 119 PID 5632 wrote to memory of 1632 5632 SIZHAQ.exe 120 PID 1632 wrote to memory of 3236 1632 cmd.exe 124 PID 3236 wrote to memory of 6136 3236 WLXC.exe 125 PID 6136 wrote to memory of 5340 6136 cmd.exe 129 PID 5340 wrote to memory of 1964 5340 GJDWHS.exe 130 PID 1964 wrote to memory of 1380 1964 cmd.exe 134 PID 1380 wrote to memory of 5728 1380 QGQIXA.exe 135 PID 5728 wrote to memory of 1940 5728 cmd.exe 139 PID 1940 wrote to memory of 860 1940 DRZH.exe 140 PID 860 wrote to memory of 5572 860 cmd.exe 144 PID 5572 wrote to memory of 4108 5572 LXLO.exe 145 PID 4108 wrote to memory of 5792 4108 cmd.exe 149 PID 5792 wrote to memory of 2428 5792 KHO.exe 150 PID 2428 wrote to memory of 256 2428 cmd.exe 154 PID 256 wrote to memory of 4960 256 MFUYMYQ.exe 155 PID 4960 wrote to memory of 5600 4960 cmd.exe 159 PID 5600 wrote to memory of 3008 5600 NIXU.exe 160 PID 3008 wrote to memory of 520 3008 cmd.exe 164 PID 520 wrote to memory of 1840 520 JJH.exe 165 PID 1840 wrote to memory of 2072 1840 cmd.exe 169 PID 2072 wrote to memory of 5284 2072 OOAT.exe 170 PID 5284 wrote to memory of 4804 5284 cmd.exe 174 PID 4804 wrote to memory of 1344 4804 BMAFVZF.exe 175 PID 1344 wrote to memory of 1608 1344 cmd.exe 179 PID 1608 wrote to memory of 4120 1608 DKFRD.exe 180 PID 4120 wrote to memory of 5156 4120 cmd.exe 184 PID 5156 wrote to memory of 4336 5156 PAMZ.exe 185 PID 4336 wrote to memory of 5908 4336 cmd.exe 189 PID 5908 wrote to memory of 4476 5908 KNRJRR.exe 190 PID 4476 wrote to memory of 4184 4476 cmd.exe 194 PID 4184 wrote to memory of 4792 4184 OVF.exe 195 PID 4792 wrote to memory of 4620 4792 cmd.exe 199 PID 4620 wrote to memory of 2164 4620 BBFVNVW.exe 200 PID 2164 wrote to memory of 2884 2164 cmd.exe 204 PID 2884 wrote to memory of 2728 2884 AMILOB.exe 205 PID 2728 wrote to memory of 2236 2728 cmd.exe 209 PID 2236 wrote to memory of 4220 2236 KKW.exe 210 PID 4220 wrote to memory of 2664 4220 cmd.exe 214 PID 2664 wrote to memory of 5280 2664 MHB.exe 215 PID 5280 wrote to memory of 5928 5280 cmd.exe 219 PID 5928 wrote to memory of 4760 5928 ZSKQZD.exe 220 PID 4760 wrote to memory of 2392 4760 cmd.exe 224 PID 2392 wrote to memory of 1128 2392 TGRWEE.exe 225 PID 1128 wrote to memory of 4408 1128 cmd.exe 229 PID 4408 wrote to memory of 1116 4408 RVCRR.exe 230 PID 1116 wrote to memory of 2520 1116 cmd.exe 234 PID 2520 wrote to memory of 5796 2520 COFKZR.exe 235 PID 5796 wrote to memory of 2524 5796 cmd.exe 239 PID 2524 wrote to memory of 5068 2524 GEM.exe 240 PID 5068 wrote to memory of 4908 5068 cmd.exe 244 PID 4908 wrote to memory of 4216 4908 LHKFLC.exe 245 PID 4144 wrote to memory of 4072 4144 FUP.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_31cebe84fa8bac6c2a845c65eb10bbaa_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_31cebe84fa8bac6c2a845c65eb10bbaa_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAXR.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\windows\SysWOW64\AAXR.exeC:\windows\system32\AAXR.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DBGII.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\windows\system\DBGII.exeC:\windows\system\DBGII.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGTWS.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\windows\LGTWS.exeC:\windows\LGTWS.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IEHGABE.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\windows\IEHGABE.exeC:\windows\IEHGABE.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VCHRK.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\windows\SysWOW64\VCHRK.exeC:\windows\system32\VCHRK.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIZHAQ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\windows\SIZHAQ.exeC:\windows\SIZHAQ.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLXC.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\windows\SysWOW64\WLXC.exeC:\windows\system32\WLXC.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJDWHS.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\windows\GJDWHS.exeC:\windows\GJDWHS.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QGQIXA.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\windows\SysWOW64\QGQIXA.exeC:\windows\system32\QGQIXA.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DRZH.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\windows\DRZH.exeC:\windows\DRZH.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LXLO.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:860 -
C:\windows\SysWOW64\LXLO.exeC:\windows\system32\LXLO.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KHO.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\windows\KHO.exeC:\windows\KHO.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MFUYMYQ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\windows\MFUYMYQ.exeC:\windows\MFUYMYQ.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NIXU.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\windows\SysWOW64\NIXU.exeC:\windows\system32\NIXU.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJH.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\windows\system\JJH.exeC:\windows\system\JJH.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OOAT.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\windows\OOAT.exeC:\windows\OOAT.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMAFVZF.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\windows\SysWOW64\BMAFVZF.exeC:\windows\system32\BMAFVZF.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DKFRD.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\windows\SysWOW64\DKFRD.exeC:\windows\system32\DKFRD.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PAMZ.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\windows\SysWOW64\PAMZ.exeC:\windows\system32\PAMZ.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNRJRR.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\windows\SysWOW64\KNRJRR.exeC:\windows\system32\KNRJRR.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVF.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\windows\SysWOW64\OVF.exeC:\windows\system32\OVF.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBFVNVW.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\windows\system\BBFVNVW.exeC:\windows\system\BBFVNVW.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AMILOB.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\windows\AMILOB.exeC:\windows\AMILOB.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKW.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\windows\SysWOW64\KKW.exeC:\windows\system32\KKW.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MHB.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\windows\system\MHB.exeC:\windows\system\MHB.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZSKQZD.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\windows\SysWOW64\ZSKQZD.exeC:\windows\system32\ZSKQZD.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TGRWEE.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\windows\TGRWEE.exeC:\windows\TGRWEE.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RVCRR.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\windows\system\RVCRR.exeC:\windows\system\RVCRR.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\COFKZR.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\windows\system\COFKZR.exeC:\windows\system\COFKZR.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GEM.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\windows\system\GEM.exeC:\windows\system\GEM.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LHKFLC.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\windows\LHKFLC.exeC:\windows\LHKFLC.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FUP.exe.bat" "64⤵PID:4216
-
C:\windows\system\FUP.exeC:\windows\system\FUP.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFXNKN.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4072 -
C:\windows\AFXNKN.exeC:\windows\AFXNKN.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TAJRP.exe.bat" "68⤵PID:4624
-
C:\windows\TAJRP.exeC:\windows\TAJRP.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\STMZYJP.exe.bat" "70⤵PID:4436
-
C:\windows\STMZYJP.exeC:\windows\STMZYJP.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WBSHKB.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4752 -
C:\windows\SysWOW64\WBSHKB.exeC:\windows\system32\WBSHKB.exe73⤵
- Executes dropped EXE
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NJUMOZF.exe.bat" "74⤵PID:5496
-
C:\windows\system\NJUMOZF.exeC:\windows\system\NJUMOZF.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMDKC.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:1208 -
C:\windows\system\AMDKC.exeC:\windows\system\AMDKC.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SUFP.exe.bat" "78⤵PID:4640
-
C:\windows\SUFP.exeC:\windows\SUFP.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KQILLX.exe.bat" "80⤵PID:2496
-
C:\windows\system\KQILLX.exeC:\windows\system\KQILLX.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTAX.exe.bat" "82⤵
- Executes a command shell one-liner
PID:2732 -
C:\windows\ZTAX.exeC:\windows\ZTAX.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBGYIK.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4512 -
C:\windows\SysWOW64\DBGYIK.exeC:\windows\system32\DBGYIK.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EEKBV.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:4976 -
C:\windows\system\EEKBV.exeC:\windows\system\EEKBV.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NEMGZX.exe.bat" "88⤵
- Executes a command shell one-liner
PID:616 -
C:\windows\SysWOW64\NEMGZX.exeC:\windows\system32\NEMGZX.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZR.exe.bat" "90⤵PID:5984
-
C:\windows\IZR.exeC:\windows\IZR.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OAZDS.exe.bat" "92⤵
- Executes a command shell one-liner
PID:976 -
C:\windows\SysWOW64\OAZDS.exeC:\windows\system32\OAZDS.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNQEXC.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:6092 -
C:\windows\system\UNQEXC.exeC:\windows\system\UNQEXC.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANY.exe.bat" "96⤵PID:1308
-
C:\windows\SysWOW64\ANY.exeC:\windows\system32\ANY.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNFGPZ.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:460 -
C:\windows\SysWOW64\YNFGPZ.exeC:\windows\system32\YNFGPZ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWHTAWF.exe.bat" "100⤵PID:3336
-
C:\windows\system\PWHTAWF.exeC:\windows\system\PWHTAWF.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEOT.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4584 -
C:\windows\system\TEOT.exeC:\windows\system\TEOT.exe103⤵
- Executes dropped EXE
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJOHO.exe.bat" "104⤵PID:4380
-
C:\windows\system\TJOHO.exeC:\windows\system\TJOHO.exe105⤵
- Executes dropped EXE
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KXY.exe.bat" "106⤵PID:3452
-
C:\windows\KXY.exeC:\windows\KXY.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FKDJ.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:2668 -
C:\windows\system\FKDJ.exeC:\windows\system\FKDJ.exe109⤵
- Executes dropped EXE
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZFISQY.exe.bat" "110⤵PID:4240
-
C:\windows\ZFISQY.exeC:\windows\ZFISQY.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BVBUX.exe.bat" "112⤵PID:3028
-
C:\windows\BVBUX.exeC:\windows\BVBUX.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVJIGPW.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4600 -
C:\windows\SysWOW64\HVJIGPW.exeC:\windows\system32\HVJIGPW.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SOM.exe.bat" "116⤵PID:3060
-
C:\windows\system\SOM.exeC:\windows\system\SOM.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NJRKQ.exe.bat" "118⤵
- Executes a command shell one-liner
PID:3144 -
C:\windows\system\NJRKQ.exeC:\windows\system\NJRKQ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKYYHYB.exe.bat" "120⤵
- Executes a command shell one-liner
PID:3332 -
C:\windows\SysWOW64\TKYYHYB.exeC:\windows\system32\TKYYHYB.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-