Analysis
- max time kernel
93s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 02:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_3a5f5ff982e2d7898a17eb8172d77d66_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-29_3a5f5ff982e2d7898a17eb8172d77d66_elex_emotet_stop.exe
- Size 208KB
- Sample260930-deg3gaxtct
- SHA256 f29f8c0d2f78a897a62f24caaab8d11e3e19b33981642d997218ea54ab03268a
- MD5 3a5f5ff982e2d7898a17eb8172d77d66
- SHA1 0208ffa016e114980f5447fc6a8f8e1afb040977
- SHA512 d56965cea4a12362a1729efca126a72c4d7f7934ed69f20542b5bc8bcf9aba765e72f699698b3a96af6593b0220a538cd3b4942e723a7efe9ed1299405e8b0d0
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfm4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LO+kEj1
- TLSH T18D247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1348 JEMY.exe 2592 IUA.exe 2432 JXESQ.exe 4504 HMXNDP.exe 5972 RVZSGNO.exe 3392 IVB.exe 3428 XQKJDF.exe 2196 SLP.exe 5692 BMRY.exe 1968 WZWHAK.exe 3836 IPD.exe 2028 MXJ.exe 4284 GSOY.exe 1508 QTQMFS.exe 2904 QWU.exe 5496 UEBHWSV.exe 1200 ECGCM.exe 3040 BCQE.exe 5540 ONYD.exe 1048 SQXYEI.exe 3996 HLOC.exe 2144 ERMZ.exe 4376 NROEH.exe 5868 QMTOSCL.exe 5996 DPBMGNH.exe 4740 TFKE.exe 4004 VDQ.exe 4816 RIWVB.exe 1836 AJYAEY.exe 1364 MZE.exe 4620 HMJSB.exe 2784 CZOBLIA.exe 824 LII.exe 3112 RIPUYI.exe 2116 RLTX.exe 2416 BLVDPD.exe 5148 FTK.exe 3992 ZPHMD.exe 1644 OKY.exe 2736 UFPZ.exe 2524 PSUJD.exe 3208 KGZSNKT.exe 4404 KJDWTA.exe 5052 FWI.exe 2296 URZJON.exe 3544 PMW.exe 3196 HHIX.exe 108 TXOXQVE.exe 4984 VVURFD.exe 1748 NVW.exe 2944 FYAAOZ.exe 668 PZC.exe 4548 VWNINJ.exe 2816 EXP.exe 920 ZSUW.exe 1412 ISW.exe 3184 OTD.exe 4940 GBFUQE.exe 5964 AOK.exe 2160 EWRMN.exe 2768 PPUEVDP.exe 684 QSY.exe 4112 LFCJL.exe 5164 AAM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\TRCP.exe.bat UBRUIA.exe File opened for modification C:\windows\SysWOW64\IZOOMU.exe TWW.exe File opened for modification C:\windows\SysWOW64\BMRY.exe SLP.exe File created C:\windows\SysWOW64\TWW.exe HDBJTS.exe File created C:\windows\SysWOW64\KGZSNKT.exe PSUJD.exe File opened for modification C:\windows\SysWOW64\PMW.exe URZJON.exe File opened for modification C:\windows\SysWOW64\TXOXQVE.exe HHIX.exe File opened for modification C:\windows\SysWOW64\DQU.exe JDQLVVA.exe File opened for modification C:\windows\SysWOW64\HKZEZ.exe PCXZ.exe File created C:\windows\SysWOW64\BMRY.exe.bat SLP.exe File created C:\windows\SysWOW64\PMW.exe.bat URZJON.exe File created C:\windows\SysWOW64\DJBF.exe ABUFSHR.exe File created C:\windows\SysWOW64\BLVDPD.exe RLTX.exe File created C:\windows\SysWOW64\PMW.exe URZJON.exe File created C:\windows\SysWOW64\NVW.exe VVURFD.exe File created C:\windows\SysWOW64\LGE.exe.bat SDAYDI.exe File created C:\windows\SysWOW64\RVZSGNO.exe.bat HMXNDP.exe File created C:\windows\SysWOW64\VDQ.exe TFKE.exe File opened for modification C:\windows\SysWOW64\MZE.exe AJYAEY.exe File opened for modification C:\windows\SysWOW64\KJDWTA.exe KGZSNKT.exe File created C:\windows\SysWOW64\EJVFKA.exe ABPXYH.exe File created C:\windows\SysWOW64\JSQQ.exe ZRO.exe File opened for modification C:\windows\SysWOW64\LGE.exe SDAYDI.exe File created C:\windows\SysWOW64\WLIX.exe.bat QLBJDVK.exe File created C:\windows\SysWOW64\UARPJ.exe.bat KSPKFLY.exe File created C:\windows\SysWOW64\YJYPVJW.exe UARPJ.exe File created C:\windows\SysWOW64\MZE.exe AJYAEY.exe File created C:\windows\SysWOW64\DKXNSY.exe JXSE.exe File created C:\windows\SysWOW64\KTADHZ.exe.bat LYBCC.exe File opened for modification C:\windows\SysWOW64\TWW.exe HDBJTS.exe File opened for modification C:\windows\SysWOW64\IAM.exe EJFHD.exe File created C:\windows\SysWOW64\HKZEZ.exe.bat PCXZ.exe File opened for modification C:\windows\SysWOW64\ZYHI.exe XLCZENO.exe File opened for modification C:\windows\SysWOW64\RVZSGNO.exe HMXNDP.exe File created C:\windows\SysWOW64\PPUEVDP.exe EWRMN.exe File created C:\windows\SysWOW64\TRCP.exe UBRUIA.exe File created C:\windows\SysWOW64\EJVFKA.exe.bat ABPXYH.exe File opened for modification C:\windows\SysWOW64\ERMZ.exe HLOC.exe File created C:\windows\SysWOW64\RIPUYI.exe LII.exe File created C:\windows\SysWOW64\TXOXQVE.exe HHIX.exe File created C:\windows\SysWOW64\DQU.exe.bat JDQLVVA.exe File created C:\windows\SysWOW64\QFGDNH.exe IZOOMU.exe File created C:\windows\SysWOW64\JSQQ.exe.bat ZRO.exe File opened for modification C:\windows\SysWOW64\XQKJDF.exe IVB.exe File created C:\windows\SysWOW64\KKVEIA.exe.bat KSML.exe File created C:\windows\SysWOW64\HWC.exe.bat DGNQTF.exe File opened for modification C:\windows\SysWOW64\UARPJ.exe KSPKFLY.exe File created C:\windows\SysWOW64\BMRY.exe SLP.exe File opened for modification C:\windows\SysWOW64\VDQ.exe TFKE.exe File opened for modification C:\windows\SysWOW64\BLVDPD.exe RLTX.exe File created C:\windows\SysWOW64\TXOXQVE.exe.bat HHIX.exe File created C:\windows\SysWOW64\DJBF.exe.bat ABUFSHR.exe File created C:\windows\SysWOW64\RVZSGNO.exe HMXNDP.exe File created C:\windows\SysWOW64\UARPJ.exe KSPKFLY.exe File created C:\windows\SysWOW64\YJYPVJW.exe.bat UARPJ.exe File created C:\windows\SysWOW64\ERMZ.exe HLOC.exe File opened for modification C:\windows\SysWOW64\RIPUYI.exe LII.exe File created C:\windows\SysWOW64\DKXNSY.exe.bat JXSE.exe File opened for modification C:\windows\SysWOW64\KTADHZ.exe LYBCC.exe File opened for modification C:\windows\SysWOW64\JSQQ.exe ZRO.exe File opened for modification C:\windows\SysWOW64\YJYPVJW.exe UARPJ.exe File created C:\windows\SysWOW64\MZE.exe.bat AJYAEY.exe File created C:\windows\SysWOW64\RIPUYI.exe.bat LII.exe File opened for modification C:\windows\SysWOW64\DJBF.exe ABUFSHR.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\MXJ.exe IPD.exe File created C:\windows\SQXYEI.exe ONYD.exe File created C:\windows\ZNUQJU.exe.bat IIK.exe File opened for modification C:\windows\system\HDBJTS.exe NQWAI.exe File created C:\windows\system\QTQMFS.exe GSOY.exe File opened for modification C:\windows\FYAAOZ.exe NVW.exe File created C:\windows\system\EWRMN.exe AOK.exe File opened for modification C:\windows\system\EJFHD.exe TRCP.exe File opened for modification C:\windows\system\QUQQNQ.exe IGMKKSX.exe File opened for modification C:\windows\HLOC.exe SQXYEI.exe File opened for modification C:\windows\system\ZPHMD.exe FTK.exe File created C:\windows\system\ISW.exe.bat ZSUW.exe File opened for modification C:\windows\IIK.exe QFGDNH.exe File opened for modification C:\windows\system\PCXZ.exe XHTVICE.exe File created C:\windows\system\QLBJDVK.exe HKZEZ.exe File opened for modification C:\windows\ZRO.exe MGF.exe File created C:\windows\ZRO.exe.bat MGF.exe File opened for modification C:\windows\system\QTQMFS.exe GSOY.exe File created C:\windows\AJYAEY.exe.bat RIWVB.exe File created C:\windows\ZSUW.exe EXP.exe File opened for modification C:\windows\system\UBRUIA.exe UWRFG.exe File opened for modification C:\windows\system\ABPXYH.exe WLIX.exe File opened for modification C:\windows\system\UCAAWL.exe EMZ.exe File opened for modification C:\windows\JXSE.exe UCAAWL.exe File created C:\windows\JEMY.exe.bat 2026-09-29_3a5f5ff982e2d7898a17eb8172d77d66_elex_emotet_stop.exe File created C:\windows\system\HHIX.exe PMW.exe File created C:\windows\system\JXESQ.exe.bat IUA.exe File created C:\windows\AUKQ.exe WMDIMTB.exe File created C:\windows\MXJ.exe.bat IPD.exe File opened for modification C:\windows\UEBHWSV.exe QWU.exe File created C:\windows\WMDIMTB.exe HWC.exe File created C:\windows\ZUS.exe QUQQNQ.exe File created C:\windows\UWRFG.exe.bat AAM.exe File created C:\windows\system\IUA.exe JEMY.exe File opened for modification C:\windows\WZWHAK.exe BMRY.exe File opened for modification C:\windows\ZSUW.exe EXP.exe File created C:\windows\UWRFG.exe AAM.exe File created C:\windows\IIK.exe QFGDNH.exe File created C:\windows\system\MXS.exe.bat KKVEIA.exe File created C:\windows\TPDKQPP.exe.bat JSQQ.exe File created C:\windows\QWU.exe QTQMFS.exe File created C:\windows\UEBHWSV.exe.bat QWU.exe File created C:\windows\system\ZPHMD.exe FTK.exe File created C:\windows\system\HDBJTS.exe.bat NQWAI.exe File created C:\windows\system\MGF.exe KTADHZ.exe File opened for modification C:\windows\IPD.exe WZWHAK.exe File created C:\windows\system\TFKE.exe DPBMGNH.exe File opened for modification C:\windows\system\VVURFD.exe TXOXQVE.exe File opened for modification C:\windows\AAM.exe LFCJL.exe File opened for modification C:\windows\JEMY.exe 2026-09-29_3a5f5ff982e2d7898a17eb8172d77d66_elex_emotet_stop.exe File created C:\windows\HLOC.exe SQXYEI.exe File created C:\windows\system\CZOBLIA.exe HMJSB.exe File created C:\windows\LII.exe.bat CZOBLIA.exe File created C:\windows\FWI.exe.bat KJDWTA.exe File created C:\windows\ZNUQJU.exe IIK.exe File created C:\windows\system\IGMKKSX.exe YJYPVJW.exe File created C:\windows\system\IUA.exe.bat JEMY.exe File opened for modification C:\windows\AJYAEY.exe RIWVB.exe File created C:\windows\VWNINJ.exe.bat PZC.exe File created C:\windows\JDQLVVA.exe IAM.exe File opened for modification C:\windows\system\FUIDT.exe LGE.exe File created C:\windows\system\QLBJDVK.exe.bat HKZEZ.exe File opened for modification C:\windows\system\ECGCM.exe UEBHWSV.exe File created C:\windows\system\ONYD.exe BCQE.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5528 cmd.exe 812 cmd.exe 3164 cmd.exe 1988 cmd.exe 4968 cmd.exe 1580 cmd.exe 1928 cmd.exe 4288 cmd.exe 4600 cmd.exe 5144 cmd.exe 2528 cmd.exe 2452 cmd.exe 5764 cmd.exe 3564 cmd.exe 4280 cmd.exe 2764 cmd.exe 4992 cmd.exe 2104 cmd.exe 3912 cmd.exe 3276 cmd.exe 1252 cmd.exe 3432 cmd.exe 888 cmd.exe 1068 cmd.exe 6060 cmd.exe 5436 cmd.exe 3684 cmd.exe 3316 cmd.exe 4352 cmd.exe 5928 cmd.exe 2540 cmd.exe 3652 cmd.exe 3136 cmd.exe 4016 cmd.exe 4692 cmd.exe 3552 cmd.exe 5092 cmd.exe 3864 cmd.exe 3444 cmd.exe 5796 cmd.exe 3140 cmd.exe 3240 cmd.exe 2604 cmd.exe 3236 cmd.exe 796 cmd.exe 5828 cmd.exe 5876 cmd.exe 3304 cmd.exe 5792 cmd.exe 3404 cmd.exe 4340 cmd.exe 3628 cmd.exe 2696 cmd.exe 5772 cmd.exe 5652 cmd.exe 2488 cmd.exe 3116 cmd.exe 1952 cmd.exe 1028 cmd.exe 3600 cmd.exe 2388 cmd.exe 4388 cmd.exe 2308 cmd.exe 400 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4732 3916 WerFault.exe 87 1336 1348 WerFault.exe 93 5148 2592 WerFault.exe 99 3156 2432 WerFault.exe 104 3340 4504 WerFault.exe 109 5500 5972 WerFault.exe 114 4000 3392 WerFault.exe 119 4328 3428 WerFault.exe 124 4652 2196 WerFault.exe 129 2880 5692 WerFault.exe 134 4804 1968 WerFault.exe 139 3328 3836 WerFault.exe 144 3840 2028 WerFault.exe 149 2648 4284 WerFault.exe 154 260 1508 WerFault.exe 159 832 2904 WerFault.exe 164 5812 5496 WerFault.exe 169 2936 1200 WerFault.exe 174 3164 3040 WerFault.exe 179 5092 5540 WerFault.exe 184 2384 1048 WerFault.exe 189 4256 3996 WerFault.exe 193 2108 2144 WerFault.exe 199 1472 4376 WerFault.exe 204 4820 5868 WerFault.exe 209 2316 5996 WerFault.exe 214 1340 4740 WerFault.exe 219 3280 4004 WerFault.exe 224 2996 4816 WerFault.exe 229 4308 1836 WerFault.exe 234 8 1364 WerFault.exe 239 4524 4620 WerFault.exe 244 2700 2784 WerFault.exe 249 5688 824 WerFault.exe 254 1248 3112 WerFault.exe 259 5080 2116 WerFault.exe 264 1780 2416 WerFault.exe 269 3316 5148 WerFault.exe 274 832 3992 WerFault.exe 279 5812 1644 WerFault.exe 284 888 2736 WerFault.exe 289 5516 2524 WerFault.exe 294 3376 3208 WerFault.exe 299 5460 4404 WerFault.exe 304 5800 5052 WerFault.exe 309 1248 2296 WerFault.exe 314 5796 3544 WerFault.exe 319 3932 3196 WerFault.exe 324 3540 108 WerFault.exe 329 5188 4984 WerFault.exe 334 5876 1748 WerFault.exe 339 1708 2944 WerFault.exe 344 1404 668 WerFault.exe 349 5048 4548 WerFault.exe 354 1420 2816 WerFault.exe 359 1488 920 WerFault.exe 364 5512 1412 WerFault.exe 369 3452 3184 WerFault.exe 374 5468 4940 WerFault.exe 379 1440 5964 WerFault.exe 384 4308 2160 WerFault.exe 389 3816 2768 WerFault.exe 394 1452 684 WerFault.exe 399 4352 4112 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZOOMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DPBMGNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSPKFLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDBJTS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLVDPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VVURFD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OTD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYAAOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZYHI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ERMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTQMFS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMJSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCXZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJDWTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VWNINJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JEMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSUJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJITNT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NROEH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMTOSCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJYAEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFCJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3916 2026-09-29_3a5f5ff982e2d7898a17eb8172d77d66_elex_emotet_stop.exe 3916 2026-09-29_3a5f5ff982e2d7898a17eb8172d77d66_elex_emotet_stop.exe 1348 JEMY.exe 1348 JEMY.exe 2592 IUA.exe 2592 IUA.exe 2432 JXESQ.exe 2432 JXESQ.exe 4504 HMXNDP.exe 4504 HMXNDP.exe 5972 RVZSGNO.exe 5972 RVZSGNO.exe 3392 IVB.exe 3392 IVB.exe 3428 XQKJDF.exe 3428 XQKJDF.exe 2196 SLP.exe 2196 SLP.exe 5692 BMRY.exe 5692 BMRY.exe 1968 WZWHAK.exe 1968 WZWHAK.exe 3836 IPD.exe 3836 IPD.exe 2028 MXJ.exe 2028 MXJ.exe 4284 GSOY.exe 4284 GSOY.exe 1508 QTQMFS.exe 1508 QTQMFS.exe 2904 QWU.exe 2904 QWU.exe 5496 UEBHWSV.exe 5496 UEBHWSV.exe 1200 ECGCM.exe 1200 ECGCM.exe 3040 BCQE.exe 3040 BCQE.exe 5540 ONYD.exe 5540 ONYD.exe 1048 SQXYEI.exe 1048 SQXYEI.exe 3996 HLOC.exe 3996 HLOC.exe 2144 ERMZ.exe 2144 ERMZ.exe 4376 NROEH.exe 4376 NROEH.exe 5868 QMTOSCL.exe 5868 QMTOSCL.exe 5996 DPBMGNH.exe 5996 DPBMGNH.exe 4740 TFKE.exe 4740 TFKE.exe 4004 VDQ.exe 4004 VDQ.exe 4816 RIWVB.exe 4816 RIWVB.exe 1836 AJYAEY.exe 1836 AJYAEY.exe 1364 MZE.exe 1364 MZE.exe 4620 HMJSB.exe 4620 HMJSB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3916 2026-09-29_3a5f5ff982e2d7898a17eb8172d77d66_elex_emotet_stop.exe 3916 2026-09-29_3a5f5ff982e2d7898a17eb8172d77d66_elex_emotet_stop.exe 1348 JEMY.exe 1348 JEMY.exe 2592 IUA.exe 2592 IUA.exe 2432 JXESQ.exe 2432 JXESQ.exe 4504 HMXNDP.exe 4504 HMXNDP.exe 5972 RVZSGNO.exe 5972 RVZSGNO.exe 3392 IVB.exe 3392 IVB.exe 3428 XQKJDF.exe 3428 XQKJDF.exe 2196 SLP.exe 2196 SLP.exe 5692 BMRY.exe 5692 BMRY.exe 1968 WZWHAK.exe 1968 WZWHAK.exe 3836 IPD.exe 3836 IPD.exe 2028 MXJ.exe 2028 MXJ.exe 4284 GSOY.exe 4284 GSOY.exe 1508 QTQMFS.exe 1508 QTQMFS.exe 2904 QWU.exe 2904 QWU.exe 5496 UEBHWSV.exe 5496 UEBHWSV.exe 1200 ECGCM.exe 1200 ECGCM.exe 3040 BCQE.exe 3040 BCQE.exe 5540 ONYD.exe 5540 ONYD.exe 1048 SQXYEI.exe 1048 SQXYEI.exe 3996 HLOC.exe 3996 HLOC.exe 2144 ERMZ.exe 2144 ERMZ.exe 4376 NROEH.exe 4376 NROEH.exe 5868 QMTOSCL.exe 5868 QMTOSCL.exe 5996 DPBMGNH.exe 5996 DPBMGNH.exe 4740 TFKE.exe 4740 TFKE.exe 4004 VDQ.exe 4004 VDQ.exe 4816 RIWVB.exe 4816 RIWVB.exe 1836 AJYAEY.exe 1836 AJYAEY.exe 1364 MZE.exe 1364 MZE.exe 4620 HMJSB.exe 4620 HMJSB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3916 wrote to memory of 4624 3916 2026-09-29_3a5f5ff982e2d7898a17eb8172d77d66_elex_emotet_stop.exe 89 PID 4624 wrote to memory of 1348 4624 cmd.exe 93 PID 1348 wrote to memory of 1928 1348 JEMY.exe 95 PID 1928 wrote to memory of 2592 1928 cmd.exe 99 PID 2592 wrote to memory of 4656 2592 IUA.exe 100 PID 4656 wrote to memory of 2432 4656 cmd.exe 104 PID 2432 wrote to memory of 4960 2432 JXESQ.exe 105 PID 4960 wrote to memory of 4504 4960 cmd.exe 109 PID 4504 wrote to memory of 3512 4504 HMXNDP.exe 110 PID 3512 wrote to memory of 5972 3512 cmd.exe 114 PID 5972 wrote to memory of 3684 5972 RVZSGNO.exe 115 PID 3684 wrote to memory of 3392 3684 cmd.exe 119 PID 3392 wrote to memory of 6052 3392 IVB.exe 120 PID 6052 wrote to memory of 3428 6052 cmd.exe 124 PID 3428 wrote to memory of 4412 3428 XQKJDF.exe 125 PID 4412 wrote to memory of 2196 4412 cmd.exe 129 PID 2196 wrote to memory of 4992 2196 SLP.exe 130 PID 4992 wrote to memory of 5692 4992 cmd.exe 134 PID 5692 wrote to memory of 5856 5692 BMRY.exe 135 PID 5856 wrote to memory of 1968 5856 cmd.exe 139 PID 1968 wrote to memory of 5640 1968 WZWHAK.exe 140 PID 5640 wrote to memory of 3836 5640 cmd.exe 144 PID 3836 wrote to memory of 5656 3836 IPD.exe 145 PID 5656 wrote to memory of 2028 5656 cmd.exe 149 PID 2028 wrote to memory of 5316 2028 MXJ.exe 150 PID 5316 wrote to memory of 4284 5316 cmd.exe 154 PID 4284 wrote to memory of 5772 4284 GSOY.exe 155 PID 5772 wrote to memory of 1508 5772 cmd.exe 159 PID 1508 wrote to memory of 2388 1508 QTQMFS.exe 160 PID 2388 wrote to memory of 2904 2388 cmd.exe 164 PID 2904 wrote to memory of 5380 2904 QWU.exe 165 PID 5380 wrote to memory of 5496 5380 cmd.exe 169 PID 5496 wrote to memory of 2452 5496 UEBHWSV.exe 170 PID 2452 wrote to memory of 1200 2452 cmd.exe 174 PID 1200 wrote to memory of 5400 1200 ECGCM.exe 175 PID 5400 wrote to memory of 3040 5400 cmd.exe 179 PID 3040 wrote to memory of 772 3040 BCQE.exe 180 PID 772 wrote to memory of 5540 772 cmd.exe 184 PID 5540 wrote to memory of 2840 5540 ONYD.exe 185 PID 2840 wrote to memory of 1048 2840 cmd.exe 189 PID 1048 wrote to memory of 4692 1048 SQXYEI.exe 190 PID 4692 wrote to memory of 3996 4692 cmd.exe 193 PID 3996 wrote to memory of 4812 3996 HLOC.exe 195 PID 4812 wrote to memory of 2144 4812 cmd.exe 199 PID 2144 wrote to memory of 5652 2144 ERMZ.exe 200 PID 5652 wrote to memory of 4376 5652 cmd.exe 204 PID 4376 wrote to memory of 3552 4376 NROEH.exe 205 PID 3552 wrote to memory of 5868 3552 cmd.exe 209 PID 5868 wrote to memory of 1336 5868 QMTOSCL.exe 210 PID 1336 wrote to memory of 5996 1336 cmd.exe 214 PID 5996 wrote to memory of 4904 5996 DPBMGNH.exe 215 PID 4904 wrote to memory of 4740 4904 cmd.exe 219 PID 4740 wrote to memory of 2856 4740 TFKE.exe 220 PID 2856 wrote to memory of 4004 2856 cmd.exe 224 PID 4004 wrote to memory of 244 4004 VDQ.exe 225 PID 244 wrote to memory of 4816 244 cmd.exe 229 PID 4816 wrote to memory of 1688 4816 RIWVB.exe 230 PID 1688 wrote to memory of 1836 1688 cmd.exe 234 PID 1836 wrote to memory of 5156 1836 AJYAEY.exe 235 PID 5156 wrote to memory of 1364 5156 cmd.exe 239 PID 1364 wrote to memory of 3912 1364 MZE.exe 240 PID 3912 wrote to memory of 4620 3912 cmd.exe 244 PID 4620 wrote to memory of 5092 4620 HMJSB.exe 245 PID 5092 wrote to memory of 2784 5092 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_3a5f5ff982e2d7898a17eb8172d77d66_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_3a5f5ff982e2d7898a17eb8172d77d66_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JEMY.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\windows\JEMY.exeC:\windows\JEMY.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IUA.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\windows\system\IUA.exeC:\windows\system\IUA.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JXESQ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\windows\system\JXESQ.exeC:\windows\system\JXESQ.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMXNDP.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\windows\HMXNDP.exeC:\windows\HMXNDP.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RVZSGNO.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\windows\SysWOW64\RVZSGNO.exeC:\windows\system32\RVZSGNO.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IVB.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\windows\IVB.exeC:\windows\IVB.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQKJDF.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\windows\SysWOW64\XQKJDF.exeC:\windows\system32\XQKJDF.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SLP.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\SLP.exeC:\windows\SLP.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMRY.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\windows\SysWOW64\BMRY.exeC:\windows\system32\BMRY.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WZWHAK.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\windows\WZWHAK.exeC:\windows\WZWHAK.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IPD.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\windows\IPD.exeC:\windows\IPD.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXJ.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\MXJ.exeC:\windows\MXJ.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSOY.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\windows\SysWOW64\GSOY.exeC:\windows\system32\GSOY.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTQMFS.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\windows\system\QTQMFS.exeC:\windows\system\QTQMFS.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QWU.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\windows\QWU.exeC:\windows\QWU.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UEBHWSV.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\windows\UEBHWSV.exeC:\windows\UEBHWSV.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECGCM.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\system\ECGCM.exeC:\windows\system\ECGCM.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BCQE.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\windows\SysWOW64\BCQE.exeC:\windows\system32\BCQE.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ONYD.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\windows\system\ONYD.exeC:\windows\system\ONYD.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SQXYEI.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\windows\SQXYEI.exeC:\windows\SQXYEI.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLOC.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\windows\HLOC.exeC:\windows\HLOC.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ERMZ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\windows\SysWOW64\ERMZ.exeC:\windows\system32\ERMZ.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NROEH.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\windows\system\NROEH.exeC:\windows\system\NROEH.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QMTOSCL.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\windows\QMTOSCL.exeC:\windows\QMTOSCL.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DPBMGNH.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\windows\SysWOW64\DPBMGNH.exeC:\windows\system32\DPBMGNH.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFKE.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\windows\system\TFKE.exeC:\windows\system\TFKE.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDQ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\windows\SysWOW64\VDQ.exeC:\windows\system32\VDQ.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIWVB.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:244 -
C:\windows\SysWOW64\RIWVB.exeC:\windows\system32\RIWVB.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AJYAEY.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\windows\AJYAEY.exeC:\windows\AJYAEY.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MZE.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\windows\SysWOW64\MZE.exeC:\windows\system32\MZE.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HMJSB.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\windows\SysWOW64\HMJSB.exeC:\windows\system32\HMJSB.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZOBLIA.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\windows\system\CZOBLIA.exeC:\windows\system\CZOBLIA.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LII.exe.bat" "66⤵PID:5384
-
C:\windows\LII.exeC:\windows\LII.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIPUYI.exe.bat" "68⤵PID:1824
-
C:\windows\SysWOW64\RIPUYI.exeC:\windows\system32\RIPUYI.exe69⤵
- Executes dropped EXE
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLTX.exe.bat" "70⤵PID:4936
-
C:\windows\system\RLTX.exeC:\windows\system\RLTX.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BLVDPD.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3424 -
C:\windows\SysWOW64\BLVDPD.exeC:\windows\system32\BLVDPD.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTK.exe.bat" "74⤵PID:4744
-
C:\windows\FTK.exeC:\windows\FTK.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPHMD.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:1232 -
C:\windows\system\ZPHMD.exeC:\windows\system\ZPHMD.exe77⤵
- Executes dropped EXE
PID:3992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKY.exe.bat" "78⤵PID:256
-
C:\windows\system\OKY.exeC:\windows\system\OKY.exe79⤵
- Executes dropped EXE
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFPZ.exe.bat" "80⤵
- Executes a command shell one-liner
PID:2488 -
C:\windows\UFPZ.exeC:\windows\UFPZ.exe81⤵
- Executes dropped EXE
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PSUJD.exe.bat" "82⤵PID:4716
-
C:\windows\system\PSUJD.exeC:\windows\system\PSUJD.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGZSNKT.exe.bat" "84⤵
- Executes a command shell one-liner
PID:3864 -
C:\windows\SysWOW64\KGZSNKT.exeC:\windows\system32\KGZSNKT.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJDWTA.exe.bat" "86⤵PID:4328
-
C:\windows\SysWOW64\KJDWTA.exeC:\windows\system32\KJDWTA.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWI.exe.bat" "88⤵PID:4712
-
C:\windows\FWI.exeC:\windows\FWI.exe89⤵
- Executes dropped EXE
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URZJON.exe.bat" "90⤵PID:3488
-
C:\windows\system\URZJON.exeC:\windows\system\URZJON.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMW.exe.bat" "92⤵
- Executes a command shell one-liner
PID:5792 -
C:\windows\SysWOW64\PMW.exeC:\windows\system32\PMW.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HHIX.exe.bat" "94⤵PID:4708
-
C:\windows\system\HHIX.exeC:\windows\system\HHIX.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXOXQVE.exe.bat" "96⤵PID:3228
-
C:\windows\SysWOW64\TXOXQVE.exeC:\windows\system32\TXOXQVE.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVURFD.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3316 -
C:\windows\system\VVURFD.exeC:\windows\system\VVURFD.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVW.exe.bat" "100⤵PID:832
-
C:\windows\SysWOW64\NVW.exeC:\windows\system32\NVW.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYAAOZ.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:3004 -
C:\windows\FYAAOZ.exeC:\windows\FYAAOZ.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PZC.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:3764 -
C:\windows\PZC.exeC:\windows\PZC.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VWNINJ.exe.bat" "106⤵PID:5552
-
C:\windows\VWNINJ.exeC:\windows\VWNINJ.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXP.exe.bat" "108⤵PID:2384
-
C:\windows\system\EXP.exeC:\windows\system\EXP.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSUW.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3404 -
C:\windows\ZSUW.exeC:\windows\ZSUW.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ISW.exe.bat" "112⤵PID:4948
-
C:\windows\system\ISW.exeC:\windows\system\ISW.exe113⤵
- Executes dropped EXE
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTD.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3276 -
C:\windows\OTD.exeC:\windows\OTD.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GBFUQE.exe.bat" "116⤵
- Executes a command shell one-liner
PID:3444 -
C:\windows\system\GBFUQE.exeC:\windows\system\GBFUQE.exe117⤵
- Executes dropped EXE
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOK.exe.bat" "118⤵PID:2000
-
C:\windows\SysWOW64\AOK.exeC:\windows\system32\AOK.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWRMN.exe.bat" "120⤵PID:4736
-
C:\windows\system\EWRMN.exeC:\windows\system\EWRMN.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-