Analysis
- max time kernel
50s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 12:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_375faa194c9c8beb64a26280e518ad96_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-30_375faa194c9c8beb64a26280e518ad96_elex_emotet_stop.exe
- Size 208KB
- Sample260930-pkg57svwex
- SHA256 2fd9cd4e0651914809728c7bf980a8be41efd46372aca9ed49ee2718d6d3fead
- MD5 375faa194c9c8beb64a26280e518ad96
- SHA1 6ef5603a6534e15083a423c219d90c81dcffbf4c
- SHA512 16e338cb4782dfa545906430471becef547ea41771dc942f4a37044735c98c9c8319cbcb21f2176476d477532a1b9eb95754c451e0ef918bf4b1405f89e5f565
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbtlUKL+LOfw4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbtlUS+LOYkEj1
- TLSH T127247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 62 IoCs
pid Process 1868 PTBQQRQ.exe 4800 YMAFYHO.exe 5288 HKUGSLX.exe 4660 NFGZYAF.exe 4704 LVRCL.exe 4884 XYP.exe 2424 BOWXX.exe 5816 QJN.exe 3496 ARHO.exe 5932 UFMYDI.exe 5044 PSR.exe 2092 VSYVX.exe 932 GLBOFKI.exe 3220 GRBCGXL.exe 2332 XEMUW.exe 5400 XJEAYG.exe 5912 OXPTODQ.exe 2116 FINQNXL.exe 1788 UDWVY.exe 4900 UIPJA.exe 5296 AIWXJZY.exe 3760 XOCU.exe 2904 IHF.exe 4796 EMDKN.exe 5752 BNNM.exe 4572 OPVL.exe 1404 PSHHLX.exe 2956 CDPF.exe 3680 STQXFVZ.exe 5640 KOUALL.exe 4532 FKZ.exe 3888 LKG.exe 4524 TPHM.exe 4600 HVFJVC.exe 1360 ZAPB.exe 2464 ZOPQ.exe 2480 OJZUXYV.exe 2516 UEY.exe 1816 WCDPJKL.exe 5324 GARJR.exe 5628 ZSYUI.exe 2392 MQG.exe 1668 GJOR.exe 5600 BZXGA.exe 5448 SZLLN.exe 992 CXRFCRB.exe 4340 VPG.exe 2692 TLFRQ.exe 5012 OYKABVN.exe 4580 FLV.exe 2088 CRSPY.exe 4016 WEXZAB.exe 1552 RRC.exe 3372 RFCX.exe 4760 XFKKDI.exe 3776 TDIIKS.exe 3764 VBJCIG.exe 4256 GTM.exe 3428 BHJE.exe 3560 UZY.exe 944 GAN.exe 1240 ZNM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\ZNM.exe.bat GAN.exe File created C:\windows\SysWOW64\HVFJVC.exe TPHM.exe File created C:\windows\SysWOW64\UFMYDI.exe ARHO.exe File created C:\windows\SysWOW64\UFMYDI.exe.bat ARHO.exe File created C:\windows\SysWOW64\IHF.exe XOCU.exe File created C:\windows\SysWOW64\IHF.exe.bat XOCU.exe File opened for modification C:\windows\SysWOW64\KOUALL.exe STQXFVZ.exe File created C:\windows\SysWOW64\XEMUW.exe.bat GRBCGXL.exe File opened for modification C:\windows\SysWOW64\XJEAYG.exe XEMUW.exe File opened for modification C:\windows\SysWOW64\STQXFVZ.exe CDPF.exe File opened for modification C:\windows\SysWOW64\ZAPB.exe HVFJVC.exe File created C:\windows\SysWOW64\ZSYUI.exe.bat GARJR.exe File opened for modification C:\windows\SysWOW64\GTM.exe VBJCIG.exe File opened for modification C:\windows\SysWOW64\ARHO.exe QJN.exe File created C:\windows\SysWOW64\UIPJA.exe.bat UDWVY.exe File opened for modification C:\windows\SysWOW64\IHF.exe XOCU.exe File opened for modification C:\windows\SysWOW64\ZSYUI.exe GARJR.exe File created C:\windows\SysWOW64\WEXZAB.exe.bat CRSPY.exe File created C:\windows\SysWOW64\RFCX.exe.bat RRC.exe File created C:\windows\SysWOW64\BHJE.exe GTM.exe File created C:\windows\SysWOW64\AIWXJZY.exe UIPJA.exe File created C:\windows\SysWOW64\GARJR.exe WCDPJKL.exe File created C:\windows\SysWOW64\ARHO.exe QJN.exe File created C:\windows\SysWOW64\XEMUW.exe GRBCGXL.exe File created C:\windows\SysWOW64\XJEAYG.exe.bat XEMUW.exe File created C:\windows\SysWOW64\WCDPJKL.exe UEY.exe File created C:\windows\SysWOW64\BZXGA.exe.bat GJOR.exe File created C:\windows\SysWOW64\WEXZAB.exe CRSPY.exe File created C:\windows\SysWOW64\GRBCGXL.exe GLBOFKI.exe File created C:\windows\SysWOW64\WTFVPMG.exe ZNM.exe File opened for modification C:\windows\SysWOW64\AIWXJZY.exe UIPJA.exe File created C:\windows\SysWOW64\OPVL.exe BNNM.exe File created C:\windows\SysWOW64\GARJR.exe.bat WCDPJKL.exe File created C:\windows\SysWOW64\ZSYUI.exe GARJR.exe File created C:\windows\SysWOW64\SZLLN.exe.bat BZXGA.exe File opened for modification C:\windows\SysWOW64\BHJE.exe GTM.exe File created C:\windows\SysWOW64\AIWXJZY.exe.bat UIPJA.exe File opened for modification C:\windows\SysWOW64\EMDKN.exe IHF.exe File created C:\windows\SysWOW64\KOUALL.exe STQXFVZ.exe File opened for modification C:\windows\SysWOW64\WEXZAB.exe CRSPY.exe File created C:\windows\SysWOW64\BHJE.exe.bat GTM.exe File opened for modification C:\windows\SysWOW64\WTFVPMG.exe ZNM.exe File created C:\windows\SysWOW64\XJEAYG.exe XEMUW.exe File created C:\windows\SysWOW64\OPVL.exe.bat BNNM.exe File created C:\windows\SysWOW64\STQXFVZ.exe.bat CDPF.exe File opened for modification C:\windows\SysWOW64\UFMYDI.exe ARHO.exe File created C:\windows\SysWOW64\GRBCGXL.exe.bat GLBOFKI.exe File created C:\windows\SysWOW64\PSHHLX.exe.bat OPVL.exe File created C:\windows\SysWOW64\STQXFVZ.exe CDPF.exe File created C:\windows\SysWOW64\UIPJA.exe UDWVY.exe File created C:\windows\SysWOW64\WCDPJKL.exe.bat UEY.exe File opened for modification C:\windows\SysWOW64\GARJR.exe WCDPJKL.exe File created C:\windows\SysWOW64\BZXGA.exe GJOR.exe File opened for modification C:\windows\SysWOW64\PSHHLX.exe OPVL.exe File created C:\windows\SysWOW64\KOUALL.exe.bat STQXFVZ.exe File opened for modification C:\windows\SysWOW64\BZXGA.exe GJOR.exe File opened for modification C:\windows\SysWOW64\ZNM.exe GAN.exe File created C:\windows\SysWOW64\ZAPB.exe HVFJVC.exe File created C:\windows\SysWOW64\OYKABVN.exe TLFRQ.exe File created C:\windows\SysWOW64\OYKABVN.exe.bat TLFRQ.exe File opened for modification C:\windows\SysWOW64\RFCX.exe RRC.exe File created C:\windows\SysWOW64\GTM.exe.bat VBJCIG.exe File created C:\windows\SysWOW64\ZNM.exe GAN.exe File created C:\windows\SysWOW64\WTFVPMG.exe.bat ZNM.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\RRC.exe WEXZAB.exe File created C:\windows\TDIIKS.exe.bat XFKKDI.exe File opened for modification C:\windows\system\HKUGSLX.exe YMAFYHO.exe File opened for modification C:\windows\NFGZYAF.exe HKUGSLX.exe File created C:\windows\XYP.exe.bat LVRCL.exe File created C:\windows\XOCU.exe AIWXJZY.exe File created C:\windows\system\CDPF.exe PSHHLX.exe File created C:\windows\system\ZOPQ.exe ZAPB.exe File created C:\windows\OJZUXYV.exe ZOPQ.exe File created C:\windows\system\RRC.exe.bat WEXZAB.exe File opened for modification C:\windows\XYP.exe LVRCL.exe File created C:\windows\BOWXX.exe.bat XYP.exe File opened for modification C:\windows\XOCU.exe AIWXJZY.exe File created C:\windows\LKG.exe FKZ.exe File opened for modification C:\windows\system\MQG.exe ZSYUI.exe File opened for modification C:\windows\system\CRSPY.exe FLV.exe File created C:\windows\LVRCL.exe.bat NFGZYAF.exe File created C:\windows\system\QJN.exe BOWXX.exe File created C:\windows\FINQNXL.exe.bat OXPTODQ.exe File opened for modification C:\windows\FKZ.exe KOUALL.exe File created C:\windows\TPHM.exe.bat LKG.exe File opened for modification C:\windows\OJZUXYV.exe ZOPQ.exe File created C:\windows\system\VPG.exe.bat CXRFCRB.exe File opened for modification C:\windows\system\VBJCIG.exe TDIIKS.exe File created C:\windows\system\MQG.exe ZSYUI.exe File created C:\windows\TDIIKS.exe XFKKDI.exe File created C:\windows\FKZ.exe KOUALL.exe File opened for modification C:\windows\LVRCL.exe NFGZYAF.exe File opened for modification C:\windows\GLBOFKI.exe VSYVX.exe File created C:\windows\GLBOFKI.exe.bat VSYVX.exe File created C:\windows\system\UDWVY.exe FINQNXL.exe File opened for modification C:\windows\system\UDWVY.exe FINQNXL.exe File created C:\windows\BNNM.exe EMDKN.exe File opened for modification C:\windows\TPHM.exe LKG.exe File created C:\windows\PTBQQRQ.exe.bat 2026-09-30_375faa194c9c8beb64a26280e518ad96_elex_emotet_stop.exe File created C:\windows\system\YMAFYHO.exe PTBQQRQ.exe File created C:\windows\OJZUXYV.exe.bat ZOPQ.exe File opened for modification C:\windows\UEY.exe OJZUXYV.exe File created C:\windows\GJOR.exe.bat MQG.exe File created C:\windows\XFKKDI.exe.bat RFCX.exe File opened for modification C:\windows\PTBQQRQ.exe 2026-09-30_375faa194c9c8beb64a26280e518ad96_elex_emotet_stop.exe File opened for modification C:\windows\system\YMAFYHO.exe PTBQQRQ.exe File created C:\windows\BOWXX.exe XYP.exe File opened for modification C:\windows\system\QJN.exe BOWXX.exe File created C:\windows\FINQNXL.exe OXPTODQ.exe File opened for modification C:\windows\system\TLFRQ.exe VPG.exe File opened for modification C:\windows\FLV.exe OYKABVN.exe File created C:\windows\system\CRSPY.exe.bat FLV.exe File created C:\windows\system\HKUGSLX.exe YMAFYHO.exe File created C:\windows\NFGZYAF.exe HKUGSLX.exe File created C:\windows\XYP.exe LVRCL.exe File opened for modification C:\windows\VSYVX.exe PSR.exe File created C:\windows\LKG.exe.bat FKZ.exe File created C:\windows\UEY.exe.bat OJZUXYV.exe File created C:\windows\system\MQG.exe.bat ZSYUI.exe File created C:\windows\XFKKDI.exe RFCX.exe File created C:\windows\system\HKUGSLX.exe.bat YMAFYHO.exe File created C:\windows\GLBOFKI.exe VSYVX.exe File opened for modification C:\windows\system\OXPTODQ.exe XJEAYG.exe File created C:\windows\TPHM.exe LKG.exe File opened for modification C:\windows\system\VPG.exe CXRFCRB.exe File created C:\windows\system\RRC.exe WEXZAB.exe File opened for modification C:\windows\XFKKDI.exe RFCX.exe File created C:\windows\system\VBJCIG.exe TDIIKS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4788 cmd.exe 2184 cmd.exe 2824 cmd.exe 2748 cmd.exe 4728 cmd.exe 1532 cmd.exe 4284 cmd.exe 5892 cmd.exe 5292 cmd.exe 260 cmd.exe 2840 cmd.exe 2312 cmd.exe 3088 cmd.exe 5788 cmd.exe 6136 cmd.exe 3712 cmd.exe 4168 cmd.exe 5724 cmd.exe 3176 cmd.exe 5928 cmd.exe 5068 cmd.exe 5844 cmd.exe 1716 cmd.exe 3316 cmd.exe 5944 cmd.exe 5900 cmd.exe 4408 cmd.exe 5284 cmd.exe 1908 cmd.exe 4268 cmd.exe 2484 cmd.exe 2488 cmd.exe 2664 cmd.exe 3968 cmd.exe 420 cmd.exe 1456 cmd.exe 3816 cmd.exe 6068 cmd.exe 1384 cmd.exe 4504 cmd.exe 4132 cmd.exe 5676 cmd.exe 2104 cmd.exe 436 cmd.exe 1636 cmd.exe 3448 cmd.exe 4032 cmd.exe 4364 cmd.exe 1652 cmd.exe 700 cmd.exe 4136 cmd.exe 4712 cmd.exe 3276 cmd.exe 4628 cmd.exe 1528 cmd.exe 1164 cmd.exe 3224 cmd.exe 2628 cmd.exe 1504 cmd.exe 4124 cmd.exe 5452 cmd.exe 2864 cmd.exe 5340 cmd.exe 2540 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 6140 6020 WerFault.exe 87 5892 1868 WerFault.exe 92 3788 4800 WerFault.exe 98 2576 5288 WerFault.exe 103 1532 4660 WerFault.exe 107 5096 4704 WerFault.exe 113 5424 4884 WerFault.exe 118 2148 2424 WerFault.exe 123 4352 5816 WerFault.exe 127 672 3496 WerFault.exe 133 6124 5932 WerFault.exe 138 4732 5044 WerFault.exe 142 2104 2092 WerFault.exe 147 2780 932 WerFault.exe 153 1572 3220 WerFault.exe 157 548 2332 WerFault.exe 163 800 5400 WerFault.exe 168 2924 5912 WerFault.exe 172 1832 2116 WerFault.exe 178 1884 1788 WerFault.exe 182 700 4900 WerFault.exe 187 2336 5296 WerFault.exe 193 5832 3760 WerFault.exe 198 3160 2904 WerFault.exe 202 5712 4796 WerFault.exe 208 5088 5752 WerFault.exe 213 2516 4572 WerFault.exe 218 2192 1404 WerFault.exe 223 2580 2956 WerFault.exe 228 5484 3680 WerFault.exe 233 4628 5640 WerFault.exe 237 4548 4532 WerFault.exe 243 2824 3888 WerFault.exe 248 4972 4524 WerFault.exe 252 4760 4600 WerFault.exe 258 4328 1360 WerFault.exe 263 5568 2464 WerFault.exe 268 3276 2480 WerFault.exe 273 2788 2516 WerFault.exe 279 2940 1816 WerFault.exe 284 108 5324 WerFault.exe 289 2220 5628 WerFault.exe 294 4036 2392 WerFault.exe 299 5276 1668 WerFault.exe 304 5512 5600 WerFault.exe 309 5744 5448 WerFault.exe 314 3588 992 WerFault.exe 319 4080 4340 WerFault.exe 324 5928 2692 WerFault.exe 329 4352 5012 WerFault.exe 334 944 4580 WerFault.exe 338 2280 2088 WerFault.exe 344 1960 4016 WerFault.exe 349 5652 1552 WerFault.exe 353 4108 3372 WerFault.exe 358 476 4760 WerFault.exe 363 1452 3776 WerFault.exe 368 5096 3764 WerFault.exe 374 4048 4256 WerFault.exe 379 3176 3428 WerFault.exe 384 2508 3560 WerFault.exe 389 3504 944 WerFault.exe 394 4708 1240 WerFault.exe 399 5512 1932 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ARHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJZUXYV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GARJR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TDIIKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZXGA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSYUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXRFCRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMDKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UIPJA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVFJVC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRSPY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIWXJZY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XEMUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TPHM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZAPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFGZYAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QJN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GRBCGXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDWVY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCDPJKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BOWXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OYKABVN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFMYDI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WEXZAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6020 2026-09-30_375faa194c9c8beb64a26280e518ad96_elex_emotet_stop.exe 6020 2026-09-30_375faa194c9c8beb64a26280e518ad96_elex_emotet_stop.exe 1868 PTBQQRQ.exe 1868 PTBQQRQ.exe 4800 YMAFYHO.exe 4800 YMAFYHO.exe 5288 HKUGSLX.exe 5288 HKUGSLX.exe 4660 NFGZYAF.exe 4660 NFGZYAF.exe 4704 LVRCL.exe 4704 LVRCL.exe 4884 XYP.exe 4884 XYP.exe 2424 BOWXX.exe 2424 BOWXX.exe 5816 QJN.exe 5816 QJN.exe 3496 ARHO.exe 3496 ARHO.exe 5932 UFMYDI.exe 5932 UFMYDI.exe 5044 PSR.exe 5044 PSR.exe 2092 VSYVX.exe 2092 VSYVX.exe 932 GLBOFKI.exe 932 GLBOFKI.exe 3220 GRBCGXL.exe 3220 GRBCGXL.exe 2332 XEMUW.exe 2332 XEMUW.exe 5400 XJEAYG.exe 5400 XJEAYG.exe 5912 OXPTODQ.exe 5912 OXPTODQ.exe 2116 FINQNXL.exe 2116 FINQNXL.exe 1788 UDWVY.exe 1788 UDWVY.exe 4900 UIPJA.exe 4900 UIPJA.exe 5296 AIWXJZY.exe 5296 AIWXJZY.exe 3760 XOCU.exe 3760 XOCU.exe 2904 IHF.exe 2904 IHF.exe 4796 EMDKN.exe 4796 EMDKN.exe 5752 BNNM.exe 5752 BNNM.exe 4572 OPVL.exe 4572 OPVL.exe 1404 PSHHLX.exe 1404 PSHHLX.exe 2956 CDPF.exe 2956 CDPF.exe 3680 STQXFVZ.exe 3680 STQXFVZ.exe 5640 KOUALL.exe 5640 KOUALL.exe 4532 FKZ.exe 4532 FKZ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 6020 2026-09-30_375faa194c9c8beb64a26280e518ad96_elex_emotet_stop.exe 6020 2026-09-30_375faa194c9c8beb64a26280e518ad96_elex_emotet_stop.exe 1868 PTBQQRQ.exe 1868 PTBQQRQ.exe 4800 YMAFYHO.exe 4800 YMAFYHO.exe 5288 HKUGSLX.exe 5288 HKUGSLX.exe 4660 NFGZYAF.exe 4660 NFGZYAF.exe 4704 LVRCL.exe 4704 LVRCL.exe 4884 XYP.exe 4884 XYP.exe 2424 BOWXX.exe 2424 BOWXX.exe 5816 QJN.exe 5816 QJN.exe 3496 ARHO.exe 3496 ARHO.exe 5932 UFMYDI.exe 5932 UFMYDI.exe 5044 PSR.exe 5044 PSR.exe 2092 VSYVX.exe 2092 VSYVX.exe 932 GLBOFKI.exe 932 GLBOFKI.exe 3220 GRBCGXL.exe 3220 GRBCGXL.exe 2332 XEMUW.exe 2332 XEMUW.exe 5400 XJEAYG.exe 5400 XJEAYG.exe 5912 OXPTODQ.exe 5912 OXPTODQ.exe 2116 FINQNXL.exe 2116 FINQNXL.exe 1788 UDWVY.exe 1788 UDWVY.exe 4900 UIPJA.exe 4900 UIPJA.exe 5296 AIWXJZY.exe 5296 AIWXJZY.exe 3760 XOCU.exe 3760 XOCU.exe 2904 IHF.exe 2904 IHF.exe 4796 EMDKN.exe 4796 EMDKN.exe 5752 BNNM.exe 5752 BNNM.exe 4572 OPVL.exe 4572 OPVL.exe 1404 PSHHLX.exe 1404 PSHHLX.exe 2956 CDPF.exe 2956 CDPF.exe 3680 STQXFVZ.exe 3680 STQXFVZ.exe 5640 KOUALL.exe 5640 KOUALL.exe 4532 FKZ.exe 4532 FKZ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6020 wrote to memory of 260 6020 2026-09-30_375faa194c9c8beb64a26280e518ad96_elex_emotet_stop.exe 88 PID 260 wrote to memory of 1868 260 cmd.exe 92 PID 1868 wrote to memory of 5492 1868 PTBQQRQ.exe 94 PID 5492 wrote to memory of 4800 5492 cmd.exe 98 PID 4800 wrote to memory of 3968 4800 YMAFYHO.exe 99 PID 3968 wrote to memory of 5288 3968 cmd.exe 103 PID 5288 wrote to memory of 1948 5288 HKUGSLX.exe 104 PID 1948 wrote to memory of 4660 1948 cmd.exe 107 PID 4660 wrote to memory of 5208 4660 NFGZYAF.exe 109 PID 5208 wrote to memory of 4704 5208 cmd.exe 113 PID 4704 wrote to memory of 3224 4704 LVRCL.exe 114 PID 3224 wrote to memory of 4884 3224 cmd.exe 118 PID 4884 wrote to memory of 2840 4884 XYP.exe 119 PID 2840 wrote to memory of 2424 2840 cmd.exe 123 PID 2424 wrote to memory of 1636 2424 BOWXX.exe 124 PID 1636 wrote to memory of 5816 1636 cmd.exe 127 PID 5816 wrote to memory of 4260 5816 QJN.exe 129 PID 4260 wrote to memory of 3496 4260 cmd.exe 133 PID 3496 wrote to memory of 2748 3496 ARHO.exe 134 PID 2748 wrote to memory of 5932 2748 cmd.exe 138 PID 5932 wrote to memory of 4920 5932 UFMYDI.exe 139 PID 4920 wrote to memory of 5044 4920 cmd.exe 142 PID 5044 wrote to memory of 5844 5044 PSR.exe 144 PID 5844 wrote to memory of 2092 5844 cmd.exe 147 PID 2092 wrote to memory of 6136 2092 VSYVX.exe 149 PID 6136 wrote to memory of 932 6136 cmd.exe 153 PID 932 wrote to memory of 1604 932 GLBOFKI.exe 154 PID 1604 wrote to memory of 3220 1604 cmd.exe 157 PID 3220 wrote to memory of 6132 3220 GRBCGXL.exe 159 PID 6132 wrote to memory of 2332 6132 cmd.exe 163 PID 2332 wrote to memory of 1716 2332 XEMUW.exe 164 PID 1716 wrote to memory of 5400 1716 cmd.exe 168 PID 5400 wrote to memory of 2200 5400 XJEAYG.exe 169 PID 2200 wrote to memory of 5912 2200 cmd.exe 172 PID 5912 wrote to memory of 3600 5912 OXPTODQ.exe 174 PID 3600 wrote to memory of 2116 3600 cmd.exe 178 PID 2116 wrote to memory of 1760 2116 FINQNXL.exe 179 PID 1760 wrote to memory of 1788 1760 cmd.exe 182 PID 1788 wrote to memory of 5768 1788 UDWVY.exe 184 PID 5768 wrote to memory of 4900 5768 cmd.exe 187 PID 4900 wrote to memory of 4308 4900 UIPJA.exe 189 PID 4308 wrote to memory of 5296 4308 cmd.exe 193 PID 5296 wrote to memory of 1912 5296 AIWXJZY.exe 194 PID 1912 wrote to memory of 3760 1912 cmd.exe 198 PID 3760 wrote to memory of 3712 3760 XOCU.exe 199 PID 3712 wrote to memory of 2904 3712 cmd.exe 202 PID 2904 wrote to memory of 2756 2904 IHF.exe 204 PID 2756 wrote to memory of 4796 2756 cmd.exe 208 PID 4796 wrote to memory of 3316 4796 EMDKN.exe 209 PID 3316 wrote to memory of 5752 3316 cmd.exe 213 PID 5752 wrote to memory of 4364 5752 BNNM.exe 214 PID 4364 wrote to memory of 4572 4364 cmd.exe 218 PID 4572 wrote to memory of 5944 4572 OPVL.exe 219 PID 5944 wrote to memory of 1404 5944 cmd.exe 223 PID 1404 wrote to memory of 3544 1404 PSHHLX.exe 224 PID 3544 wrote to memory of 2956 3544 cmd.exe 228 PID 2956 wrote to memory of 5672 2956 CDPF.exe 229 PID 5672 wrote to memory of 3680 5672 cmd.exe 233 PID 3680 wrote to memory of 4220 3680 STQXFVZ.exe 234 PID 4220 wrote to memory of 5640 4220 cmd.exe 237 PID 5640 wrote to memory of 1060 5640 KOUALL.exe 239 PID 1060 wrote to memory of 4532 1060 cmd.exe 243 PID 4532 wrote to memory of 3008 4532 FKZ.exe 244 PID 3008 wrote to memory of 3888 3008 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_375faa194c9c8beb64a26280e518ad96_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_375faa194c9c8beb64a26280e518ad96_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PTBQQRQ.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:260 -
C:\windows\PTBQQRQ.exeC:\windows\PTBQQRQ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YMAFYHO.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\windows\system\YMAFYHO.exeC:\windows\system\YMAFYHO.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKUGSLX.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\windows\system\HKUGSLX.exeC:\windows\system\HKUGSLX.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFGZYAF.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\windows\NFGZYAF.exeC:\windows\NFGZYAF.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LVRCL.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\windows\LVRCL.exeC:\windows\LVRCL.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYP.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\windows\XYP.exeC:\windows\XYP.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOWXX.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\windows\BOWXX.exeC:\windows\BOWXX.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJN.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\windows\system\QJN.exeC:\windows\system\QJN.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ARHO.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\windows\SysWOW64\ARHO.exeC:\windows\system32\ARHO.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UFMYDI.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\windows\SysWOW64\UFMYDI.exeC:\windows\system32\UFMYDI.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PSR.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\windows\PSR.exeC:\windows\PSR.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSYVX.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\windows\VSYVX.exeC:\windows\VSYVX.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLBOFKI.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\windows\GLBOFKI.exeC:\windows\GLBOFKI.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GRBCGXL.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\windows\SysWOW64\GRBCGXL.exeC:\windows\system32\GRBCGXL.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XEMUW.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\windows\SysWOW64\XEMUW.exeC:\windows\system32\XEMUW.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XJEAYG.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\windows\SysWOW64\XJEAYG.exeC:\windows\system32\XJEAYG.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXPTODQ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\windows\system\OXPTODQ.exeC:\windows\system\OXPTODQ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FINQNXL.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\windows\FINQNXL.exeC:\windows\FINQNXL.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDWVY.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\windows\system\UDWVY.exeC:\windows\system\UDWVY.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UIPJA.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\windows\SysWOW64\UIPJA.exeC:\windows\system32\UIPJA.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AIWXJZY.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\windows\SysWOW64\AIWXJZY.exeC:\windows\system32\AIWXJZY.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XOCU.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\windows\XOCU.exeC:\windows\XOCU.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHF.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\windows\SysWOW64\IHF.exeC:\windows\system32\IHF.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EMDKN.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\windows\SysWOW64\EMDKN.exeC:\windows\system32\EMDKN.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNNM.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\windows\BNNM.exeC:\windows\BNNM.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OPVL.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\windows\SysWOW64\OPVL.exeC:\windows\system32\OPVL.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PSHHLX.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\windows\SysWOW64\PSHHLX.exeC:\windows\system32\PSHHLX.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDPF.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\windows\system\CDPF.exeC:\windows\system\CDPF.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STQXFVZ.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\windows\SysWOW64\STQXFVZ.exeC:\windows\system32\STQXFVZ.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KOUALL.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\windows\SysWOW64\KOUALL.exeC:\windows\system32\KOUALL.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FKZ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\windows\FKZ.exeC:\windows\FKZ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LKG.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\windows\LKG.exeC:\windows\LKG.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TPHM.exe.bat" "66⤵PID:4848
-
C:\windows\TPHM.exeC:\windows\TPHM.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVFJVC.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1476 -
C:\windows\SysWOW64\HVFJVC.exeC:\windows\system32\HVFJVC.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZAPB.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4728 -
C:\windows\SysWOW64\ZAPB.exeC:\windows\system32\ZAPB.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOPQ.exe.bat" "72⤵PID:5824
-
C:\windows\system\ZOPQ.exeC:\windows\system\ZOPQ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJZUXYV.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1532 -
C:\windows\OJZUXYV.exeC:\windows\OJZUXYV.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UEY.exe.bat" "76⤵PID:4752
-
C:\windows\UEY.exeC:\windows\UEY.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCDPJKL.exe.bat" "78⤵PID:5496
-
C:\windows\SysWOW64\WCDPJKL.exeC:\windows\system32\WCDPJKL.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GARJR.exe.bat" "80⤵PID:2580
-
C:\windows\SysWOW64\GARJR.exeC:\windows\system32\GARJR.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZSYUI.exe.bat" "82⤵PID:1068
-
C:\windows\SysWOW64\ZSYUI.exeC:\windows\system32\ZSYUI.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MQG.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5972 -
C:\windows\system\MQG.exeC:\windows\system\MQG.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJOR.exe.bat" "86⤵
- Executes a command shell one-liner
PID:1384 -
C:\windows\GJOR.exeC:\windows\GJOR.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BZXGA.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:4436 -
C:\windows\SysWOW64\BZXGA.exeC:\windows\system32\BZXGA.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SZLLN.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4788 -
C:\windows\SysWOW64\SZLLN.exeC:\windows\system32\SZLLN.exe91⤵
- Executes dropped EXE
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CXRFCRB.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:5720 -
C:\windows\system\CXRFCRB.exeC:\windows\system\CXRFCRB.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VPG.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:3676 -
C:\windows\system\VPG.exeC:\windows\system\VPG.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TLFRQ.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:2968 -
C:\windows\system\TLFRQ.exeC:\windows\system\TLFRQ.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OYKABVN.exe.bat" "98⤵PID:3248
-
C:\windows\SysWOW64\OYKABVN.exeC:\windows\system32\OYKABVN.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FLV.exe.bat" "100⤵PID:2788
-
C:\windows\FLV.exeC:\windows\FLV.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CRSPY.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4168 -
C:\windows\system\CRSPY.exeC:\windows\system\CRSPY.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WEXZAB.exe.bat" "104⤵PID:1684
-
C:\windows\SysWOW64\WEXZAB.exeC:\windows\system32\WEXZAB.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RRC.exe.bat" "106⤵PID:480
-
C:\windows\system\RRC.exeC:\windows\system\RRC.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RFCX.exe.bat" "108⤵PID:4916
-
C:\windows\SysWOW64\RFCX.exeC:\windows\system32\RFCX.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFKKDI.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1908 -
C:\windows\XFKKDI.exeC:\windows\XFKKDI.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TDIIKS.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3448 -
C:\windows\TDIIKS.exeC:\windows\TDIIKS.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBJCIG.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:4664 -
C:\windows\system\VBJCIG.exeC:\windows\system\VBJCIG.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GTM.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2312 -
C:\windows\SysWOW64\GTM.exeC:\windows\system32\GTM.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BHJE.exe.bat" "118⤵PID:5424
-
C:\windows\SysWOW64\BHJE.exeC:\windows\system32\BHJE.exe119⤵
- Executes dropped EXE
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UZY.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:3288 -
C:\windows\UZY.exeC:\windows\UZY.exe121⤵
- Executes dropped EXE
PID:3560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-