Analysis
- max time kernel
148s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 08:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-16_e7f87d3f1776f60a350a32c0e198fcc3_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-16_e7f87d3f1776f60a350a32c0e198fcc3_elex_emotet_stop.exe
- Size 208KB
- Sample260916-j8a4xavydt
- SHA256 59f4914dd28cb931c8548a709ebbe0cd4c4aed54875cc6539472170dbc4fc796
- MD5 e7f87d3f1776f60a350a32c0e198fcc3
- SHA1 10c0f15bbdf0133d837311c0669354287302ece5
- SHA512 99d06c9c054e6ae7294c1a33eebc6910b56c85997b26eb0f25ad367b62cc8b1c4f3f077699a98aaf8c9be5c42cb3f2ef17ad8a7fd792ec835b351169f6a8c41d
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcKL+LOfw4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlcS+LO4kEj1
- TLSH T13E247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5292 AOUVIEU.exe 4384 HBNI.exe 4912 KKW.exe 4584 MHB.exe 1808 HVGJ.exe 3480 PILP.exe 4184 ABOIO.exe 3492 EJU.exe 2612 ZULHGB.exe 1156 XPC.exe 1632 JXRQXW.exe 4548 JLVNQ.exe 3384 TTXSUW.exe 4360 NGC.exe 3128 TGJPN.exe 4784 OUOYXPT.exe 5680 BAOKZ.exe 2888 XCF.exe 4312 ESGAUZN.exe 2232 KTNW.exe 5100 OJUWPM.exe 1720 FJW.exe 6048 UEFFEE.exe 4844 EMHSPKP.exe 5748 VNJXT.exe 2828 OQNTYXT.exe 296 MNYWTC.exe 4176 DOABXID.exe 4132 WREFCX.exe 5144 REJ.exe 4932 RHVK.exe 1408 VPBSEFZ.exe 1128 OSFOKV.exe 2668 ZLAHSDP.exe 4900 OGSLD.exe 2816 UBRUIA.exe 1376 YJX.exe 5988 XCAKDZQ.exe 2824 VSMNQE.exe 2776 UDWVY.exe 5768 UIPJA.exe 2428 GYD.exe 5592 BLAB.exe 6092 HMIOFJB.exe 4864 HRIDHWE.exe 3728 WURHA.exe 3844 FVTMDOG.exe 4136 CAZ.exe 4524 IAHXTS.exe 5720 TTKQCAZ.exe 3412 ZTJELCA.exe 2512 PEIBKWW.exe 4104 MKNQ.exe 4972 HXKIBG.exe 3116 KFZ.exe 3416 HLXFV.exe 4308 QTZKGG.exe 4400 FOIO.exe 3424 ABNYBS.exe 2968 AHNMDF.exe 5152 GHVA.exe 4944 SXBIYS.exe 4928 MKG.exe 1184 HYLBT.exe - Drops file in System32 directory 63 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\KKW.exe HBNI.exe File created C:\windows\SysWOW64\PILP.exe.bat HVGJ.exe File created C:\windows\SysWOW64\OSFOKV.exe VPBSEFZ.exe File created C:\windows\SysWOW64\HRIDHWE.exe.bat HMIOFJB.exe File opened for modification C:\windows\SysWOW64\WURHA.exe HRIDHWE.exe File created C:\windows\SysWOW64\QTZKGG.exe.bat HLXFV.exe File opened for modification C:\windows\SysWOW64\ABOIO.exe PILP.exe File opened for modification C:\windows\SysWOW64\UIPJA.exe UDWVY.exe File opened for modification C:\windows\SysWOW64\KFZ.exe HXKIBG.exe File created C:\windows\SysWOW64\QTZKGG.exe HLXFV.exe File opened for modification C:\windows\SysWOW64\TTXSUW.exe JLVNQ.exe File created C:\windows\SysWOW64\OUOYXPT.exe TGJPN.exe File created C:\windows\SysWOW64\TTKQCAZ.exe IAHXTS.exe File created C:\windows\SysWOW64\SQOUTZ.exe HYLBT.exe File created C:\windows\SysWOW64\TTXSUW.exe JLVNQ.exe File opened for modification C:\windows\SysWOW64\OUOYXPT.exe TGJPN.exe File created C:\windows\SysWOW64\VNJXT.exe EMHSPKP.exe File created C:\windows\SysWOW64\MNYWTC.exe OQNTYXT.exe File created C:\windows\SysWOW64\HRIDHWE.exe HMIOFJB.exe File created C:\windows\SysWOW64\WURHA.exe HRIDHWE.exe File created C:\windows\SysWOW64\KFZ.exe HXKIBG.exe File created C:\windows\SysWOW64\HVGJ.exe MHB.exe File opened for modification C:\windows\SysWOW64\EJU.exe ABOIO.exe File created C:\windows\SysWOW64\RHVK.exe REJ.exe File created C:\windows\SysWOW64\BLAB.exe GYD.exe File created C:\windows\SysWOW64\ABOIO.exe PILP.exe File created C:\windows\SysWOW64\OSFOKV.exe.bat VPBSEFZ.exe File created C:\windows\SysWOW64\ZTJELCA.exe.bat TTKQCAZ.exe File created C:\windows\SysWOW64\MKG.exe.bat SXBIYS.exe File opened for modification C:\windows\SysWOW64\HVGJ.exe MHB.exe File opened for modification C:\windows\SysWOW64\BLAB.exe GYD.exe File created C:\windows\SysWOW64\ZTJELCA.exe TTKQCAZ.exe File opened for modification C:\windows\SysWOW64\MKG.exe SXBIYS.exe File opened for modification C:\windows\SysWOW64\MNYWTC.exe OQNTYXT.exe File created C:\windows\SysWOW64\MNYWTC.exe.bat OQNTYXT.exe File created C:\windows\SysWOW64\KKW.exe.bat HBNI.exe File created C:\windows\SysWOW64\PILP.exe HVGJ.exe File created C:\windows\SysWOW64\EJU.exe.bat ABOIO.exe File created C:\windows\SysWOW64\TTXSUW.exe.bat JLVNQ.exe File opened for modification C:\windows\SysWOW64\OSFOKV.exe VPBSEFZ.exe File created C:\windows\SysWOW64\KKW.exe HBNI.exe File created C:\windows\SysWOW64\HVGJ.exe.bat MHB.exe File created C:\windows\SysWOW64\ABOIO.exe.bat PILP.exe File opened for modification C:\windows\SysWOW64\VNJXT.exe EMHSPKP.exe File created C:\windows\SysWOW64\UIPJA.exe.bat UDWVY.exe File opened for modification C:\windows\SysWOW64\ZTJELCA.exe TTKQCAZ.exe File created C:\windows\SysWOW64\RHVK.exe.bat REJ.exe File created C:\windows\SysWOW64\KFZ.exe.bat HXKIBG.exe File created C:\windows\SysWOW64\EJU.exe ABOIO.exe File created C:\windows\SysWOW64\OUOYXPT.exe.bat TGJPN.exe File created C:\windows\SysWOW64\BLAB.exe.bat GYD.exe File created C:\windows\SysWOW64\SQOUTZ.exe.bat HYLBT.exe File opened for modification C:\windows\SysWOW64\PILP.exe HVGJ.exe File opened for modification C:\windows\SysWOW64\RHVK.exe REJ.exe File opened for modification C:\windows\SysWOW64\TTKQCAZ.exe IAHXTS.exe File created C:\windows\SysWOW64\TTKQCAZ.exe.bat IAHXTS.exe File created C:\windows\SysWOW64\VNJXT.exe.bat EMHSPKP.exe File created C:\windows\SysWOW64\UIPJA.exe UDWVY.exe File opened for modification C:\windows\SysWOW64\HRIDHWE.exe HMIOFJB.exe File created C:\windows\SysWOW64\WURHA.exe.bat HRIDHWE.exe File opened for modification C:\windows\SysWOW64\QTZKGG.exe HLXFV.exe File created C:\windows\SysWOW64\MKG.exe SXBIYS.exe File opened for modification C:\windows\SysWOW64\SQOUTZ.exe HYLBT.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\AOUVIEU.exe.bat 2026-09-16_e7f87d3f1776f60a350a32c0e198fcc3_elex_emotet_stop.exe File opened for modification C:\windows\system\JXRQXW.exe XPC.exe File created C:\windows\system\JLVNQ.exe.bat EKVZHWD.exe File created C:\windows\AHNMDF.exe ABNYBS.exe File opened for modification C:\windows\AHNMDF.exe ABNYBS.exe File created C:\windows\system\HBNI.exe.bat AOUVIEU.exe File opened for modification C:\windows\XCF.exe BAOKZ.exe File created C:\windows\system\KTNW.exe ESGAUZN.exe File created C:\windows\system\VSMNQE.exe XCAKDZQ.exe File opened for modification C:\windows\GYD.exe UIPJA.exe File opened for modification C:\windows\FOIO.exe QTZKGG.exe File created C:\windows\system\JXRQXW.exe.bat XPC.exe File created C:\windows\system\UBRUIA.exe.bat OGSLD.exe File opened for modification C:\windows\system\UDWVY.exe VSMNQE.exe File created C:\windows\UEFFEE.exe.bat FJW.exe File created C:\windows\system\OQNTYXT.exe.bat VNJXT.exe File opened for modification C:\windows\system\XCAKDZQ.exe YJX.exe File opened for modification C:\windows\system\MKNQ.exe PEIBKWW.exe File created C:\windows\ABNYBS.exe.bat FOIO.exe File created C:\windows\system\ZULHGB.exe EJU.exe File opened for modification C:\windows\system\DOABXID.exe MNYWTC.exe File created C:\windows\VPBSEFZ.exe RHVK.exe File created C:\windows\ZLAHSDP.exe.bat OSFOKV.exe File created C:\windows\system\YJX.exe UBRUIA.exe File created C:\windows\CAZ.exe.bat FVTMDOG.exe File created C:\windows\system\PEIBKWW.exe ZTJELCA.exe File created C:\windows\HXKIBG.exe MKNQ.exe File created C:\windows\system\BAOKZ.exe OUOYXPT.exe File opened for modification C:\windows\system\ESGAUZN.exe XCF.exe File created C:\windows\FJW.exe.bat OJUWPM.exe File created C:\windows\system\EMHSPKP.exe.bat UEFFEE.exe File created C:\windows\system\YJX.exe.bat UBRUIA.exe File created C:\windows\system\MKNQ.exe PEIBKWW.exe File created C:\windows\ABNYBS.exe FOIO.exe File created C:\windows\system\ESGAUZN.exe XCF.exe File created C:\windows\system\AOUVIEU.exe 2026-09-16_e7f87d3f1776f60a350a32c0e198fcc3_elex_emotet_stop.exe File created C:\windows\system\MHB.exe KKW.exe File created C:\windows\system\XPC.exe ZULHGB.exe File created C:\windows\system\ESGAUZN.exe.bat XCF.exe File created C:\windows\system\EMHSPKP.exe UEFFEE.exe File created C:\windows\REJ.exe WREFCX.exe File opened for modification C:\windows\system\HMIOFJB.exe BLAB.exe File opened for modification C:\windows\system\AOUVIEU.exe 2026-09-16_e7f87d3f1776f60a350a32c0e198fcc3_elex_emotet_stop.exe File opened for modification C:\windows\system\OQNTYXT.exe VNJXT.exe File created C:\windows\NGC.exe TTXSUW.exe File created C:\windows\system\XCAKDZQ.exe YJX.exe File created C:\windows\system\PEIBKWW.exe.bat ZTJELCA.exe File created C:\windows\system\HLXFV.exe.bat KFZ.exe File created C:\windows\system\GHVA.exe AHNMDF.exe File opened for modification C:\windows\system\MHB.exe KKW.exe File created C:\windows\system\TGJPN.exe.bat NGC.exe File created C:\windows\system\DOABXID.exe.bat MNYWTC.exe File created C:\windows\REJ.exe.bat WREFCX.exe File created C:\windows\system\IAHXTS.exe.bat CAZ.exe File created C:\windows\system\BAOKZ.exe.bat OUOYXPT.exe File opened for modification C:\windows\system\KTNW.exe ESGAUZN.exe File opened for modification C:\windows\VPBSEFZ.exe RHVK.exe File created C:\windows\system\OGSLD.exe.bat ZLAHSDP.exe File created C:\windows\system\VSMNQE.exe.bat XCAKDZQ.exe File created C:\windows\system\HMIOFJB.exe BLAB.exe File created C:\windows\system\HMIOFJB.exe.bat BLAB.exe File created C:\windows\system\IAHXTS.exe CAZ.exe File created C:\windows\system\JLVNQ.exe EKVZHWD.exe File created C:\windows\XCF.exe BAOKZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1312 cmd.exe 3320 cmd.exe 4108 cmd.exe 2460 cmd.exe 1356 cmd.exe 2212 cmd.exe 4544 cmd.exe 2576 cmd.exe 2672 cmd.exe 4488 cmd.exe 1284 cmd.exe 5956 cmd.exe 1900 cmd.exe 4404 cmd.exe 3192 cmd.exe 1280 cmd.exe 968 cmd.exe 3344 cmd.exe 2564 cmd.exe 5176 cmd.exe 1768 cmd.exe 5508 cmd.exe 5444 cmd.exe 3124 cmd.exe 2016 cmd.exe 1488 cmd.exe 2976 cmd.exe 1776 cmd.exe 4800 cmd.exe 4828 cmd.exe 3508 cmd.exe 4304 cmd.exe 5948 cmd.exe 760 cmd.exe 868 cmd.exe 5316 cmd.exe 3308 cmd.exe 4940 cmd.exe 808 cmd.exe 5636 cmd.exe 3748 cmd.exe 2572 cmd.exe 2424 cmd.exe 3720 cmd.exe 5972 cmd.exe 3980 cmd.exe 1252 cmd.exe 5840 cmd.exe 2076 cmd.exe 124 cmd.exe 5560 cmd.exe 2280 cmd.exe 2228 cmd.exe 5496 cmd.exe 4836 cmd.exe 2068 cmd.exe 3640 cmd.exe 2524 cmd.exe 3208 cmd.exe 4504 cmd.exe 3956 cmd.exe 2940 cmd.exe 2704 cmd.exe 3948 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3040 3256 WerFault.exe 86 2560 5292 WerFault.exe 91 4216 4384 WerFault.exe 97 4648 4912 WerFault.exe 102 5752 4584 WerFault.exe 107 4560 1808 WerFault.exe 112 2848 3480 WerFault.exe 116 3276 4184 WerFault.exe 122 5200 3492 WerFault.exe 127 1416 2612 WerFault.exe 132 2572 1156 WerFault.exe 137 2176 1632 WerFault.exe 142 924 496 WerFault.exe 147 6004 4548 WerFault.exe 152 972 3384 WerFault.exe 157 2300 4360 WerFault.exe 162 3280 3128 WerFault.exe 167 4676 4784 WerFault.exe 172 1760 5680 WerFault.exe 177 4956 2888 WerFault.exe 182 1676 4312 WerFault.exe 187 1492 2232 WerFault.exe 192 4608 5100 WerFault.exe 197 200 1720 WerFault.exe 202 1824 6048 WerFault.exe 207 1212 4844 WerFault.exe 212 2644 5748 WerFault.exe 217 4920 2828 WerFault.exe 222 3488 296 WerFault.exe 227 1344 4176 WerFault.exe 232 5260 4132 WerFault.exe 237 1236 5144 WerFault.exe 242 3372 4932 WerFault.exe 247 5908 1408 WerFault.exe 252 2912 1128 WerFault.exe 257 4276 2668 WerFault.exe 262 3640 4900 WerFault.exe 267 1752 2816 WerFault.exe 272 2672 1376 WerFault.exe 278 3488 5988 WerFault.exe 283 3368 2824 WerFault.exe 288 3812 2776 WerFault.exe 293 5940 5768 WerFault.exe 298 1588 2428 WerFault.exe 303 980 5592 WerFault.exe 308 1428 6092 WerFault.exe 313 4300 4864 WerFault.exe 318 2728 3728 WerFault.exe 323 3392 3844 WerFault.exe 328 3088 4136 WerFault.exe 333 5832 4524 WerFault.exe 338 5076 5720 WerFault.exe 343 4472 3412 WerFault.exe 348 248 2512 WerFault.exe 353 2312 4104 WerFault.exe 358 6136 4972 WerFault.exe 363 2176 3116 WerFault.exe 368 4568 3416 WerFault.exe 373 2784 4308 WerFault.exe 378 3088 4400 WerFault.exe 383 4444 3424 WerFault.exe 388 2396 2968 WerFault.exe 393 2260 5152 WerFault.exe 398 5304 4944 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DOABXID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSFOKV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UIPJA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAOKZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MNYWTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZTJELCA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AOUVIEU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGSLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMIOFJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAHXTS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXRQXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WREFCX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDWVY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXKIBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGJPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMHSPKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSMNQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTKQCAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABOIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FVTMDOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTNW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJUWPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNJXT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HRIDHWE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQNTYXT.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3256 2026-09-16_e7f87d3f1776f60a350a32c0e198fcc3_elex_emotet_stop.exe 3256 2026-09-16_e7f87d3f1776f60a350a32c0e198fcc3_elex_emotet_stop.exe 5292 AOUVIEU.exe 5292 AOUVIEU.exe 4384 HBNI.exe 4384 HBNI.exe 4912 KKW.exe 4912 KKW.exe 4584 MHB.exe 4584 MHB.exe 1808 HVGJ.exe 1808 HVGJ.exe 3480 PILP.exe 3480 PILP.exe 4184 ABOIO.exe 4184 ABOIO.exe 3492 EJU.exe 3492 EJU.exe 2612 ZULHGB.exe 2612 ZULHGB.exe 1156 XPC.exe 1156 XPC.exe 496 EKVZHWD.exe 496 EKVZHWD.exe 4548 JLVNQ.exe 4548 JLVNQ.exe 3384 TTXSUW.exe 3384 TTXSUW.exe 4360 NGC.exe 4360 NGC.exe 3128 TGJPN.exe 3128 TGJPN.exe 4784 OUOYXPT.exe 4784 OUOYXPT.exe 5680 BAOKZ.exe 5680 BAOKZ.exe 2888 XCF.exe 2888 XCF.exe 4312 ESGAUZN.exe 4312 ESGAUZN.exe 2232 KTNW.exe 2232 KTNW.exe 5100 OJUWPM.exe 5100 OJUWPM.exe 1720 FJW.exe 1720 FJW.exe 6048 UEFFEE.exe 6048 UEFFEE.exe 4844 EMHSPKP.exe 4844 EMHSPKP.exe 5748 VNJXT.exe 5748 VNJXT.exe 2828 OQNTYXT.exe 2828 OQNTYXT.exe 296 MNYWTC.exe 296 MNYWTC.exe 4176 DOABXID.exe 4176 DOABXID.exe 4132 WREFCX.exe 4132 WREFCX.exe 5144 REJ.exe 5144 REJ.exe 4932 RHVK.exe 4932 RHVK.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3256 2026-09-16_e7f87d3f1776f60a350a32c0e198fcc3_elex_emotet_stop.exe 3256 2026-09-16_e7f87d3f1776f60a350a32c0e198fcc3_elex_emotet_stop.exe 5292 AOUVIEU.exe 5292 AOUVIEU.exe 4384 HBNI.exe 4384 HBNI.exe 4912 KKW.exe 4912 KKW.exe 4584 MHB.exe 4584 MHB.exe 1808 HVGJ.exe 1808 HVGJ.exe 3480 PILP.exe 3480 PILP.exe 4184 ABOIO.exe 4184 ABOIO.exe 3492 EJU.exe 3492 EJU.exe 2612 ZULHGB.exe 2612 ZULHGB.exe 1156 XPC.exe 1156 XPC.exe 496 EKVZHWD.exe 496 EKVZHWD.exe 4548 JLVNQ.exe 4548 JLVNQ.exe 3384 TTXSUW.exe 3384 TTXSUW.exe 4360 NGC.exe 4360 NGC.exe 3128 TGJPN.exe 3128 TGJPN.exe 4784 OUOYXPT.exe 4784 OUOYXPT.exe 5680 BAOKZ.exe 5680 BAOKZ.exe 2888 XCF.exe 2888 XCF.exe 4312 ESGAUZN.exe 4312 ESGAUZN.exe 2232 KTNW.exe 2232 KTNW.exe 5100 OJUWPM.exe 5100 OJUWPM.exe 1720 FJW.exe 1720 FJW.exe 6048 UEFFEE.exe 6048 UEFFEE.exe 4844 EMHSPKP.exe 4844 EMHSPKP.exe 5748 VNJXT.exe 5748 VNJXT.exe 2828 OQNTYXT.exe 2828 OQNTYXT.exe 296 MNYWTC.exe 296 MNYWTC.exe 4176 DOABXID.exe 4176 DOABXID.exe 4132 WREFCX.exe 4132 WREFCX.exe 5144 REJ.exe 5144 REJ.exe 4932 RHVK.exe 4932 RHVK.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3256 wrote to memory of 5972 3256 2026-09-16_e7f87d3f1776f60a350a32c0e198fcc3_elex_emotet_stop.exe 87 PID 5972 wrote to memory of 5292 5972 cmd.exe 91 PID 5292 wrote to memory of 3320 5292 AOUVIEU.exe 93 PID 3320 wrote to memory of 4384 3320 cmd.exe 97 PID 4384 wrote to memory of 4488 4384 HBNI.exe 98 PID 4488 wrote to memory of 4912 4488 cmd.exe 102 PID 4912 wrote to memory of 1284 4912 KKW.exe 103 PID 1284 wrote to memory of 4584 1284 cmd.exe 107 PID 4584 wrote to memory of 4404 4584 MHB.exe 108 PID 4404 wrote to memory of 1808 4404 cmd.exe 112 PID 1808 wrote to memory of 2704 1808 HVGJ.exe 113 PID 2704 wrote to memory of 3480 2704 cmd.exe 116 PID 3480 wrote to memory of 2228 3480 PILP.exe 118 PID 2228 wrote to memory of 4184 2228 cmd.exe 122 PID 4184 wrote to memory of 3980 4184 ABOIO.exe 123 PID 3980 wrote to memory of 3492 3980 cmd.exe 127 PID 3492 wrote to memory of 968 3492 EJU.exe 128 PID 968 wrote to memory of 2612 968 cmd.exe 132 PID 2612 wrote to memory of 3344 2612 ZULHGB.exe 133 PID 3344 wrote to memory of 1156 3344 cmd.exe 137 PID 1156 wrote to memory of 3124 1156 XPC.exe 138 PID 3124 wrote to memory of 1632 3124 cmd.exe 142 PID 3308 wrote to memory of 496 3308 cmd.exe 147 PID 496 wrote to memory of 4800 496 EKVZHWD.exe 148 PID 4800 wrote to memory of 4548 4800 cmd.exe 152 PID 4548 wrote to memory of 5956 4548 JLVNQ.exe 153 PID 5956 wrote to memory of 3384 5956 cmd.exe 157 PID 3384 wrote to memory of 2564 3384 TTXSUW.exe 158 PID 2564 wrote to memory of 4360 2564 cmd.exe 162 PID 4360 wrote to memory of 1252 4360 NGC.exe 163 PID 1252 wrote to memory of 3128 1252 cmd.exe 167 PID 3128 wrote to memory of 4940 3128 TGJPN.exe 168 PID 4940 wrote to memory of 4784 4940 cmd.exe 172 PID 4784 wrote to memory of 808 4784 OUOYXPT.exe 173 PID 808 wrote to memory of 5680 808 cmd.exe 177 PID 5680 wrote to memory of 3508 5680 BAOKZ.exe 178 PID 3508 wrote to memory of 2888 3508 cmd.exe 182 PID 2888 wrote to memory of 5636 2888 XCF.exe 183 PID 5636 wrote to memory of 4312 5636 cmd.exe 187 PID 4312 wrote to memory of 4836 4312 ESGAUZN.exe 188 PID 4836 wrote to memory of 2232 4836 cmd.exe 192 PID 2232 wrote to memory of 4828 2232 KTNW.exe 193 PID 4828 wrote to memory of 5100 4828 cmd.exe 197 PID 5100 wrote to memory of 4304 5100 OJUWPM.exe 198 PID 4304 wrote to memory of 1720 4304 cmd.exe 202 PID 1720 wrote to memory of 5176 1720 FJW.exe 203 PID 5176 wrote to memory of 6048 5176 cmd.exe 207 PID 6048 wrote to memory of 3956 6048 UEFFEE.exe 208 PID 3956 wrote to memory of 4844 3956 cmd.exe 212 PID 4844 wrote to memory of 2576 4844 EMHSPKP.exe 213 PID 2576 wrote to memory of 5748 2576 cmd.exe 217 PID 5748 wrote to memory of 5840 5748 VNJXT.exe 218 PID 5840 wrote to memory of 2828 5840 cmd.exe 222 PID 2828 wrote to memory of 1356 2828 OQNTYXT.exe 223 PID 1356 wrote to memory of 296 1356 cmd.exe 227 PID 296 wrote to memory of 2016 296 MNYWTC.exe 228 PID 2016 wrote to memory of 4176 2016 cmd.exe 232 PID 4176 wrote to memory of 1768 4176 DOABXID.exe 233 PID 1768 wrote to memory of 4132 1768 cmd.exe 237 PID 4132 wrote to memory of 2076 4132 WREFCX.exe 238 PID 2076 wrote to memory of 5144 2076 cmd.exe 242 PID 5144 wrote to memory of 5508 5144 REJ.exe 243 PID 5508 wrote to memory of 4932 5508 cmd.exe 247 PID 4932 wrote to memory of 5444 4932 RHVK.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_e7f87d3f1776f60a350a32c0e198fcc3_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_e7f87d3f1776f60a350a32c0e198fcc3_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOUVIEU.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\windows\system\AOUVIEU.exeC:\windows\system\AOUVIEU.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBNI.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\windows\system\HBNI.exeC:\windows\system\HBNI.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKW.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\windows\SysWOW64\KKW.exeC:\windows\system32\KKW.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MHB.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\windows\system\MHB.exeC:\windows\system\MHB.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVGJ.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\windows\SysWOW64\HVGJ.exeC:\windows\system32\HVGJ.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PILP.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\windows\SysWOW64\PILP.exeC:\windows\system32\PILP.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABOIO.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\windows\SysWOW64\ABOIO.exeC:\windows\system32\ABOIO.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EJU.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\windows\SysWOW64\EJU.exeC:\windows\system32\EJU.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZULHGB.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:968 -
C:\windows\system\ZULHGB.exeC:\windows\system\ZULHGB.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPC.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\windows\system\XPC.exeC:\windows\system\XPC.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JXRQXW.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\windows\system\JXRQXW.exeC:\windows\system\JXRQXW.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EKVZHWD.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\windows\EKVZHWD.exeC:\windows\EKVZHWD.exe25⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLVNQ.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\windows\system\JLVNQ.exeC:\windows\system\JLVNQ.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTXSUW.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\windows\SysWOW64\TTXSUW.exeC:\windows\system32\TTXSUW.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NGC.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\windows\NGC.exeC:\windows\NGC.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGJPN.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\windows\system\TGJPN.exeC:\windows\system\TGJPN.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUOYXPT.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\windows\SysWOW64\OUOYXPT.exeC:\windows\system32\OUOYXPT.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BAOKZ.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:808 -
C:\windows\system\BAOKZ.exeC:\windows\system\BAOKZ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XCF.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\windows\XCF.exeC:\windows\XCF.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ESGAUZN.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\windows\system\ESGAUZN.exeC:\windows\system\ESGAUZN.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTNW.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\windows\system\KTNW.exeC:\windows\system\KTNW.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJUWPM.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\windows\OJUWPM.exeC:\windows\OJUWPM.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJW.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\windows\FJW.exeC:\windows\FJW.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UEFFEE.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\windows\UEFFEE.exeC:\windows\UEFFEE.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMHSPKP.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\windows\system\EMHSPKP.exeC:\windows\system\EMHSPKP.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNJXT.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\windows\SysWOW64\VNJXT.exeC:\windows\system32\VNJXT.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OQNTYXT.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\windows\system\OQNTYXT.exeC:\windows\system\OQNTYXT.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MNYWTC.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\windows\SysWOW64\MNYWTC.exeC:\windows\system32\MNYWTC.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOABXID.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\windows\system\DOABXID.exeC:\windows\system\DOABXID.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WREFCX.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\windows\WREFCX.exeC:\windows\WREFCX.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REJ.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\windows\REJ.exeC:\windows\REJ.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHVK.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\windows\SysWOW64\RHVK.exeC:\windows\system32\RHVK.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPBSEFZ.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5444 -
C:\windows\VPBSEFZ.exeC:\windows\VPBSEFZ.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OSFOKV.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:124 -
C:\windows\SysWOW64\OSFOKV.exeC:\windows\system32\OSFOKV.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLAHSDP.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4108 -
C:\windows\ZLAHSDP.exeC:\windows\ZLAHSDP.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGSLD.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2212 -
C:\windows\system\OGSLD.exeC:\windows\system\OGSLD.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBRUIA.exe.bat" "74⤵
- Executes a command shell one-liner
PID:3748 -
C:\windows\system\UBRUIA.exeC:\windows\system\UBRUIA.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YJX.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3948 -
C:\windows\system\YJX.exeC:\windows\system\YJX.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCAKDZQ.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:3972 -
C:\windows\system\XCAKDZQ.exeC:\windows\system\XCAKDZQ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSMNQE.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5560 -
C:\windows\system\VSMNQE.exeC:\windows\system\VSMNQE.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDWVY.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4504 -
C:\windows\system\UDWVY.exeC:\windows\system\UDWVY.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UIPJA.exe.bat" "84⤵
- Executes a command shell one-liner
PID:1900 -
C:\windows\SysWOW64\UIPJA.exeC:\windows\system32\UIPJA.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYD.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5948 -
C:\windows\GYD.exeC:\windows\GYD.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BLAB.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2572 -
C:\windows\SysWOW64\BLAB.exeC:\windows\system32\BLAB.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HMIOFJB.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2068 -
C:\windows\system\HMIOFJB.exeC:\windows\system\HMIOFJB.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HRIDHWE.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2424 -
C:\windows\SysWOW64\HRIDHWE.exeC:\windows\system32\HRIDHWE.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WURHA.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3720 -
C:\windows\SysWOW64\WURHA.exeC:\windows\system32\WURHA.exe95⤵
- Executes dropped EXE
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FVTMDOG.exe.bat" "96⤵PID:620
-
C:\windows\system\FVTMDOG.exeC:\windows\system\FVTMDOG.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAZ.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2280 -
C:\windows\CAZ.exeC:\windows\CAZ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IAHXTS.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2672 -
C:\windows\system\IAHXTS.exeC:\windows\system\IAHXTS.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTKQCAZ.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1488 -
C:\windows\SysWOW64\TTKQCAZ.exeC:\windows\system32\TTKQCAZ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZTJELCA.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4544 -
C:\windows\SysWOW64\ZTJELCA.exeC:\windows\system32\ZTJELCA.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEIBKWW.exe.bat" "106⤵
- Executes a command shell one-liner
PID:2976 -
C:\windows\system\PEIBKWW.exeC:\windows\system\PEIBKWW.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKNQ.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:760 -
C:\windows\system\MKNQ.exeC:\windows\system\MKNQ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HXKIBG.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2460 -
C:\windows\HXKIBG.exeC:\windows\HXKIBG.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KFZ.exe.bat" "112⤵
- Executes a command shell one-liner
PID:1280 -
C:\windows\SysWOW64\KFZ.exeC:\windows\system32\KFZ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HLXFV.exe.bat" "114⤵
- Executes a command shell one-liner
PID:5496 -
C:\windows\system\HLXFV.exeC:\windows\system\HLXFV.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QTZKGG.exe.bat" "116⤵
- Executes a command shell one-liner
PID:3640 -
C:\windows\SysWOW64\QTZKGG.exeC:\windows\system32\QTZKGG.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FOIO.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2524 -
C:\windows\FOIO.exeC:\windows\FOIO.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ABNYBS.exe.bat" "120⤵
- Executes a command shell one-liner
PID:2940 -
C:\windows\ABNYBS.exeC:\windows\ABNYBS.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-