Analysis
- max time kernel
25s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 15:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_0e9a8badec6abf480a2ce06a4c125db9_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-24_0e9a8badec6abf480a2ce06a4c125db9_elex_emotet_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-09-24_0e9a8badec6abf480a2ce06a4c125db9_elex_emotet_stop.exe
- Size 208KB
- Sample260925-sec6va1v2p
- SHA256 683aa3df5de4ddce9db6c1b1851ad2b8f5f0c8e8d3112744fe24ec2c4c5da7f9
- MD5 0e9a8badec6abf480a2ce06a4c125db9
- SHA1 239b01338dceba04d137c90c6d1664670f7e47a5
- SHA512 74bfc613c4936fbd730a2ed145adfa623fb1e07b75895e212d907db4fca6dffe18925ffda7cb89ccd7f31472610f2280ae903cb7d8063919f43a1796269d078e
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlEKL+LOfD4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlES+LOrkEj1
- TLSH T10E247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 5 5848 Process not Found 6 5848 Process not Found - Executes dropped EXE 35 IoCs
pid Process 1868 GZOVQ.exe 5708 YSFUCAH.exe 4920 TFKE.exe 4712 HLIBT.exe 1920 JIJDSH.exe 2280 GGHAHJ.exe 1788 CMNPOSK.exe 5728 HWRWTK.exe 2288 PHR.exe 1352 CSV.exe 4640 WQP.exe 2036 PNAV.exe 5740 RLTX.exe 2144 RVCRR.exe 5468 KZT.exe 4300 KJCWJ.exe 6056 XUGC.exe 3736 INBVO.exe 5780 IXKPC.exe 4332 KVDRJS.exe 5952 XYHPO.exe 5600 UDNMVTC.exe 3536 KTLPHN.exe 3364 MRNRNBS.exe 2096 DHLURV.exe 2256 OZO.exe 2628 HFA.exe 4312 YQQ.exe 3292 OGP.exe 924 BITS.exe 5100 PTP.exe 3572 ARAW.exe 2736 CPCY.exe 6004 BZCZO.exe 3192 UCCDS.exe - Drops file in System32 directory 30 IoCs
description ioc Process File created C:\windows\SysWOW64\GGHAHJ.exe.bat JIJDSH.exe File created C:\windows\SysWOW64\PNAV.exe WQP.exe File created C:\windows\SysWOW64\PNAV.exe.bat WQP.exe File opened for modification C:\windows\SysWOW64\INBVO.exe XUGC.exe File created C:\windows\SysWOW64\HFA.exe OZO.exe File opened for modification C:\windows\SysWOW64\KVDRJS.exe IXKPC.exe File opened for modification C:\windows\SysWOW64\KJCWJ.exe KZT.exe File created C:\windows\SysWOW64\KJCWJ.exe.bat KZT.exe File created C:\windows\SysWOW64\GGHAHJ.exe JIJDSH.exe File created C:\windows\SysWOW64\HWRWTK.exe.bat CMNPOSK.exe File created C:\windows\SysWOW64\KVDRJS.exe IXKPC.exe File opened for modification C:\windows\SysWOW64\CPCY.exe ARAW.exe File created C:\windows\SysWOW64\UCCDS.exe BZCZO.exe File opened for modification C:\windows\SysWOW64\UCCDS.exe BZCZO.exe File created C:\windows\SysWOW64\JIJDSH.exe.bat HLIBT.exe File opened for modification C:\windows\SysWOW64\GGHAHJ.exe JIJDSH.exe File created C:\windows\SysWOW64\CPCY.exe.bat ARAW.exe File created C:\windows\SysWOW64\HWRWTK.exe CMNPOSK.exe File opened for modification C:\windows\SysWOW64\PNAV.exe WQP.exe File created C:\windows\SysWOW64\KJCWJ.exe KZT.exe File created C:\windows\SysWOW64\INBVO.exe.bat XUGC.exe File created C:\windows\SysWOW64\KVDRJS.exe.bat IXKPC.exe File created C:\windows\SysWOW64\HFA.exe.bat OZO.exe File created C:\windows\SysWOW64\CPCY.exe ARAW.exe File created C:\windows\SysWOW64\JIJDSH.exe HLIBT.exe File opened for modification C:\windows\SysWOW64\JIJDSH.exe HLIBT.exe File opened for modification C:\windows\SysWOW64\HWRWTK.exe CMNPOSK.exe File created C:\windows\SysWOW64\INBVO.exe XUGC.exe File opened for modification C:\windows\SysWOW64\HFA.exe OZO.exe File created C:\windows\SysWOW64\UCCDS.exe.bat BZCZO.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\CSV.exe PHR.exe File created C:\windows\system\IXKPC.exe INBVO.exe File created C:\windows\XYHPO.exe KVDRJS.exe File created C:\windows\MRNRNBS.exe.bat KTLPHN.exe File opened for modification C:\windows\YQQ.exe HFA.exe File created C:\windows\system\GZOVQ.exe.bat 2026-09-24_0e9a8badec6abf480a2ce06a4c125db9_elex_emotet_stop.exe File opened for modification C:\windows\system\IXKPC.exe INBVO.exe File created C:\windows\system\KTLPHN.exe.bat UDNMVTC.exe File created C:\windows\OGP.exe YQQ.exe File created C:\windows\OGP.exe.bat YQQ.exe File created C:\windows\system\BITS.exe OGP.exe File opened for modification C:\windows\system\ARAW.exe PTP.exe File created C:\windows\system\TFKE.exe YSFUCAH.exe File created C:\windows\system\WQP.exe.bat CSV.exe File opened for modification C:\windows\system\PTP.exe BITS.exe File opened for modification C:\windows\BZCZO.exe CPCY.exe File created C:\windows\HNYB.exe.bat UCCDS.exe File created C:\windows\CMNPOSK.exe.bat GGHAHJ.exe File created C:\windows\system\KTLPHN.exe UDNMVTC.exe File created C:\windows\system\ARAW.exe.bat PTP.exe File created C:\windows\BZCZO.exe CPCY.exe File opened for modification C:\windows\HNYB.exe UCCDS.exe File created C:\windows\YSFUCAH.exe GZOVQ.exe File created C:\windows\system\RLTX.exe.bat PNAV.exe File created C:\windows\DHLURV.exe MRNRNBS.exe File created C:\windows\CMNPOSK.exe GGHAHJ.exe File opened for modification C:\windows\CMNPOSK.exe GGHAHJ.exe File created C:\windows\system\PHR.exe HWRWTK.exe File created C:\windows\system\WQP.exe CSV.exe File opened for modification C:\windows\XYHPO.exe KVDRJS.exe File created C:\windows\system\UDNMVTC.exe.bat XYHPO.exe File opened for modification C:\windows\system\GZOVQ.exe 2026-09-24_0e9a8badec6abf480a2ce06a4c125db9_elex_emotet_stop.exe File created C:\windows\HLIBT.exe.bat TFKE.exe File created C:\windows\system\CSV.exe.bat PHR.exe File created C:\windows\system\RVCRR.exe RLTX.exe File created C:\windows\system\XUGC.exe.bat KJCWJ.exe File created C:\windows\YQQ.exe.bat HFA.exe File opened for modification C:\windows\system\KZT.exe RVCRR.exe File created C:\windows\YQQ.exe HFA.exe File opened for modification C:\windows\YSFUCAH.exe GZOVQ.exe File created C:\windows\YSFUCAH.exe.bat GZOVQ.exe File created C:\windows\HLIBT.exe TFKE.exe File created C:\windows\system\RLTX.exe PNAV.exe File created C:\windows\system\RVCRR.exe.bat RLTX.exe File opened for modification C:\windows\system\UDNMVTC.exe XYHPO.exe File created C:\windows\MRNRNBS.exe KTLPHN.exe File opened for modification C:\windows\MRNRNBS.exe KTLPHN.exe File created C:\windows\BZCZO.exe.bat CPCY.exe File created C:\windows\system\XUGC.exe KJCWJ.exe File created C:\windows\OZO.exe DHLURV.exe File created C:\windows\system\PTP.exe BITS.exe File created C:\windows\HNYB.exe UCCDS.exe File created C:\windows\system\GZOVQ.exe 2026-09-24_0e9a8badec6abf480a2ce06a4c125db9_elex_emotet_stop.exe File opened for modification C:\windows\HLIBT.exe TFKE.exe File created C:\windows\system\KZT.exe RVCRR.exe File created C:\windows\system\UDNMVTC.exe XYHPO.exe File opened for modification C:\windows\OZO.exe DHLURV.exe File opened for modification C:\windows\system\BITS.exe OGP.exe File created C:\windows\system\ARAW.exe PTP.exe File opened for modification C:\windows\system\TFKE.exe YSFUCAH.exe File opened for modification C:\windows\system\RLTX.exe PNAV.exe File opened for modification C:\windows\system\RVCRR.exe RLTX.exe File created C:\windows\OZO.exe.bat DHLURV.exe File opened for modification C:\windows\OGP.exe YQQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1636 cmd.exe 1284 cmd.exe 1792 cmd.exe 2908 cmd.exe 3456 cmd.exe 4888 cmd.exe 4664 cmd.exe 4408 cmd.exe 1576 cmd.exe 4608 cmd.exe 4936 cmd.exe 2632 cmd.exe 4992 cmd.exe 2704 cmd.exe 5920 cmd.exe 3604 cmd.exe 2400 cmd.exe 6084 cmd.exe 2432 cmd.exe 4356 cmd.exe 5692 cmd.exe 5992 cmd.exe 3484 cmd.exe 2384 cmd.exe 1432 cmd.exe 3544 cmd.exe 1324 cmd.exe 1192 cmd.exe 2792 cmd.exe 3720 cmd.exe 5320 cmd.exe 2328 cmd.exe 1768 cmd.exe 1508 cmd.exe 3440 cmd.exe 2888 cmd.exe 2300 cmd.exe 5580 cmd.exe 2372 cmd.exe 3844 cmd.exe 5424 cmd.exe 1488 cmd.exe 4912 cmd.exe 200 cmd.exe 4860 cmd.exe 2856 cmd.exe 2796 cmd.exe 4396 cmd.exe 4272 cmd.exe 4536 cmd.exe 5408 cmd.exe 4524 cmd.exe 5432 cmd.exe 1228 cmd.exe 2684 cmd.exe 3108 cmd.exe 2484 cmd.exe 3176 cmd.exe 1132 cmd.exe 4508 cmd.exe 5696 cmd.exe 4432 cmd.exe 4188 cmd.exe 3400 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3452 4600 WerFault.exe 87 1304 1868 WerFault.exe 93 1328 5708 WerFault.exe 99 2000 4920 WerFault.exe 104 1084 4712 WerFault.exe 108 2536 1920 WerFault.exe 114 780 2280 WerFault.exe 119 436 1788 WerFault.exe 123 3120 5728 WerFault.exe 129 2428 2288 WerFault.exe 133 5796 1352 WerFault.exe 138 2952 4640 WerFault.exe 144 6096 2036 WerFault.exe 148 1456 5740 WerFault.exe 153 944 2144 WerFault.exe 158 200 5468 WerFault.exe 163 4160 4300 WerFault.exe 169 5652 6056 WerFault.exe 174 3392 3736 WerFault.exe 178 5592 5780 WerFault.exe 183 6084 4332 WerFault.exe 189 4124 5952 WerFault.exe 193 3084 5600 WerFault.exe 198 1232 3536 WerFault.exe 203 1584 3364 WerFault.exe 208 5700 2096 WerFault.exe 214 568 2256 WerFault.exe 219 1748 2628 WerFault.exe 223 720 4312 WerFault.exe 228 5808 3292 WerFault.exe 233 2336 924 WerFault.exe 239 2020 5100 WerFault.exe 243 1456 3572 WerFault.exe 248 1656 2736 WerFault.exe 253 1120 6004 WerFault.exe 258 2028 3192 WerFault.exe 263 5360 2816 WerFault.exe 268 4720 1468 WerFault.exe 274 1912 1616 WerFault.exe 278 2584 3452 WerFault.exe 283 2424 4360 WerFault.exe 288 240 4532 WerFault.exe 293 5852 1412 WerFault.exe 298 3548 1392 WerFault.exe 304 3844 5820 WerFault.exe 309 1812 5700 WerFault.exe 314 1324 5248 WerFault.exe 319 436 4844 WerFault.exe 324 1260 1436 WerFault.exe 330 4124 1992 WerFault.exe 334 4684 480 WerFault.exe 339 3104 5976 WerFault.exe 345 4964 2876 WerFault.exe 350 5624 5716 WerFault.exe 354 5824 5304 WerFault.exe 359 2064 3980 WerFault.exe 364 5476 5632 WerFault.exe 369 1072 3708 WerFault.exe 374 6068 2148 WerFault.exe 380 4684 2424 WerFault.exe 384 5620 5112 WerFault.exe 389 4744 6136 WerFault.exe 394 1584 4228 WerFault.exe 399 3988 724 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GGHAHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDNMVTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWRWTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJCWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BITS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLIBT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INBVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYHPO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTLPHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RLTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVDRJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMNPOSK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DHLURV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ARAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPCY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZCZO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZOVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIJDSH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PNAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSFUCAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-24_0e9a8badec6abf480a2ce06a4c125db9_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MRNRNBS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXKPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVCRR.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4600 2026-09-24_0e9a8badec6abf480a2ce06a4c125db9_elex_emotet_stop.exe 4600 2026-09-24_0e9a8badec6abf480a2ce06a4c125db9_elex_emotet_stop.exe 1868 GZOVQ.exe 1868 GZOVQ.exe 5708 YSFUCAH.exe 5708 YSFUCAH.exe 4920 TFKE.exe 4920 TFKE.exe 4712 HLIBT.exe 4712 HLIBT.exe 1920 JIJDSH.exe 1920 JIJDSH.exe 2280 GGHAHJ.exe 2280 GGHAHJ.exe 1788 CMNPOSK.exe 1788 CMNPOSK.exe 5728 HWRWTK.exe 5728 HWRWTK.exe 2288 PHR.exe 2288 PHR.exe 1352 CSV.exe 1352 CSV.exe 4640 WQP.exe 4640 WQP.exe 2036 PNAV.exe 2036 PNAV.exe 5740 RLTX.exe 5740 RLTX.exe 2144 RVCRR.exe 2144 RVCRR.exe 5468 KZT.exe 5468 KZT.exe 4300 KJCWJ.exe 4300 KJCWJ.exe 6056 XUGC.exe 6056 XUGC.exe 3736 INBVO.exe 3736 INBVO.exe 5780 IXKPC.exe 5780 IXKPC.exe 4332 KVDRJS.exe 4332 KVDRJS.exe 5952 XYHPO.exe 5952 XYHPO.exe 5600 UDNMVTC.exe 5600 UDNMVTC.exe 3536 KTLPHN.exe 3536 KTLPHN.exe 3364 MRNRNBS.exe 3364 MRNRNBS.exe 2096 DHLURV.exe 2096 DHLURV.exe 2256 OZO.exe 2256 OZO.exe 2628 HFA.exe 2628 HFA.exe 4312 YQQ.exe 4312 YQQ.exe 3292 OGP.exe 3292 OGP.exe 924 BITS.exe 924 BITS.exe 5100 PTP.exe 5100 PTP.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4600 2026-09-24_0e9a8badec6abf480a2ce06a4c125db9_elex_emotet_stop.exe 4600 2026-09-24_0e9a8badec6abf480a2ce06a4c125db9_elex_emotet_stop.exe 1868 GZOVQ.exe 1868 GZOVQ.exe 5708 YSFUCAH.exe 5708 YSFUCAH.exe 4920 TFKE.exe 4920 TFKE.exe 4712 HLIBT.exe 4712 HLIBT.exe 1920 JIJDSH.exe 1920 JIJDSH.exe 2280 GGHAHJ.exe 2280 GGHAHJ.exe 1788 CMNPOSK.exe 1788 CMNPOSK.exe 5728 HWRWTK.exe 5728 HWRWTK.exe 2288 PHR.exe 2288 PHR.exe 1352 CSV.exe 1352 CSV.exe 4640 WQP.exe 4640 WQP.exe 2036 PNAV.exe 2036 PNAV.exe 5740 RLTX.exe 5740 RLTX.exe 2144 RVCRR.exe 2144 RVCRR.exe 5468 KZT.exe 5468 KZT.exe 4300 KJCWJ.exe 4300 KJCWJ.exe 6056 XUGC.exe 6056 XUGC.exe 3736 INBVO.exe 3736 INBVO.exe 5780 IXKPC.exe 5780 IXKPC.exe 4332 KVDRJS.exe 4332 KVDRJS.exe 5952 XYHPO.exe 5952 XYHPO.exe 5600 UDNMVTC.exe 5600 UDNMVTC.exe 3536 KTLPHN.exe 3536 KTLPHN.exe 3364 MRNRNBS.exe 3364 MRNRNBS.exe 2096 DHLURV.exe 2096 DHLURV.exe 2256 OZO.exe 2256 OZO.exe 2628 HFA.exe 2628 HFA.exe 4312 YQQ.exe 4312 YQQ.exe 3292 OGP.exe 3292 OGP.exe 924 BITS.exe 924 BITS.exe 5100 PTP.exe 5100 PTP.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4600 wrote to memory of 3124 4600 2026-09-24_0e9a8badec6abf480a2ce06a4c125db9_elex_emotet_stop.exe 89 PID 3124 wrote to memory of 1868 3124 cmd.exe 93 PID 1868 wrote to memory of 2432 1868 GZOVQ.exe 95 PID 2432 wrote to memory of 5708 2432 cmd.exe 99 PID 5708 wrote to memory of 5676 5708 YSFUCAH.exe 100 PID 5676 wrote to memory of 4920 5676 cmd.exe 104 PID 4920 wrote to memory of 1448 4920 TFKE.exe 105 PID 1448 wrote to memory of 4712 1448 cmd.exe 108 PID 4712 wrote to memory of 3412 4712 HLIBT.exe 110 PID 3412 wrote to memory of 1920 3412 cmd.exe 114 PID 1920 wrote to memory of 3880 1920 JIJDSH.exe 115 PID 3880 wrote to memory of 2280 3880 cmd.exe 119 PID 2280 wrote to memory of 1132 2280 GGHAHJ.exe 120 PID 1132 wrote to memory of 1788 1132 cmd.exe 123 PID 1788 wrote to memory of 4676 1788 CMNPOSK.exe 125 PID 4676 wrote to memory of 5728 4676 cmd.exe 129 PID 5728 wrote to memory of 4508 5728 HWRWTK.exe 130 PID 4508 wrote to memory of 2288 4508 cmd.exe 133 PID 2288 wrote to memory of 5696 2288 PHR.exe 135 PID 5696 wrote to memory of 1352 5696 cmd.exe 138 PID 1352 wrote to memory of 5580 1352 CSV.exe 140 PID 5580 wrote to memory of 4640 5580 cmd.exe 144 PID 4640 wrote to memory of 4812 4640 WQP.exe 145 PID 4812 wrote to memory of 2036 4812 cmd.exe 148 PID 2036 wrote to memory of 236 2036 PNAV.exe 150 PID 236 wrote to memory of 5740 236 cmd.exe 153 PID 5740 wrote to memory of 4340 5740 RLTX.exe 155 PID 4340 wrote to memory of 2144 4340 cmd.exe 158 PID 2144 wrote to memory of 2988 2144 RVCRR.exe 160 PID 2988 wrote to memory of 5468 2988 cmd.exe 163 PID 5468 wrote to memory of 4616 5468 KZT.exe 165 PID 4616 wrote to memory of 4300 4616 cmd.exe 169 PID 4300 wrote to memory of 2372 4300 KJCWJ.exe 170 PID 2372 wrote to memory of 6056 2372 cmd.exe 174 PID 6056 wrote to memory of 4788 6056 XUGC.exe 175 PID 4788 wrote to memory of 3736 4788 cmd.exe 178 PID 3736 wrote to memory of 5064 3736 INBVO.exe 180 PID 5064 wrote to memory of 5780 5064 cmd.exe 183 PID 5780 wrote to memory of 2428 5780 IXKPC.exe 185 PID 2428 wrote to memory of 4332 2428 cmd.exe 189 PID 4332 wrote to memory of 2548 4332 KVDRJS.exe 190 PID 2548 wrote to memory of 5952 2548 cmd.exe 193 PID 5952 wrote to memory of 2300 5952 XYHPO.exe 195 PID 2300 wrote to memory of 5600 2300 cmd.exe 198 PID 5600 wrote to memory of 2616 5600 UDNMVTC.exe 200 PID 2616 wrote to memory of 3536 2616 cmd.exe 203 PID 3536 wrote to memory of 4688 3536 KTLPHN.exe 205 PID 4688 wrote to memory of 3364 4688 cmd.exe 208 PID 3364 wrote to memory of 1084 3364 MRNRNBS.exe 210 PID 1084 wrote to memory of 2096 1084 cmd.exe 214 PID 2096 wrote to memory of 2264 2096 DHLURV.exe 215 PID 2264 wrote to memory of 2256 2264 cmd.exe 219 PID 2256 wrote to memory of 5772 2256 OZO.exe 220 PID 5772 wrote to memory of 2628 5772 cmd.exe 223 PID 2628 wrote to memory of 1248 2628 HFA.exe 225 PID 1248 wrote to memory of 4312 1248 cmd.exe 228 PID 4312 wrote to memory of 1636 4312 YQQ.exe 230 PID 1636 wrote to memory of 3292 1636 cmd.exe 233 PID 3292 wrote to memory of 3544 3292 OGP.exe 235 PID 3544 wrote to memory of 924 3544 cmd.exe 239 PID 924 wrote to memory of 3028 924 BITS.exe 240 PID 3028 wrote to memory of 5100 3028 cmd.exe 243 PID 5100 wrote to memory of 5060 5100 PTP.exe 245 PID 5060 wrote to memory of 3572 5060 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_0e9a8badec6abf480a2ce06a4c125db9_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_0e9a8badec6abf480a2ce06a4c125db9_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GZOVQ.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\windows\system\GZOVQ.exeC:\windows\system\GZOVQ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YSFUCAH.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\windows\YSFUCAH.exeC:\windows\YSFUCAH.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFKE.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\windows\system\TFKE.exeC:\windows\system\TFKE.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLIBT.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\windows\HLIBT.exeC:\windows\HLIBT.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JIJDSH.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\windows\SysWOW64\JIJDSH.exeC:\windows\system32\JIJDSH.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GGHAHJ.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\windows\SysWOW64\GGHAHJ.exeC:\windows\system32\GGHAHJ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMNPOSK.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\windows\CMNPOSK.exeC:\windows\CMNPOSK.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWRWTK.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\windows\SysWOW64\HWRWTK.exeC:\windows\system32\HWRWTK.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHR.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\windows\system\PHR.exeC:\windows\system\PHR.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CSV.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\windows\system\CSV.exeC:\windows\system\CSV.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQP.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\windows\system\WQP.exeC:\windows\system\WQP.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PNAV.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\windows\SysWOW64\PNAV.exeC:\windows\system32\PNAV.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLTX.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:236 -
C:\windows\system\RLTX.exeC:\windows\system\RLTX.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RVCRR.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\windows\system\RVCRR.exeC:\windows\system\RVCRR.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KZT.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\windows\system\KZT.exeC:\windows\system\KZT.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJCWJ.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\windows\SysWOW64\KJCWJ.exeC:\windows\system32\KJCWJ.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUGC.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\windows\system\XUGC.exeC:\windows\system\XUGC.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INBVO.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\windows\SysWOW64\INBVO.exeC:\windows\system32\INBVO.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IXKPC.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\windows\system\IXKPC.exeC:\windows\system\IXKPC.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVDRJS.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\windows\SysWOW64\KVDRJS.exeC:\windows\system32\KVDRJS.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYHPO.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\windows\XYHPO.exeC:\windows\XYHPO.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDNMVTC.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\windows\system\UDNMVTC.exeC:\windows\system\UDNMVTC.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTLPHN.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\windows\system\KTLPHN.exeC:\windows\system\KTLPHN.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MRNRNBS.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\windows\MRNRNBS.exeC:\windows\MRNRNBS.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DHLURV.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\windows\DHLURV.exeC:\windows\DHLURV.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OZO.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\windows\OZO.exeC:\windows\OZO.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HFA.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\windows\SysWOW64\HFA.exeC:\windows\system32\HFA.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQQ.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\windows\YQQ.exeC:\windows\YQQ.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OGP.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\windows\OGP.exeC:\windows\OGP.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BITS.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\windows\system\BITS.exeC:\windows\system\BITS.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PTP.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\windows\system\PTP.exeC:\windows\system\PTP.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ARAW.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\windows\system\ARAW.exeC:\windows\system\ARAW.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CPCY.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5996 -
C:\windows\SysWOW64\CPCY.exeC:\windows\system32\CPCY.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZCZO.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:4988 -
C:\windows\BZCZO.exeC:\windows\BZCZO.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCCDS.exe.bat" "70⤵PID:4128
-
C:\windows\SysWOW64\UCCDS.exeC:\windows\system32\UCCDS.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNYB.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4408 -
C:\windows\HNYB.exeC:\windows\HNYB.exe73⤵PID:2816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYGD.exe.bat" "74⤵PID:3348
-
C:\windows\HYGD.exeC:\windows\HYGD.exe75⤵PID:1468
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDMASP.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2792 -
C:\windows\EDMASP.exeC:\windows\EDMASP.exe77⤵PID:1616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTLDE.exe.bat" "78⤵PID:2596
-
C:\windows\SysWOW64\UTLDE.exeC:\windows\system32\UTLDE.exe79⤵PID:3452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NWCGA.exe.bat" "80⤵PID:1336
-
C:\windows\system\NWCGA.exeC:\windows\system\NWCGA.exe81⤵PID:4360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NHLIO.exe.bat" "82⤵PID:4136
-
C:\windows\NHLIO.exeC:\windows\NHLIO.exe83⤵PID:4532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YZOAWYJ.exe.bat" "84⤵PID:5984
-
C:\windows\YZOAWYJ.exeC:\windows\YZOAWYJ.exe85⤵PID:1412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPNDAK.exe.bat" "86⤵PID:3828
-
C:\windows\WPNDAK.exeC:\windows\WPNDAK.exe87⤵PID:1392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BARKF.exe.bat" "88⤵PID:5660
-
C:\windows\system\BARKF.exeC:\windows\system\BARKF.exe89⤵PID:5820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YFPHULN.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4432 -
C:\windows\YFPHULN.exeC:\windows\YFPHULN.exe91⤵PID:5700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XVVKYFC.exe.bat" "92⤵PID:964
-
C:\windows\system\XVVKYFC.exeC:\windows\system\XVVKYFC.exe93⤵PID:5248
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDQSBEY.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4992 -
C:\windows\SysWOW64\SDQSBEY.exeC:\windows\system32\SDQSBEY.exe95⤵PID:4844
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GOUYOV.exe.bat" "96⤵PID:1112
-
C:\windows\GOUYOV.exeC:\windows\GOUYOV.exe97⤵PID:1436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LRQWT.exe.bat" "98⤵PID:6088
-
C:\windows\system\LRQWT.exeC:\windows\system\LRQWT.exe99⤵PID:1992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKYYHYB.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5432 -
C:\windows\SysWOW64\TKYYHYB.exeC:\windows\system32\TKYYHYB.exe101⤵PID:480
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PHWNOAD.exe.bat" "102⤵PID:1844
-
C:\windows\SysWOW64\PHWNOAD.exeC:\windows\system32\PHWNOAD.exe103⤵PID:5976
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RFX.exe.bat" "104⤵PID:4292
-
C:\windows\system\RFX.exeC:\windows\system\RFX.exe105⤵PID:2876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RXG.exe.bat" "106⤵PID:3020
-
C:\windows\SysWOW64\RXG.exeC:\windows\system32\RXG.exe107⤵PID:5716
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TNZ.exe.bat" "108⤵PID:1736
-
C:\windows\TNZ.exeC:\windows\TNZ.exe109⤵PID:5304
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLG.exe.bat" "110⤵
- Executes a command shell one-liner
PID:2704 -
C:\windows\JLG.exeC:\windows\JLG.exe111⤵PID:3980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XOCU.exe.bat" "112⤵
- Executes a command shell one-liner
PID:200 -
C:\windows\XOCU.exeC:\windows\XOCU.exe113⤵PID:5632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMD.exe.bat" "114⤵PID:3356
-
C:\windows\system\ZMD.exeC:\windows\system\ZMD.exe115⤵PID:3708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJH.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4188 -
C:\windows\SysWOW64\KJH.exeC:\windows\system32\KJH.exe117⤵PID:2148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XULAW.exe.bat" "118⤵
- Executes a command shell one-liner
PID:1228 -
C:\windows\SysWOW64\XULAW.exeC:\windows\system32\XULAW.exe119⤵PID:2424
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CXHZ.exe.bat" "120⤵
- Executes a command shell one-liner
PID:4396 -
C:\windows\CXHZ.exeC:\windows\CXHZ.exe121⤵PID:5112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-