Analysis
- max time kernel
60s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 15:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_f22ff550a8a73705356db01033273f0a_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-29_f22ff550a8a73705356db01033273f0a_elex_emotet_stop.exe
- Size 208KB
- Sample260930-sh6mkavy4n
- SHA256 8a4f045f29193c6a9f6bf15d495f7d147a787cc548cb70a0240a9517828871d2
- MD5 f22ff550a8a73705356db01033273f0a
- SHA1 560fb68cd7409ebe0de07e3d0b7ab8161b305545
- SHA512 528a624988fde30a9e2038721175f774821b6ec842d6701b0255b37b7c45adf8c897eccd6282bd0ae6b98072387b727f9648ecc26a1734a83fcce5b4b8a99214
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFl1dL+LOfX4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFl15+LOvkEj1
- TLSH T17B247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5012 BAI.exe 3784 KTH.exe 3908 DLWCIT.exe 5912 VUYP.exe 2168 IEHGABE.exe 3876 DSLP.exe 1248 BDO.exe 5768 LLQS.exe 4204 AGAXPHS.exe 4908 ZRKNYN.exe 4080 OHLE.exe 3288 HZTPOCL.exe 2788 YKEFXQ.exe 5816 MFH.exe 1364 XYXRMF.exe 2172 HWCLBO.exe 6032 REEQFLJ.exe 1348 TRJA.exe 3920 RSRNYN.exe 4236 UFW.exe 4492 OAAGT.exe 4292 JNFQVN.exe 460 CQJ.exe 5952 LGP.exe 4732 FHE.exe 5248 MXFQGZ.exe 5032 FPUB.exe 5296 NVZI.exe 1460 KAFFPI.exe 4612 VTIYPQB.exe 4712 XRBAW.exe 4256 ZPHMD.exe 3376 URX.exe 4128 PNCUB.exe 5824 MFEWFC.exe 3380 DNSCST.exe 3600 LTFIDR.exe 3704 MWJEIHL.exe 5756 FZMIVX.exe 5516 SKVG.exe 4508 YXUHGLX.exe 5684 PKE.exe 4088 ADHS.exe 2252 TGLOKF.exe 2196 MZBZBG.exe 4532 AWBKD.exe 2072 TXIVN.exe 1736 OFRSUE.exe 5904 WLEZE.exe 5936 PDLK.exe 5524 GLZPAV.exe 616 WBAGHQA.exe 5552 NKPLUHV.exe 3404 GFTHZX.exe 1156 RXWAHEU.exe 1632 GAFEA.exe 5392 FLIU.exe 2608 PJVPQNA.exe 1116 IMZKWD.exe 1212 WHLLC.exe 1316 YXRGR.exe 3968 NNSXYW.exe 4340 AYIWEH.exe 6008 ZJL.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\MFH.exe YKEFXQ.exe File opened for modification C:\windows\SysWOW64\FPUB.exe MXFQGZ.exe File created C:\windows\SysWOW64\SKVG.exe.bat FZMIVX.exe File created C:\windows\SysWOW64\WBAGHQA.exe.bat GLZPAV.exe File created C:\windows\SysWOW64\FLIU.exe GAFEA.exe File opened for modification C:\windows\SysWOW64\MFH.exe YKEFXQ.exe File created C:\windows\SysWOW64\JNFQVN.exe OAAGT.exe File opened for modification C:\windows\SysWOW64\TXIVN.exe AWBKD.exe File created C:\windows\SysWOW64\NKPLUHV.exe WBAGHQA.exe File created C:\windows\SysWOW64\PKE.exe.bat YXUHGLX.exe File created C:\windows\SysWOW64\AWBKD.exe MZBZBG.exe File created C:\windows\SysWOW64\BAI.exe.bat 2026-09-29_f22ff550a8a73705356db01033273f0a_elex_emotet_stop.exe File created C:\windows\SysWOW64\YXUHGLX.exe.bat SKVG.exe File created C:\windows\SysWOW64\NKPLUHV.exe.bat WBAGHQA.exe File created C:\windows\SysWOW64\GAFEA.exe RXWAHEU.exe File created C:\windows\SysWOW64\PJVPQNA.exe.bat FLIU.exe File opened for modification C:\windows\SysWOW64\YXRGR.exe WHLLC.exe File created C:\windows\SysWOW64\FPUB.exe.bat MXFQGZ.exe File opened for modification C:\windows\SysWOW64\WBAGHQA.exe GLZPAV.exe File created C:\windows\SysWOW64\MFH.exe.bat YKEFXQ.exe File opened for modification C:\windows\SysWOW64\HWCLBO.exe XYXRMF.exe File opened for modification C:\windows\SysWOW64\REEQFLJ.exe HWCLBO.exe File opened for modification C:\windows\SysWOW64\XRBAW.exe VTIYPQB.exe File created C:\windows\SysWOW64\BAI.exe 2026-09-29_f22ff550a8a73705356db01033273f0a_elex_emotet_stop.exe File created C:\windows\SysWOW64\FPUB.exe MXFQGZ.exe File opened for modification C:\windows\SysWOW64\AWBKD.exe MZBZBG.exe File created C:\windows\SysWOW64\YXRGR.exe.bat WHLLC.exe File opened for modification C:\windows\SysWOW64\JNFQVN.exe OAAGT.exe File created C:\windows\SysWOW64\LTFIDR.exe DNSCST.exe File created C:\windows\SysWOW64\YXUHGLX.exe SKVG.exe File created C:\windows\SysWOW64\FLIU.exe.bat GAFEA.exe File created C:\windows\SysWOW64\CECN.exe ZJL.exe File opened for modification C:\windows\SysWOW64\LTFIDR.exe DNSCST.exe File created C:\windows\SysWOW64\FZMIVX.exe MWJEIHL.exe File opened for modification C:\windows\SysWOW64\SKVG.exe FZMIVX.exe File created C:\windows\SysWOW64\WBAGHQA.exe GLZPAV.exe File created C:\windows\SysWOW64\CECN.exe.bat ZJL.exe File opened for modification C:\windows\SysWOW64\BAI.exe 2026-09-29_f22ff550a8a73705356db01033273f0a_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\CQJ.exe JNFQVN.exe File created C:\windows\SysWOW64\LTFIDR.exe.bat DNSCST.exe File created C:\windows\SysWOW64\TXIVN.exe AWBKD.exe File created C:\windows\SysWOW64\GAFEA.exe.bat RXWAHEU.exe File created C:\windows\SysWOW64\KOUALL.exe OWSYH.exe File opened for modification C:\windows\SysWOW64\FLIU.exe GAFEA.exe File created C:\windows\SysWOW64\HWCLBO.exe.bat XYXRMF.exe File created C:\windows\SysWOW64\REEQFLJ.exe.bat HWCLBO.exe File created C:\windows\SysWOW64\JNFQVN.exe.bat OAAGT.exe File opened for modification C:\windows\SysWOW64\YXUHGLX.exe SKVG.exe File created C:\windows\SysWOW64\TXIVN.exe.bat AWBKD.exe File opened for modification C:\windows\SysWOW64\PJVPQNA.exe FLIU.exe File created C:\windows\SysWOW64\YXRGR.exe WHLLC.exe File created C:\windows\SysWOW64\XRBAW.exe.bat VTIYPQB.exe File opened for modification C:\windows\SysWOW64\FZMIVX.exe MWJEIHL.exe File created C:\windows\SysWOW64\FZMIVX.exe.bat MWJEIHL.exe File opened for modification C:\windows\SysWOW64\PKE.exe YXUHGLX.exe File created C:\windows\SysWOW64\AWBKD.exe.bat MZBZBG.exe File opened for modification C:\windows\SysWOW64\NKPLUHV.exe WBAGHQA.exe File created C:\windows\SysWOW64\PJVPQNA.exe FLIU.exe File opened for modification C:\windows\SysWOW64\KOUALL.exe OWSYH.exe File opened for modification C:\windows\SysWOW64\GAFEA.exe RXWAHEU.exe File created C:\windows\SysWOW64\CQJ.exe.bat JNFQVN.exe File created C:\windows\SysWOW64\XRBAW.exe VTIYPQB.exe File created C:\windows\SysWOW64\SKVG.exe FZMIVX.exe File created C:\windows\SysWOW64\PKE.exe YXUHGLX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\MFEWFC.exe.bat PNCUB.exe File opened for modification C:\windows\OFRSUE.exe TXIVN.exe File created C:\windows\system\WLEZE.exe OFRSUE.exe File created C:\windows\system\OWSYH.exe.bat IAHXTS.exe File opened for modification C:\windows\OAAGT.exe UFW.exe File opened for modification C:\windows\system\KTH.exe BAI.exe File created C:\windows\DSLP.exe.bat IEHGABE.exe File created C:\windows\OHLE.exe ZRKNYN.exe File opened for modification C:\windows\RXWAHEU.exe GFTHZX.exe File created C:\windows\RXWAHEU.exe.bat GFTHZX.exe File created C:\windows\system\IAHXTS.exe ZNUQJU.exe File opened for modification C:\windows\DLWCIT.exe KTH.exe File created C:\windows\VUYP.exe.bat DLWCIT.exe File created C:\windows\LGP.exe CQJ.exe File created C:\windows\MXFQGZ.exe FHE.exe File created C:\windows\system\URX.exe.bat ZPHMD.exe File created C:\windows\MWJEIHL.exe.bat LTFIDR.exe File created C:\windows\ZNUQJU.exe.bat EKMSCJ.exe File created C:\windows\DSLP.exe IEHGABE.exe File opened for modification C:\windows\system\RSRNYN.exe TRJA.exe File opened for modification C:\windows\system\NVZI.exe FPUB.exe File created C:\windows\system\ZPHMD.exe XRBAW.exe File created C:\windows\PNCUB.exe URX.exe File opened for modification C:\windows\system\MFEWFC.exe PNCUB.exe File created C:\windows\WHLLC.exe.bat IMZKWD.exe File opened for modification C:\windows\OHLE.exe ZRKNYN.exe File created C:\windows\system\VTIYPQB.exe.bat KAFFPI.exe File created C:\windows\system\ZPHMD.exe.bat XRBAW.exe File opened for modification C:\windows\IMZKWD.exe PJVPQNA.exe File created C:\windows\ZNUQJU.exe EKMSCJ.exe File created C:\windows\system\LLQS.exe BDO.exe File created C:\windows\GFTHZX.exe NKPLUHV.exe File created C:\windows\system\ZJL.exe.bat AYIWEH.exe File opened for modification C:\windows\system\UFW.exe RSRNYN.exe File opened for modification C:\windows\LGP.exe CQJ.exe File opened for modification C:\windows\system\WLEZE.exe OFRSUE.exe File opened for modification C:\windows\PDLK.exe WLEZE.exe File opened for modification C:\windows\WHLLC.exe IMZKWD.exe File created C:\windows\system\LLQS.exe.bat BDO.exe File created C:\windows\ZRKNYN.exe AGAXPHS.exe File created C:\windows\system\TGLOKF.exe.bat ADHS.exe File created C:\windows\GFTHZX.exe.bat NKPLUHV.exe File opened for modification C:\windows\AYIWEH.exe NNSXYW.exe File created C:\windows\XYXRMF.exe.bat MFH.exe File created C:\windows\system\RSRNYN.exe TRJA.exe File opened for modification C:\windows\system\TGLOKF.exe ADHS.exe File created C:\windows\FHE.exe LGP.exe File opened for modification C:\windows\IEHGABE.exe VUYP.exe File created C:\windows\LGP.exe.bat CQJ.exe File created C:\windows\MXFQGZ.exe.bat FHE.exe File opened for modification C:\windows\system\KAFFPI.exe NVZI.exe File created C:\windows\AYIWEH.exe NNSXYW.exe File opened for modification C:\windows\system\IAHXTS.exe ZNUQJU.exe File created C:\windows\system\BDO.exe.bat DSLP.exe File created C:\windows\system\HZTPOCL.exe.bat OHLE.exe File opened for modification C:\windows\PNCUB.exe URX.exe File created C:\windows\system\ADHS.exe.bat PKE.exe File created C:\windows\HKCPRNK.exe NWXGG.exe File opened for modification C:\windows\ZNUQJU.exe EKMSCJ.exe File created C:\windows\system\OWSYH.exe IAHXTS.exe File created C:\windows\IEHGABE.exe.bat VUYP.exe File created C:\windows\system\KAFFPI.exe NVZI.exe File opened for modification C:\windows\system\ADHS.exe PKE.exe File created C:\windows\OFRSUE.exe TXIVN.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2888 cmd.exe 2240 cmd.exe 2120 cmd.exe 596 cmd.exe 4156 cmd.exe 2796 cmd.exe 2948 cmd.exe 520 cmd.exe 808 cmd.exe 2016 cmd.exe 2984 cmd.exe 696 cmd.exe 1388 cmd.exe 3520 cmd.exe 2020 cmd.exe 1300 cmd.exe 3172 cmd.exe 5688 cmd.exe 608 cmd.exe 1280 cmd.exe 5696 cmd.exe 4376 cmd.exe 3484 cmd.exe 1252 cmd.exe 4888 cmd.exe 5116 cmd.exe 5980 cmd.exe 1056 cmd.exe 1756 cmd.exe 3468 cmd.exe 3180 cmd.exe 2588 cmd.exe 5244 cmd.exe 912 cmd.exe 3392 cmd.exe 4432 cmd.exe 1652 cmd.exe 5736 cmd.exe 3624 cmd.exe 1564 cmd.exe 1852 cmd.exe 4268 cmd.exe 4152 cmd.exe 5052 cmd.exe 5500 cmd.exe 2880 cmd.exe 3552 cmd.exe 2336 cmd.exe 3828 cmd.exe 4892 cmd.exe 1400 cmd.exe 3128 cmd.exe 4456 cmd.exe 1392 cmd.exe 4760 cmd.exe 5644 cmd.exe 1332 cmd.exe 1256 cmd.exe 4344 cmd.exe 2936 cmd.exe 5648 cmd.exe 5680 cmd.exe 3244 cmd.exe 5828 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2252 3280 WerFault.exe 87 3732 5012 WerFault.exe 93 4588 3784 WerFault.exe 99 608 3908 WerFault.exe 104 2172 5912 WerFault.exe 109 3556 2168 WerFault.exe 114 1252 3876 WerFault.exe 119 2324 1248 WerFault.exe 123 3172 5768 WerFault.exe 129 4736 4204 WerFault.exe 134 2300 4908 WerFault.exe 139 460 4080 WerFault.exe 144 3520 3288 WerFault.exe 149 3584 2788 WerFault.exe 154 4424 5816 WerFault.exe 159 5388 1364 WerFault.exe 164 3704 2172 WerFault.exe 169 2704 6032 WerFault.exe 174 4332 1348 WerFault.exe 179 1536 3920 WerFault.exe 184 4736 4236 WerFault.exe 189 916 4492 WerFault.exe 193 2024 4292 WerFault.exe 199 4448 460 WerFault.exe 204 3912 5952 WerFault.exe 209 4532 4732 WerFault.exe 214 2976 5248 WerFault.exe 219 3704 5032 WerFault.exe 224 3160 5296 WerFault.exe 228 4696 1460 WerFault.exe 234 4636 4612 WerFault.exe 239 5548 4712 WerFault.exe 244 1280 4256 WerFault.exe 249 4376 3376 WerFault.exe 254 4580 4128 WerFault.exe 259 4368 5824 WerFault.exe 264 2816 3380 WerFault.exe 269 3556 3600 WerFault.exe 275 4152 3704 WerFault.exe 280 2432 5756 WerFault.exe 285 5528 5516 WerFault.exe 290 5660 4508 WerFault.exe 295 3384 5684 WerFault.exe 300 2792 4088 WerFault.exe 305 4300 2252 WerFault.exe 310 5040 2196 WerFault.exe 315 2980 4532 WerFault.exe 320 4772 2072 WerFault.exe 325 5096 1736 WerFault.exe 330 4648 5904 WerFault.exe 335 684 5936 WerFault.exe 340 5672 5524 WerFault.exe 345 3060 616 WerFault.exe 350 2544 5552 WerFault.exe 355 4484 3404 WerFault.exe 360 4644 1156 WerFault.exe 365 4848 1632 WerFault.exe 370 3772 5392 WerFault.exe 375 2432 2608 WerFault.exe 380 5596 1116 WerFault.exe 385 4892 1212 WerFault.exe 390 4196 1316 WerFault.exe 394 5008 3968 WerFault.exe 400 92 4340 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWSYH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZTPOCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWJEIHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JNFQVN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OFRSUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZMIVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPUB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFEWFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WHLLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YKEFXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLIU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NNSXYW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLWCIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEHGABE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRBAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXUHGLX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OAAGT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NKPLUHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWXGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYXRMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXRGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPHMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFTHZX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KOUALL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMZKWD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFH.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3280 2026-09-29_f22ff550a8a73705356db01033273f0a_elex_emotet_stop.exe 3280 2026-09-29_f22ff550a8a73705356db01033273f0a_elex_emotet_stop.exe 5012 BAI.exe 5012 BAI.exe 3784 KTH.exe 3784 KTH.exe 3908 DLWCIT.exe 3908 DLWCIT.exe 5912 VUYP.exe 5912 VUYP.exe 2168 IEHGABE.exe 2168 IEHGABE.exe 3876 DSLP.exe 3876 DSLP.exe 1248 BDO.exe 1248 BDO.exe 5768 LLQS.exe 5768 LLQS.exe 4204 AGAXPHS.exe 4204 AGAXPHS.exe 4908 ZRKNYN.exe 4908 ZRKNYN.exe 4080 OHLE.exe 4080 OHLE.exe 3288 HZTPOCL.exe 3288 HZTPOCL.exe 2788 YKEFXQ.exe 2788 YKEFXQ.exe 5816 MFH.exe 5816 MFH.exe 1364 XYXRMF.exe 1364 XYXRMF.exe 2172 HWCLBO.exe 2172 HWCLBO.exe 6032 REEQFLJ.exe 6032 REEQFLJ.exe 1348 TRJA.exe 1348 TRJA.exe 3920 RSRNYN.exe 3920 RSRNYN.exe 4236 UFW.exe 4236 UFW.exe 4492 OAAGT.exe 4492 OAAGT.exe 4292 JNFQVN.exe 4292 JNFQVN.exe 460 CQJ.exe 460 CQJ.exe 5952 LGP.exe 5952 LGP.exe 4732 FHE.exe 4732 FHE.exe 5248 MXFQGZ.exe 5248 MXFQGZ.exe 5032 FPUB.exe 5032 FPUB.exe 5296 NVZI.exe 5296 NVZI.exe 1460 KAFFPI.exe 1460 KAFFPI.exe 4612 VTIYPQB.exe 4612 VTIYPQB.exe 4712 XRBAW.exe 4712 XRBAW.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3280 2026-09-29_f22ff550a8a73705356db01033273f0a_elex_emotet_stop.exe 3280 2026-09-29_f22ff550a8a73705356db01033273f0a_elex_emotet_stop.exe 5012 BAI.exe 5012 BAI.exe 3784 KTH.exe 3784 KTH.exe 3908 DLWCIT.exe 3908 DLWCIT.exe 5912 VUYP.exe 5912 VUYP.exe 2168 IEHGABE.exe 2168 IEHGABE.exe 3876 DSLP.exe 3876 DSLP.exe 1248 BDO.exe 1248 BDO.exe 5768 LLQS.exe 5768 LLQS.exe 4204 AGAXPHS.exe 4204 AGAXPHS.exe 4908 ZRKNYN.exe 4908 ZRKNYN.exe 4080 OHLE.exe 4080 OHLE.exe 3288 HZTPOCL.exe 3288 HZTPOCL.exe 2788 YKEFXQ.exe 2788 YKEFXQ.exe 5816 MFH.exe 5816 MFH.exe 1364 XYXRMF.exe 1364 XYXRMF.exe 2172 HWCLBO.exe 2172 HWCLBO.exe 6032 REEQFLJ.exe 6032 REEQFLJ.exe 1348 TRJA.exe 1348 TRJA.exe 3920 RSRNYN.exe 3920 RSRNYN.exe 4236 UFW.exe 4236 UFW.exe 4492 OAAGT.exe 4492 OAAGT.exe 4292 JNFQVN.exe 4292 JNFQVN.exe 460 CQJ.exe 460 CQJ.exe 5952 LGP.exe 5952 LGP.exe 4732 FHE.exe 4732 FHE.exe 5248 MXFQGZ.exe 5248 MXFQGZ.exe 5032 FPUB.exe 5032 FPUB.exe 5296 NVZI.exe 5296 NVZI.exe 1460 KAFFPI.exe 1460 KAFFPI.exe 4612 VTIYPQB.exe 4612 VTIYPQB.exe 4712 XRBAW.exe 4712 XRBAW.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3280 wrote to memory of 4528 3280 2026-09-29_f22ff550a8a73705356db01033273f0a_elex_emotet_stop.exe 89 PID 4528 wrote to memory of 5012 4528 cmd.exe 93 PID 5012 wrote to memory of 4764 5012 BAI.exe 95 PID 4764 wrote to memory of 3784 4764 cmd.exe 99 PID 3784 wrote to memory of 5164 3784 KTH.exe 100 PID 5164 wrote to memory of 3908 5164 cmd.exe 104 PID 3908 wrote to memory of 3552 3908 DLWCIT.exe 105 PID 3552 wrote to memory of 5912 3552 cmd.exe 109 PID 5912 wrote to memory of 5828 5912 VUYP.exe 110 PID 5828 wrote to memory of 2168 5828 cmd.exe 114 PID 2168 wrote to memory of 1968 2168 IEHGABE.exe 115 PID 1968 wrote to memory of 3876 1968 cmd.exe 119 PID 3876 wrote to memory of 824 3876 DSLP.exe 120 PID 824 wrote to memory of 1248 824 cmd.exe 123 PID 1248 wrote to memory of 4888 1248 BDO.exe 125 PID 4888 wrote to memory of 5768 4888 cmd.exe 129 PID 5768 wrote to memory of 3204 5768 LLQS.exe 130 PID 3204 wrote to memory of 4204 3204 cmd.exe 134 PID 4204 wrote to memory of 4792 4204 AGAXPHS.exe 135 PID 4792 wrote to memory of 4908 4792 cmd.exe 139 PID 4908 wrote to memory of 5244 4908 ZRKNYN.exe 140 PID 5244 wrote to memory of 4080 5244 cmd.exe 144 PID 4080 wrote to memory of 2052 4080 OHLE.exe 145 PID 2052 wrote to memory of 3288 2052 cmd.exe 149 PID 3288 wrote to memory of 2004 3288 HZTPOCL.exe 150 PID 2004 wrote to memory of 2788 2004 cmd.exe 154 PID 2788 wrote to memory of 912 2788 YKEFXQ.exe 155 PID 912 wrote to memory of 5816 912 cmd.exe 159 PID 5816 wrote to memory of 4708 5816 MFH.exe 160 PID 4708 wrote to memory of 1364 4708 cmd.exe 164 PID 1364 wrote to memory of 1388 1364 XYXRMF.exe 165 PID 1388 wrote to memory of 2172 1388 cmd.exe 169 PID 2172 wrote to memory of 808 2172 HWCLBO.exe 170 PID 808 wrote to memory of 6032 808 cmd.exe 174 PID 6032 wrote to memory of 3112 6032 REEQFLJ.exe 175 PID 3112 wrote to memory of 1348 3112 cmd.exe 179 PID 1348 wrote to memory of 6124 1348 TRJA.exe 180 PID 6124 wrote to memory of 3920 6124 cmd.exe 184 PID 3920 wrote to memory of 1392 3920 RSRNYN.exe 185 PID 1392 wrote to memory of 4236 1392 cmd.exe 189 PID 4236 wrote to memory of 588 4236 UFW.exe 190 PID 588 wrote to memory of 4492 588 cmd.exe 193 PID 4492 wrote to memory of 2148 4492 OAAGT.exe 195 PID 2148 wrote to memory of 4292 2148 cmd.exe 199 PID 4292 wrote to memory of 896 4292 JNFQVN.exe 200 PID 896 wrote to memory of 460 896 cmd.exe 204 PID 460 wrote to memory of 4940 460 CQJ.exe 205 PID 4940 wrote to memory of 5952 4940 cmd.exe 209 PID 5952 wrote to memory of 2016 5952 LGP.exe 210 PID 2016 wrote to memory of 4732 2016 cmd.exe 214 PID 4732 wrote to memory of 5784 4732 FHE.exe 215 PID 5784 wrote to memory of 5248 5784 cmd.exe 219 PID 5248 wrote to memory of 2464 5248 MXFQGZ.exe 220 PID 2464 wrote to memory of 5032 2464 cmd.exe 224 PID 5032 wrote to memory of 820 5032 FPUB.exe 225 PID 820 wrote to memory of 5296 820 cmd.exe 228 PID 5296 wrote to memory of 5688 5296 NVZI.exe 230 PID 5688 wrote to memory of 1460 5688 cmd.exe 234 PID 1460 wrote to memory of 1564 1460 KAFFPI.exe 235 PID 1564 wrote to memory of 4612 1564 cmd.exe 239 PID 4612 wrote to memory of 4760 4612 VTIYPQB.exe 240 PID 4760 wrote to memory of 4712 4760 cmd.exe 244 PID 4712 wrote to memory of 4816 4712 XRBAW.exe 245 PID 4816 wrote to memory of 4256 4816 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_f22ff550a8a73705356db01033273f0a_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_f22ff550a8a73705356db01033273f0a_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BAI.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\windows\SysWOW64\BAI.exeC:\windows\system32\BAI.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTH.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\windows\system\KTH.exeC:\windows\system\KTH.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DLWCIT.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\windows\DLWCIT.exeC:\windows\DLWCIT.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUYP.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\windows\VUYP.exeC:\windows\VUYP.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IEHGABE.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\windows\IEHGABE.exeC:\windows\IEHGABE.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DSLP.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\windows\DSLP.exeC:\windows\DSLP.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BDO.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:824 -
C:\windows\system\BDO.exeC:\windows\system\BDO.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LLQS.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\windows\system\LLQS.exeC:\windows\system\LLQS.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AGAXPHS.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\windows\system\AGAXPHS.exeC:\windows\system\AGAXPHS.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZRKNYN.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\windows\ZRKNYN.exeC:\windows\ZRKNYN.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHLE.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\windows\OHLE.exeC:\windows\OHLE.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HZTPOCL.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\windows\system\HZTPOCL.exeC:\windows\system\HZTPOCL.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YKEFXQ.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\windows\YKEFXQ.exeC:\windows\YKEFXQ.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MFH.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:912 -
C:\windows\SysWOW64\MFH.exeC:\windows\system32\MFH.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYXRMF.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\windows\XYXRMF.exeC:\windows\XYXRMF.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWCLBO.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\windows\SysWOW64\HWCLBO.exeC:\windows\system32\HWCLBO.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\REEQFLJ.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:808 -
C:\windows\SysWOW64\REEQFLJ.exeC:\windows\system32\REEQFLJ.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRJA.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\windows\TRJA.exeC:\windows\TRJA.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSRNYN.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\windows\system\RSRNYN.exeC:\windows\system\RSRNYN.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UFW.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\windows\system\UFW.exeC:\windows\system\UFW.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OAAGT.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:588 -
C:\windows\OAAGT.exeC:\windows\OAAGT.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNFQVN.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\windows\SysWOW64\JNFQVN.exeC:\windows\system32\JNFQVN.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQJ.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:896 -
C:\windows\SysWOW64\CQJ.exeC:\windows\system32\CQJ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGP.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\windows\LGP.exeC:\windows\LGP.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHE.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\windows\FHE.exeC:\windows\FHE.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXFQGZ.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\windows\MXFQGZ.exeC:\windows\MXFQGZ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPUB.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\windows\SysWOW64\FPUB.exeC:\windows\system32\FPUB.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NVZI.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\windows\system\NVZI.exeC:\windows\system\NVZI.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KAFFPI.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\windows\system\KAFFPI.exeC:\windows\system\KAFFPI.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VTIYPQB.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\windows\system\VTIYPQB.exeC:\windows\system\VTIYPQB.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XRBAW.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\windows\SysWOW64\XRBAW.exeC:\windows\system32\XRBAW.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPHMD.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\windows\system\ZPHMD.exeC:\windows\system\ZPHMD.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URX.exe.bat" "66⤵PID:5380
-
C:\windows\system\URX.exeC:\windows\system\URX.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PNCUB.exe.bat" "68⤵PID:5176
-
C:\windows\PNCUB.exeC:\windows\PNCUB.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MFEWFC.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2888 -
C:\windows\system\MFEWFC.exeC:\windows\system\MFEWFC.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNSCST.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2240 -
C:\windows\DNSCST.exeC:\windows\DNSCST.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LTFIDR.exe.bat" "74⤵
- Executes a command shell one-liner
PID:2336 -
C:\windows\SysWOW64\LTFIDR.exeC:\windows\system32\LTFIDR.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MWJEIHL.exe.bat" "76⤵
- Executes a command shell one-liner
PID:1852 -
C:\windows\MWJEIHL.exeC:\windows\MWJEIHL.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FZMIVX.exe.bat" "78⤵PID:3856
-
C:\windows\SysWOW64\FZMIVX.exeC:\windows\system32\FZMIVX.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SKVG.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4996 -
C:\windows\SysWOW64\SKVG.exeC:\windows\system32\SKVG.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXUHGLX.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5116 -
C:\windows\SysWOW64\YXUHGLX.exeC:\windows\system32\YXUHGLX.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PKE.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5548 -
C:\windows\SysWOW64\PKE.exeC:\windows\system32\PKE.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADHS.exe.bat" "86⤵PID:2284
-
C:\windows\system\ADHS.exeC:\windows\system\ADHS.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGLOKF.exe.bat" "88⤵
- Executes a command shell one-liner
PID:5644 -
C:\windows\system\TGLOKF.exeC:\windows\system\TGLOKF.exe89⤵
- Executes dropped EXE
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MZBZBG.exe.bat" "90⤵PID:2548
-
C:\windows\system\MZBZBG.exeC:\windows\system\MZBZBG.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AWBKD.exe.bat" "92⤵
- Executes a command shell one-liner
PID:608 -
C:\windows\SysWOW64\AWBKD.exeC:\windows\system32\AWBKD.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXIVN.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:2956 -
C:\windows\SysWOW64\TXIVN.exeC:\windows\system32\TXIVN.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OFRSUE.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:1868 -
C:\windows\OFRSUE.exeC:\windows\OFRSUE.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WLEZE.exe.bat" "98⤵PID:2492
-
C:\windows\system\WLEZE.exeC:\windows\system\WLEZE.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PDLK.exe.bat" "100⤵PID:3040
-
C:\windows\PDLK.exeC:\windows\PDLK.exe101⤵
- Executes dropped EXE
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GLZPAV.exe.bat" "102⤵PID:5528
-
C:\windows\system\GLZPAV.exeC:\windows\system\GLZPAV.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WBAGHQA.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:5660 -
C:\windows\SysWOW64\WBAGHQA.exeC:\windows\system32\WBAGHQA.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NKPLUHV.exe.bat" "106⤵PID:3384
-
C:\windows\SysWOW64\NKPLUHV.exeC:\windows\system32\NKPLUHV.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GFTHZX.exe.bat" "108⤵
- Executes a command shell one-liner
PID:2796 -
C:\windows\GFTHZX.exeC:\windows\GFTHZX.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RXWAHEU.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:3056 -
C:\windows\RXWAHEU.exeC:\windows\RXWAHEU.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GAFEA.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3520 -
C:\windows\SysWOW64\GAFEA.exeC:\windows\system32\GAFEA.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLIU.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:5796 -
C:\windows\SysWOW64\FLIU.exeC:\windows\system32\FLIU.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJVPQNA.exe.bat" "116⤵PID:5740
-
C:\windows\SysWOW64\PJVPQNA.exeC:\windows\system32\PJVPQNA.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMZKWD.exe.bat" "118⤵
- Executes a command shell one-liner
PID:2020 -
C:\windows\IMZKWD.exeC:\windows\IMZKWD.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WHLLC.exe.bat" "120⤵
- Executes a command shell one-liner
PID:1300 -
C:\windows\WHLLC.exeC:\windows\WHLLC.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-