Analysis
- max time kernel
88s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 16:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-23_03480020eaddbbb356995c14b818f3a1_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-23_03480020eaddbbb356995c14b818f3a1_elex_emotet_stop.exe
- Size 208KB
- Sample260925-tz73dsff76
- SHA256 a3c5f877b8c25dbfbe4f2365ce4cf88038e68c0abad265350e984874bf32acb1
- MD5 03480020eaddbbb356995c14b818f3a1
- SHA1 eb05e4a726508d1bcc8880b582242f59d9304479
- SHA512 2133ea46a152cedecd13b04f676dedc35d04b9330062e3c5bfe3dfc6281990d641c4ed28abb3655595490d8d43eb5cc30b7c5a15672fe9d256fa1efb47fe12f1
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFleKL+LOfI4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFleS+LOQkEj1
- TLSH T13D247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6056 IRESCLQ.exe 4512 THAHKZN.exe 2572 OFMKV.exe 5528 SVBKHOD.exe 1340 WDHS.exe 2184 WRZHV.exe 3388 CRHVENV.exe 2636 IRPIV.exe 5424 RSRNYN.exe 4828 UFW.exe 2756 YVCXV.exe 4856 GGHAHJ.exe 3132 ABMJJJW.exe 6128 DOD.exe 4276 NMRFKKN.exe 2536 WVLK.exe 5048 RIPUYI.exe 2972 AIRZBNG.exe 3956 PLBLU.exe 2644 HMD.exe 4868 QMFV.exe 824 FPOAUPT.exe 3260 ACTR.exe 4472 WIZG.exe 1136 TFFDS.exe 1568 XQD.exe 2768 GWNQ.exe 1776 MRNRNBS.exe 2752 DEX.exe 6108 DKPYE.exe 4308 SFZCPY.exe 4356 EXCVXFY.exe 4988 KYJJG.exe 2036 ITIJLKX.exe 4636 ZGT.exe 4344 ZMTQ.exe 5652 ZPX.exe 2088 WUV.exe 1708 PQHMUK.exe 5536 JDD.exe 5456 EYIFP.exe 5592 KYQTY.exe 2872 XBUZDV.exe 3820 IUP.exe 2336 KSCFT.exe 4784 NFHODSF.exe 3644 DYKEMY.exe 932 VDUW.exe 5572 NGYAHL.exe 2392 FOAFKQB.exe 108 EZJG.exe 2436 FCNCEK.exe 4132 APS.exe 2144 LIVE.exe 4580 UIPJA.exe 4560 AIWXJZY.exe 3268 VEBG.exe 3864 GWEZB.exe 5788 SEL.exe 2520 FPBYCB.exe 2588 ACY.exe 4080 AIY.exe 4808 GIGRWJ.exe 2432 RBJCFYM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\VEBG.exe.bat AIWXJZY.exe File created C:\windows\SysWOW64\FPBYCB.exe.bat SEL.exe File created C:\windows\SysWOW64\LJWOCE.exe.bat UQTYTQM.exe File opened for modification C:\windows\SysWOW64\DKXNSY.exe JXSE.exe File created C:\windows\SysWOW64\IXMDE.exe DWE.exe File opened for modification C:\windows\SysWOW64\IXMDE.exe DWE.exe File opened for modification C:\windows\SysWOW64\APW.exe KUNFK.exe File created C:\windows\SysWOW64\ACTR.exe FPOAUPT.exe File created C:\windows\SysWOW64\EXCVXFY.exe SFZCPY.exe File created C:\windows\SysWOW64\ACY.exe.bat FPBYCB.exe File created C:\windows\SysWOW64\SDOPJQ.exe JPE.exe File opened for modification C:\windows\SysWOW64\EXETRBV.exe WJZ.exe File created C:\windows\SysWOW64\UARPJ.exe.bat UVRB.exe File created C:\windows\SysWOW64\AYV.exe.bat RBP.exe File created C:\windows\SysWOW64\IKI.exe.bat OPDGGX.exe File created C:\windows\SysWOW64\YVCXV.exe.bat UFW.exe File created C:\windows\SysWOW64\WIZG.exe ACTR.exe File opened for modification C:\windows\SysWOW64\AIWXJZY.exe UIPJA.exe File opened for modification C:\windows\SysWOW64\ACY.exe FPBYCB.exe File created C:\windows\SysWOW64\DKXNSY.exe JXSE.exe File created C:\windows\SysWOW64\IKI.exe OPDGGX.exe File created C:\windows\SysWOW64\AKKVU.exe IKI.exe File opened for modification C:\windows\SysWOW64\UYP.exe AKKVU.exe File created C:\windows\SysWOW64\GGHAHJ.exe GAPMX.exe File opened for modification C:\windows\SysWOW64\ABMJJJW.exe GGHAHJ.exe File opened for modification C:\windows\SysWOW64\AIRZBNG.exe RIPUYI.exe File opened for modification C:\windows\SysWOW64\JDD.exe PQHMUK.exe File created C:\windows\SysWOW64\JPE.exe JKDIRHH.exe File opened for modification C:\windows\SysWOW64\UARPJ.exe UVRB.exe File created C:\windows\SysWOW64\AKKVU.exe.bat IKI.exe File created C:\windows\SysWOW64\WDHS.exe.bat SVBKHOD.exe File created C:\windows\SysWOW64\YVCXV.exe UFW.exe File created C:\windows\SysWOW64\ZMTQ.exe.bat ZGT.exe File opened for modification C:\windows\SysWOW64\NFHODSF.exe KSCFT.exe File opened for modification C:\windows\SysWOW64\VRPK.exe RBJCFYM.exe File created C:\windows\SysWOW64\VRPK.exe.bat RBJCFYM.exe File created C:\windows\SysWOW64\LJWOCE.exe UQTYTQM.exe File opened for modification C:\windows\SysWOW64\GGHAHJ.exe GAPMX.exe File created C:\windows\SysWOW64\ABMJJJW.exe.bat GGHAHJ.exe File created C:\windows\SysWOW64\NMRFKKN.exe.bat DOD.exe File opened for modification C:\windows\SysWOW64\ACTR.exe FPOAUPT.exe File opened for modification C:\windows\SysWOW64\EXCVXFY.exe SFZCPY.exe File opened for modification C:\windows\SysWOW64\AYV.exe RBP.exe File created C:\windows\SysWOW64\OPDGGX.exe.bat TBZXW.exe File opened for modification C:\windows\SysWOW64\SVBKHOD.exe OFMKV.exe File opened for modification C:\windows\SysWOW64\WDHS.exe SVBKHOD.exe File opened for modification C:\windows\SysWOW64\RIPUYI.exe WVLK.exe File opened for modification C:\windows\SysWOW64\TFFDS.exe WIZG.exe File created C:\windows\SysWOW64\JDD.exe.bat PQHMUK.exe File opened for modification C:\windows\SysWOW64\UIPJA.exe LIVE.exe File created C:\windows\SysWOW64\OPDGGX.exe TBZXW.exe File opened for modification C:\windows\SysWOW64\IKI.exe OPDGGX.exe File opened for modification C:\windows\SysWOW64\YVCXV.exe UFW.exe File created C:\windows\SysWOW64\AIRZBNG.exe.bat RIPUYI.exe File created C:\windows\SysWOW64\ACTR.exe.bat FPOAUPT.exe File created C:\windows\SysWOW64\AYV.exe RBP.exe File opened for modification C:\windows\SysWOW64\OPDGGX.exe TBZXW.exe File opened for modification C:\windows\SysWOW64\FPBYCB.exe SEL.exe File created C:\windows\SysWOW64\RIPUYI.exe WVLK.exe File created C:\windows\SysWOW64\TFFDS.exe.bat WIZG.exe File opened for modification C:\windows\SysWOW64\ZMTQ.exe ZGT.exe File created C:\windows\SysWOW64\VDUW.exe DYKEMY.exe File opened for modification C:\windows\SysWOW64\VDUW.exe DYKEMY.exe File created C:\windows\SysWOW64\UIPJA.exe.bat LIVE.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\KYQTY.exe EYIFP.exe File created C:\windows\ITIJLKX.exe.bat KYJJG.exe File opened for modification C:\windows\FCNCEK.exe EZJG.exe File created C:\windows\system\SFR.exe HMWZ.exe File created C:\windows\system\JKDIRHH.exe.bat MEYLKFF.exe File created C:\windows\IVVJ.exe DKXNSY.exe File created C:\windows\GWNQ.exe.bat XQD.exe File created C:\windows\THAHKZN.exe IRESCLQ.exe File created C:\windows\MZMPAOA.exe QUGSTE.exe File created C:\windows\UDBTG.exe.bat APW.exe File created C:\windows\system\UFW.exe RSRNYN.exe File created C:\windows\system\DEX.exe MRNRNBS.exe File created C:\windows\EYIFP.exe JDD.exe File created C:\windows\FCNCEK.exe.bat EZJG.exe File created C:\windows\system\WNG.exe.bat SFR.exe File created C:\windows\RADBB.exe.bat WNG.exe File created C:\windows\system\QUGSTE.exe.bat OWA.exe File created C:\windows\system\DEX.exe.bat MRNRNBS.exe File created C:\windows\IUP.exe.bat XBUZDV.exe File created C:\windows\system\GVU.exe RADBB.exe File opened for modification C:\windows\OWA.exe LJWOCE.exe File opened for modification C:\windows\system\QUGSTE.exe OWA.exe File created C:\windows\system\EYXKYZJ.exe.bat UARPJ.exe File created C:\windows\PQHMUK.exe.bat WUV.exe File created C:\windows\system\DYKEMY.exe.bat NFHODSF.exe File opened for modification C:\windows\system\TBZXW.exe AYV.exe File created C:\windows\system\ZGT.exe.bat ITIJLKX.exe File created C:\windows\JXSE.exe.bat MZMPAOA.exe File opened for modification C:\windows\EYIFP.exe JDD.exe File created C:\windows\EYIFP.exe.bat JDD.exe File created C:\windows\system\SEL.exe GWEZB.exe File opened for modification C:\windows\system\WNG.exe SFR.exe File created C:\windows\system\ZAURXEJ.exe EXETRBV.exe File opened for modification C:\windows\THAHKZN.exe IRESCLQ.exe File created C:\windows\OFMKV.exe.bat THAHKZN.exe File opened for modification C:\windows\IRPIV.exe CRHVENV.exe File created C:\windows\system\PLBLU.exe.bat AIRZBNG.exe File created C:\windows\system\WJZ.exe ZJPK.exe File opened for modification C:\windows\system\DOD.exe ABMJJJW.exe File created C:\windows\SFZCPY.exe DKPYE.exe File created C:\windows\system\RBJCFYM.exe.bat GIGRWJ.exe File created C:\windows\system\EYXKYZJ.exe UARPJ.exe File created C:\windows\system\EMJHRTZ.exe.bat TTOOJ.exe File opened for modification C:\windows\system\KSRJC.exe CMRU.exe File created C:\windows\system\QMFV.exe.bat HMD.exe File created C:\windows\system\SRTCAF.exe OJM.exe File opened for modification C:\windows\DWE.exe BYLV.exe File created C:\windows\system\KSRJC.exe CMRU.exe File created C:\windows\RBP.exe.bat SQER.exe File created C:\windows\IRPIV.exe CRHVENV.exe File created C:\windows\system\XQD.exe.bat TFFDS.exe File created C:\windows\system\KSCFT.exe IUP.exe File opened for modification C:\windows\FOAFKQB.exe NGYAHL.exe File created C:\windows\system\UQTYTQM.exe SDOPJQ.exe File created C:\windows\KUNFK.exe.bat IXMDE.exe File created C:\windows\IUP.exe XBUZDV.exe File opened for modification C:\windows\system\APS.exe FCNCEK.exe File created C:\windows\OJM.exe.bat GVU.exe File created C:\windows\OWA.exe LJWOCE.exe File created C:\windows\WUV.exe.bat ZPX.exe File created C:\windows\system\RBJCFYM.exe GIGRWJ.exe File opened for modification C:\windows\MZMPAOA.exe QUGSTE.exe File opened for modification C:\windows\system\ZAURXEJ.exe EXETRBV.exe File opened for modification C:\windows\system\DVVFHY.exe KSRJC.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3048 cmd.exe 1088 cmd.exe 3480 cmd.exe 5972 cmd.exe 1792 cmd.exe 5956 cmd.exe 2780 cmd.exe 1460 cmd.exe 3368 cmd.exe 1812 cmd.exe 4364 cmd.exe 1732 cmd.exe 5432 cmd.exe 300 cmd.exe 4872 cmd.exe 4536 cmd.exe 4804 cmd.exe 5748 cmd.exe 4440 cmd.exe 5844 cmd.exe 4644 cmd.exe 2544 cmd.exe 5072 cmd.exe 3004 cmd.exe 3016 cmd.exe 2784 cmd.exe 5568 cmd.exe 1628 cmd.exe 4788 cmd.exe 2808 cmd.exe 600 cmd.exe 2416 cmd.exe 4264 cmd.exe 3352 cmd.exe 2136 cmd.exe 3472 cmd.exe 4488 cmd.exe 5388 cmd.exe 4776 cmd.exe 2660 cmd.exe 2948 cmd.exe 4888 cmd.exe 2552 cmd.exe 4964 cmd.exe 844 cmd.exe 3836 cmd.exe 4144 cmd.exe 5344 cmd.exe 5076 cmd.exe 2964 cmd.exe 1940 cmd.exe 1952 cmd.exe 2140 cmd.exe 3704 cmd.exe 1688 cmd.exe 1256 cmd.exe 4604 cmd.exe 4092 cmd.exe 3228 cmd.exe 928 cmd.exe 1996 cmd.exe 3808 cmd.exe 5068 cmd.exe 4200 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5148 3108 WerFault.exe 88 4232 6056 WerFault.exe 93 3456 4512 WerFault.exe 99 4384 2572 WerFault.exe 104 3676 5528 WerFault.exe 109 2768 1340 WerFault.exe 114 3548 2184 WerFault.exe 119 5036 3388 WerFault.exe 124 1724 2636 WerFault.exe 129 2644 5424 WerFault.exe 134 3184 4828 WerFault.exe 139 928 2756 WerFault.exe 144 4896 3528 WerFault.exe 149 4788 4856 WerFault.exe 154 1712 3132 WerFault.exe 159 1296 6128 WerFault.exe 164 2952 4276 WerFault.exe 169 4784 2536 WerFault.exe 174 2708 5048 WerFault.exe 179 3716 2972 WerFault.exe 184 5488 3956 WerFault.exe 189 5248 2644 WerFault.exe 194 3472 4868 WerFault.exe 199 1976 824 WerFault.exe 204 3360 3260 WerFault.exe 209 1848 4472 WerFault.exe 214 2156 1136 WerFault.exe 219 4784 1568 WerFault.exe 224 3068 2768 WerFault.exe 229 5920 1776 WerFault.exe 234 3420 2752 WerFault.exe 239 3680 6108 WerFault.exe 244 4408 4308 WerFault.exe 249 4216 4356 WerFault.exe 254 3456 4988 WerFault.exe 259 5040 2036 WerFault.exe 264 4708 4636 WerFault.exe 269 5736 4344 WerFault.exe 274 5844 5652 WerFault.exe 279 1360 2088 WerFault.exe 285 4884 1708 WerFault.exe 290 3692 5536 WerFault.exe 295 5568 5456 WerFault.exe 300 4496 5592 WerFault.exe 305 4452 2872 WerFault.exe 310 4628 3820 WerFault.exe 315 3584 2336 WerFault.exe 320 1884 4784 WerFault.exe 325 5532 3644 WerFault.exe 330 3844 932 WerFault.exe 335 4660 5572 WerFault.exe 340 6096 2392 WerFault.exe 345 4088 108 WerFault.exe 350 2404 2436 WerFault.exe 355 3672 4132 WerFault.exe 360 2800 2144 WerFault.exe 365 2008 4580 WerFault.exe 370 3832 4560 WerFault.exe 375 5732 3268 WerFault.exe 380 1228 3864 WerFault.exe 385 3292 5788 WerFault.exe 390 1768 2520 WerFault.exe 395 2044 2588 WerFault.exe 400 4316 4080 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGYAHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMWZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WNG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JPE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPOAUPT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSRJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XQD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQHMUK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPBYCB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWNQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DWPZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UYP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYJJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIWXJZY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQTYTQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYKEMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ITIJLKX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABMJJJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYXKYZJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRZHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJWOCE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMJHRTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIPUYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRHVENV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RADBB.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3108 2026-09-23_03480020eaddbbb356995c14b818f3a1_elex_emotet_stop.exe 3108 2026-09-23_03480020eaddbbb356995c14b818f3a1_elex_emotet_stop.exe 6056 IRESCLQ.exe 6056 IRESCLQ.exe 4512 THAHKZN.exe 4512 THAHKZN.exe 2572 OFMKV.exe 2572 OFMKV.exe 5528 SVBKHOD.exe 5528 SVBKHOD.exe 1340 WDHS.exe 1340 WDHS.exe 2184 WRZHV.exe 2184 WRZHV.exe 3388 CRHVENV.exe 3388 CRHVENV.exe 2636 IRPIV.exe 2636 IRPIV.exe 5424 RSRNYN.exe 5424 RSRNYN.exe 4828 UFW.exe 4828 UFW.exe 3528 GAPMX.exe 3528 GAPMX.exe 4856 GGHAHJ.exe 4856 GGHAHJ.exe 3132 ABMJJJW.exe 3132 ABMJJJW.exe 6128 DOD.exe 6128 DOD.exe 4276 NMRFKKN.exe 4276 NMRFKKN.exe 2536 WVLK.exe 2536 WVLK.exe 5048 RIPUYI.exe 5048 RIPUYI.exe 2972 AIRZBNG.exe 2972 AIRZBNG.exe 3956 PLBLU.exe 3956 PLBLU.exe 2644 HMD.exe 2644 HMD.exe 4868 QMFV.exe 4868 QMFV.exe 824 FPOAUPT.exe 824 FPOAUPT.exe 3260 ACTR.exe 3260 ACTR.exe 4472 WIZG.exe 4472 WIZG.exe 1136 TFFDS.exe 1136 TFFDS.exe 1568 XQD.exe 1568 XQD.exe 2768 GWNQ.exe 2768 GWNQ.exe 1776 MRNRNBS.exe 1776 MRNRNBS.exe 2752 DEX.exe 2752 DEX.exe 6108 DKPYE.exe 6108 DKPYE.exe 4308 SFZCPY.exe 4308 SFZCPY.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3108 2026-09-23_03480020eaddbbb356995c14b818f3a1_elex_emotet_stop.exe 3108 2026-09-23_03480020eaddbbb356995c14b818f3a1_elex_emotet_stop.exe 6056 IRESCLQ.exe 6056 IRESCLQ.exe 4512 THAHKZN.exe 4512 THAHKZN.exe 2572 OFMKV.exe 2572 OFMKV.exe 5528 SVBKHOD.exe 5528 SVBKHOD.exe 1340 WDHS.exe 1340 WDHS.exe 2184 WRZHV.exe 2184 WRZHV.exe 3388 CRHVENV.exe 3388 CRHVENV.exe 2636 IRPIV.exe 2636 IRPIV.exe 5424 RSRNYN.exe 5424 RSRNYN.exe 4828 UFW.exe 4828 UFW.exe 3528 GAPMX.exe 3528 GAPMX.exe 4856 GGHAHJ.exe 4856 GGHAHJ.exe 3132 ABMJJJW.exe 3132 ABMJJJW.exe 6128 DOD.exe 6128 DOD.exe 4276 NMRFKKN.exe 4276 NMRFKKN.exe 2536 WVLK.exe 2536 WVLK.exe 5048 RIPUYI.exe 5048 RIPUYI.exe 2972 AIRZBNG.exe 2972 AIRZBNG.exe 3956 PLBLU.exe 3956 PLBLU.exe 2644 HMD.exe 2644 HMD.exe 4868 QMFV.exe 4868 QMFV.exe 824 FPOAUPT.exe 824 FPOAUPT.exe 3260 ACTR.exe 3260 ACTR.exe 4472 WIZG.exe 4472 WIZG.exe 1136 TFFDS.exe 1136 TFFDS.exe 1568 XQD.exe 1568 XQD.exe 2768 GWNQ.exe 2768 GWNQ.exe 1776 MRNRNBS.exe 1776 MRNRNBS.exe 2752 DEX.exe 2752 DEX.exe 6108 DKPYE.exe 6108 DKPYE.exe 4308 SFZCPY.exe 4308 SFZCPY.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3108 wrote to memory of 3424 3108 2026-09-23_03480020eaddbbb356995c14b818f3a1_elex_emotet_stop.exe 89 PID 3424 wrote to memory of 6056 3424 cmd.exe 93 PID 6056 wrote to memory of 2140 6056 IRESCLQ.exe 95 PID 2140 wrote to memory of 4512 2140 cmd.exe 99 PID 4512 wrote to memory of 4624 4512 THAHKZN.exe 100 PID 4624 wrote to memory of 2572 4624 cmd.exe 104 PID 2572 wrote to memory of 5508 2572 OFMKV.exe 105 PID 5508 wrote to memory of 5528 5508 cmd.exe 109 PID 5528 wrote to memory of 3016 5528 SVBKHOD.exe 110 PID 3016 wrote to memory of 1340 3016 cmd.exe 114 PID 1340 wrote to memory of 1612 1340 WDHS.exe 115 PID 1612 wrote to memory of 2184 1612 cmd.exe 119 PID 2184 wrote to memory of 4796 2184 WRZHV.exe 120 PID 4796 wrote to memory of 3388 4796 cmd.exe 124 PID 3388 wrote to memory of 2900 3388 CRHVENV.exe 125 PID 2900 wrote to memory of 2636 2900 cmd.exe 129 PID 2636 wrote to memory of 1996 2636 IRPIV.exe 130 PID 1996 wrote to memory of 5424 1996 cmd.exe 134 PID 5424 wrote to memory of 5956 5424 RSRNYN.exe 135 PID 5956 wrote to memory of 4828 5956 cmd.exe 139 PID 4828 wrote to memory of 5784 4828 UFW.exe 140 PID 5784 wrote to memory of 2756 5784 cmd.exe 144 PID 4592 wrote to memory of 3528 4592 cmd.exe 149 PID 3528 wrote to memory of 1092 3528 GAPMX.exe 150 PID 1092 wrote to memory of 4856 1092 cmd.exe 154 PID 4856 wrote to memory of 5164 4856 GGHAHJ.exe 155 PID 5164 wrote to memory of 3132 5164 cmd.exe 159 PID 3132 wrote to memory of 4548 3132 ABMJJJW.exe 160 PID 4548 wrote to memory of 6128 4548 cmd.exe 164 PID 6128 wrote to memory of 1700 6128 DOD.exe 165 PID 1700 wrote to memory of 4276 1700 cmd.exe 169 PID 4276 wrote to memory of 3704 4276 NMRFKKN.exe 170 PID 3704 wrote to memory of 2536 3704 cmd.exe 174 PID 2536 wrote to memory of 3264 2536 WVLK.exe 175 PID 3264 wrote to memory of 5048 3264 cmd.exe 179 PID 5048 wrote to memory of 4824 5048 RIPUYI.exe 180 PID 4824 wrote to memory of 2972 4824 cmd.exe 184 PID 2972 wrote to memory of 600 2972 AIRZBNG.exe 185 PID 600 wrote to memory of 3956 600 cmd.exe 189 PID 3956 wrote to memory of 4888 3956 PLBLU.exe 190 PID 4888 wrote to memory of 2644 4888 cmd.exe 194 PID 2644 wrote to memory of 5504 2644 HMD.exe 195 PID 5504 wrote to memory of 4868 5504 cmd.exe 199 PID 4868 wrote to memory of 2352 4868 QMFV.exe 200 PID 2352 wrote to memory of 824 2352 cmd.exe 204 PID 824 wrote to memory of 200 824 FPOAUPT.exe 205 PID 200 wrote to memory of 3260 200 cmd.exe 209 PID 3260 wrote to memory of 4208 3260 ACTR.exe 210 PID 4208 wrote to memory of 4472 4208 cmd.exe 214 PID 4472 wrote to memory of 2784 4472 WIZG.exe 215 PID 2784 wrote to memory of 1136 2784 cmd.exe 219 PID 1136 wrote to memory of 1916 1136 TFFDS.exe 220 PID 1916 wrote to memory of 1568 1916 cmd.exe 224 PID 1568 wrote to memory of 2832 1568 XQD.exe 225 PID 2832 wrote to memory of 2768 2832 cmd.exe 229 PID 2768 wrote to memory of 844 2768 GWNQ.exe 230 PID 844 wrote to memory of 1776 844 cmd.exe 234 PID 1776 wrote to memory of 756 1776 MRNRNBS.exe 235 PID 756 wrote to memory of 2752 756 cmd.exe 239 PID 2752 wrote to memory of 1056 2752 DEX.exe 240 PID 1056 wrote to memory of 6108 1056 cmd.exe 244 PID 6108 wrote to memory of 3632 6108 DKPYE.exe 245 PID 3632 wrote to memory of 4308 3632 cmd.exe 249 PID 4308 wrote to memory of 236 4308 SFZCPY.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_03480020eaddbbb356995c14b818f3a1_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_03480020eaddbbb356995c14b818f3a1_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IRESCLQ.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\windows\IRESCLQ.exeC:\windows\IRESCLQ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THAHKZN.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\windows\THAHKZN.exeC:\windows\THAHKZN.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OFMKV.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\windows\OFMKV.exeC:\windows\OFMKV.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVBKHOD.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\windows\SysWOW64\SVBKHOD.exeC:\windows\system32\SVBKHOD.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WDHS.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\windows\SysWOW64\WDHS.exeC:\windows\system32\WDHS.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRZHV.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\windows\system\WRZHV.exeC:\windows\system\WRZHV.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CRHVENV.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\windows\CRHVENV.exeC:\windows\CRHVENV.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IRPIV.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\windows\IRPIV.exeC:\windows\IRPIV.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSRNYN.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\windows\system\RSRNYN.exeC:\windows\system\RSRNYN.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UFW.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\windows\system\UFW.exeC:\windows\system\UFW.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YVCXV.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\windows\SysWOW64\YVCXV.exeC:\windows\system32\YVCXV.exe23⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GAPMX.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\windows\GAPMX.exeC:\windows\GAPMX.exe25⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GGHAHJ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\windows\SysWOW64\GGHAHJ.exeC:\windows\system32\GGHAHJ.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABMJJJW.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\windows\SysWOW64\ABMJJJW.exeC:\windows\system32\ABMJJJW.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOD.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\windows\system\DOD.exeC:\windows\system\DOD.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NMRFKKN.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\windows\SysWOW64\NMRFKKN.exeC:\windows\system32\NMRFKKN.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WVLK.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\windows\system\WVLK.exeC:\windows\system\WVLK.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIPUYI.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\windows\SysWOW64\RIPUYI.exeC:\windows\system32\RIPUYI.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AIRZBNG.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\SysWOW64\AIRZBNG.exeC:\windows\system32\AIRZBNG.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PLBLU.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:600 -
C:\windows\system\PLBLU.exeC:\windows\system\PLBLU.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMD.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\windows\HMD.exeC:\windows\HMD.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QMFV.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\windows\system\QMFV.exeC:\windows\system\QMFV.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FPOAUPT.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\windows\FPOAUPT.exeC:\windows\FPOAUPT.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACTR.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:200 -
C:\windows\SysWOW64\ACTR.exeC:\windows\system32\ACTR.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WIZG.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\windows\SysWOW64\WIZG.exeC:\windows\system32\WIZG.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TFFDS.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\windows\SysWOW64\TFFDS.exeC:\windows\system32\TFFDS.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XQD.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\windows\system\XQD.exeC:\windows\system\XQD.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWNQ.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\windows\GWNQ.exeC:\windows\GWNQ.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MRNRNBS.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:844 -
C:\windows\MRNRNBS.exeC:\windows\MRNRNBS.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DEX.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\windows\system\DEX.exeC:\windows\system\DEX.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKPYE.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\windows\system\DKPYE.exeC:\windows\system\DKPYE.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFZCPY.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\windows\SFZCPY.exeC:\windows\SFZCPY.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXCVXFY.exe.bat" "66⤵PID:236
-
C:\windows\SysWOW64\EXCVXFY.exeC:\windows\system32\EXCVXFY.exe67⤵
- Executes dropped EXE
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYJJG.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1812 -
C:\windows\system\KYJJG.exeC:\windows\system\KYJJG.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ITIJLKX.exe.bat" "70⤵PID:4112
-
C:\windows\ITIJLKX.exeC:\windows\ITIJLKX.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGT.exe.bat" "72⤵PID:4852
-
C:\windows\system\ZGT.exeC:\windows\system\ZGT.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZMTQ.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1688 -
C:\windows\SysWOW64\ZMTQ.exeC:\windows\system32\ZMTQ.exe75⤵
- Executes dropped EXE
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPX.exe.bat" "76⤵PID:2312
-
C:\windows\ZPX.exeC:\windows\ZPX.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUV.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4440 -
C:\windows\WUV.exeC:\windows\WUV.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PQHMUK.exe.bat" "80⤵PID:252
-
C:\windows\PQHMUK.exeC:\windows\PQHMUK.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDD.exe.bat" "82⤵PID:2648
-
C:\windows\SysWOW64\JDD.exeC:\windows\system32\JDD.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EYIFP.exe.bat" "84⤵PID:4184
-
C:\windows\EYIFP.exeC:\windows\EYIFP.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYQTY.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:1196 -
C:\windows\system\KYQTY.exeC:\windows\system\KYQTY.exe87⤵
- Executes dropped EXE
PID:5592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBUZDV.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2780 -
C:\windows\XBUZDV.exeC:\windows\XBUZDV.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IUP.exe.bat" "90⤵PID:2600
-
C:\windows\IUP.exeC:\windows\IUP.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KSCFT.exe.bat" "92⤵PID:1124
-
C:\windows\system\KSCFT.exeC:\windows\system\KSCFT.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NFHODSF.exe.bat" "94⤵PID:4708
-
C:\windows\SysWOW64\NFHODSF.exeC:\windows\system32\NFHODSF.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYKEMY.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:2632 -
C:\windows\system\DYKEMY.exeC:\windows\system\DYKEMY.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDUW.exe.bat" "98⤵
- Executes a command shell one-liner
PID:4776 -
C:\windows\SysWOW64\VDUW.exeC:\windows\system32\VDUW.exe99⤵
- Executes dropped EXE
PID:932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NGYAHL.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5480 -
C:\windows\NGYAHL.exeC:\windows\NGYAHL.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FOAFKQB.exe.bat" "102⤵PID:2420
-
C:\windows\FOAFKQB.exeC:\windows\FOAFKQB.exe103⤵
- Executes dropped EXE
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EZJG.exe.bat" "104⤵PID:4764
-
C:\windows\EZJG.exeC:\windows\EZJG.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FCNCEK.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3836 -
C:\windows\FCNCEK.exeC:\windows\FCNCEK.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\APS.exe.bat" "108⤵PID:3456
-
C:\windows\system\APS.exeC:\windows\system\APS.exe109⤵
- Executes dropped EXE
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIVE.exe.bat" "110⤵PID:4768
-
C:\windows\system\LIVE.exeC:\windows\system\LIVE.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UIPJA.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3808 -
C:\windows\SysWOW64\UIPJA.exeC:\windows\system32\UIPJA.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AIWXJZY.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3048 -
C:\windows\SysWOW64\AIWXJZY.exeC:\windows\system32\AIWXJZY.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEBG.exe.bat" "116⤵
- Executes a command shell one-liner
PID:2660 -
C:\windows\SysWOW64\VEBG.exeC:\windows\system32\VEBG.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWEZB.exe.bat" "118⤵
- Executes a command shell one-liner
PID:4144 -
C:\windows\GWEZB.exeC:\windows\GWEZB.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEL.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5068 -
C:\windows\system\SEL.exeC:\windows\system\SEL.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-