Analysis
- max time kernel
90s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 08:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-16_eb79c5c94a50b268b6e765c0aaf3ee54_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-16_eb79c5c94a50b268b6e765c0aaf3ee54_elex_emotet_stop.exe
- Size 208KB
- Sample260916-j39ehsvxgt
- SHA256 b58f54f21d287c6248392487b70f039632751527c3952e28450bddda5bf43702
- MD5 eb79c5c94a50b268b6e765c0aaf3ee54
- SHA1 32f56706e55e602dd8d626815dc3ba9fdecbd52d
- SHA512 f5f010ed08478e3ac8f3ead2acafc87008b7bbc34decb4ebc002f1232bb06dd89b1e06ed09471a2f9020f376b196ac4f21485ca4cd964ccae1e6d8e2ca363955
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUtL+LOfl4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUp+LO9kEj1
- TLSH T173247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3416 GZJCPM.exe 3628 JHXRXS.exe 3032 NITM.exe 4796 GLXPXF.exe 1316 XLZV.exe 5396 URWS.exe 5208 HBNI.exe 3156 LJTQII.exe 3384 MMX.exe 2380 KIWVTB.exe 5136 EVB.exe 5352 UQLJOV.exe 4512 UTO.exe 6120 NWSIZB.exe 4092 TWAWQDM.exe 2024 NKFF.exe 3796 ONJJFTC.exe 3368 JANS.exe 5492 DNSCST.exe 2588 EQW.exe 1284 NRYKJG.exe 1768 TRGYSI.exe 408 ZRNM.exe 4972 MXNYLOD.exe 4580 HKSH.exe 4628 NLAVEQ.exe 1148 JQFKLA.exe 6052 RGGJ.exe 5376 GBQODIT.exe 4752 IZR.exe 3716 CNWZT.exe 4436 KXXBZ.exe 2716 WQATHQ.exe 5296 ZGG.exe 4260 JGIYX.exe 1268 UZLRFN.exe 1472 VCPVL.exe 5800 BCXJU.exe 4292 XHUYJPE.exe 4532 FYDXI.exe 4860 ZLAHSDP.exe 5560 FLIU.exe 3176 LLPIS.exe 5916 ABQ.exe 1568 XHWWG.exe 3444 RUBOIE.exe 5780 MIG.exe 5896 VQICW.exe 728 KLRHPWX.exe 6092 RGR.exe 5192 GBAUEM.exe 4732 YWEQK.exe 3132 XPPGTQL.exe 4828 MKYSE.exe 5084 EKA.exe 4620 BLI.exe 2404 JYAZAP.exe 3128 VRDSI.exe 3256 KMM.exe 1704 TMOBWP.exe 2400 IPYGPCS.exe 1136 PDXPM.exe 5556 YQH.exe 5536 GVIV.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\MKYSE.exe XPPGTQL.exe File created C:\windows\SysWOW64\EVB.exe.bat KIWVTB.exe File created C:\windows\SysWOW64\HKSH.exe.bat MXNYLOD.exe File created C:\windows\SysWOW64\UOU.exe WOM.exe File created C:\windows\SysWOW64\YOWMQN.exe.bat NVTTI.exe File opened for modification C:\windows\SysWOW64\SPH.exe TEER.exe File created C:\windows\SysWOW64\EKAWE.exe PUZXXMR.exe File created C:\windows\SysWOW64\OOTX.exe PDQHV.exe File opened for modification C:\windows\SysWOW64\URWS.exe XLZV.exe File created C:\windows\SysWOW64\MMX.exe.bat LJTQII.exe File created C:\windows\SysWOW64\ONJJFTC.exe.bat NKFF.exe File created C:\windows\SysWOW64\HKSH.exe MXNYLOD.exe File created C:\windows\SysWOW64\YWEQK.exe GBAUEM.exe File opened for modification C:\windows\SysWOW64\KRTIZ.exe AUF.exe File opened for modification C:\windows\SysWOW64\EKAWE.exe PUZXXMR.exe File created C:\windows\SysWOW64\PDQHV.exe EKAWE.exe File created C:\windows\SysWOW64\FLIU.exe.bat ZLAHSDP.exe File created C:\windows\SysWOW64\EKA.exe.bat MKYSE.exe File opened for modification C:\windows\SysWOW64\UARPJ.exe QXTUJYY.exe File created C:\windows\SysWOW64\VRUIR.exe.bat IGMKKSX.exe File created C:\windows\SysWOW64\JBXGGO.exe OOTX.exe File opened for modification C:\windows\SysWOW64\VRUIR.exe IGMKKSX.exe File opened for modification C:\windows\SysWOW64\ONJJFTC.exe NKFF.exe File opened for modification C:\windows\SysWOW64\MXNYLOD.exe ZRNM.exe File opened for modification C:\windows\SysWOW64\FLIU.exe ZLAHSDP.exe File opened for modification C:\windows\SysWOW64\VRDSI.exe JYAZAP.exe File opened for modification C:\windows\SysWOW64\PSXESJP.exe ZXOZ.exe File created C:\windows\SysWOW64\KRTIZ.exe.bat AUF.exe File opened for modification C:\windows\SysWOW64\YOWMQN.exe NVTTI.exe File created C:\windows\SysWOW64\JBXGGO.exe.bat OOTX.exe File opened for modification C:\windows\SysWOW64\KXXBZ.exe CNWZT.exe File opened for modification C:\windows\SysWOW64\UOU.exe WOM.exe File created C:\windows\SysWOW64\ZXOZ.exe.bat MROOX.exe File created C:\windows\SysWOW64\NWSIZB.exe.bat UTO.exe File created C:\windows\SysWOW64\GBAUEM.exe RGR.exe File created C:\windows\SysWOW64\GBAUEM.exe.bat RGR.exe File created C:\windows\SysWOW64\KRTIZ.exe AUF.exe File created C:\windows\SysWOW64\VRDSI.exe.bat JYAZAP.exe File opened for modification C:\windows\SysWOW64\UQLJOV.exe EVB.exe File created C:\windows\SysWOW64\PROX.exe VEROYOC.exe File created C:\windows\SysWOW64\ZXOZ.exe MROOX.exe File opened for modification C:\windows\SysWOW64\PDQHV.exe EKAWE.exe File created C:\windows\SysWOW64\KMM.exe VRDSI.exe File created C:\windows\SysWOW64\KXXBZ.exe CNWZT.exe File created C:\windows\SysWOW64\URWS.exe XLZV.exe File created C:\windows\SysWOW64\EVB.exe KIWVTB.exe File opened for modification C:\windows\SysWOW64\MIG.exe RUBOIE.exe File created C:\windows\SysWOW64\MIG.exe.bat RUBOIE.exe File opened for modification C:\windows\SysWOW64\GBAUEM.exe RGR.exe File created C:\windows\SysWOW64\OOTX.exe.bat PDQHV.exe File created C:\windows\SysWOW64\UQLJOV.exe.bat EVB.exe File created C:\windows\SysWOW64\UTO.exe UQLJOV.exe File opened for modification C:\windows\SysWOW64\UTO.exe UQLJOV.exe File opened for modification C:\windows\SysWOW64\NWSIZB.exe UTO.exe File created C:\windows\SysWOW64\MXNYLOD.exe ZRNM.exe File created C:\windows\SysWOW64\RUBOIE.exe.bat XHWWG.exe File created C:\windows\SysWOW64\YWEQK.exe.bat GBAUEM.exe File created C:\windows\SysWOW64\EKA.exe MKYSE.exe File opened for modification C:\windows\SysWOW64\HKSH.exe MXNYLOD.exe File created C:\windows\SysWOW64\RUBOIE.exe XHWWG.exe File created C:\windows\SysWOW64\KMM.exe.bat VRDSI.exe File opened for modification C:\windows\SysWOW64\PROX.exe VEROYOC.exe File created C:\windows\SysWOW64\HSJNM.exe FVDTFSJ.exe File opened for modification C:\windows\SysWOW64\HSJNM.exe FVDTFSJ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\CNWZT.exe IZR.exe File created C:\windows\system\XHUYJPE.exe.bat BCXJU.exe File created C:\windows\IVVJ.exe.bat HSJNM.exe File created C:\windows\system\UDLJ.exe SFYOJ.exe File opened for modification C:\windows\system\RGR.exe KLRHPWX.exe File opened for modification C:\windows\NKFF.exe TWAWQDM.exe File created C:\windows\EQW.exe.bat DNSCST.exe File opened for modification C:\windows\system\ZRNM.exe TRGYSI.exe File opened for modification C:\windows\FYDXI.exe XHUYJPE.exe File created C:\windows\system\MGTDP.exe TDIIKS.exe File created C:\windows\GLXPXF.exe NITM.exe File created C:\windows\XLZV.exe.bat GLXPXF.exe File created C:\windows\system\NLAVEQ.exe.bat HKSH.exe File opened for modification C:\windows\ZLAHSDP.exe FYDXI.exe File opened for modification C:\windows\system\IPYGPCS.exe TMOBWP.exe File created C:\windows\PUZXXMR.exe SPH.exe File opened for modification C:\windows\system\NITM.exe JHXRXS.exe File created C:\windows\LJTQII.exe HBNI.exe File created C:\windows\WOM.exe UBHJPN.exe File created C:\windows\system\MGTDP.exe.bat TDIIKS.exe File created C:\windows\NKFF.exe TWAWQDM.exe File created C:\windows\DNSCST.exe.bat JANS.exe File created C:\windows\system\JGIYX.exe.bat ZGG.exe File created C:\windows\JYAZAP.exe BLI.exe File created C:\windows\VEROYOC.exe.bat NQRZWBH.exe File created C:\windows\YCS.exe YOALBAK.exe File created C:\windows\YCS.exe.bat YOALBAK.exe File created C:\windows\GLXPXF.exe.bat NITM.exe File opened for modification C:\windows\XLZV.exe GLXPXF.exe File opened for modification C:\windows\XHWWG.exe ABQ.exe File opened for modification C:\windows\CJASCQ.exe IVVJ.exe File created C:\windows\system\JHXRXS.exe.bat GZJCPM.exe File created C:\windows\system\TWAWQDM.exe NWSIZB.exe File created C:\windows\ZZESA.exe.bat EMZ.exe File created C:\windows\FVDTFSJ.exe.bat ZZESA.exe File created C:\windows\system\TWAWQDM.exe.bat NWSIZB.exe File created C:\windows\CNWZT.exe.bat IZR.exe File created C:\windows\JIEYH.exe.bat ZAKL.exe File created C:\windows\system\ZRNM.exe TRGYSI.exe File created C:\windows\system\BCXJU.exe VCPVL.exe File created C:\windows\GVIV.exe.bat YQH.exe File opened for modification C:\windows\WOM.exe UBHJPN.exe File created C:\windows\ZZESA.exe EMZ.exe File created C:\windows\system\IGMKKSX.exe.bat HLA.exe File created C:\windows\TZDB.exe.bat JBXGGO.exe File opened for modification C:\windows\system\NLAVEQ.exe HKSH.exe File created C:\windows\JYAZAP.exe.bat BLI.exe File opened for modification C:\windows\ZZESA.exe EMZ.exe File created C:\windows\system\ILB.exe.bat YOWMQN.exe File created C:\windows\system\RGGJ.exe.bat JQFKLA.exe File created C:\windows\system\VQICW.exe.bat MIG.exe File created C:\windows\system\XPPGTQL.exe YWEQK.exe File opened for modification C:\windows\HLA.exe UARPJ.exe File opened for modification C:\windows\system\VQICW.exe MIG.exe File opened for modification C:\windows\system\PDXPM.exe IPYGPCS.exe File opened for modification C:\windows\system\YOALBAK.exe MGTDP.exe File opened for modification C:\windows\QXTUJYY.exe GAN.exe File created C:\windows\system\XWWBMQW.exe.bat CJASCQ.exe File opened for modification C:\windows\system\ILB.exe YOWMQN.exe File created C:\windows\system\LLPIS.exe FLIU.exe File opened for modification C:\windows\system\YQH.exe PDXPM.exe File created C:\windows\system\UBHJPN.exe.bat JIEYH.exe File created C:\windows\system\VQICW.exe MIG.exe File created C:\windows\system\JQFKLA.exe NLAVEQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1968 cmd.exe 3512 cmd.exe 1876 cmd.exe 4624 cmd.exe 6000 cmd.exe 4244 cmd.exe 4612 cmd.exe 4300 cmd.exe 5112 cmd.exe 5908 cmd.exe 5652 cmd.exe 3888 cmd.exe 5980 cmd.exe 1984 cmd.exe 1172 cmd.exe 2804 cmd.exe 5316 cmd.exe 2864 cmd.exe 2044 cmd.exe 4208 cmd.exe 3180 cmd.exe 5244 cmd.exe 4892 cmd.exe 5708 cmd.exe 2456 cmd.exe 252 cmd.exe 764 cmd.exe 5856 cmd.exe 1496 cmd.exe 4452 cmd.exe 2140 cmd.exe 716 cmd.exe 4772 cmd.exe 2644 cmd.exe 3844 cmd.exe 1772 cmd.exe 2476 cmd.exe 3836 cmd.exe 2396 cmd.exe 5104 cmd.exe 200 cmd.exe 4820 cmd.exe 5224 cmd.exe 5628 cmd.exe 4276 cmd.exe 2572 cmd.exe 6080 cmd.exe 5592 cmd.exe 4500 cmd.exe 5312 cmd.exe 2952 cmd.exe 2732 cmd.exe 2212 cmd.exe 5356 cmd.exe 3508 cmd.exe 5816 cmd.exe 1936 cmd.exe 5308 cmd.exe 3340 cmd.exe 1300 cmd.exe 4852 cmd.exe 2808 cmd.exe 1292 cmd.exe 4792 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4108 3484 WerFault.exe 87 5588 3416 WerFault.exe 92 5976 3628 WerFault.exe 98 1148 3032 WerFault.exe 103 1988 4796 WerFault.exe 108 2316 1316 WerFault.exe 113 3972 5396 WerFault.exe 118 2384 5208 WerFault.exe 123 4772 3156 WerFault.exe 128 2796 3384 WerFault.exe 133 1236 2380 WerFault.exe 138 1216 5136 WerFault.exe 143 6140 5352 WerFault.exe 148 3024 4512 WerFault.exe 153 4708 6120 WerFault.exe 158 2800 4092 WerFault.exe 163 6052 2024 WerFault.exe 168 5244 3796 WerFault.exe 173 2744 3368 WerFault.exe 178 4508 5492 WerFault.exe 183 1248 2588 WerFault.exe 188 5740 1284 WerFault.exe 193 5916 1768 WerFault.exe 198 4608 408 WerFault.exe 203 952 4972 WerFault.exe 208 5780 4580 WerFault.exe 213 4340 4628 WerFault.exe 218 4832 1148 WerFault.exe 223 2236 6052 WerFault.exe 228 1724 5376 WerFault.exe 233 2760 4752 WerFault.exe 238 3728 3716 WerFault.exe 243 2788 4436 WerFault.exe 248 5036 2716 WerFault.exe 253 5856 5296 WerFault.exe 258 1420 4260 WerFault.exe 263 4240 1268 WerFault.exe 268 4388 1472 WerFault.exe 273 4648 5800 WerFault.exe 278 2648 4292 WerFault.exe 283 1008 4532 WerFault.exe 288 4192 4860 WerFault.exe 293 5544 5560 WerFault.exe 298 3124 3176 WerFault.exe 303 5316 5916 WerFault.exe 308 2780 1568 WerFault.exe 313 2368 3444 WerFault.exe 318 3856 5780 WerFault.exe 323 4832 5896 WerFault.exe 328 2236 728 WerFault.exe 333 4840 6092 WerFault.exe 338 1484 5192 WerFault.exe 343 3744 4732 WerFault.exe 348 2628 3132 WerFault.exe 353 1856 4828 WerFault.exe 358 2984 5084 WerFault.exe 363 3664 4620 WerFault.exe 368 4240 2404 WerFault.exe 373 3556 3128 WerFault.exe 378 4956 3256 WerFault.exe 383 3508 1704 WerFault.exe 388 4192 2400 WerFault.exe 393 3928 1136 WerFault.exe 398 2528 5556 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIEYH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSXESJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRDSI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PROX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NRYKJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLAHSDP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZZESA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OOTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLRHPWX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JANS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNWZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBAUEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FVDTFSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUBOIE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QXTUJYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBNI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCPVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNSCST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZJCPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EQW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWSIZB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPPGTQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKAWE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-16_eb79c5c94a50b268b6e765c0aaf3ee54_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQDY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEER.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3484 2026-09-16_eb79c5c94a50b268b6e765c0aaf3ee54_elex_emotet_stop.exe 3484 2026-09-16_eb79c5c94a50b268b6e765c0aaf3ee54_elex_emotet_stop.exe 3416 GZJCPM.exe 3416 GZJCPM.exe 3628 JHXRXS.exe 3628 JHXRXS.exe 3032 NITM.exe 3032 NITM.exe 4796 GLXPXF.exe 4796 GLXPXF.exe 1316 XLZV.exe 1316 XLZV.exe 5396 URWS.exe 5396 URWS.exe 5208 HBNI.exe 5208 HBNI.exe 3156 LJTQII.exe 3156 LJTQII.exe 3384 MMX.exe 3384 MMX.exe 2380 KIWVTB.exe 2380 KIWVTB.exe 5136 EVB.exe 5136 EVB.exe 5352 UQLJOV.exe 5352 UQLJOV.exe 4512 UTO.exe 4512 UTO.exe 6120 NWSIZB.exe 6120 NWSIZB.exe 4092 TWAWQDM.exe 4092 TWAWQDM.exe 2024 NKFF.exe 2024 NKFF.exe 3796 ONJJFTC.exe 3796 ONJJFTC.exe 3368 JANS.exe 3368 JANS.exe 5492 DNSCST.exe 5492 DNSCST.exe 2588 EQW.exe 2588 EQW.exe 1284 NRYKJG.exe 1284 NRYKJG.exe 1768 TRGYSI.exe 1768 TRGYSI.exe 408 ZRNM.exe 408 ZRNM.exe 4972 MXNYLOD.exe 4972 MXNYLOD.exe 4580 HKSH.exe 4580 HKSH.exe 4628 NLAVEQ.exe 4628 NLAVEQ.exe 1148 JQFKLA.exe 1148 JQFKLA.exe 6052 RGGJ.exe 6052 RGGJ.exe 5376 GBQODIT.exe 5376 GBQODIT.exe 4752 IZR.exe 4752 IZR.exe 3716 CNWZT.exe 3716 CNWZT.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3484 2026-09-16_eb79c5c94a50b268b6e765c0aaf3ee54_elex_emotet_stop.exe 3484 2026-09-16_eb79c5c94a50b268b6e765c0aaf3ee54_elex_emotet_stop.exe 3416 GZJCPM.exe 3416 GZJCPM.exe 3628 JHXRXS.exe 3628 JHXRXS.exe 3032 NITM.exe 3032 NITM.exe 4796 GLXPXF.exe 4796 GLXPXF.exe 1316 XLZV.exe 1316 XLZV.exe 5396 URWS.exe 5396 URWS.exe 5208 HBNI.exe 5208 HBNI.exe 3156 LJTQII.exe 3156 LJTQII.exe 3384 MMX.exe 3384 MMX.exe 2380 KIWVTB.exe 2380 KIWVTB.exe 5136 EVB.exe 5136 EVB.exe 5352 UQLJOV.exe 5352 UQLJOV.exe 4512 UTO.exe 4512 UTO.exe 6120 NWSIZB.exe 6120 NWSIZB.exe 4092 TWAWQDM.exe 4092 TWAWQDM.exe 2024 NKFF.exe 2024 NKFF.exe 3796 ONJJFTC.exe 3796 ONJJFTC.exe 3368 JANS.exe 3368 JANS.exe 5492 DNSCST.exe 5492 DNSCST.exe 2588 EQW.exe 2588 EQW.exe 1284 NRYKJG.exe 1284 NRYKJG.exe 1768 TRGYSI.exe 1768 TRGYSI.exe 408 ZRNM.exe 408 ZRNM.exe 4972 MXNYLOD.exe 4972 MXNYLOD.exe 4580 HKSH.exe 4580 HKSH.exe 4628 NLAVEQ.exe 4628 NLAVEQ.exe 1148 JQFKLA.exe 1148 JQFKLA.exe 6052 RGGJ.exe 6052 RGGJ.exe 5376 GBQODIT.exe 5376 GBQODIT.exe 4752 IZR.exe 4752 IZR.exe 3716 CNWZT.exe 3716 CNWZT.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3484 wrote to memory of 5304 3484 2026-09-16_eb79c5c94a50b268b6e765c0aaf3ee54_elex_emotet_stop.exe 88 PID 5304 wrote to memory of 3416 5304 cmd.exe 92 PID 3416 wrote to memory of 3884 3416 GZJCPM.exe 94 PID 3884 wrote to memory of 3628 3884 cmd.exe 98 PID 3628 wrote to memory of 5308 3628 JHXRXS.exe 99 PID 5308 wrote to memory of 3032 5308 cmd.exe 103 PID 3032 wrote to memory of 4392 3032 NITM.exe 104 PID 4392 wrote to memory of 4796 4392 cmd.exe 108 PID 4796 wrote to memory of 1772 4796 GLXPXF.exe 109 PID 1772 wrote to memory of 1316 1772 cmd.exe 113 PID 1316 wrote to memory of 1364 1316 XLZV.exe 114 PID 1364 wrote to memory of 5396 1364 cmd.exe 118 PID 5396 wrote to memory of 5340 5396 URWS.exe 119 PID 5340 wrote to memory of 5208 5340 cmd.exe 123 PID 5208 wrote to memory of 5364 5208 HBNI.exe 124 PID 5364 wrote to memory of 3156 5364 cmd.exe 128 PID 3156 wrote to memory of 5260 3156 LJTQII.exe 129 PID 5260 wrote to memory of 3384 5260 cmd.exe 133 PID 3384 wrote to memory of 5224 3384 MMX.exe 134 PID 5224 wrote to memory of 2380 5224 cmd.exe 138 PID 2380 wrote to memory of 3340 2380 KIWVTB.exe 139 PID 3340 wrote to memory of 5136 3340 cmd.exe 143 PID 5136 wrote to memory of 252 5136 EVB.exe 144 PID 252 wrote to memory of 5352 252 cmd.exe 148 PID 5352 wrote to memory of 960 5352 UQLJOV.exe 149 PID 960 wrote to memory of 4512 960 cmd.exe 153 PID 4512 wrote to memory of 2752 4512 UTO.exe 154 PID 2752 wrote to memory of 6120 2752 cmd.exe 158 PID 6120 wrote to memory of 6116 6120 NWSIZB.exe 159 PID 6116 wrote to memory of 4092 6116 cmd.exe 163 PID 4092 wrote to memory of 2476 4092 TWAWQDM.exe 164 PID 2476 wrote to memory of 2024 2476 cmd.exe 168 PID 2024 wrote to memory of 1876 2024 NKFF.exe 169 PID 1876 wrote to memory of 3796 1876 cmd.exe 173 PID 3796 wrote to memory of 3600 3796 ONJJFTC.exe 174 PID 3600 wrote to memory of 3368 3600 cmd.exe 178 PID 3368 wrote to memory of 4800 3368 JANS.exe 179 PID 4800 wrote to memory of 5492 4800 cmd.exe 183 PID 5492 wrote to memory of 4660 5492 DNSCST.exe 184 PID 4660 wrote to memory of 2588 4660 cmd.exe 188 PID 2588 wrote to memory of 4772 2588 EQW.exe 189 PID 4772 wrote to memory of 1284 4772 cmd.exe 193 PID 1284 wrote to memory of 5348 1284 NRYKJG.exe 194 PID 5348 wrote to memory of 1768 5348 cmd.exe 198 PID 1768 wrote to memory of 3684 1768 TRGYSI.exe 199 PID 3684 wrote to memory of 408 3684 cmd.exe 203 PID 408 wrote to memory of 4396 408 ZRNM.exe 204 PID 4396 wrote to memory of 4972 4396 cmd.exe 208 PID 4972 wrote to memory of 5540 4972 MXNYLOD.exe 209 PID 5540 wrote to memory of 4580 5540 cmd.exe 213 PID 4580 wrote to memory of 4588 4580 HKSH.exe 214 PID 4588 wrote to memory of 4628 4588 cmd.exe 218 PID 4628 wrote to memory of 3412 4628 NLAVEQ.exe 219 PID 3412 wrote to memory of 1148 3412 cmd.exe 223 PID 1148 wrote to memory of 2164 1148 JQFKLA.exe 224 PID 2164 wrote to memory of 6052 2164 cmd.exe 228 PID 6052 wrote to memory of 5628 6052 RGGJ.exe 229 PID 5628 wrote to memory of 5376 5628 cmd.exe 233 PID 5376 wrote to memory of 2952 5376 GBQODIT.exe 234 PID 2952 wrote to memory of 4752 2952 cmd.exe 238 PID 4752 wrote to memory of 4276 4752 IZR.exe 239 PID 4276 wrote to memory of 3716 4276 cmd.exe 243 PID 3716 wrote to memory of 2116 3716 CNWZT.exe 244 PID 2116 wrote to memory of 4436 2116 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_eb79c5c94a50b268b6e765c0aaf3ee54_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_eb79c5c94a50b268b6e765c0aaf3ee54_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZJCPM.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\windows\GZJCPM.exeC:\windows\GZJCPM.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JHXRXS.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\windows\system\JHXRXS.exeC:\windows\system\JHXRXS.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NITM.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\windows\system\NITM.exeC:\windows\system\NITM.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLXPXF.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\windows\GLXPXF.exeC:\windows\GLXPXF.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XLZV.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\windows\XLZV.exeC:\windows\XLZV.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\URWS.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\windows\SysWOW64\URWS.exeC:\windows\system32\URWS.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBNI.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\windows\system\HBNI.exeC:\windows\system\HBNI.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJTQII.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\windows\LJTQII.exeC:\windows\LJTQII.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMX.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\windows\SysWOW64\MMX.exeC:\windows\system32\MMX.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIWVTB.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\windows\KIWVTB.exeC:\windows\KIWVTB.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EVB.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\windows\SysWOW64\EVB.exeC:\windows\system32\EVB.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UQLJOV.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:252 -
C:\windows\SysWOW64\UQLJOV.exeC:\windows\system32\UQLJOV.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTO.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:960 -
C:\windows\SysWOW64\UTO.exeC:\windows\system32\UTO.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NWSIZB.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\windows\SysWOW64\NWSIZB.exeC:\windows\system32\NWSIZB.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWAWQDM.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\windows\system\TWAWQDM.exeC:\windows\system\TWAWQDM.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NKFF.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\windows\NKFF.exeC:\windows\NKFF.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ONJJFTC.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\windows\SysWOW64\ONJJFTC.exeC:\windows\system32\ONJJFTC.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JANS.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\windows\JANS.exeC:\windows\JANS.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNSCST.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\windows\DNSCST.exeC:\windows\DNSCST.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQW.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\windows\EQW.exeC:\windows\EQW.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NRYKJG.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\windows\NRYKJG.exeC:\windows\NRYKJG.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRGYSI.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\windows\TRGYSI.exeC:\windows\TRGYSI.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRNM.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\windows\system\ZRNM.exeC:\windows\system\ZRNM.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MXNYLOD.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\windows\SysWOW64\MXNYLOD.exeC:\windows\system32\MXNYLOD.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKSH.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\windows\SysWOW64\HKSH.exeC:\windows\system32\HKSH.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLAVEQ.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\windows\system\NLAVEQ.exeC:\windows\system\NLAVEQ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JQFKLA.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\windows\system\JQFKLA.exeC:\windows\system\JQFKLA.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGGJ.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\windows\system\RGGJ.exeC:\windows\system\RGGJ.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GBQODIT.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\windows\GBQODIT.exeC:\windows\GBQODIT.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZR.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\windows\IZR.exeC:\windows\IZR.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNWZT.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\windows\CNWZT.exeC:\windows\CNWZT.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXXBZ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\windows\SysWOW64\KXXBZ.exeC:\windows\system32\KXXBZ.exe65⤵
- Executes dropped EXE
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQATHQ.exe.bat" "66⤵PID:1328
-
C:\windows\system\WQATHQ.exeC:\windows\system\WQATHQ.exe67⤵
- Executes dropped EXE
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGG.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:124 -
C:\windows\system\ZGG.exeC:\windows\system\ZGG.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JGIYX.exe.bat" "70⤵
- Executes a command shell one-liner
PID:2732 -
C:\windows\system\JGIYX.exeC:\windows\system\JGIYX.exe71⤵
- Executes dropped EXE
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UZLRFN.exe.bat" "72⤵PID:4120
-
C:\windows\system\UZLRFN.exeC:\windows\system\UZLRFN.exe73⤵
- Executes dropped EXE
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VCPVL.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:5924 -
C:\windows\VCPVL.exeC:\windows\VCPVL.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BCXJU.exe.bat" "76⤵PID:4160
-
C:\windows\system\BCXJU.exeC:\windows\system\BCXJU.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XHUYJPE.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4844 -
C:\windows\system\XHUYJPE.exeC:\windows\system\XHUYJPE.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYDXI.exe.bat" "80⤵PID:1440
-
C:\windows\FYDXI.exeC:\windows\FYDXI.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLAHSDP.exe.bat" "82⤵
- Executes a command shell one-liner
PID:3836 -
C:\windows\ZLAHSDP.exeC:\windows\ZLAHSDP.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLIU.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2212 -
C:\windows\SysWOW64\FLIU.exeC:\windows\system32\FLIU.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LLPIS.exe.bat" "86⤵PID:1976
-
C:\windows\system\LLPIS.exeC:\windows\system\LLPIS.exe87⤵
- Executes dropped EXE
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABQ.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2804 -
C:\windows\system\ABQ.exeC:\windows\system\ABQ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHWWG.exe.bat" "90⤵PID:1620
-
C:\windows\XHWWG.exeC:\windows\XHWWG.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUBOIE.exe.bat" "92⤵
- Executes a command shell one-liner
PID:4624 -
C:\windows\SysWOW64\RUBOIE.exeC:\windows\system32\RUBOIE.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIG.exe.bat" "94⤵PID:1376
-
C:\windows\SysWOW64\MIG.exeC:\windows\system32\MIG.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VQICW.exe.bat" "96⤵PID:3136
-
C:\windows\system\VQICW.exeC:\windows\system\VQICW.exe97⤵
- Executes dropped EXE
PID:5896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KLRHPWX.exe.bat" "98⤵
- Executes a command shell one-liner
PID:764 -
C:\windows\system\KLRHPWX.exeC:\windows\system\KLRHPWX.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGR.exe.bat" "100⤵PID:1436
-
C:\windows\system\RGR.exeC:\windows\system\RGR.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GBAUEM.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1300 -
C:\windows\SysWOW64\GBAUEM.exeC:\windows\system32\GBAUEM.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YWEQK.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4852 -
C:\windows\SysWOW64\YWEQK.exeC:\windows\system32\YWEQK.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPPGTQL.exe.bat" "106⤵
- Executes a command shell one-liner
PID:2808 -
C:\windows\system\XPPGTQL.exeC:\windows\system\XPPGTQL.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MKYSE.exe.bat" "108⤵PID:4560
-
C:\windows\SysWOW64\MKYSE.exeC:\windows\system32\MKYSE.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EKA.exe.bat" "110⤵PID:4212
-
C:\windows\SysWOW64\EKA.exeC:\windows\system32\EKA.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BLI.exe.bat" "112⤵PID:4320
-
C:\windows\system\BLI.exeC:\windows\system\BLI.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JYAZAP.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:4984 -
C:\windows\JYAZAP.exeC:\windows\JYAZAP.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRDSI.exe.bat" "116⤵
- Executes a command shell one-liner
PID:2044 -
C:\windows\SysWOW64\VRDSI.exeC:\windows\system32\VRDSI.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMM.exe.bat" "118⤵PID:1280
-
C:\windows\SysWOW64\KMM.exeC:\windows\system32\KMM.exe119⤵
- Executes dropped EXE
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TMOBWP.exe.bat" "120⤵
- Executes a command shell one-liner
PID:6000 -
C:\windows\system\TMOBWP.exeC:\windows\system\TMOBWP.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-