Analysis
- max time kernel
88s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_47e790e754c740a983d68255d533a219_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_47e790e754c740a983d68255d533a219_elex_emotet_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-09-29_47e790e754c740a983d68255d533a219_elex_emotet_stop.exe
- Size 208KB
- Sample260930-cd7fascc46
- SHA256 b1132c591b84485b6e17f76db263eedc650f498985a576f8fe80d1b33fa4970c
- MD5 47e790e754c740a983d68255d533a219
- SHA1 afe0a402c1630ab5a3d66f606b0e949024d37b76
- SHA512 b0c7de88917f026d0f380c35da61e096741fdf64e207d70ced7e008657cf0e4354e7c6e61ed7373044c9239bc5b59aa37c5dd6fe1585b4451fed70742ccf0857
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOf94NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOlQEj1
- TLSH T1DC247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4756 DDB.exe 1816 DYGDAX.exe 5892 CQJ.exe 4208 CMNPOSK.exe 5296 XZSY.exe 2352 VSU.exe 2864 JULNNJ.exe 3644 YKMN.exe 1844 LVUDIHS.exe 4148 KGFTRV.exe 4536 UELOYE.exe 3456 YUR.exe 5144 THWXU.exe 5936 WPDFHGW.exe 5904 XSHB.exe 1212 FGTH.exe 5448 OGVUAAV.exe 3864 PJZQ.exe 1204 KWEAQQ.exe 5112 XHMY.exe 2860 YCQ.exe 204 CSFCW.exe 52 LSZHZG.exe 3584 WLC.exe 1240 XOFWNM.exe 1184 GBQODIT.exe 1892 XCSB.exe 4896 HKUGSLX.exe 5032 MKCTBFY.exe 5968 FFFPGV.exe 4216 IBK.exe 3168 TTNR.exe 3064 CYYJH.exe 4200 XUCTRHH.exe 2208 FZVHSMJ.exe 3404 DACVJ.exe 5356 XNHEMO.exe 2068 FTHTVBC.exe 4812 AOMK.exe 5236 GOUYOV.exe 5852 YJX.exe 5288 CZEUGDQ.exe 4908 VSHNGKF.exe 4520 TSHA.exe 2460 OFMKIN.exe 5168 WLMYJA.exe 5680 RGR.exe 992 GBAUEM.exe 2888 GHAIGZQ.exe 4864 ORJC.exe 5688 XADPX.exe 3000 BIR.exe 2804 HIZDS.exe 704 HWRRUA.exe 1332 YBCJKF.exe 5692 JTF.exe 5180 LRY.exe 6140 AMHIJW.exe 5608 AAHXLBO.exe 3196 VNMG.exe 8 ZVTGHT.exe 6136 QEVLLQB.exe 3480 RRHQES.exe 3396 WRPE.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\YPKXQ.exe XMG.exe File opened for modification C:\windows\SysWOW64\URGXOH.exe ZWBG.exe File created C:\windows\SysWOW64\URGXOH.exe.bat ZWBG.exe File created C:\windows\SysWOW64\JSQQ.exe ZRO.exe File created C:\windows\SysWOW64\JYBOKRF.exe DYTAB.exe File created C:\windows\SysWOW64\YKMN.exe.bat JULNNJ.exe File opened for modification C:\windows\SysWOW64\YBCJKF.exe HWRRUA.exe File created C:\windows\SysWOW64\VNMG.exe AAHXLBO.exe File created C:\windows\SysWOW64\IKSPV.exe.bat WRPE.exe File opened for modification C:\windows\SysWOW64\ODG.exe IDYHN.exe File opened for modification C:\windows\SysWOW64\KIGRI.exe GAZ.exe File opened for modification C:\windows\SysWOW64\KBMBZV.exe POIS.exe File created C:\windows\SysWOW64\WFAIC.exe FWMC.exe File opened for modification C:\windows\SysWOW64\FGTH.exe XSHB.exe File created C:\windows\SysWOW64\YBCJKF.exe.bat HWRRUA.exe File opened for modification C:\windows\SysWOW64\AMHIJW.exe LRY.exe File created C:\windows\SysWOW64\AAHXLBO.exe.bat AMHIJW.exe File created C:\windows\SysWOW64\ODG.exe.bat IDYHN.exe File opened for modification C:\windows\SysWOW64\PUDG.exe YMB.exe File created C:\windows\SysWOW64\JGZFRUR.exe WARTPI.exe File opened for modification C:\windows\SysWOW64\JGZFRUR.exe WARTPI.exe File created C:\windows\SysWOW64\FGTH.exe XSHB.exe File created C:\windows\SysWOW64\CSFCW.exe.bat YCQ.exe File created C:\windows\SysWOW64\AMHIJW.exe.bat LRY.exe File opened for modification C:\windows\SysWOW64\NKT.exe YPKXQ.exe File opened for modification C:\windows\SysWOW64\BUXI.exe FWR.exe File created C:\windows\SysWOW64\JGZFRUR.exe.bat WARTPI.exe File created C:\windows\SysWOW64\CQJ.exe DYGDAX.exe File opened for modification C:\windows\SysWOW64\UELOYE.exe KGFTRV.exe File created C:\windows\SysWOW64\RRHQES.exe.bat ZRFDB.exe File created C:\windows\SysWOW64\PUDG.exe YMB.exe File created C:\windows\SysWOW64\BUXI.exe FWR.exe File created C:\windows\SysWOW64\VBDBWP.exe RTXB.exe File opened for modification C:\windows\SysWOW64\CQJ.exe DYGDAX.exe File opened for modification C:\windows\SysWOW64\UKTJJ.exe JSQQ.exe File created C:\windows\SysWOW64\KBMBZV.exe POIS.exe File opened for modification C:\windows\SysWOW64\JYBOKRF.exe DYTAB.exe File created C:\windows\SysWOW64\JYBOKRF.exe.bat DYTAB.exe File created C:\windows\SysWOW64\XSHB.exe WPDFHGW.exe File opened for modification C:\windows\SysWOW64\VNMG.exe AAHXLBO.exe File created C:\windows\SysWOW64\URGXOH.exe ZWBG.exe File created C:\windows\SysWOW64\BUXI.exe.bat FWR.exe File created C:\windows\SysWOW64\VBDBWP.exe.bat RTXB.exe File opened for modification C:\windows\SysWOW64\KGFTRV.exe LVUDIHS.exe File created C:\windows\SysWOW64\UELOYE.exe.bat KGFTRV.exe File created C:\windows\SysWOW64\WLC.exe.bat LSZHZG.exe File created C:\windows\SysWOW64\XNHEMO.exe.bat DACVJ.exe File opened for modification C:\windows\SysWOW64\XADPX.exe ORJC.exe File opened for modification C:\windows\SysWOW64\RRHQES.exe ZRFDB.exe File opened for modification C:\windows\SysWOW64\YPKXQ.exe XMG.exe File created C:\windows\SysWOW64\YPKXQ.exe.bat XMG.exe File created C:\windows\SysWOW64\XADPX.exe ORJC.exe File opened for modification C:\windows\SysWOW64\AAHXLBO.exe AMHIJW.exe File created C:\windows\SysWOW64\ZVTGHT.exe.bat VNMG.exe File created C:\windows\SysWOW64\QEVLLQB.exe ZVTGHT.exe File opened for modification C:\windows\SysWOW64\JSQQ.exe ZRO.exe File created C:\windows\SysWOW64\PUDG.exe.bat YMB.exe File created C:\windows\SysWOW64\KBMBZV.exe.bat POIS.exe File created C:\windows\SysWOW64\CQJ.exe.bat DYGDAX.exe File created C:\windows\SysWOW64\YKMN.exe JULNNJ.exe File created C:\windows\SysWOW64\XSHB.exe.bat WPDFHGW.exe File opened for modification C:\windows\SysWOW64\QEVLLQB.exe ZVTGHT.exe File opened for modification C:\windows\SysWOW64\IKSPV.exe WRPE.exe File created C:\windows\SysWOW64\NKT.exe.bat YPKXQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\TSHA.exe.bat VSHNGKF.exe File created C:\windows\system\ORJC.exe.bat GHAIGZQ.exe File opened for modification C:\windows\system\HWRRUA.exe HIZDS.exe File opened for modification C:\windows\system\XMG.exe XGGNBWB.exe File created C:\windows\system\YMB.exe.bat AMTFIP.exe File created C:\windows\AXIR.exe WPCRBF.exe File opened for modification C:\windows\system\ROCNRM.exe JYBOKRF.exe File created C:\windows\system\XHMY.exe.bat KWEAQQ.exe File created C:\windows\system\XCSB.exe GBQODIT.exe File opened for modification C:\windows\PJZQ.exe OGVUAAV.exe File opened for modification C:\windows\system\FWMC.exe XJHWF.exe File created C:\windows\PJZQ.exe OGVUAAV.exe File opened for modification C:\windows\HIZDS.exe BIR.exe File created C:\windows\system\UKNBP.exe.bat AXIR.exe File created C:\windows\system\DYTAB.exe FNR.exe File created C:\windows\THWXU.exe.bat YUR.exe File opened for modification C:\windows\system\IBK.exe FFFPGV.exe File created C:\windows\LSZHZG.exe.bat CSFCW.exe File created C:\windows\system\OFMKIN.exe.bat TSHA.exe File opened for modification C:\windows\system\GAZ.exe UKTJJ.exe File created C:\windows\system\AHSKKJP.exe VBDBWP.exe File created C:\windows\system\XZSY.exe CMNPOSK.exe File opened for modification C:\windows\system\VSU.exe XZSY.exe File created C:\windows\KWEAQQ.exe PJZQ.exe File opened for modification C:\windows\system\WRPE.exe RRHQES.exe File created C:\windows\RGYZS.exe.bat XTU.exe File created C:\windows\EVLAKZU.exe KIGRI.exe File created C:\windows\system\OGVUAAV.exe FGTH.exe File opened for modification C:\windows\system\YJX.exe GOUYOV.exe File opened for modification C:\windows\ZRO.exe URGXOH.exe File created C:\windows\system\XZSY.exe.bat CMNPOSK.exe File created C:\windows\system\XKVP.exe NKT.exe File opened for modification C:\windows\system\UMMSR.exe EVLAKZU.exe File opened for modification C:\windows\AMTFIP.exe UMMSR.exe File opened for modification C:\windows\POIS.exe GNN.exe File opened for modification C:\windows\AXIR.exe WPCRBF.exe File created C:\windows\YCQ.exe XHMY.exe File created C:\windows\system\UMMSR.exe EVLAKZU.exe File created C:\windows\FWR.exe.bat KBMBZV.exe File created C:\windows\AXIR.exe.bat WPCRBF.exe File created C:\windows\SDI.exe WFAIC.exe File created C:\windows\system\FNR.exe.bat SDI.exe File created C:\windows\JTF.exe YBCJKF.exe File opened for modification C:\windows\OKADEWJ.exe IKSPV.exe File created C:\windows\CMNPOSK.exe.bat CQJ.exe File created C:\windows\system\OFMKIN.exe TSHA.exe File created C:\windows\system\FWMC.exe XJHWF.exe File opened for modification C:\windows\system\DYTAB.exe FNR.exe File created C:\windows\system\MKCTBFY.exe.bat HKUGSLX.exe File opened for modification C:\windows\RGYZS.exe XTU.exe File opened for modification C:\windows\LSZHZG.exe CSFCW.exe File created C:\windows\XUCTRHH.exe CYYJH.exe File created C:\windows\system\ZWBG.exe.bat ODG.exe File created C:\windows\POIS.exe.bat GNN.exe File created C:\windows\SSKL.exe ZAVA.exe File created C:\windows\DYGDAX.exe DDB.exe File created C:\windows\system\RGR.exe WLMYJA.exe File created C:\windows\system\MTPGBUO.exe UKNBP.exe File opened for modification C:\windows\system\AHSKKJP.exe VBDBWP.exe File created C:\windows\system\VSHNGKF.exe.bat CZEUGDQ.exe File created C:\windows\HIZDS.exe.bat BIR.exe File created C:\windows\system\HWRRUA.exe.bat HIZDS.exe File created C:\windows\system\GNN.exe ANGRC.exe File created C:\windows\system\OGVUAAV.exe.bat FGTH.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5336 cmd.exe 2244 cmd.exe 3156 cmd.exe 5876 cmd.exe 3564 cmd.exe 2712 cmd.exe 3612 cmd.exe 2284 cmd.exe 2396 cmd.exe 2072 cmd.exe 4108 cmd.exe 3372 cmd.exe 2696 cmd.exe 5956 cmd.exe 1136 cmd.exe 4740 cmd.exe 4580 cmd.exe 3908 cmd.exe 4732 cmd.exe 4192 cmd.exe 1096 cmd.exe 2544 cmd.exe 1208 cmd.exe 6044 cmd.exe 5232 cmd.exe 5152 cmd.exe 5864 cmd.exe 2416 cmd.exe 4268 cmd.exe 6000 cmd.exe 2136 cmd.exe 5488 cmd.exe 1400 cmd.exe 5328 cmd.exe 5252 cmd.exe 5660 cmd.exe 4632 cmd.exe 2384 cmd.exe 5256 cmd.exe 4432 cmd.exe 3004 cmd.exe 3580 cmd.exe 3784 cmd.exe 2568 cmd.exe 6028 cmd.exe 1840 cmd.exe 2400 cmd.exe 5652 cmd.exe 3828 cmd.exe 1144 cmd.exe 5804 cmd.exe 2228 cmd.exe 980 cmd.exe 4856 cmd.exe 5056 cmd.exe 4668 cmd.exe 4576 cmd.exe 4324 cmd.exe 3224 cmd.exe 4028 cmd.exe 1148 cmd.exe 3916 cmd.exe 5132 cmd.exe 488 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2364 4320 WerFault.exe 87 6096 4756 WerFault.exe 93 4644 1816 WerFault.exe 99 4696 5892 WerFault.exe 104 2036 4208 WerFault.exe 109 1096 5296 WerFault.exe 114 1548 2352 WerFault.exe 119 1600 2864 WerFault.exe 124 5868 3644 WerFault.exe 129 4168 1844 WerFault.exe 134 3640 4148 WerFault.exe 139 3784 4536 WerFault.exe 144 3132 3456 WerFault.exe 149 3480 5144 WerFault.exe 154 4060 5936 WerFault.exe 159 3648 5904 WerFault.exe 164 4244 1212 WerFault.exe 169 3596 5448 WerFault.exe 174 3812 3864 WerFault.exe 179 5764 1204 WerFault.exe 184 5336 5112 WerFault.exe 189 5232 2860 WerFault.exe 194 2724 204 WerFault.exe 199 2228 52 WerFault.exe 204 3236 3584 WerFault.exe 209 2360 1240 WerFault.exe 214 5356 1184 WerFault.exe 219 5444 1892 WerFault.exe 224 4480 4896 WerFault.exe 229 2116 5032 WerFault.exe 234 3380 5968 WerFault.exe 239 5596 4216 WerFault.exe 244 3932 3168 WerFault.exe 249 4728 3064 WerFault.exe 254 4988 4200 WerFault.exe 259 3908 2208 WerFault.exe 264 2688 3404 WerFault.exe 269 1620 5356 WerFault.exe 274 4456 2068 WerFault.exe 280 6056 4812 WerFault.exe 285 4128 5236 WerFault.exe 290 3384 5852 WerFault.exe 295 5044 5288 WerFault.exe 300 6036 4908 WerFault.exe 305 4124 4520 WerFault.exe 310 5128 2460 WerFault.exe 315 2244 5168 WerFault.exe 320 1620 5680 WerFault.exe 325 2300 992 WerFault.exe 330 3916 2888 WerFault.exe 335 4764 4864 WerFault.exe 340 5500 5688 WerFault.exe 345 5532 3000 WerFault.exe 350 4548 2804 WerFault.exe 355 3124 704 WerFault.exe 360 3664 1332 WerFault.exe 365 5700 5692 WerFault.exe 370 5572 5180 WerFault.exe 375 1192 6140 WerFault.exe 380 2836 5608 WerFault.exe 385 2904 3196 WerFault.exe 390 1828 8 WerFault.exe 395 2404 6136 WerFault.exe 400 3236 1076 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMTFIP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZRFDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVLAKZU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XJHWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIZDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNHEMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WARTPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UELOYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGVUAAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOFWNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVUDIHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XHMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFFPGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBDBWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZAVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_47e790e754c740a983d68255d533a219_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGYZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZVTGHT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGGNBWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYGDAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKSPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THWXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFAIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAHXLBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANGRC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUDG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPCRBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4320 2026-09-29_47e790e754c740a983d68255d533a219_elex_emotet_stop.exe 4320 2026-09-29_47e790e754c740a983d68255d533a219_elex_emotet_stop.exe 4756 DDB.exe 4756 DDB.exe 1816 DYGDAX.exe 1816 DYGDAX.exe 5892 CQJ.exe 5892 CQJ.exe 4208 CMNPOSK.exe 4208 CMNPOSK.exe 5296 XZSY.exe 5296 XZSY.exe 2352 VSU.exe 2352 VSU.exe 2864 JULNNJ.exe 2864 JULNNJ.exe 3644 YKMN.exe 3644 YKMN.exe 1844 LVUDIHS.exe 1844 LVUDIHS.exe 4148 KGFTRV.exe 4148 KGFTRV.exe 4536 UELOYE.exe 4536 UELOYE.exe 3456 YUR.exe 3456 YUR.exe 5144 THWXU.exe 5144 THWXU.exe 5936 WPDFHGW.exe 5936 WPDFHGW.exe 5904 XSHB.exe 5904 XSHB.exe 1212 FGTH.exe 1212 FGTH.exe 5448 OGVUAAV.exe 5448 OGVUAAV.exe 3864 PJZQ.exe 3864 PJZQ.exe 1204 KWEAQQ.exe 1204 KWEAQQ.exe 5112 XHMY.exe 5112 XHMY.exe 2860 YCQ.exe 2860 YCQ.exe 204 CSFCW.exe 204 CSFCW.exe 52 LSZHZG.exe 52 LSZHZG.exe 3584 WLC.exe 3584 WLC.exe 1240 XOFWNM.exe 1240 XOFWNM.exe 1184 GBQODIT.exe 1184 GBQODIT.exe 1892 XCSB.exe 1892 XCSB.exe 4896 HKUGSLX.exe 4896 HKUGSLX.exe 5032 MKCTBFY.exe 5032 MKCTBFY.exe 5968 FFFPGV.exe 5968 FFFPGV.exe 4216 IBK.exe 4216 IBK.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4320 2026-09-29_47e790e754c740a983d68255d533a219_elex_emotet_stop.exe 4320 2026-09-29_47e790e754c740a983d68255d533a219_elex_emotet_stop.exe 4756 DDB.exe 4756 DDB.exe 1816 DYGDAX.exe 1816 DYGDAX.exe 5892 CQJ.exe 5892 CQJ.exe 4208 CMNPOSK.exe 4208 CMNPOSK.exe 5296 XZSY.exe 5296 XZSY.exe 2352 VSU.exe 2352 VSU.exe 2864 JULNNJ.exe 2864 JULNNJ.exe 3644 YKMN.exe 3644 YKMN.exe 1844 LVUDIHS.exe 1844 LVUDIHS.exe 4148 KGFTRV.exe 4148 KGFTRV.exe 4536 UELOYE.exe 4536 UELOYE.exe 3456 YUR.exe 3456 YUR.exe 5144 THWXU.exe 5144 THWXU.exe 5936 WPDFHGW.exe 5936 WPDFHGW.exe 5904 XSHB.exe 5904 XSHB.exe 1212 FGTH.exe 1212 FGTH.exe 5448 OGVUAAV.exe 5448 OGVUAAV.exe 3864 PJZQ.exe 3864 PJZQ.exe 1204 KWEAQQ.exe 1204 KWEAQQ.exe 5112 XHMY.exe 5112 XHMY.exe 2860 YCQ.exe 2860 YCQ.exe 204 CSFCW.exe 204 CSFCW.exe 52 LSZHZG.exe 52 LSZHZG.exe 3584 WLC.exe 3584 WLC.exe 1240 XOFWNM.exe 1240 XOFWNM.exe 1184 GBQODIT.exe 1184 GBQODIT.exe 1892 XCSB.exe 1892 XCSB.exe 4896 HKUGSLX.exe 4896 HKUGSLX.exe 5032 MKCTBFY.exe 5032 MKCTBFY.exe 5968 FFFPGV.exe 5968 FFFPGV.exe 4216 IBK.exe 4216 IBK.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4320 wrote to memory of 1880 4320 2026-09-29_47e790e754c740a983d68255d533a219_elex_emotet_stop.exe 89 PID 1880 wrote to memory of 4756 1880 cmd.exe 93 PID 4756 wrote to memory of 2680 4756 DDB.exe 95 PID 2680 wrote to memory of 1816 2680 cmd.exe 99 PID 1816 wrote to memory of 2544 1816 DYGDAX.exe 100 PID 2544 wrote to memory of 5892 2544 cmd.exe 104 PID 5892 wrote to memory of 2996 5892 CQJ.exe 105 PID 2996 wrote to memory of 4208 2996 cmd.exe 109 PID 4208 wrote to memory of 2296 4208 CMNPOSK.exe 110 PID 2296 wrote to memory of 5296 2296 cmd.exe 114 PID 5296 wrote to memory of 2636 5296 XZSY.exe 115 PID 2636 wrote to memory of 2352 2636 cmd.exe 119 PID 2352 wrote to memory of 3268 2352 VSU.exe 120 PID 3268 wrote to memory of 2864 3268 cmd.exe 124 PID 2864 wrote to memory of 4980 2864 JULNNJ.exe 125 PID 4980 wrote to memory of 3644 4980 cmd.exe 129 PID 3644 wrote to memory of 2396 3644 YKMN.exe 130 PID 2396 wrote to memory of 1844 2396 cmd.exe 134 PID 1844 wrote to memory of 1208 1844 LVUDIHS.exe 135 PID 1208 wrote to memory of 4148 1208 cmd.exe 139 PID 4148 wrote to memory of 5804 4148 KGFTRV.exe 140 PID 5804 wrote to memory of 4536 5804 cmd.exe 144 PID 4536 wrote to memory of 368 4536 UELOYE.exe 145 PID 368 wrote to memory of 3456 368 cmd.exe 149 PID 3456 wrote to memory of 120 3456 YUR.exe 150 PID 120 wrote to memory of 5144 120 cmd.exe 154 PID 5144 wrote to memory of 4604 5144 THWXU.exe 155 PID 4604 wrote to memory of 5936 4604 cmd.exe 159 PID 5936 wrote to memory of 2448 5936 WPDFHGW.exe 160 PID 2448 wrote to memory of 5904 2448 cmd.exe 164 PID 5904 wrote to memory of 3080 5904 XSHB.exe 165 PID 3080 wrote to memory of 1212 3080 cmd.exe 169 PID 1212 wrote to memory of 3224 1212 FGTH.exe 170 PID 3224 wrote to memory of 5448 3224 cmd.exe 174 PID 5448 wrote to memory of 1348 5448 OGVUAAV.exe 175 PID 1348 wrote to memory of 3864 1348 cmd.exe 179 PID 3864 wrote to memory of 6008 3864 PJZQ.exe 180 PID 6008 wrote to memory of 1204 6008 cmd.exe 184 PID 1204 wrote to memory of 3720 1204 KWEAQQ.exe 185 PID 3720 wrote to memory of 5112 3720 cmd.exe 189 PID 5112 wrote to memory of 476 5112 XHMY.exe 190 PID 476 wrote to memory of 2860 476 cmd.exe 194 PID 2860 wrote to memory of 5324 2860 YCQ.exe 195 PID 5324 wrote to memory of 204 5324 cmd.exe 199 PID 204 wrote to memory of 3336 204 CSFCW.exe 200 PID 3336 wrote to memory of 52 3336 cmd.exe 204 PID 52 wrote to memory of 1968 52 LSZHZG.exe 205 PID 1968 wrote to memory of 3584 1968 cmd.exe 209 PID 3584 wrote to memory of 996 3584 WLC.exe 210 PID 996 wrote to memory of 1240 996 cmd.exe 214 PID 1240 wrote to memory of 480 1240 XOFWNM.exe 215 PID 480 wrote to memory of 1184 480 cmd.exe 219 PID 1184 wrote to memory of 6044 1184 GBQODIT.exe 220 PID 6044 wrote to memory of 1892 6044 cmd.exe 224 PID 1892 wrote to memory of 2560 1892 XCSB.exe 225 PID 2560 wrote to memory of 4896 2560 cmd.exe 229 PID 4896 wrote to memory of 4440 4896 HKUGSLX.exe 230 PID 4440 wrote to memory of 5032 4440 cmd.exe 234 PID 5032 wrote to memory of 4028 5032 MKCTBFY.exe 235 PID 4028 wrote to memory of 5968 4028 cmd.exe 239 PID 5968 wrote to memory of 5984 5968 FFFPGV.exe 240 PID 5984 wrote to memory of 4216 5984 cmd.exe 244 PID 4216 wrote to memory of 4972 4216 IBK.exe 245 PID 4972 wrote to memory of 3168 4972 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_47e790e754c740a983d68255d533a219_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_47e790e754c740a983d68255d533a219_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDB.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\windows\system\DDB.exeC:\windows\system\DDB.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYGDAX.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\windows\DYGDAX.exeC:\windows\DYGDAX.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQJ.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\windows\SysWOW64\CQJ.exeC:\windows\system32\CQJ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMNPOSK.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\windows\CMNPOSK.exeC:\windows\CMNPOSK.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XZSY.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\windows\system\XZSY.exeC:\windows\system\XZSY.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSU.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\windows\system\VSU.exeC:\windows\system\VSU.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JULNNJ.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\windows\JULNNJ.exeC:\windows\JULNNJ.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YKMN.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\windows\SysWOW64\YKMN.exeC:\windows\system32\YKMN.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LVUDIHS.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\windows\LVUDIHS.exeC:\windows\LVUDIHS.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGFTRV.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\windows\SysWOW64\KGFTRV.exeC:\windows\system32\KGFTRV.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UELOYE.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\windows\SysWOW64\UELOYE.exeC:\windows\system32\UELOYE.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUR.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:368 -
C:\windows\YUR.exeC:\windows\YUR.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THWXU.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:120 -
C:\windows\THWXU.exeC:\windows\THWXU.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPDFHGW.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\windows\WPDFHGW.exeC:\windows\WPDFHGW.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSHB.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\windows\SysWOW64\XSHB.exeC:\windows\system32\XSHB.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGTH.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\windows\SysWOW64\FGTH.exeC:\windows\system32\FGTH.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGVUAAV.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\windows\system\OGVUAAV.exeC:\windows\system\OGVUAAV.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJZQ.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\windows\PJZQ.exeC:\windows\PJZQ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KWEAQQ.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\windows\KWEAQQ.exeC:\windows\KWEAQQ.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XHMY.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\windows\system\XHMY.exeC:\windows\system\XHMY.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCQ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:476 -
C:\windows\YCQ.exeC:\windows\YCQ.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CSFCW.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\windows\SysWOW64\CSFCW.exeC:\windows\system32\CSFCW.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LSZHZG.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\windows\LSZHZG.exeC:\windows\LSZHZG.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLC.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\windows\SysWOW64\WLC.exeC:\windows\system32\WLC.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOFWNM.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:996 -
C:\windows\system\XOFWNM.exeC:\windows\system\XOFWNM.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GBQODIT.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:480 -
C:\windows\GBQODIT.exeC:\windows\GBQODIT.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCSB.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\windows\system\XCSB.exeC:\windows\system\XCSB.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKUGSLX.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\windows\system\HKUGSLX.exeC:\windows\system\HKUGSLX.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKCTBFY.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\windows\system\MKCTBFY.exeC:\windows\system\MKCTBFY.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FFFPGV.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\windows\system\FFFPGV.exeC:\windows\system\FFFPGV.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBK.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\windows\system\IBK.exeC:\windows\system\IBK.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTNR.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\windows\SysWOW64\TTNR.exeC:\windows\system32\TTNR.exe65⤵
- Executes dropped EXE
PID:3168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYYJH.exe.bat" "66⤵
- Executes a command shell one-liner
PID:2072 -
C:\windows\system\CYYJH.exeC:\windows\system\CYYJH.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XUCTRHH.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3132 -
C:\windows\XUCTRHH.exeC:\windows\XUCTRHH.exe69⤵
- Executes dropped EXE
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZVHSMJ.exe.bat" "70⤵PID:2624
-
C:\windows\system\FZVHSMJ.exeC:\windows\system\FZVHSMJ.exe71⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DACVJ.exe.bat" "72⤵PID:3324
-
C:\windows\DACVJ.exeC:\windows\DACVJ.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNHEMO.exe.bat" "74⤵PID:5088
-
C:\windows\SysWOW64\XNHEMO.exeC:\windows\system32\XNHEMO.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTHTVBC.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:1064 -
C:\windows\FTHTVBC.exeC:\windows\FTHTVBC.exe77⤵
- Executes dropped EXE
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOMK.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1148 -
C:\windows\system\AOMK.exeC:\windows\system\AOMK.exe79⤵
- Executes dropped EXE
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GOUYOV.exe.bat" "80⤵PID:3696
-
C:\windows\GOUYOV.exeC:\windows\GOUYOV.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YJX.exe.bat" "82⤵PID:3572
-
C:\windows\system\YJX.exeC:\windows\system\YJX.exe83⤵
- Executes dropped EXE
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZEUGDQ.exe.bat" "84⤵
- Executes a command shell one-liner
PID:5232 -
C:\windows\system\CZEUGDQ.exeC:\windows\system\CZEUGDQ.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSHNGKF.exe.bat" "86⤵PID:3348
-
C:\windows\system\VSHNGKF.exeC:\windows\system\VSHNGKF.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TSHA.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:5464 -
C:\windows\system\TSHA.exeC:\windows\system\TSHA.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OFMKIN.exe.bat" "90⤵PID:904
-
C:\windows\system\OFMKIN.exeC:\windows\system\OFMKIN.exe91⤵
- Executes dropped EXE
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WLMYJA.exe.bat" "92⤵
- Executes a command shell one-liner
PID:2384 -
C:\windows\system\WLMYJA.exeC:\windows\system\WLMYJA.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGR.exe.bat" "94⤵PID:2732
-
C:\windows\system\RGR.exeC:\windows\system\RGR.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GBAUEM.exe.bat" "96⤵PID:4760
-
C:\windows\SysWOW64\GBAUEM.exeC:\windows\system32\GBAUEM.exe97⤵
- Executes dropped EXE
PID:992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GHAIGZQ.exe.bat" "98⤵PID:6024
-
C:\windows\GHAIGZQ.exeC:\windows\GHAIGZQ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORJC.exe.bat" "100⤵PID:6016
-
C:\windows\system\ORJC.exeC:\windows\system\ORJC.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XADPX.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5336 -
C:\windows\SysWOW64\XADPX.exeC:\windows\system32\XADPX.exe103⤵
- Executes dropped EXE
PID:5688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BIR.exe.bat" "104⤵PID:5760
-
C:\windows\system\BIR.exeC:\windows\system\BIR.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIZDS.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1136 -
C:\windows\HIZDS.exeC:\windows\HIZDS.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWRRUA.exe.bat" "108⤵PID:3748
-
C:\windows\system\HWRRUA.exeC:\windows\system\HWRRUA.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YBCJKF.exe.bat" "110⤵PID:4380
-
C:\windows\SysWOW64\YBCJKF.exeC:\windows\system32\YBCJKF.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JTF.exe.bat" "112⤵
- Executes a command shell one-liner
PID:6000 -
C:\windows\JTF.exeC:\windows\JTF.exe113⤵
- Executes dropped EXE
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LRY.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2244 -
C:\windows\system\LRY.exeC:\windows\system\LRY.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AMHIJW.exe.bat" "116⤵PID:896
-
C:\windows\SysWOW64\AMHIJW.exeC:\windows\system32\AMHIJW.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAHXLBO.exe.bat" "118⤵PID:4792
-
C:\windows\SysWOW64\AAHXLBO.exeC:\windows\system32\AAHXLBO.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNMG.exe.bat" "120⤵PID:3420
-
C:\windows\SysWOW64\VNMG.exeC:\windows\system32\VNMG.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-