Analysis
- max time kernel
88s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 15:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_05d297b400dd2ea19240f8ae8fd2728b_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-24_05d297b400dd2ea19240f8ae8fd2728b_elex_emotet_stop.exe
- Size 208KB
- Sample260925-s68f3afc88
- SHA256 50b7fcd166e008c71dcff95100e05a4ce71ab51b3d706633d9cc9611c5cd1925
- MD5 05d297b400dd2ea19240f8ae8fd2728b
- SHA1 d117ff6397c7355750d057a7cf69c4df2dacdef1
- SHA512 3dbfb4540ea844a5d8f772c77a41409a44f73d7e5a1a601e961f24c4fee94c5323251f1736c6133d924ad576806dacd0d2056d164e56ccad1bd6c30b0d5f912f
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUtL+LOfk4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUp+LOskEj1
- TLSH T1C7247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5944 LHH.exe 4100 GMGADAR.exe 2108 KCMAPK.exe 948 BDO.exe 4984 FTVNF.exe 2764 PTXSJF.exe 3304 GTZXM.exe 4632 KJFFYVW.exe 1996 ZEPKR.exe 5196 MKXV.exe 852 NFBRZ.exe 2964 GIEV.exe 908 KYLVQZN.exe 5972 ZTUHJ.exe 1868 OJVZIH.exe 6020 UKD.exe 1400 JAMMYXB.exe 4128 ZVWQR.exe 5824 ZAOFS.exe 3372 RDSAYNN.exe 1552 DLGIKFB.exe 5552 CEJ.exe 6016 RZSDEY.exe 5396 AZUIH.exe 5216 VNZRRD.exe 5052 WQD.exe 1920 AGKVJL.exe 3680 FGR.exe 2360 ETQR.exe 1952 EWU.exe 464 GUIHS.exe 5276 VPR.exe 3520 NYTROZ.exe 4504 RGAZ.exe 1372 JJEVGH.exe 1360 VBHNGPL.exe 4272 GJNV.exe 2076 BFSFDH.exe 4540 HFA.exe 4360 QFUYX.exe 2988 LSZHZG.exe 200 HYE.exe 5176 XOFWNM.exe 5588 PRJ.exe 1804 LCAYHE.exe 3052 PKGYTX.exe 4396 EAHXASN.exe 5840 IIOXM.exe 5500 MYVX.exe 4988 BOWXX.exe 3380 URZS.exe 5632 WERCW.exe 2140 DAQDAV.exe 4280 SVZH.exe 2412 BVBUX.exe 2384 WQGEZNJ.exe 4944 CROR.exe 2316 CWOGS.exe 1192 RRX.exe 2020 ZXX.exe 6032 TSCIO.exe 2532 OFZRZTC.exe 2928 JTEB.exe 5916 YOVNUO.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\NYTROZ.exe.bat VPR.exe File created C:\windows\SysWOW64\WERCW.exe.bat URZS.exe File created C:\windows\SysWOW64\OFZRZTC.exe TSCIO.exe File created C:\windows\SysWOW64\SGC.exe.bat GQVJ.exe File created C:\windows\SysWOW64\PTXSJF.exe FTVNF.exe File created C:\windows\SysWOW64\JOJHPGJ.exe AOHCLB.exe File opened for modification C:\windows\SysWOW64\YNZUUUP.exe JSQQ.exe File created C:\windows\SysWOW64\JTRZ.exe XLCZENO.exe File created C:\windows\SysWOW64\UKD.exe OJVZIH.exe File opened for modification C:\windows\SysWOW64\OFZRZTC.exe TSCIO.exe File created C:\windows\SysWOW64\VDOY.exe ONNHNF.exe File created C:\windows\SysWOW64\YSNBMG.exe DXIS.exe File opened for modification C:\windows\SysWOW64\KHLBWEN.exe FHDONKL.exe File created C:\windows\SysWOW64\GQVJ.exe.bat XPT.exe File opened for modification C:\windows\SysWOW64\GIEV.exe NFBRZ.exe File created C:\windows\SysWOW64\FGR.exe.bat AGKVJL.exe File created C:\windows\SysWOW64\DAQDAV.exe.bat WERCW.exe File created C:\windows\SysWOW64\CROR.exe WQGEZNJ.exe File created C:\windows\SysWOW64\JSQQ.exe FKJIXPS.exe File created C:\windows\SysWOW64\PTXSJF.exe.bat FTVNF.exe File created C:\windows\SysWOW64\ZEPKR.exe.bat KJFFYVW.exe File created C:\windows\SysWOW64\HFA.exe BFSFDH.exe File created C:\windows\SysWOW64\MYVX.exe IIOXM.exe File created C:\windows\SysWOW64\YSNBMG.exe.bat DXIS.exe File created C:\windows\SysWOW64\FHDONKL.exe VHBI.exe File created C:\windows\SysWOW64\KHLBWEN.exe.bat FHDONKL.exe File created C:\windows\SysWOW64\ZXX.exe.bat RRX.exe File opened for modification C:\windows\SysWOW64\VDOY.exe ONNHNF.exe File created C:\windows\SysWOW64\FHDONKL.exe.bat VHBI.exe File created C:\windows\SysWOW64\ZEPKR.exe KJFFYVW.exe File opened for modification C:\windows\SysWOW64\FGR.exe AGKVJL.exe File created C:\windows\SysWOW64\ULR.exe UFQWLMW.exe File created C:\windows\SysWOW64\CZFXH.exe HLA.exe File created C:\windows\SysWOW64\GIEV.exe.bat NFBRZ.exe File created C:\windows\SysWOW64\ZTUHJ.exe KYLVQZN.exe File created C:\windows\SysWOW64\GUIHS.exe EWU.exe File opened for modification C:\windows\SysWOW64\ULR.exe UFQWLMW.exe File created C:\windows\SysWOW64\ZTUHJ.exe.bat KYLVQZN.exe File created C:\windows\SysWOW64\OFZRZTC.exe.bat TSCIO.exe File opened for modification C:\windows\SysWOW64\YSNBMG.exe DXIS.exe File opened for modification C:\windows\SysWOW64\GQVJ.exe XPT.exe File created C:\windows\SysWOW64\CZFXH.exe.bat HLA.exe File created C:\windows\SysWOW64\ALYYW.exe.bat ULR.exe File opened for modification C:\windows\SysWOW64\NYTROZ.exe VPR.exe File opened for modification C:\windows\SysWOW64\HFA.exe BFSFDH.exe File opened for modification C:\windows\SysWOW64\MYVX.exe IIOXM.exe File created C:\windows\SysWOW64\WERCW.exe URZS.exe File created C:\windows\SysWOW64\CWOGS.exe.bat CROR.exe File created C:\windows\SysWOW64\CECN.exe.bat YOVNUO.exe File created C:\windows\SysWOW64\ULR.exe.bat UFQWLMW.exe File opened for modification C:\windows\SysWOW64\ZEPKR.exe KJFFYVW.exe File created C:\windows\SysWOW64\ETQR.exe.bat FGR.exe File created C:\windows\SysWOW64\YNZUUUP.exe.bat JSQQ.exe File opened for modification C:\windows\SysWOW64\JSQQ.exe FKJIXPS.exe File created C:\windows\SysWOW64\FTVNF.exe BDO.exe File created C:\windows\SysWOW64\EAHXASN.exe.bat PKGYTX.exe File opened for modification C:\windows\SysWOW64\UDFCDZR.exe UIBZ.exe File opened for modification C:\windows\SysWOW64\FHDONKL.exe VHBI.exe File opened for modification C:\windows\SysWOW64\VPR.exe GUIHS.exe File created C:\windows\SysWOW64\KTADHZ.exe.bat ALYYW.exe File created C:\windows\SysWOW64\SGC.exe GQVJ.exe File created C:\windows\SysWOW64\FTVNF.exe.bat BDO.exe File created C:\windows\SysWOW64\ZAOFS.exe.bat ZVWQR.exe File opened for modification C:\windows\SysWOW64\ZXX.exe RRX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\RRX.exe.bat CWOGS.exe File created C:\windows\CYXPU.exe YNZUUUP.exe File created C:\windows\XPT.exe.bat DCOUQU.exe File created C:\windows\HYE.exe.bat LSZHZG.exe File opened for modification C:\windows\BVBUX.exe SVZH.exe File opened for modification C:\windows\system\JTEB.exe OFZRZTC.exe File created C:\windows\system\JTEB.exe.bat OFZRZTC.exe File created C:\windows\system\ONNHNF.exe RHPKGV.exe File created C:\windows\system\ONNHNF.exe.bat RHPKGV.exe File created C:\windows\system\OIT.exe VEPP.exe File opened for modification C:\windows\system\KCMAPK.exe GMGADAR.exe File created C:\windows\system\NFBRZ.exe.bat MKXV.exe File opened for modification C:\windows\system\QFUYX.exe HFA.exe File created C:\windows\system\WQGEZNJ.exe BVBUX.exe File created C:\windows\system\JTEB.exe OFZRZTC.exe File opened for modification C:\windows\system\UPUE.exe NUV.exe File created C:\windows\OCZNJU.exe UPUE.exe File opened for modification C:\windows\GTZXM.exe PTXSJF.exe File opened for modification C:\windows\CEJ.exe DLGIKFB.exe File created C:\windows\AGKVJL.exe.bat WQD.exe File created C:\windows\system\XOFWNM.exe HYE.exe File opened for modification C:\windows\system\MKXV.exe ZEPKR.exe File opened for modification C:\windows\LSZHZG.exe QFUYX.exe File created C:\windows\CMY.exe.bat IZBODBD.exe File created C:\windows\UFQWLMW.exe.bat KHLBWEN.exe File opened for modification C:\windows\HLA.exe SGC.exe File opened for modification C:\windows\system\KSRJC.exe PEM.exe File opened for modification C:\windows\system\QYZ.exe QSZXLDE.exe File opened for modification C:\windows\system\ZVWQR.exe JAMMYXB.exe File created C:\windows\system\ZVWQR.exe.bat JAMMYXB.exe File created C:\windows\DLGIKFB.exe.bat RDSAYNN.exe File created C:\windows\system\GJNV.exe.bat VBHNGPL.exe File created C:\windows\HYE.exe LSZHZG.exe File created C:\windows\WYA.exe VDOY.exe File created C:\windows\system\VEPP.exe.bat JOJHPGJ.exe File opened for modification C:\windows\system\OIT.exe VEPP.exe File created C:\windows\system\KJFFYVW.exe GTZXM.exe File created C:\windows\system\RZSDEY.exe.bat CEJ.exe File created C:\windows\system\BFSFDH.exe GJNV.exe File created C:\windows\system\SDMQM.exe.bat UDFCDZR.exe File created C:\windows\system\NUV.exe YZLRRE.exe File opened for modification C:\windows\CAUJQ.exe YSNBMG.exe File opened for modification C:\windows\system\IWTKVC.exe CAUJQ.exe File opened for modification C:\windows\UFQWLMW.exe KHLBWEN.exe File created C:\windows\system\KYLVQZN.exe GIEV.exe File created C:\windows\JAMMYXB.exe.bat UKD.exe File created C:\windows\system\VBHNGPL.exe.bat JJEVGH.exe File created C:\windows\system\IZBODBD.exe CECN.exe File created C:\windows\system\XLCZENO.exe.bat CYXPU.exe File created C:\windows\system\KSRJC.exe.bat PEM.exe File created C:\windows\system\BDO.exe KCMAPK.exe File created C:\windows\SVZH.exe.bat DAQDAV.exe File created C:\windows\system\WQGEZNJ.exe.bat BVBUX.exe File opened for modification C:\windows\WYA.exe VDOY.exe File created C:\windows\UIBZ.exe OIT.exe File opened for modification C:\windows\OCZNJU.exe UPUE.exe File created C:\windows\system\YWKMOD.exe CZFXH.exe File created C:\windows\GTZXM.exe.bat PTXSJF.exe File created C:\windows\CEJ.exe DLGIKFB.exe File created C:\windows\AZUIH.exe.bat RZSDEY.exe File created C:\windows\VNZRRD.exe.bat AZUIH.exe File created C:\windows\PKGYTX.exe.bat LCAYHE.exe File opened for modification C:\windows\URZS.exe BOWXX.exe File opened for modification C:\windows\system\DXIS.exe OCZNJU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1700 cmd.exe 4248 cmd.exe 1580 cmd.exe 3296 cmd.exe 3360 cmd.exe 3500 cmd.exe 4888 cmd.exe 2300 cmd.exe 3320 cmd.exe 4468 cmd.exe 1456 cmd.exe 3488 cmd.exe 4844 cmd.exe 5680 cmd.exe 1000 cmd.exe 1592 cmd.exe 3368 cmd.exe 3116 cmd.exe 4700 cmd.exe 4460 cmd.exe 3056 cmd.exe 5108 cmd.exe 1916 cmd.exe 1564 cmd.exe 1272 cmd.exe 3160 cmd.exe 3012 cmd.exe 1652 cmd.exe 2588 cmd.exe 4924 cmd.exe 2408 cmd.exe 2268 cmd.exe 5144 cmd.exe 1728 cmd.exe 4024 cmd.exe 4840 cmd.exe 2492 cmd.exe 3020 cmd.exe 4644 cmd.exe 3656 cmd.exe 2956 cmd.exe 1884 cmd.exe 5644 cmd.exe 4108 cmd.exe 2400 cmd.exe 5996 cmd.exe 4972 cmd.exe 2676 cmd.exe 1408 cmd.exe 4676 cmd.exe 5740 cmd.exe 2132 cmd.exe 5864 cmd.exe 1196 cmd.exe 5788 cmd.exe 4188 cmd.exe 3076 cmd.exe 1816 cmd.exe 3900 cmd.exe 1932 cmd.exe 1284 cmd.exe 4324 cmd.exe 3704 cmd.exe 256 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4092 3484 WerFault.exe 88 908 5944 WerFault.exe 94 2560 4100 WerFault.exe 100 1372 2108 WerFault.exe 105 3012 948 WerFault.exe 110 4088 4984 WerFault.exe 115 4548 2764 WerFault.exe 120 1732 3304 WerFault.exe 125 3860 4632 WerFault.exe 130 5536 1996 WerFault.exe 135 5508 5196 WerFault.exe 140 1592 852 WerFault.exe 145 4248 2964 WerFault.exe 150 4656 908 WerFault.exe 155 2604 5972 WerFault.exe 160 2500 1868 WerFault.exe 165 4088 6020 WerFault.exe 170 2508 1400 WerFault.exe 175 4684 4128 WerFault.exe 180 4508 5824 WerFault.exe 185 4456 3372 WerFault.exe 190 5728 1552 WerFault.exe 195 4012 5552 WerFault.exe 200 1116 6016 WerFault.exe 205 4308 5396 WerFault.exe 210 5860 5216 WerFault.exe 215 5180 5052 WerFault.exe 220 3040 1920 WerFault.exe 225 924 3680 WerFault.exe 230 2644 2360 WerFault.exe 235 5760 1952 WerFault.exe 240 4700 464 WerFault.exe 245 6032 5276 WerFault.exe 250 2624 3520 WerFault.exe 255 3508 4504 WerFault.exe 260 3296 1372 WerFault.exe 265 2820 1360 WerFault.exe 270 1588 4272 WerFault.exe 275 2636 2076 WerFault.exe 281 4868 4540 WerFault.exe 286 2020 4360 WerFault.exe 291 1700 2988 WerFault.exe 296 5048 200 WerFault.exe 301 3804 5176 WerFault.exe 306 2952 5588 WerFault.exe 311 1484 1804 WerFault.exe 316 1540 3052 WerFault.exe 321 4936 4396 WerFault.exe 326 2968 5840 WerFault.exe 331 5368 5500 WerFault.exe 336 1744 4988 WerFault.exe 341 5728 3380 WerFault.exe 346 5724 5632 WerFault.exe 351 2928 2140 WerFault.exe 356 1140 4280 WerFault.exe 361 404 2412 WerFault.exe 366 1588 2384 WerFault.exe 371 2636 4944 WerFault.exe 376 2700 2316 WerFault.exe 381 252 1192 WerFault.exe 386 5556 2020 WerFault.exe 391 4532 6032 WerFault.exe 396 5372 2532 WerFault.exe 401 3364 2928 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DXIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZTUHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEPP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDFCDZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MYVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PRJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYLVQZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYXPU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTXSJF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZVWQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJEVGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLGIKFB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CROR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTEB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AOHCLB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKJIXPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-24_05d297b400dd2ea19240f8ae8fd2728b_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NYTROZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALYYW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAQDAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3484 2026-09-24_05d297b400dd2ea19240f8ae8fd2728b_elex_emotet_stop.exe 3484 2026-09-24_05d297b400dd2ea19240f8ae8fd2728b_elex_emotet_stop.exe 5944 LHH.exe 5944 LHH.exe 4100 GMGADAR.exe 4100 GMGADAR.exe 2108 KCMAPK.exe 2108 KCMAPK.exe 948 BDO.exe 948 BDO.exe 4984 FTVNF.exe 4984 FTVNF.exe 2764 PTXSJF.exe 2764 PTXSJF.exe 3304 GTZXM.exe 3304 GTZXM.exe 4632 KJFFYVW.exe 4632 KJFFYVW.exe 1996 ZEPKR.exe 1996 ZEPKR.exe 5196 MKXV.exe 5196 MKXV.exe 852 NFBRZ.exe 852 NFBRZ.exe 2964 GIEV.exe 2964 GIEV.exe 908 KYLVQZN.exe 908 KYLVQZN.exe 5972 ZTUHJ.exe 5972 ZTUHJ.exe 1868 OJVZIH.exe 1868 OJVZIH.exe 6020 UKD.exe 6020 UKD.exe 1400 JAMMYXB.exe 1400 JAMMYXB.exe 4128 ZVWQR.exe 4128 ZVWQR.exe 5824 ZAOFS.exe 5824 ZAOFS.exe 3372 RDSAYNN.exe 3372 RDSAYNN.exe 1552 DLGIKFB.exe 1552 DLGIKFB.exe 5552 CEJ.exe 5552 CEJ.exe 6016 RZSDEY.exe 6016 RZSDEY.exe 5396 AZUIH.exe 5396 AZUIH.exe 5216 VNZRRD.exe 5216 VNZRRD.exe 5052 WQD.exe 5052 WQD.exe 1920 AGKVJL.exe 1920 AGKVJL.exe 3680 FGR.exe 3680 FGR.exe 2360 ETQR.exe 2360 ETQR.exe 1952 EWU.exe 1952 EWU.exe 464 GUIHS.exe 464 GUIHS.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3484 2026-09-24_05d297b400dd2ea19240f8ae8fd2728b_elex_emotet_stop.exe 3484 2026-09-24_05d297b400dd2ea19240f8ae8fd2728b_elex_emotet_stop.exe 5944 LHH.exe 5944 LHH.exe 4100 GMGADAR.exe 4100 GMGADAR.exe 2108 KCMAPK.exe 2108 KCMAPK.exe 948 BDO.exe 948 BDO.exe 4984 FTVNF.exe 4984 FTVNF.exe 2764 PTXSJF.exe 2764 PTXSJF.exe 3304 GTZXM.exe 3304 GTZXM.exe 4632 KJFFYVW.exe 4632 KJFFYVW.exe 1996 ZEPKR.exe 1996 ZEPKR.exe 5196 MKXV.exe 5196 MKXV.exe 852 NFBRZ.exe 852 NFBRZ.exe 2964 GIEV.exe 2964 GIEV.exe 908 KYLVQZN.exe 908 KYLVQZN.exe 5972 ZTUHJ.exe 5972 ZTUHJ.exe 1868 OJVZIH.exe 1868 OJVZIH.exe 6020 UKD.exe 6020 UKD.exe 1400 JAMMYXB.exe 1400 JAMMYXB.exe 4128 ZVWQR.exe 4128 ZVWQR.exe 5824 ZAOFS.exe 5824 ZAOFS.exe 3372 RDSAYNN.exe 3372 RDSAYNN.exe 1552 DLGIKFB.exe 1552 DLGIKFB.exe 5552 CEJ.exe 5552 CEJ.exe 6016 RZSDEY.exe 6016 RZSDEY.exe 5396 AZUIH.exe 5396 AZUIH.exe 5216 VNZRRD.exe 5216 VNZRRD.exe 5052 WQD.exe 5052 WQD.exe 1920 AGKVJL.exe 1920 AGKVJL.exe 3680 FGR.exe 3680 FGR.exe 2360 ETQR.exe 2360 ETQR.exe 1952 EWU.exe 1952 EWU.exe 464 GUIHS.exe 464 GUIHS.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3484 wrote to memory of 2268 3484 2026-09-24_05d297b400dd2ea19240f8ae8fd2728b_elex_emotet_stop.exe 90 PID 2268 wrote to memory of 5944 2268 cmd.exe 94 PID 5944 wrote to memory of 5144 5944 LHH.exe 96 PID 5144 wrote to memory of 4100 5144 cmd.exe 100 PID 4100 wrote to memory of 2548 4100 GMGADAR.exe 101 PID 2548 wrote to memory of 2108 2548 cmd.exe 105 PID 2108 wrote to memory of 2888 2108 KCMAPK.exe 106 PID 2888 wrote to memory of 948 2888 cmd.exe 110 PID 948 wrote to memory of 1728 948 BDO.exe 111 PID 1728 wrote to memory of 4984 1728 cmd.exe 115 PID 4984 wrote to memory of 3024 4984 FTVNF.exe 116 PID 3024 wrote to memory of 2764 3024 cmd.exe 120 PID 2764 wrote to memory of 4924 2764 PTXSJF.exe 121 PID 4924 wrote to memory of 3304 4924 cmd.exe 125 PID 3304 wrote to memory of 2676 3304 GTZXM.exe 126 PID 2676 wrote to memory of 4632 2676 cmd.exe 130 PID 4632 wrote to memory of 3656 4632 KJFFYVW.exe 131 PID 3656 wrote to memory of 1996 3656 cmd.exe 135 PID 1996 wrote to memory of 6008 1996 ZEPKR.exe 136 PID 6008 wrote to memory of 5196 6008 cmd.exe 140 PID 5196 wrote to memory of 256 5196 MKXV.exe 141 PID 256 wrote to memory of 852 256 cmd.exe 145 PID 852 wrote to memory of 6084 852 NFBRZ.exe 146 PID 6084 wrote to memory of 2964 6084 cmd.exe 150 PID 2964 wrote to memory of 2816 2964 GIEV.exe 151 PID 2816 wrote to memory of 908 2816 cmd.exe 155 PID 908 wrote to memory of 3344 908 KYLVQZN.exe 156 PID 3344 wrote to memory of 5972 3344 cmd.exe 160 PID 5972 wrote to memory of 800 5972 ZTUHJ.exe 161 PID 800 wrote to memory of 1868 800 cmd.exe 165 PID 1868 wrote to memory of 3288 1868 OJVZIH.exe 166 PID 3288 wrote to memory of 6020 3288 cmd.exe 170 PID 6020 wrote to memory of 1000 6020 UKD.exe 171 PID 1000 wrote to memory of 1400 1000 cmd.exe 175 PID 1400 wrote to memory of 2380 1400 JAMMYXB.exe 176 PID 2380 wrote to memory of 4128 2380 cmd.exe 180 PID 4128 wrote to memory of 1548 4128 ZVWQR.exe 181 PID 1548 wrote to memory of 5824 1548 cmd.exe 185 PID 5824 wrote to memory of 2956 5824 ZAOFS.exe 186 PID 2956 wrote to memory of 3372 2956 cmd.exe 190 PID 3372 wrote to memory of 5712 3372 RDSAYNN.exe 191 PID 5712 wrote to memory of 1552 5712 cmd.exe 195 PID 1552 wrote to memory of 5072 1552 DLGIKFB.exe 196 PID 5072 wrote to memory of 5552 5072 cmd.exe 200 PID 5552 wrote to memory of 4300 5552 CEJ.exe 201 PID 4300 wrote to memory of 6016 4300 cmd.exe 205 PID 6016 wrote to memory of 4888 6016 RZSDEY.exe 206 PID 4888 wrote to memory of 5396 4888 cmd.exe 210 PID 5396 wrote to memory of 2872 5396 AZUIH.exe 211 PID 2872 wrote to memory of 5216 2872 cmd.exe 215 PID 5216 wrote to memory of 4188 5216 VNZRRD.exe 216 PID 4188 wrote to memory of 5052 4188 cmd.exe 220 PID 5052 wrote to memory of 2300 5052 WQD.exe 221 PID 2300 wrote to memory of 1920 2300 cmd.exe 225 PID 1920 wrote to memory of 1884 1920 AGKVJL.exe 226 PID 1884 wrote to memory of 3680 1884 cmd.exe 230 PID 3680 wrote to memory of 4024 3680 FGR.exe 231 PID 4024 wrote to memory of 2360 4024 cmd.exe 235 PID 2360 wrote to memory of 4172 2360 ETQR.exe 236 PID 4172 wrote to memory of 1952 4172 cmd.exe 240 PID 1952 wrote to memory of 2192 1952 EWU.exe 241 PID 2192 wrote to memory of 464 2192 cmd.exe 245 PID 464 wrote to memory of 4716 464 GUIHS.exe 246 PID 4716 wrote to memory of 5276 4716 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_05d297b400dd2ea19240f8ae8fd2728b_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_05d297b400dd2ea19240f8ae8fd2728b_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LHH.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\windows\SysWOW64\LHH.exeC:\windows\system32\LHH.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GMGADAR.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\windows\SysWOW64\GMGADAR.exeC:\windows\system32\GMGADAR.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KCMAPK.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\windows\system\KCMAPK.exeC:\windows\system\KCMAPK.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BDO.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\windows\system\BDO.exeC:\windows\system\BDO.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FTVNF.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\windows\SysWOW64\FTVNF.exeC:\windows\system32\FTVNF.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PTXSJF.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\windows\SysWOW64\PTXSJF.exeC:\windows\system32\PTXSJF.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTZXM.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\windows\GTZXM.exeC:\windows\GTZXM.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KJFFYVW.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\windows\system\KJFFYVW.exeC:\windows\system\KJFFYVW.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZEPKR.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\windows\SysWOW64\ZEPKR.exeC:\windows\system32\ZEPKR.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKXV.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\windows\system\MKXV.exeC:\windows\system\MKXV.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFBRZ.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:256 -
C:\windows\system\NFBRZ.exeC:\windows\system\NFBRZ.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GIEV.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\windows\SysWOW64\GIEV.exeC:\windows\system32\GIEV.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYLVQZN.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\windows\system\KYLVQZN.exeC:\windows\system\KYLVQZN.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZTUHJ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\windows\SysWOW64\ZTUHJ.exeC:\windows\system32\ZTUHJ.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OJVZIH.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:800 -
C:\windows\system\OJVZIH.exeC:\windows\system\OJVZIH.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UKD.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\windows\SysWOW64\UKD.exeC:\windows\system32\UKD.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JAMMYXB.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\windows\JAMMYXB.exeC:\windows\JAMMYXB.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZVWQR.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\windows\system\ZVWQR.exeC:\windows\system\ZVWQR.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZAOFS.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\windows\SysWOW64\ZAOFS.exeC:\windows\system32\ZAOFS.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDSAYNN.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\windows\RDSAYNN.exeC:\windows\RDSAYNN.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DLGIKFB.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\windows\DLGIKFB.exeC:\windows\DLGIKFB.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEJ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\windows\CEJ.exeC:\windows\CEJ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RZSDEY.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\windows\system\RZSDEY.exeC:\windows\system\RZSDEY.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AZUIH.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\windows\AZUIH.exeC:\windows\AZUIH.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VNZRRD.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\windows\VNZRRD.exeC:\windows\VNZRRD.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WQD.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\windows\WQD.exeC:\windows\WQD.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGKVJL.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\windows\AGKVJL.exeC:\windows\AGKVJL.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGR.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\windows\SysWOW64\FGR.exeC:\windows\system32\FGR.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ETQR.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\windows\SysWOW64\ETQR.exeC:\windows\system32\ETQR.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EWU.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\windows\EWU.exeC:\windows\EWU.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GUIHS.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\windows\SysWOW64\GUIHS.exeC:\windows\system32\GUIHS.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPR.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\windows\SysWOW64\VPR.exeC:\windows\system32\VPR.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYTROZ.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5468 -
C:\windows\SysWOW64\NYTROZ.exeC:\windows\system32\NYTROZ.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RGAZ.exe.bat" "68⤵PID:1608
-
C:\windows\RGAZ.exeC:\windows\RGAZ.exe69⤵
- Executes dropped EXE
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JJEVGH.exe.bat" "70⤵
- Executes a command shell one-liner
PID:1408 -
C:\windows\JJEVGH.exeC:\windows\JJEVGH.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBHNGPL.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3076 -
C:\windows\system\VBHNGPL.exeC:\windows\system\VBHNGPL.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GJNV.exe.bat" "74⤵
- Executes a command shell one-liner
PID:1816 -
C:\windows\system\GJNV.exeC:\windows\system\GJNV.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BFSFDH.exe.bat" "76⤵
- Executes a command shell one-liner
PID:3320 -
C:\windows\system\BFSFDH.exeC:\windows\system\BFSFDH.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HFA.exe.bat" "78⤵PID:1212
-
C:\windows\SysWOW64\HFA.exeC:\windows\system32\HFA.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFUYX.exe.bat" "80⤵PID:4680
-
C:\windows\system\QFUYX.exeC:\windows\system\QFUYX.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LSZHZG.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4676 -
C:\windows\LSZHZG.exeC:\windows\LSZHZG.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYE.exe.bat" "84⤵PID:4032
-
C:\windows\HYE.exeC:\windows\HYE.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOFWNM.exe.bat" "86⤵
- Executes a command shell one-liner
PID:4468 -
C:\windows\system\XOFWNM.exeC:\windows\system\XOFWNM.exe87⤵
- Executes dropped EXE
PID:5176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRJ.exe.bat" "88⤵PID:5256
-
C:\windows\SysWOW64\PRJ.exeC:\windows\system32\PRJ.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LCAYHE.exe.bat" "90⤵PID:1568
-
C:\windows\SysWOW64\LCAYHE.exeC:\windows\system32\LCAYHE.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PKGYTX.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:2576 -
C:\windows\PKGYTX.exeC:\windows\PKGYTX.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EAHXASN.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4112 -
C:\windows\SysWOW64\EAHXASN.exeC:\windows\system32\EAHXASN.exe95⤵
- Executes dropped EXE
PID:4396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIOXM.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4348 -
C:\windows\IIOXM.exeC:\windows\IIOXM.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MYVX.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:1924 -
C:\windows\SysWOW64\MYVX.exeC:\windows\system32\MYVX.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOWXX.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:2976 -
C:\windows\BOWXX.exeC:\windows\BOWXX.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\URZS.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:2476 -
C:\windows\URZS.exeC:\windows\URZS.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WERCW.exe.bat" "104⤵
- Executes a command shell one-liner
PID:1700 -
C:\windows\SysWOW64\WERCW.exeC:\windows\system32\WERCW.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DAQDAV.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3592 -
C:\windows\SysWOW64\DAQDAV.exeC:\windows\system32\DAQDAV.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVZH.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4248 -
C:\windows\SVZH.exeC:\windows\SVZH.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BVBUX.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:3508 -
C:\windows\BVBUX.exeC:\windows\BVBUX.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQGEZNJ.exe.bat" "112⤵PID:5968
-
C:\windows\system\WQGEZNJ.exeC:\windows\system\WQGEZNJ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CROR.exe.bat" "114⤵PID:3736
-
C:\windows\SysWOW64\CROR.exeC:\windows\system32\CROR.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWOGS.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:3220 -
C:\windows\SysWOW64\CWOGS.exeC:\windows\system32\CWOGS.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RRX.exe.bat" "118⤵PID:4284
-
C:\windows\RRX.exeC:\windows\RRX.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZXX.exe.bat" "120⤵
- Executes a command shell one-liner
PID:1580 -
C:\windows\SysWOW64\ZXX.exeC:\windows\system32\ZXX.exe121⤵
- Executes dropped EXE
PID:2020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-