Analysis
- max time kernel
90s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 13:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-16_33f5407c6da5a3bb7b689511fa17c4af_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-16_33f5407c6da5a3bb7b689511fa17c4af_elex_emotet_stop.exe
- Size 208KB
- Sample260916-qmt38abb27
- SHA256 6a1b9dfac53e52b951e7e897b6543cfa072a31769e1aff121cb1967420efe053
- MD5 33f5407c6da5a3bb7b689511fa17c4af
- SHA1 474f7b8651c519a7f5670111253a7def430c46c6
- SHA512 9be21db21b79b9ad9c8c4f6f4167091c4da569bb92cf882e56b94b3d77219e606f1b4db63dfd99bb41ac5ccb93115086dcd6ad064c0527938e63e20ccd2484e1
- SSDEEP 3072:ILQaL9tbLkRIgd1Lye9yjE2hWAN5XbxlUKL+LOfG4pLthEjQT6j:slZtbLWIgd1LZ9oECZbxlUS+LOOkEj1
- TLSH T111247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4784 IYIQ.exe 1296 NTV.exe 5624 STKABU.exe 5096 FWAY.exe 3856 XFUETCH.exe 2808 KPLCH.exe 4640 ZFMU.exe 5452 MIUSULN.exe 4544 CYVSB.exe 1092 IYDFK.exe 1116 EEIDZLF.exe 4468 MUJUX.exe 1808 YCQ.exe 4340 CSFCW.exe 2612 CYXQXO.exe 4416 YDDOEYJ.exe 5864 RWK.exe 1516 BEME.exe 4860 VRRNJW.exe 4504 BSZ.exe 4888 KSBG.exe 2708 CADLHB.exe 5960 AQOO.exe 4208 VDTXFG.exe 3916 VRTMGTN.exe 1540 KMCQ.exe 3776 KSCFT.exe 4320 HXICIUS.exe 760 YXC.exe 5480 VDUW.exe 2112 ELWBF.exe 3440 FOAFKQB.exe 4792 ZCFO.exe 252 KUIHD.exe 4764 HAGEKHZ.exe 3504 CNL.exe 5324 FVRNGZ.exe 3168 AIWXJZY.exe 468 IBF.exe 4480 IHF.exe 4440 EMDKN.exe 2856 KMKYWUL.exe 4436 KSL.exe 432 DVOID.exe 4568 BLI.exe 4296 GWGYYV.exe 4368 IJL.exe 4976 RWVHYS.exe 1788 DPQSYZR.exe 3268 UPS.exe 6048 YXZFOX.exe 480 HGBKZUS.exe 2936 CQRJGFN.exe 3300 GYYJ.exe 4508 EUXSX.exe 696 BZVHECS.exe 4060 HACV.exe 692 BNHEXE.exe 4644 DLIGD.exe 2452 YYN.exe 3788 PLYI.exe 5520 PRQWF.exe 3544 KEVFHDL.exe 3952 ZZESA.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\KSL.exe KMKYWUL.exe File opened for modification C:\windows\SysWOW64\KUTWQ.exe MUL.exe File opened for modification C:\windows\SysWOW64\BHLE.exe QOI.exe File created C:\windows\SysWOW64\IYIQ.exe 2026-09-16_33f5407c6da5a3bb7b689511fa17c4af_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\BEME.exe RWK.exe File opened for modification C:\windows\SysWOW64\HXICIUS.exe KSCFT.exe File created C:\windows\SysWOW64\KUIHD.exe.bat ZCFO.exe File created C:\windows\SysWOW64\HACV.exe BZVHECS.exe File created C:\windows\SysWOW64\UVNLRS.exe.bat AIIC.exe File opened for modification C:\windows\SysWOW64\MRIMUA.exe PTKP.exe File created C:\windows\SysWOW64\XFUETCH.exe FWAY.exe File created C:\windows\SysWOW64\CYXQXO.exe CSFCW.exe File opened for modification C:\windows\SysWOW64\IHF.exe IBF.exe File opened for modification C:\windows\SysWOW64\IJL.exe GWGYYV.exe File opened for modification C:\windows\SysWOW64\AKKVU.exe OSHCM.exe File created C:\windows\SysWOW64\FLTP.exe UOQR.exe File opened for modification C:\windows\SysWOW64\KUIHD.exe ZCFO.exe File opened for modification C:\windows\SysWOW64\DVOID.exe KSL.exe File created C:\windows\SysWOW64\KERE.exe YLO.exe File created C:\windows\SysWOW64\BHLE.exe.bat QOI.exe File opened for modification C:\windows\SysWOW64\MFRT.exe SSMKZNZ.exe File created C:\windows\SysWOW64\XFUETCH.exe.bat FWAY.exe File created C:\windows\SysWOW64\YXC.exe HXICIUS.exe File created C:\windows\SysWOW64\FVRNGZ.exe.bat CNL.exe File created C:\windows\SysWOW64\CQRJGFN.exe HGBKZUS.exe File created C:\windows\SysWOW64\JBXGGO.exe UDSJZ.exe File created C:\windows\SysWOW64\BEME.exe RWK.exe File created C:\windows\SysWOW64\UVNLRS.exe AIIC.exe File opened for modification C:\windows\SysWOW64\MSEWQ.exe RWA.exe File created C:\windows\SysWOW64\SSMKZNZ.exe.bat MSEWQ.exe File created C:\windows\SysWOW64\ZFMU.exe KPLCH.exe File created C:\windows\SysWOW64\IJL.exe GWGYYV.exe File created C:\windows\SysWOW64\HACV.exe.bat BZVHECS.exe File opened for modification C:\windows\SysWOW64\XKXRXOK.exe DMWPRA.exe File opened for modification C:\windows\SysWOW64\UYP.exe AKKVU.exe File created C:\windows\SysWOW64\CYXQXO.exe.bat CSFCW.exe File created C:\windows\SysWOW64\YXC.exe.bat HXICIUS.exe File created C:\windows\SysWOW64\BEME.exe.bat RWK.exe File opened for modification C:\windows\SysWOW64\IYIQ.exe 2026-09-16_33f5407c6da5a3bb7b689511fa17c4af_elex_emotet_stop.exe File created C:\windows\SysWOW64\RWK.exe.bat YDDOEYJ.exe File created C:\windows\SysWOW64\VDUW.exe.bat YXC.exe File created C:\windows\SysWOW64\AIWXJZY.exe FVRNGZ.exe File created C:\windows\SysWOW64\DVOID.exe KSL.exe File created C:\windows\SysWOW64\IJL.exe.bat GWGYYV.exe File opened for modification C:\windows\SysWOW64\RJBL.exe ZOXPJ.exe File created C:\windows\SysWOW64\JBXGGO.exe.bat UDSJZ.exe File created C:\windows\SysWOW64\DVOID.exe.bat KSL.exe File created C:\windows\SysWOW64\XKXRXOK.exe.bat DMWPRA.exe File created C:\windows\SysWOW64\MFRT.exe.bat SSMKZNZ.exe File opened for modification C:\windows\SysWOW64\UOQR.exe IVNZSFI.exe File created C:\windows\SysWOW64\HXICIUS.exe KSCFT.exe File opened for modification C:\windows\SysWOW64\EMDKN.exe IHF.exe File created C:\windows\SysWOW64\MSEWQ.exe RWA.exe File opened for modification C:\windows\SysWOW64\XFUETCH.exe FWAY.exe File opened for modification C:\windows\SysWOW64\KMCQ.exe VRTMGTN.exe File created C:\windows\SysWOW64\EMDKN.exe.bat IHF.exe File created C:\windows\SysWOW64\KEVFHDL.exe PRQWF.exe File created C:\windows\SysWOW64\KEVFHDL.exe.bat PRQWF.exe File created C:\windows\SysWOW64\MRIMUA.exe.bat PTKP.exe File opened for modification C:\windows\SysWOW64\FXQFWR.exe PEZSBUH.exe File opened for modification C:\windows\SysWOW64\FVRNGZ.exe CNL.exe File created C:\windows\SysWOW64\BNHEXE.exe.bat HACV.exe File created C:\windows\SysWOW64\UOQR.exe IVNZSFI.exe File created C:\windows\SysWOW64\ZFMU.exe.bat KPLCH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\STKABU.exe.bat NTV.exe File opened for modification C:\windows\RWA.exe RRZYEYG.exe File created C:\windows\system\MPH.exe AXMJLNR.exe File created C:\windows\system\SBCCL.exe OTVUYQ.exe File opened for modification C:\windows\system\VDTXFG.exe AQOO.exe File created C:\windows\IBF.exe AIWXJZY.exe File created C:\windows\RRZYEYG.exe LQSLV.exe File created C:\windows\NTV.exe.bat IYIQ.exe File created C:\windows\system\FWAY.exe.bat STKABU.exe File created C:\windows\system\CYVSB.exe.bat MIUSULN.exe File created C:\windows\PRQWF.exe.bat PLYI.exe File opened for modification C:\windows\JLP.exe MFRT.exe File created C:\windows\system\MIUSULN.exe.bat ZFMU.exe File created C:\windows\YYN.exe DLIGD.exe File created C:\windows\PTKP.exe LDVPBYM.exe File created C:\windows\system\YLO.exe.bat PYETUOC.exe File opened for modification C:\windows\system\QOI.exe BTZGN.exe File opened for modification C:\windows\VXEV.exe LWC.exe File opened for modification C:\windows\BSZ.exe VRRNJW.exe File opened for modification C:\windows\KSBG.exe BSZ.exe File created C:\windows\CNL.exe HAGEKHZ.exe File created C:\windows\GWGYYV.exe BLI.exe File created C:\windows\UPS.exe DPQSYZR.exe File opened for modification C:\windows\system\MUL.exe MRIMUA.exe File created C:\windows\PEZSBUH.exe KERE.exe File opened for modification C:\windows\system\FWAY.exe STKABU.exe File opened for modification C:\windows\system\CYVSB.exe MIUSULN.exe File created C:\windows\system\BLI.exe DVOID.exe File opened for modification C:\windows\system\PYETUOC.exe VLZKRO.exe File created C:\windows\system\PYETUOC.exe.bat VLZKRO.exe File created C:\windows\RWA.exe.bat RRZYEYG.exe File created C:\windows\EUXSX.exe GYYJ.exe File created C:\windows\LSODAHO.exe FSGPR.exe File opened for modification C:\windows\GWGYYV.exe BLI.exe File created C:\windows\system\NFHVI.exe XKXRXOK.exe File created C:\windows\PEZSBUH.exe.bat KERE.exe File opened for modification C:\windows\BTZGN.exe VGAY.exe File created C:\windows\system\VDTXFG.exe.bat AQOO.exe File created C:\windows\IYDFK.exe CYVSB.exe File opened for modification C:\windows\CADLHB.exe KSBG.exe File opened for modification C:\windows\YXZFOX.exe UPS.exe File created C:\windows\system\PLYI.exe YYN.exe File created C:\windows\JLP.exe MFRT.exe File created C:\windows\KPLCH.exe.bat XFUETCH.exe File created C:\windows\system\AQOO.exe.bat CADLHB.exe File created C:\windows\system\QOI.exe.bat BTZGN.exe File created C:\windows\EEIDZLF.exe.bat IYDFK.exe File opened for modification C:\windows\NTV.exe IYIQ.exe File created C:\windows\KSBG.exe.bat BSZ.exe File opened for modification C:\windows\system\DMWPRA.exe KUTWQ.exe File created C:\windows\LQSLV.exe PLUOO.exe File opened for modification C:\windows\RQTYEHN.exe FXQFWR.exe File created C:\windows\BTZGN.exe VGAY.exe File created C:\windows\UDSJZ.exe JLP.exe File created C:\windows\GYYJ.exe.bat CQRJGFN.exe File created C:\windows\DLIGD.exe BNHEXE.exe File created C:\windows\DLIGD.exe.bat BNHEXE.exe File created C:\windows\system\JYWQ.exe.bat UVNLRS.exe File created C:\windows\system\MUL.exe.bat MRIMUA.exe File created C:\windows\NTV.exe IYIQ.exe File opened for modification C:\windows\EEIDZLF.exe IYDFK.exe File created C:\windows\system\JYWQ.exe UVNLRS.exe File created C:\windows\system\PYETUOC.exe VLZKRO.exe File created C:\windows\VXEV.exe.bat LWC.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2904 cmd.exe 2644 cmd.exe 5040 cmd.exe 2784 cmd.exe 3720 cmd.exe 1372 cmd.exe 6132 cmd.exe 5508 cmd.exe 5056 cmd.exe 3248 cmd.exe 4868 cmd.exe 3616 cmd.exe 2056 cmd.exe 3328 cmd.exe 2732 cmd.exe 4892 cmd.exe 4708 cmd.exe 3636 cmd.exe 5208 cmd.exe 2544 cmd.exe 2376 cmd.exe 5248 cmd.exe 4492 cmd.exe 4488 cmd.exe 3508 cmd.exe 3740 cmd.exe 3040 cmd.exe 4696 cmd.exe 4904 cmd.exe 5080 cmd.exe 940 cmd.exe 2160 cmd.exe 4788 cmd.exe 200 cmd.exe 3000 cmd.exe 3352 cmd.exe 4912 cmd.exe 5952 cmd.exe 240 cmd.exe 5312 cmd.exe 1916 cmd.exe 5660 cmd.exe 4780 cmd.exe 1552 cmd.exe 1904 cmd.exe 2232 cmd.exe 1436 cmd.exe 5908 cmd.exe 4388 cmd.exe 4328 cmd.exe 1048 cmd.exe 1844 cmd.exe 4588 cmd.exe 3400 cmd.exe 5484 cmd.exe 5076 cmd.exe 1416 cmd.exe 4692 cmd.exe 2552 cmd.exe 5876 cmd.exe 5340 cmd.exe 2664 cmd.exe 4900 cmd.exe 3872 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2732 2408 WerFault.exe 86 5172 4784 WerFault.exe 91 4984 1296 WerFault.exe 97 6020 5624 WerFault.exe 102 3616 5096 WerFault.exe 107 1408 3856 WerFault.exe 112 3848 2808 WerFault.exe 117 5032 4640 WerFault.exe 122 1560 5452 WerFault.exe 127 4136 4544 WerFault.exe 132 4260 1092 WerFault.exe 137 5040 1116 WerFault.exe 142 2044 4468 WerFault.exe 147 4488 1808 WerFault.exe 152 1836 4340 WerFault.exe 157 988 2612 WerFault.exe 162 1416 4416 WerFault.exe 167 4772 5864 WerFault.exe 172 3092 1516 WerFault.exe 177 1560 4860 WerFault.exe 182 3440 4504 WerFault.exe 187 8 4888 WerFault.exe 192 1028 2708 WerFault.exe 197 3100 5960 WerFault.exe 202 5848 4208 WerFault.exe 207 3196 3916 WerFault.exe 212 3396 1540 WerFault.exe 217 1416 3776 WerFault.exe 222 3416 4320 WerFault.exe 227 548 760 WerFault.exe 232 5916 5480 WerFault.exe 237 3740 2112 WerFault.exe 242 1420 3440 WerFault.exe 247 5644 4792 WerFault.exe 252 4244 252 WerFault.exe 257 4352 4764 WerFault.exe 262 3660 3504 WerFault.exe 267 5508 5324 WerFault.exe 272 5808 3168 WerFault.exe 277 5600 468 WerFault.exe 283 6012 4480 WerFault.exe 288 5860 4440 WerFault.exe 293 1728 2856 WerFault.exe 298 5824 4436 WerFault.exe 303 4508 432 WerFault.exe 308 4836 4568 WerFault.exe 313 4972 4296 WerFault.exe 318 5044 4368 WerFault.exe 323 2392 4976 WerFault.exe 328 5560 1788 WerFault.exe 333 1636 3268 WerFault.exe 338 5916 6048 WerFault.exe 343 8 480 WerFault.exe 348 5292 2936 WerFault.exe 353 2732 3300 WerFault.exe 358 4836 4508 WerFault.exe 363 4904 696 WerFault.exe 368 2348 4060 WerFault.exe 373 6032 692 WerFault.exe 378 3540 4644 WerFault.exe 383 3036 2452 WerFault.exe 388 5000 3788 WerFault.exe 393 1560 5520 WerFault.exe 398 5428 3544 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFUETCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RWVHYS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KERE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVNZSFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIWXJZY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXICIUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACINFF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LDVPBYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXQFWR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFHVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOXPJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QOI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEIDZLF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUTWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LQSLV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VXEV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STKABU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BHLE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBCCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LWC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OTVUYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DPQSYZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RWA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PLYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRTMGTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLIGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CADLHB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAGEKHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2408 2026-09-16_33f5407c6da5a3bb7b689511fa17c4af_elex_emotet_stop.exe 2408 2026-09-16_33f5407c6da5a3bb7b689511fa17c4af_elex_emotet_stop.exe 4784 IYIQ.exe 4784 IYIQ.exe 1296 NTV.exe 1296 NTV.exe 5624 STKABU.exe 5624 STKABU.exe 5096 FWAY.exe 5096 FWAY.exe 3856 XFUETCH.exe 3856 XFUETCH.exe 2808 KPLCH.exe 2808 KPLCH.exe 4640 ZFMU.exe 4640 ZFMU.exe 5452 MIUSULN.exe 5452 MIUSULN.exe 4544 CYVSB.exe 4544 CYVSB.exe 1092 IYDFK.exe 1092 IYDFK.exe 1116 EEIDZLF.exe 1116 EEIDZLF.exe 4468 MUJUX.exe 4468 MUJUX.exe 1808 YCQ.exe 1808 YCQ.exe 4340 CSFCW.exe 4340 CSFCW.exe 2612 CYXQXO.exe 2612 CYXQXO.exe 4416 YDDOEYJ.exe 4416 YDDOEYJ.exe 5864 RWK.exe 5864 RWK.exe 1516 BEME.exe 1516 BEME.exe 4860 VRRNJW.exe 4860 VRRNJW.exe 4504 BSZ.exe 4504 BSZ.exe 4888 KSBG.exe 4888 KSBG.exe 2708 CADLHB.exe 2708 CADLHB.exe 5960 AQOO.exe 5960 AQOO.exe 4208 VDTXFG.exe 4208 VDTXFG.exe 3916 VRTMGTN.exe 3916 VRTMGTN.exe 1540 KMCQ.exe 1540 KMCQ.exe 3776 KSCFT.exe 3776 KSCFT.exe 4320 HXICIUS.exe 4320 HXICIUS.exe 760 YXC.exe 760 YXC.exe 5480 VDUW.exe 5480 VDUW.exe 2112 ELWBF.exe 2112 ELWBF.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2408 2026-09-16_33f5407c6da5a3bb7b689511fa17c4af_elex_emotet_stop.exe 2408 2026-09-16_33f5407c6da5a3bb7b689511fa17c4af_elex_emotet_stop.exe 4784 IYIQ.exe 4784 IYIQ.exe 1296 NTV.exe 1296 NTV.exe 5624 STKABU.exe 5624 STKABU.exe 5096 FWAY.exe 5096 FWAY.exe 3856 XFUETCH.exe 3856 XFUETCH.exe 2808 KPLCH.exe 2808 KPLCH.exe 4640 ZFMU.exe 4640 ZFMU.exe 5452 MIUSULN.exe 5452 MIUSULN.exe 4544 CYVSB.exe 4544 CYVSB.exe 1092 IYDFK.exe 1092 IYDFK.exe 1116 EEIDZLF.exe 1116 EEIDZLF.exe 4468 MUJUX.exe 4468 MUJUX.exe 1808 YCQ.exe 1808 YCQ.exe 4340 CSFCW.exe 4340 CSFCW.exe 2612 CYXQXO.exe 2612 CYXQXO.exe 4416 YDDOEYJ.exe 4416 YDDOEYJ.exe 5864 RWK.exe 5864 RWK.exe 1516 BEME.exe 1516 BEME.exe 4860 VRRNJW.exe 4860 VRRNJW.exe 4504 BSZ.exe 4504 BSZ.exe 4888 KSBG.exe 4888 KSBG.exe 2708 CADLHB.exe 2708 CADLHB.exe 5960 AQOO.exe 5960 AQOO.exe 4208 VDTXFG.exe 4208 VDTXFG.exe 3916 VRTMGTN.exe 3916 VRTMGTN.exe 1540 KMCQ.exe 1540 KMCQ.exe 3776 KSCFT.exe 3776 KSCFT.exe 4320 HXICIUS.exe 4320 HXICIUS.exe 760 YXC.exe 760 YXC.exe 5480 VDUW.exe 5480 VDUW.exe 2112 ELWBF.exe 2112 ELWBF.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2408 wrote to memory of 4732 2408 2026-09-16_33f5407c6da5a3bb7b689511fa17c4af_elex_emotet_stop.exe 87 PID 4732 wrote to memory of 4784 4732 cmd.exe 91 PID 4784 wrote to memory of 2868 4784 IYIQ.exe 93 PID 2868 wrote to memory of 1296 2868 cmd.exe 97 PID 1296 wrote to memory of 5524 1296 NTV.exe 98 PID 5524 wrote to memory of 5624 5524 cmd.exe 102 PID 5624 wrote to memory of 5460 5624 STKABU.exe 103 PID 5460 wrote to memory of 5096 5460 cmd.exe 107 PID 5096 wrote to memory of 1180 5096 FWAY.exe 108 PID 1180 wrote to memory of 3856 1180 cmd.exe 112 PID 3856 wrote to memory of 4740 3856 XFUETCH.exe 113 PID 4740 wrote to memory of 2808 4740 cmd.exe 117 PID 2808 wrote to memory of 3624 2808 KPLCH.exe 118 PID 3624 wrote to memory of 4640 3624 cmd.exe 122 PID 4640 wrote to memory of 3636 4640 ZFMU.exe 123 PID 3636 wrote to memory of 5452 3636 cmd.exe 127 PID 5452 wrote to memory of 4388 5452 MIUSULN.exe 128 PID 4388 wrote to memory of 4544 4388 cmd.exe 132 PID 4544 wrote to memory of 5068 4544 CYVSB.exe 133 PID 5068 wrote to memory of 1092 5068 cmd.exe 137 PID 1092 wrote to memory of 6080 1092 IYDFK.exe 138 PID 6080 wrote to memory of 1116 6080 cmd.exe 142 PID 1116 wrote to memory of 2664 1116 EEIDZLF.exe 143 PID 2664 wrote to memory of 4468 2664 cmd.exe 147 PID 4468 wrote to memory of 4576 4468 MUJUX.exe 148 PID 4576 wrote to memory of 1808 4576 cmd.exe 152 PID 1808 wrote to memory of 3400 1808 YCQ.exe 153 PID 3400 wrote to memory of 4340 3400 cmd.exe 157 PID 4340 wrote to memory of 3508 4340 CSFCW.exe 158 PID 3508 wrote to memory of 2612 3508 cmd.exe 162 PID 2612 wrote to memory of 5208 2612 CYXQXO.exe 163 PID 5208 wrote to memory of 4416 5208 cmd.exe 167 PID 4416 wrote to memory of 4788 4416 YDDOEYJ.exe 168 PID 4788 wrote to memory of 5864 4788 cmd.exe 172 PID 5864 wrote to memory of 200 5864 RWK.exe 173 PID 200 wrote to memory of 1516 200 cmd.exe 177 PID 1516 wrote to memory of 2904 1516 BEME.exe 178 PID 2904 wrote to memory of 4860 2904 cmd.exe 182 PID 4860 wrote to memory of 4940 4860 VRRNJW.exe 183 PID 4940 wrote to memory of 4504 4940 cmd.exe 187 PID 4504 wrote to memory of 1916 4504 BSZ.exe 188 PID 1916 wrote to memory of 4888 1916 cmd.exe 192 PID 4888 wrote to memory of 2948 4888 KSBG.exe 193 PID 2948 wrote to memory of 2708 2948 cmd.exe 197 PID 2708 wrote to memory of 5660 2708 CADLHB.exe 198 PID 5660 wrote to memory of 5960 5660 cmd.exe 202 PID 5960 wrote to memory of 2544 5960 AQOO.exe 203 PID 2544 wrote to memory of 4208 2544 cmd.exe 207 PID 4208 wrote to memory of 2704 4208 VDTXFG.exe 208 PID 2704 wrote to memory of 3916 2704 cmd.exe 212 PID 3916 wrote to memory of 2376 3916 VRTMGTN.exe 213 PID 2376 wrote to memory of 1540 2376 cmd.exe 217 PID 1540 wrote to memory of 484 1540 KMCQ.exe 218 PID 484 wrote to memory of 3776 484 cmd.exe 222 PID 3776 wrote to memory of 5616 3776 KSCFT.exe 223 PID 5616 wrote to memory of 4320 5616 cmd.exe 227 PID 4320 wrote to memory of 2964 4320 HXICIUS.exe 228 PID 2964 wrote to memory of 760 2964 cmd.exe 232 PID 760 wrote to memory of 5056 760 YXC.exe 233 PID 5056 wrote to memory of 5480 5056 cmd.exe 237 PID 5480 wrote to memory of 3248 5480 VDUW.exe 238 PID 3248 wrote to memory of 2112 3248 cmd.exe 242 PID 2112 wrote to memory of 3744 2112 ELWBF.exe 243 PID 3744 wrote to memory of 3440 3744 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_33f5407c6da5a3bb7b689511fa17c4af_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_33f5407c6da5a3bb7b689511fa17c4af_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IYIQ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\windows\SysWOW64\IYIQ.exeC:\windows\system32\IYIQ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NTV.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\windows\NTV.exeC:\windows\NTV.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\STKABU.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\windows\STKABU.exeC:\windows\STKABU.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWAY.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\windows\system\FWAY.exeC:\windows\system\FWAY.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFUETCH.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\windows\SysWOW64\XFUETCH.exeC:\windows\system32\XFUETCH.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPLCH.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\windows\KPLCH.exeC:\windows\KPLCH.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZFMU.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\windows\SysWOW64\ZFMU.exeC:\windows\system32\ZFMU.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MIUSULN.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\windows\system\MIUSULN.exeC:\windows\system\MIUSULN.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYVSB.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\windows\system\CYVSB.exeC:\windows\system\CYVSB.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYDFK.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\windows\IYDFK.exeC:\windows\IYDFK.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEIDZLF.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\windows\EEIDZLF.exeC:\windows\EEIDZLF.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUJUX.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\windows\SysWOW64\MUJUX.exeC:\windows\system32\MUJUX.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCQ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\windows\YCQ.exeC:\windows\YCQ.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CSFCW.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\windows\SysWOW64\CSFCW.exeC:\windows\system32\CSFCW.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYXQXO.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\windows\SysWOW64\CYXQXO.exeC:\windows\system32\CYXQXO.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDDOEYJ.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\windows\system\YDDOEYJ.exeC:\windows\system\YDDOEYJ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RWK.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\windows\SysWOW64\RWK.exeC:\windows\system32\RWK.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEME.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:200 -
C:\windows\SysWOW64\BEME.exeC:\windows\system32\BEME.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRRNJW.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\windows\VRRNJW.exeC:\windows\VRRNJW.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BSZ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\windows\BSZ.exeC:\windows\BSZ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KSBG.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\windows\KSBG.exeC:\windows\KSBG.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CADLHB.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\windows\CADLHB.exeC:\windows\CADLHB.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQOO.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\windows\system\AQOO.exeC:\windows\system\AQOO.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VDTXFG.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\windows\system\VDTXFG.exeC:\windows\system\VDTXFG.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRTMGTN.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\windows\VRTMGTN.exeC:\windows\VRTMGTN.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMCQ.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\windows\SysWOW64\KMCQ.exeC:\windows\system32\KMCQ.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KSCFT.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:484 -
C:\windows\system\KSCFT.exeC:\windows\system\KSCFT.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXICIUS.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\windows\SysWOW64\HXICIUS.exeC:\windows\system32\HXICIUS.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXC.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\windows\SysWOW64\YXC.exeC:\windows\system32\YXC.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDUW.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\windows\SysWOW64\VDUW.exeC:\windows\system32\VDUW.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ELWBF.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\windows\ELWBF.exeC:\windows\ELWBF.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FOAFKQB.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\windows\FOAFKQB.exeC:\windows\FOAFKQB.exe65⤵
- Executes dropped EXE
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZCFO.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:1980 -
C:\windows\system\ZCFO.exeC:\windows\system\ZCFO.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUIHD.exe.bat" "68⤵PID:4364
-
C:\windows\SysWOW64\KUIHD.exeC:\windows\system32\KUIHD.exe69⤵
- Executes dropped EXE
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAGEKHZ.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:428 -
C:\windows\HAGEKHZ.exeC:\windows\HAGEKHZ.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNL.exe.bat" "72⤵PID:1640
-
C:\windows\CNL.exeC:\windows\CNL.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FVRNGZ.exe.bat" "74⤵PID:2352
-
C:\windows\SysWOW64\FVRNGZ.exeC:\windows\system32\FVRNGZ.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AIWXJZY.exe.bat" "76⤵PID:4768
-
C:\windows\SysWOW64\AIWXJZY.exeC:\windows\system32\AIWXJZY.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IBF.exe.bat" "78⤵PID:3496
-
C:\windows\IBF.exeC:\windows\IBF.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHF.exe.bat" "80⤵PID:5892
-
C:\windows\SysWOW64\IHF.exeC:\windows\system32\IHF.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EMDKN.exe.bat" "82⤵PID:2436
-
C:\windows\SysWOW64\EMDKN.exeC:\windows\system32\EMDKN.exe83⤵
- Executes dropped EXE
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMKYWUL.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2644 -
C:\windows\KMKYWUL.exeC:\windows\KMKYWUL.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KSL.exe.bat" "86⤵
- Executes a command shell one-liner
PID:3740 -
C:\windows\SysWOW64\KSL.exeC:\windows\system32\KSL.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DVOID.exe.bat" "88⤵PID:4736
-
C:\windows\SysWOW64\DVOID.exeC:\windows\system32\DVOID.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BLI.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4708 -
C:\windows\system\BLI.exeC:\windows\system\BLI.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWGYYV.exe.bat" "92⤵
- Executes a command shell one-liner
PID:4868 -
C:\windows\GWGYYV.exeC:\windows\GWGYYV.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IJL.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4780 -
C:\windows\SysWOW64\IJL.exeC:\windows\system32\IJL.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RWVHYS.exe.bat" "96⤵
- Executes a command shell one-liner
PID:1552 -
C:\windows\RWVHYS.exeC:\windows\RWVHYS.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DPQSYZR.exe.bat" "98⤵PID:2116
-
C:\windows\system\DPQSYZR.exeC:\windows\system\DPQSYZR.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPS.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4816 -
C:\windows\UPS.exeC:\windows\UPS.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YXZFOX.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:2336 -
C:\windows\YXZFOX.exeC:\windows\YXZFOX.exe103⤵
- Executes dropped EXE
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HGBKZUS.exe.bat" "104⤵PID:4400
-
C:\windows\HGBKZUS.exeC:\windows\HGBKZUS.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQRJGFN.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:4820 -
C:\windows\SysWOW64\CQRJGFN.exeC:\windows\system32\CQRJGFN.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYYJ.exe.bat" "108⤵PID:3484
-
C:\windows\GYYJ.exeC:\windows\GYYJ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUXSX.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5040 -
C:\windows\EUXSX.exeC:\windows\EUXSX.exe111⤵
- Executes dropped EXE
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZVHECS.exe.bat" "112⤵PID:264
-
C:\windows\BZVHECS.exeC:\windows\BZVHECS.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HACV.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:5140 -
C:\windows\SysWOW64\HACV.exeC:\windows\system32\HACV.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNHEXE.exe.bat" "116⤵PID:2744
-
C:\windows\SysWOW64\BNHEXE.exeC:\windows\system32\BNHEXE.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DLIGD.exe.bat" "118⤵
- Executes a command shell one-liner
PID:3616 -
C:\windows\DLIGD.exeC:\windows\DLIGD.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YYN.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:988 -
C:\windows\YYN.exeC:\windows\YYN.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-