Analysis
- max time kernel
80s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 14:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_14deef5f1240fafe83bb57dd8ee8f08c_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-24_14deef5f1240fafe83bb57dd8ee8f08c_elex_emotet_stop.exe
- Size 208KB
- Sample260925-rwce7syape
- SHA256 8889e05383a60d1f952d3340cec8731aadbfa9168245f0c346c15f9e858fefa6
- MD5 14deef5f1240fafe83bb57dd8ee8f08c
- SHA1 d6a2cfaa85b332ae8a9f9f067df1e83593462d5b
- SHA512 f1f3b581d34dc424c074ecc3afdd7843517672f752d0722693e485dae1130edfa5fb9c93449334db2a16dd81072770e93cbbf853131fb9a9e7095d39444fff74
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfW4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOekEj1
- TLSH T196247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4232 XMBEH.exe 4524 TKIVBLS.exe 3052 PIIHDX.exe 4784 HLL.exe 2052 XQKJDF.exe 1220 SLP.exe 5948 FJPEPQ.exe 3300 GMTIU.exe 1540 BAKJ.exe 4636 ZSN.exe 5412 WLXC.exe 5872 RWFAOMG.exe 2524 KZJW.exe 240 JJU.exe 5656 LXLO.exe 4112 RSCXSF.exe 2980 FDTN.exe 5420 YVAY.exe 5868 WRZHV.exe 2984 XMDD.exe 4420 ZJRXQKE.exe 4540 JHXRXS.exe 4904 WSNI.exe 6064 EXSX.exe 5816 KTRXBE.exe 1172 GYJNR.exe 3976 QWPH.exe 604 RZSDEY.exe 5600 MMX.exe 2252 OKD.exe 4192 DAMGCC.exe 2492 NYRS.exe 1256 YRZD.exe 1732 OHICHYY.exe 2900 BRQBW.exe 3488 QHR.exe 2264 AFXNKN.exe 3600 CDLHR.exe 1936 OLR.exe 1248 JYWRO.exe 4200 HUVZKJS.exe 5020 IXZV.exe 2580 LFGDCRQ.exe 5376 ZPOUQ.exe 2936 ZTAX.exe 1644 JTUDH.exe 2276 ULXVPW.exe 4404 JGGA.exe 3008 KJKDGH.exe 3628 MHYQV.exe 2768 DQADZNZ.exe 5300 SLJH.exe 1396 CLLMNF.exe 2784 WYQ.exe 3700 CYYJH.exe 2588 IUP.exe 3896 DHUC.exe 4496 QSKSKNR.exe 4996 YXC.exe 2324 FAUTWM.exe 5508 IOY.exe 4836 MWFCT.exe 3120 QHD.exe 2268 SXJ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\JYWRO.exe OLR.exe File created C:\windows\SysWOW64\JYWRO.exe.bat OLR.exe File created C:\windows\SysWOW64\WDIR.exe RDAEZD.exe File created C:\windows\SysWOW64\HKZEZ.exe MXUU.exe File created C:\windows\SysWOW64\IIVUQE.exe.bat SNLQF.exe File created C:\windows\SysWOW64\YVAY.exe FDTN.exe File created C:\windows\SysWOW64\MMX.exe RZSDEY.exe File opened for modification C:\windows\SysWOW64\JYWRO.exe OLR.exe File created C:\windows\SysWOW64\KJKDGH.exe JGGA.exe File opened for modification C:\windows\SysWOW64\LUQRKZR.exe HMJR.exe File opened for modification C:\windows\SysWOW64\HKZEZ.exe MXUU.exe File created C:\windows\SysWOW64\HLL.exe.bat PIIHDX.exe File created C:\windows\SysWOW64\JGGA.exe.bat ULXVPW.exe File created C:\windows\SysWOW64\HASWT.exe SXJ.exe File created C:\windows\SysWOW64\PIIHDX.exe TKIVBLS.exe File created C:\windows\SysWOW64\LXLO.exe.bat JJU.exe File opened for modification C:\windows\SysWOW64\KJKDGH.exe JGGA.exe File created C:\windows\SysWOW64\WYQ.exe CLLMNF.exe File opened for modification C:\windows\SysWOW64\HLL.exe PIIHDX.exe File created C:\windows\SysWOW64\GMTIU.exe FJPEPQ.exe File created C:\windows\SysWOW64\MHYQV.exe.bat KJKDGH.exe File created C:\windows\SysWOW64\WYQ.exe.bat CLLMNF.exe File created C:\windows\SysWOW64\YXC.exe.bat QSKSKNR.exe File opened for modification C:\windows\SysWOW64\RJBL.exe REJ.exe File created C:\windows\SysWOW64\ZPOUQ.exe LFGDCRQ.exe File created C:\windows\SysWOW64\IXZV.exe.bat HUVZKJS.exe File created C:\windows\SysWOW64\PIIHDX.exe.bat TKIVBLS.exe File created C:\windows\SysWOW64\XQKJDF.exe.bat HLL.exe File created C:\windows\SysWOW64\YVAY.exe.bat FDTN.exe File created C:\windows\SysWOW64\BRQBW.exe.bat OHICHYY.exe File created C:\windows\SysWOW64\ULXVPW.exe.bat JTUDH.exe File created C:\windows\SysWOW64\ALYYW.exe IIVUQE.exe File opened for modification C:\windows\SysWOW64\PIIHDX.exe TKIVBLS.exe File opened for modification C:\windows\SysWOW64\LXLO.exe JJU.exe File created C:\windows\SysWOW64\HUVZKJS.exe JYWRO.exe File created C:\windows\SysWOW64\HASWT.exe.bat SXJ.exe File created C:\windows\SysWOW64\ZOHYQS.exe EACP.exe File created C:\windows\SysWOW64\LUQRKZR.exe.bat HMJR.exe File opened for modification C:\windows\SysWOW64\ALYYW.exe IIVUQE.exe File created C:\windows\SysWOW64\XMBEH.exe.bat 2026-09-24_14deef5f1240fafe83bb57dd8ee8f08c_elex_emotet_stop.exe File created C:\windows\SysWOW64\XQKJDF.exe HLL.exe File opened for modification C:\windows\SysWOW64\GYJNR.exe KTRXBE.exe File created C:\windows\SysWOW64\GYJNR.exe.bat KTRXBE.exe File created C:\windows\SysWOW64\OLR.exe CDLHR.exe File opened for modification C:\windows\SysWOW64\JGGA.exe ULXVPW.exe File opened for modification C:\windows\SysWOW64\WYQ.exe CLLMNF.exe File opened for modification C:\windows\SysWOW64\ZOHYQS.exe EACP.exe File created C:\windows\SysWOW64\XMBEH.exe 2026-09-24_14deef5f1240fafe83bb57dd8ee8f08c_elex_emotet_stop.exe File created C:\windows\SysWOW64\WLXC.exe ZSN.exe File opened for modification C:\windows\SysWOW64\MMX.exe RZSDEY.exe File created C:\windows\SysWOW64\OHICHYY.exe YRZD.exe File opened for modification C:\windows\SysWOW64\MHYQV.exe KJKDGH.exe File created C:\windows\SysWOW64\YXC.exe QSKSKNR.exe File opened for modification C:\windows\SysWOW64\HASWT.exe SXJ.exe File created C:\windows\SysWOW64\HKZEZ.exe.bat MXUU.exe File opened for modification C:\windows\SysWOW64\YVAY.exe FDTN.exe File opened for modification C:\windows\SysWOW64\HMJR.exe SWIRRU.exe File created C:\windows\SysWOW64\SDOPJQ.exe HKZEZ.exe File opened for modification C:\windows\SysWOW64\SNLQF.exe MZMPAOA.exe File created C:\windows\SysWOW64\WLXC.exe.bat ZSN.exe File created C:\windows\SysWOW64\BRQBW.exe OHICHYY.exe File created C:\windows\SysWOW64\ULXVPW.exe JTUDH.exe File created C:\windows\SysWOW64\SNLQF.exe MZMPAOA.exe File created C:\windows\SysWOW64\IIVUQE.exe SNLQF.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\EXSX.exe WSNI.exe File created C:\windows\IUP.exe.bat CYYJH.exe File created C:\windows\system\QHD.exe.bat MWFCT.exe File opened for modification C:\windows\ZSN.exe BAKJ.exe File opened for modification C:\windows\system\RSCXSF.exe LXLO.exe File created C:\windows\ZJRXQKE.exe.bat XMDD.exe File created C:\windows\system\WSNI.exe JHXRXS.exe File created C:\windows\system\RZSDEY.exe QWPH.exe File opened for modification C:\windows\JLQUMWS.exe SDOPJQ.exe File created C:\windows\system\FJPEPQ.exe.bat SLP.exe File created C:\windows\system\OKD.exe MMX.exe File created C:\windows\SXJ.exe.bat QHD.exe File opened for modification C:\windows\system\NHT.exe SUOYJGC.exe File created C:\windows\system\GBNMXO.exe.bat WDIR.exe File created C:\windows\system\JHXRXS.exe.bat ZJRXQKE.exe File created C:\windows\KTRXBE.exe.bat EXSX.exe File created C:\windows\LFGDCRQ.exe IXZV.exe File opened for modification C:\windows\FAUTWM.exe YXC.exe File created C:\windows\system\MWFCT.exe.bat IOY.exe File opened for modification C:\windows\system\RDAEZD.exe WPVUW.exe File created C:\windows\system\MXUU.exe LUQRKZR.exe File created C:\windows\ZSN.exe.bat BAKJ.exe File created C:\windows\system\CYYJH.exe WYQ.exe File created C:\windows\system\NHT.exe SUOYJGC.exe File created C:\windows\system\EPJL.exe YPCY.exe File created C:\windows\MZMPAOA.exe MWILV.exe File created C:\windows\system\QWPH.exe GYJNR.exe File opened for modification C:\windows\system\QHD.exe MWFCT.exe File created C:\windows\system\XGKOY.exe ZOHYQS.exe File created C:\windows\ZWRID.exe GBNMXO.exe File created C:\windows\NTXU.exe JLQUMWS.exe File created C:\windows\system\NZPIATR.exe.bat NTXU.exe File opened for modification C:\windows\system\MWILV.exe NZPIATR.exe File created C:\windows\system\JJU.exe KZJW.exe File created C:\windows\system\CLLMNF.exe SLJH.exe File opened for modification C:\windows\QSKSKNR.exe DHUC.exe File created C:\windows\XMDD.exe.bat WRZHV.exe File opened for modification C:\windows\system\QWPH.exe GYJNR.exe File opened for modification C:\windows\LFGDCRQ.exe IXZV.exe File created C:\windows\ZTAX.exe.bat ZPOUQ.exe File created C:\windows\QSKSKNR.exe.bat DHUC.exe File created C:\windows\PFTLVG.exe HASWT.exe File opened for modification C:\windows\system\GBNMXO.exe WDIR.exe File opened for modification C:\windows\IFUDVZ.exe IAUPUU.exe File created C:\windows\ZSN.exe BAKJ.exe File created C:\windows\system\KZJW.exe.bat RWFAOMG.exe File created C:\windows\system\QHR.exe BRQBW.exe File created C:\windows\AFXNKN.exe QHR.exe File created C:\windows\IUP.exe CYYJH.exe File opened for modification C:\windows\PFTLVG.exe HASWT.exe File created C:\windows\system\XGKOY.exe.bat ZOHYQS.exe File opened for modification C:\windows\system\IAUPUU.exe NPL.exe File created C:\windows\IOY.exe.bat FAUTWM.exe File opened for modification C:\windows\system\FJPEPQ.exe SLP.exe File opened for modification C:\windows\system\KZJW.exe RWFAOMG.exe File opened for modification C:\windows\system\JHXRXS.exe ZJRXQKE.exe File created C:\windows\system\CDLHR.exe AFXNKN.exe File opened for modification C:\windows\IUP.exe CYYJH.exe File created C:\windows\IOY.exe FAUTWM.exe File created C:\windows\system\QHD.exe MWFCT.exe File created C:\windows\system\WRZHV.exe YVAY.exe File created C:\windows\system\DAMGCC.exe.bat OKD.exe File created C:\windows\ZTAX.exe ZPOUQ.exe File created C:\windows\system\NHT.exe.bat SUOYJGC.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5660 cmd.exe 1704 cmd.exe 4152 cmd.exe 1920 cmd.exe 3712 cmd.exe 6068 cmd.exe 4108 cmd.exe 5792 cmd.exe 1244 cmd.exe 808 cmd.exe 4752 cmd.exe 1140 cmd.exe 2112 cmd.exe 1272 cmd.exe 5448 cmd.exe 5256 cmd.exe 1556 cmd.exe 1268 cmd.exe 2700 cmd.exe 5644 cmd.exe 3612 cmd.exe 5048 cmd.exe 3772 cmd.exe 1892 cmd.exe 5276 cmd.exe 5616 cmd.exe 204 cmd.exe 1852 cmd.exe 2736 cmd.exe 5156 cmd.exe 1564 cmd.exe 444 cmd.exe 4624 cmd.exe 4116 cmd.exe 3152 cmd.exe 3124 cmd.exe 5372 cmd.exe 1740 cmd.exe 4368 cmd.exe 2740 cmd.exe 3456 cmd.exe 4736 cmd.exe 1392 cmd.exe 4864 cmd.exe 4648 cmd.exe 5820 cmd.exe 4212 cmd.exe 3224 cmd.exe 4884 cmd.exe 2552 cmd.exe 1772 cmd.exe 3160 cmd.exe 3720 cmd.exe 2144 cmd.exe 3040 cmd.exe 1996 cmd.exe 632 cmd.exe 2420 cmd.exe 2272 cmd.exe 5036 cmd.exe 3716 cmd.exe 4696 cmd.exe 5112 cmd.exe 3888 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3276 3372 WerFault.exe 87 3828 4232 WerFault.exe 93 4252 4524 WerFault.exe 99 820 3052 WerFault.exe 104 3440 4784 WerFault.exe 109 3600 2052 WerFault.exe 114 3532 1220 WerFault.exe 119 1436 5948 WerFault.exe 124 5048 3300 WerFault.exe 129 5932 1540 WerFault.exe 134 5156 4636 WerFault.exe 139 5704 5412 WerFault.exe 144 4548 5872 WerFault.exe 149 3492 2524 WerFault.exe 154 244 240 WerFault.exe 159 1072 5656 WerFault.exe 164 3572 4112 WerFault.exe 169 5616 2980 WerFault.exe 174 4568 5420 WerFault.exe 179 1168 5868 WerFault.exe 184 2740 2984 WerFault.exe 189 4484 4420 WerFault.exe 194 5704 4540 WerFault.exe 199 2900 4904 WerFault.exe 204 5652 6064 WerFault.exe 208 1200 5816 WerFault.exe 214 4416 1172 WerFault.exe 219 4284 3976 WerFault.exe 224 3152 604 WerFault.exe 229 3416 5600 WerFault.exe 234 1768 2252 WerFault.exe 239 3016 4192 WerFault.exe 244 4844 2492 WerFault.exe 249 632 1256 WerFault.exe 254 2392 1732 WerFault.exe 259 5652 2900 WerFault.exe 265 4476 3488 WerFault.exe 270 804 2264 WerFault.exe 275 3580 3600 WerFault.exe 280 5448 1936 WerFault.exe 285 2176 1248 WerFault.exe 290 5428 4200 WerFault.exe 295 4844 5020 WerFault.exe 300 632 2580 WerFault.exe 305 2124 5376 WerFault.exe 310 1328 2936 WerFault.exe 315 4288 1644 WerFault.exe 320 2760 2276 WerFault.exe 325 5940 4404 WerFault.exe 330 5616 3008 WerFault.exe 335 4272 3628 WerFault.exe 340 5972 2768 WerFault.exe 345 2480 5300 WerFault.exe 350 2880 1396 WerFault.exe 355 2224 2784 WerFault.exe 360 2472 3700 WerFault.exe 365 3444 2588 WerFault.exe 370 2632 3896 WerFault.exe 375 4564 4496 WerFault.exe 380 4588 4996 WerFault.exe 385 4092 2324 WerFault.exe 390 3012 5508 WerFault.exe 395 6036 4836 WerFault.exe 400 3852 3120 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWRID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUQRKZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QWPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NYRS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YRZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SLJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMTIU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMJR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-24_14deef5f1240fafe83bb57dd8ee8f08c_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KZJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTRXBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYYJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFTLVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAKJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFXNKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTUDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NZPIATR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUVZKJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IFUDVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSNI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RZSDEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YVAY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BRQBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDLHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPOUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3372 2026-09-24_14deef5f1240fafe83bb57dd8ee8f08c_elex_emotet_stop.exe 3372 2026-09-24_14deef5f1240fafe83bb57dd8ee8f08c_elex_emotet_stop.exe 4232 XMBEH.exe 4232 XMBEH.exe 4524 TKIVBLS.exe 4524 TKIVBLS.exe 3052 PIIHDX.exe 3052 PIIHDX.exe 4784 HLL.exe 4784 HLL.exe 2052 XQKJDF.exe 2052 XQKJDF.exe 1220 SLP.exe 1220 SLP.exe 5948 FJPEPQ.exe 5948 FJPEPQ.exe 3300 GMTIU.exe 3300 GMTIU.exe 1540 BAKJ.exe 1540 BAKJ.exe 4636 ZSN.exe 4636 ZSN.exe 5412 WLXC.exe 5412 WLXC.exe 5872 RWFAOMG.exe 5872 RWFAOMG.exe 2524 KZJW.exe 2524 KZJW.exe 240 JJU.exe 240 JJU.exe 5656 LXLO.exe 5656 LXLO.exe 4112 RSCXSF.exe 4112 RSCXSF.exe 2980 FDTN.exe 2980 FDTN.exe 5420 YVAY.exe 5420 YVAY.exe 5868 WRZHV.exe 5868 WRZHV.exe 2984 XMDD.exe 2984 XMDD.exe 4420 ZJRXQKE.exe 4420 ZJRXQKE.exe 4540 JHXRXS.exe 4540 JHXRXS.exe 4904 WSNI.exe 4904 WSNI.exe 6064 EXSX.exe 6064 EXSX.exe 5816 KTRXBE.exe 5816 KTRXBE.exe 1172 GYJNR.exe 1172 GYJNR.exe 3976 QWPH.exe 3976 QWPH.exe 604 RZSDEY.exe 604 RZSDEY.exe 5600 MMX.exe 5600 MMX.exe 2252 OKD.exe 2252 OKD.exe 4192 DAMGCC.exe 4192 DAMGCC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3372 2026-09-24_14deef5f1240fafe83bb57dd8ee8f08c_elex_emotet_stop.exe 3372 2026-09-24_14deef5f1240fafe83bb57dd8ee8f08c_elex_emotet_stop.exe 4232 XMBEH.exe 4232 XMBEH.exe 4524 TKIVBLS.exe 4524 TKIVBLS.exe 3052 PIIHDX.exe 3052 PIIHDX.exe 4784 HLL.exe 4784 HLL.exe 2052 XQKJDF.exe 2052 XQKJDF.exe 1220 SLP.exe 1220 SLP.exe 5948 FJPEPQ.exe 5948 FJPEPQ.exe 3300 GMTIU.exe 3300 GMTIU.exe 1540 BAKJ.exe 1540 BAKJ.exe 4636 ZSN.exe 4636 ZSN.exe 5412 WLXC.exe 5412 WLXC.exe 5872 RWFAOMG.exe 5872 RWFAOMG.exe 2524 KZJW.exe 2524 KZJW.exe 240 JJU.exe 240 JJU.exe 5656 LXLO.exe 5656 LXLO.exe 4112 RSCXSF.exe 4112 RSCXSF.exe 2980 FDTN.exe 2980 FDTN.exe 5420 YVAY.exe 5420 YVAY.exe 5868 WRZHV.exe 5868 WRZHV.exe 2984 XMDD.exe 2984 XMDD.exe 4420 ZJRXQKE.exe 4420 ZJRXQKE.exe 4540 JHXRXS.exe 4540 JHXRXS.exe 4904 WSNI.exe 4904 WSNI.exe 6064 EXSX.exe 6064 EXSX.exe 5816 KTRXBE.exe 5816 KTRXBE.exe 1172 GYJNR.exe 1172 GYJNR.exe 3976 QWPH.exe 3976 QWPH.exe 604 RZSDEY.exe 604 RZSDEY.exe 5600 MMX.exe 5600 MMX.exe 2252 OKD.exe 2252 OKD.exe 4192 DAMGCC.exe 4192 DAMGCC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3372 wrote to memory of 4724 3372 2026-09-24_14deef5f1240fafe83bb57dd8ee8f08c_elex_emotet_stop.exe 89 PID 4724 wrote to memory of 4232 4724 cmd.exe 93 PID 4232 wrote to memory of 2420 4232 XMBEH.exe 95 PID 2420 wrote to memory of 4524 2420 cmd.exe 99 PID 4524 wrote to memory of 4088 4524 TKIVBLS.exe 100 PID 4088 wrote to memory of 3052 4088 cmd.exe 104 PID 3052 wrote to memory of 3160 3052 PIIHDX.exe 105 PID 3160 wrote to memory of 4784 3160 cmd.exe 109 PID 4784 wrote to memory of 4848 4784 HLL.exe 110 PID 4848 wrote to memory of 2052 4848 cmd.exe 114 PID 2052 wrote to memory of 1552 2052 XQKJDF.exe 115 PID 1552 wrote to memory of 1220 1552 cmd.exe 119 PID 1220 wrote to memory of 5596 1220 SLP.exe 120 PID 5596 wrote to memory of 5948 5596 cmd.exe 124 PID 5948 wrote to memory of 1996 5948 FJPEPQ.exe 125 PID 1996 wrote to memory of 3300 1996 cmd.exe 129 PID 3300 wrote to memory of 3124 3300 GMTIU.exe 130 PID 3124 wrote to memory of 1540 3124 cmd.exe 134 PID 1540 wrote to memory of 3388 1540 BAKJ.exe 135 PID 3388 wrote to memory of 4636 3388 cmd.exe 139 PID 4636 wrote to memory of 5644 4636 ZSN.exe 140 PID 5644 wrote to memory of 5412 5644 cmd.exe 144 PID 5412 wrote to memory of 3144 5412 WLXC.exe 145 PID 3144 wrote to memory of 5872 3144 cmd.exe 149 PID 5872 wrote to memory of 4152 5872 RWFAOMG.exe 150 PID 4152 wrote to memory of 2524 4152 cmd.exe 154 PID 2524 wrote to memory of 5320 2524 KZJW.exe 155 PID 5320 wrote to memory of 240 5320 cmd.exe 159 PID 240 wrote to memory of 4884 240 JJU.exe 160 PID 4884 wrote to memory of 5656 4884 cmd.exe 164 PID 5656 wrote to memory of 1920 5656 LXLO.exe 165 PID 1920 wrote to memory of 4112 1920 cmd.exe 169 PID 4112 wrote to memory of 808 4112 RSCXSF.exe 170 PID 808 wrote to memory of 2980 808 cmd.exe 174 PID 2980 wrote to memory of 4340 2980 FDTN.exe 175 PID 4340 wrote to memory of 5420 4340 cmd.exe 179 PID 5420 wrote to memory of 3148 5420 YVAY.exe 180 PID 3148 wrote to memory of 5868 3148 cmd.exe 184 PID 5868 wrote to memory of 5556 5868 WRZHV.exe 185 PID 5556 wrote to memory of 2984 5556 cmd.exe 189 PID 2984 wrote to memory of 1084 2984 XMDD.exe 190 PID 1084 wrote to memory of 4420 1084 cmd.exe 194 PID 4420 wrote to memory of 5176 4420 ZJRXQKE.exe 195 PID 5176 wrote to memory of 4540 5176 cmd.exe 199 PID 4540 wrote to memory of 3876 4540 JHXRXS.exe 200 PID 3876 wrote to memory of 4904 3876 cmd.exe 204 PID 4904 wrote to memory of 2164 4904 WSNI.exe 205 PID 2164 wrote to memory of 6064 2164 cmd.exe 208 PID 6064 wrote to memory of 3712 6064 EXSX.exe 210 PID 3712 wrote to memory of 5816 3712 cmd.exe 214 PID 5816 wrote to memory of 6104 5816 KTRXBE.exe 215 PID 6104 wrote to memory of 1172 6104 cmd.exe 219 PID 1172 wrote to memory of 5576 1172 GYJNR.exe 220 PID 5576 wrote to memory of 3976 5576 cmd.exe 224 PID 3976 wrote to memory of 5884 3976 QWPH.exe 225 PID 5884 wrote to memory of 604 5884 cmd.exe 229 PID 604 wrote to memory of 3532 604 RZSDEY.exe 230 PID 3532 wrote to memory of 5600 3532 cmd.exe 234 PID 5600 wrote to memory of 1436 5600 MMX.exe 235 PID 1436 wrote to memory of 2252 1436 cmd.exe 239 PID 2252 wrote to memory of 1852 2252 OKD.exe 240 PID 1852 wrote to memory of 4192 1852 cmd.exe 244 PID 4192 wrote to memory of 2628 4192 DAMGCC.exe 245 PID 2628 wrote to memory of 2492 2628 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_14deef5f1240fafe83bb57dd8ee8f08c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_14deef5f1240fafe83bb57dd8ee8f08c_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XMBEH.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\windows\SysWOW64\XMBEH.exeC:\windows\system32\XMBEH.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TKIVBLS.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\windows\system\TKIVBLS.exeC:\windows\system\TKIVBLS.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PIIHDX.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\windows\SysWOW64\PIIHDX.exeC:\windows\system32\PIIHDX.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HLL.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\windows\SysWOW64\HLL.exeC:\windows\system32\HLL.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQKJDF.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\windows\SysWOW64\XQKJDF.exeC:\windows\system32\XQKJDF.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SLP.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\windows\SLP.exeC:\windows\SLP.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FJPEPQ.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\windows\system\FJPEPQ.exeC:\windows\system\FJPEPQ.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GMTIU.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\windows\SysWOW64\GMTIU.exeC:\windows\system32\GMTIU.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BAKJ.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\windows\BAKJ.exeC:\windows\BAKJ.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSN.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\windows\ZSN.exeC:\windows\ZSN.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLXC.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\windows\SysWOW64\WLXC.exeC:\windows\system32\WLXC.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RWFAOMG.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\windows\RWFAOMG.exeC:\windows\RWFAOMG.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KZJW.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\windows\system\KZJW.exeC:\windows\system\KZJW.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJU.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\windows\system\JJU.exeC:\windows\system\JJU.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LXLO.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\windows\SysWOW64\LXLO.exeC:\windows\system32\LXLO.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSCXSF.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\windows\system\RSCXSF.exeC:\windows\system\RSCXSF.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FDTN.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:808 -
C:\windows\system\FDTN.exeC:\windows\system\FDTN.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YVAY.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\windows\SysWOW64\YVAY.exeC:\windows\system32\YVAY.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRZHV.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\windows\system\WRZHV.exeC:\windows\system\WRZHV.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XMDD.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\windows\XMDD.exeC:\windows\XMDD.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZJRXQKE.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\windows\ZJRXQKE.exeC:\windows\ZJRXQKE.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JHXRXS.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\windows\system\JHXRXS.exeC:\windows\system\JHXRXS.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSNI.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\windows\system\WSNI.exeC:\windows\system\WSNI.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXSX.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\windows\system\EXSX.exeC:\windows\system\EXSX.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KTRXBE.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\windows\KTRXBE.exeC:\windows\KTRXBE.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GYJNR.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\windows\SysWOW64\GYJNR.exeC:\windows\system32\GYJNR.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWPH.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\windows\system\QWPH.exeC:\windows\system\QWPH.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RZSDEY.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\windows\system\RZSDEY.exeC:\windows\system\RZSDEY.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMX.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\windows\SysWOW64\MMX.exeC:\windows\system32\MMX.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKD.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\windows\system\OKD.exeC:\windows\system\OKD.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAMGCC.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\windows\system\DAMGCC.exeC:\windows\system\DAMGCC.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYRS.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\windows\SysWOW64\NYRS.exeC:\windows\system32\NYRS.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YRZD.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5256 -
C:\windows\YRZD.exeC:\windows\YRZD.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHICHYY.exe.bat" "68⤵
- Executes a command shell one-liner
PID:2736 -
C:\windows\SysWOW64\OHICHYY.exeC:\windows\system32\OHICHYY.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRQBW.exe.bat" "70⤵PID:1620
-
C:\windows\SysWOW64\BRQBW.exeC:\windows\system32\BRQBW.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHR.exe.bat" "72⤵PID:4160
-
C:\windows\system\QHR.exeC:\windows\system\QHR.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFXNKN.exe.bat" "74⤵PID:1200
-
C:\windows\AFXNKN.exeC:\windows\AFXNKN.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDLHR.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2272 -
C:\windows\system\CDLHR.exeC:\windows\system\CDLHR.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OLR.exe.bat" "78⤵PID:5996
-
C:\windows\SysWOW64\OLR.exeC:\windows\system32\OLR.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JYWRO.exe.bat" "80⤵
- Executes a command shell one-liner
PID:3612 -
C:\windows\SysWOW64\JYWRO.exeC:\windows\system32\JYWRO.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUVZKJS.exe.bat" "82⤵PID:4400
-
C:\windows\SysWOW64\HUVZKJS.exeC:\windows\system32\HUVZKJS.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXZV.exe.bat" "84⤵PID:2568
-
C:\windows\SysWOW64\IXZV.exeC:\windows\system32\IXZV.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFGDCRQ.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5156 -
C:\windows\LFGDCRQ.exeC:\windows\LFGDCRQ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZPOUQ.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:4932 -
C:\windows\SysWOW64\ZPOUQ.exeC:\windows\system32\ZPOUQ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTAX.exe.bat" "90⤵
- Executes a command shell one-liner
PID:3456 -
C:\windows\ZTAX.exeC:\windows\ZTAX.exe91⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JTUDH.exe.bat" "92⤵PID:768
-
C:\windows\system\JTUDH.exeC:\windows\system\JTUDH.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ULXVPW.exe.bat" "94⤵PID:3796
-
C:\windows\SysWOW64\ULXVPW.exeC:\windows\system32\ULXVPW.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JGGA.exe.bat" "96⤵PID:1528
-
C:\windows\SysWOW64\JGGA.exeC:\windows\system32\JGGA.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJKDGH.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1564 -
C:\windows\SysWOW64\KJKDGH.exeC:\windows\system32\KJKDGH.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MHYQV.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5448 -
C:\windows\SysWOW64\MHYQV.exeC:\windows\system32\MHYQV.exe101⤵
- Executes dropped EXE
PID:3628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQADZNZ.exe.bat" "102⤵
- Executes a command shell one-liner
PID:5048 -
C:\windows\system\DQADZNZ.exeC:\windows\system\DQADZNZ.exe103⤵
- Executes dropped EXE
PID:2768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SLJH.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:3664 -
C:\windows\SLJH.exeC:\windows\SLJH.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLLMNF.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2616 -
C:\windows\system\CLLMNF.exeC:\windows\system\CLLMNF.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYQ.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:5604 -
C:\windows\SysWOW64\WYQ.exeC:\windows\system32\WYQ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYYJH.exe.bat" "110⤵PID:4760
-
C:\windows\system\CYYJH.exeC:\windows\system\CYYJH.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IUP.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:6004 -
C:\windows\IUP.exeC:\windows\IUP.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DHUC.exe.bat" "114⤵PID:3420
-
C:\windows\DHUC.exeC:\windows\DHUC.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSKSKNR.exe.bat" "116⤵PID:6100
-
C:\windows\QSKSKNR.exeC:\windows\QSKSKNR.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXC.exe.bat" "118⤵PID:3984
-
C:\windows\SysWOW64\YXC.exeC:\windows\system32\YXC.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FAUTWM.exe.bat" "120⤵PID:1408
-
C:\windows\FAUTWM.exeC:\windows\FAUTWM.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-