Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 16:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_c609a03a589b3e44f99871fec6d879dc_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-29_c609a03a589b3e44f99871fec6d879dc_elex_emotet_stop.exe
- Size 208KB
- Sample260930-t7y5fsdc66
- SHA256 15d711e1590a40c45bba6de33037fe1bbead9246926b7159e59134d2c50f1093
- MD5 c609a03a589b3e44f99871fec6d879dc
- SHA1 88577d0afcf80676ebfac6773c941d582be59fc9
- SHA512 7e61fd98cb8051efd3751137020172032ec779806d96809d4f370157efb8cf5d999fee035c35c0b22825e205e6378bcb0d0f79fa2f47c9a923e29bee70de6b60
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOf34pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOPkEj1
- TLSH T107247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1900 XSA.exe 5224 JEMY.exe 248 CRLWB.exe 3360 FECYU.exe 2584 LANZA.exe 1292 IAXBEC.exe 1740 KNGDXNW.exe 1184 STTRIMS.exe 2200 GZTDK.exe 3492 ZRJ.exe 5640 MXJA.exe 2464 PKABPVA.exe 1304 CIA.exe 2876 KWMTBFF.exe 5692 NJEVUZ.exe 3476 ERS.exe 1928 QFRYMRM.exe 1404 EADZ.exe 752 GYIMZO.exe 2504 KDABQKY.exe 4648 TJFQAI.exe 3016 BWSWLO.exe 2572 VEBLS.exe 2400 JAMMYXB.exe 2892 QVQFMM.exe 1600 GAPMX.exe 2004 ROOKC.exe 5168 KGDUU.exe 1072 JZGKCMG.exe 4052 RFTRFLB.exe 4760 KIWVTB.exe 5932 UGC.exe 4596 MBGLFZV.exe 4752 WYTFV.exe 5192 EMYM.exe 1400 OKMY.exe 4872 EFVLYJI.exe 3432 UPYBHP.exe 1560 VTC.exe 3312 BTJKD.exe 4940 ZOJ.exe 5984 JMWFP.exe 4492 WPF.exe 5364 VZHUMJP.exe 5808 OAXFVKF.exe 5652 JNCO.exe 5172 PJBPCFJ.exe 3116 LOLET.exe 4100 PRJ.exe 1328 TZQZFU.exe 3320 FPF.exe 544 ADJRB.exe 4260 JDD.exe 1840 NTSWRC.exe 5092 IGXNBBS.exe 3284 IJBJ.exe 1164 BME.exe 3648 KPVB.exe 3088 BPJG.exe 932 JDOM.exe 3744 NGMHYZY.exe 1296 QTDJRLN.exe 5360 UJKJD.exe 2356 RCTTHH.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\HWSKD.exe HTCW.exe File created C:\windows\SysWOW64\QFCT.exe.bat CUUCKU.exe File created C:\windows\SysWOW64\CRLWB.exe.bat JEMY.exe File opened for modification C:\windows\SysWOW64\VTC.exe UPYBHP.exe File created C:\windows\SysWOW64\TZQZFU.exe PRJ.exe File created C:\windows\SysWOW64\STTRIMS.exe KNGDXNW.exe File created C:\windows\SysWOW64\BWSWLO.exe TJFQAI.exe File opened for modification C:\windows\SysWOW64\CUUCKU.exe JGNWF.exe File opened for modification C:\windows\SysWOW64\CRLWB.exe JEMY.exe File created C:\windows\SysWOW64\GZTDK.exe.bat STTRIMS.exe File created C:\windows\SysWOW64\QVQFMM.exe.bat JAMMYXB.exe File created C:\windows\SysWOW64\VTC.exe UPYBHP.exe File created C:\windows\SysWOW64\WPF.exe JMWFP.exe File opened for modification C:\windows\SysWOW64\RCTTHH.exe UJKJD.exe File opened for modification C:\windows\SysWOW64\CMAE.exe DTXOBKB.exe File opened for modification C:\windows\SysWOW64\GZTDK.exe STTRIMS.exe File created C:\windows\SysWOW64\ZRJ.exe.bat GZTDK.exe File created C:\windows\SysWOW64\VTC.exe.bat UPYBHP.exe File created C:\windows\SysWOW64\PRJ.exe.bat LOLET.exe File created C:\windows\SysWOW64\PVW.exe RCTTHH.exe File created C:\windows\SysWOW64\JNM.exe.bat PVW.exe File created C:\windows\SysWOW64\CMAE.exe DTXOBKB.exe File created C:\windows\SysWOW64\QVQFMM.exe JAMMYXB.exe File created C:\windows\SysWOW64\JZGKCMG.exe KGDUU.exe File created C:\windows\SysWOW64\TZQZFU.exe.bat PRJ.exe File created C:\windows\SysWOW64\AVMZD.exe JKCJVR.exe File created C:\windows\SysWOW64\CUUCKU.exe JGNWF.exe File created C:\windows\SysWOW64\XSA.exe.bat 2026-09-29_c609a03a589b3e44f99871fec6d879dc_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\ZRJ.exe GZTDK.exe File created C:\windows\SysWOW64\KNGDXNW.exe.bat IAXBEC.exe File created C:\windows\SysWOW64\ZRJ.exe GZTDK.exe File opened for modification C:\windows\SysWOW64\BWSWLO.exe TJFQAI.exe File opened for modification C:\windows\SysWOW64\WYTFV.exe MBGLFZV.exe File created C:\windows\SysWOW64\PRJ.exe LOLET.exe File created C:\windows\SysWOW64\KPVB.exe.bat BME.exe File opened for modification C:\windows\SysWOW64\IHF.exe HDBJTS.exe File created C:\windows\SysWOW64\XSA.exe 2026-09-29_c609a03a589b3e44f99871fec6d879dc_elex_emotet_stop.exe File created C:\windows\SysWOW64\VEBLS.exe BWSWLO.exe File created C:\windows\SysWOW64\JZGKCMG.exe.bat KGDUU.exe File created C:\windows\SysWOW64\PVW.exe.bat RCTTHH.exe File created C:\windows\SysWOW64\IHF.exe HDBJTS.exe File opened for modification C:\windows\SysWOW64\QFCT.exe CUUCKU.exe File created C:\windows\SysWOW64\LANZA.exe.bat FECYU.exe File created C:\windows\SysWOW64\KNGDXNW.exe IAXBEC.exe File opened for modification C:\windows\SysWOW64\KNGDXNW.exe IAXBEC.exe File created C:\windows\SysWOW64\BWSWLO.exe.bat TJFQAI.exe File opened for modification C:\windows\SysWOW64\JZGKCMG.exe KGDUU.exe File opened for modification C:\windows\SysWOW64\KPVB.exe BME.exe File opened for modification C:\windows\SysWOW64\HWSKD.exe HTCW.exe File created C:\windows\SysWOW64\HWSKD.exe.bat HTCW.exe File created C:\windows\SysWOW64\LANZA.exe FECYU.exe File created C:\windows\SysWOW64\RFTRFLB.exe JZGKCMG.exe File created C:\windows\SysWOW64\WYTFV.exe.bat MBGLFZV.exe File opened for modification C:\windows\SysWOW64\WPF.exe JMWFP.exe File opened for modification C:\windows\SysWOW64\PRJ.exe LOLET.exe File opened for modification C:\windows\SysWOW64\TZQZFU.exe PRJ.exe File created C:\windows\SysWOW64\UJKJD.exe QTDJRLN.exe File created C:\windows\SysWOW64\UJKJD.exe.bat QTDJRLN.exe File opened for modification C:\windows\SysWOW64\XSA.exe 2026-09-29_c609a03a589b3e44f99871fec6d879dc_elex_emotet_stop.exe File created C:\windows\SysWOW64\VEBLS.exe.bat BWSWLO.exe File created C:\windows\SysWOW64\RCTTHH.exe UJKJD.exe File created C:\windows\SysWOW64\CMAE.exe.bat DTXOBKB.exe File created C:\windows\SysWOW64\JDD.exe.bat ADJRB.exe File opened for modification C:\windows\SysWOW64\AVMZD.exe JKCJVR.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\ADJRB.exe FPF.exe File created C:\windows\JDOM.exe.bat BPJG.exe File opened for modification C:\windows\NGMHYZY.exe JDOM.exe File opened for modification C:\windows\TNBJ.exe THBV.exe File created C:\windows\TNBJ.exe.bat THBV.exe File opened for modification C:\windows\system\OIT.exe MKNQ.exe File opened for modification C:\windows\system\QFRYMRM.exe ERS.exe File created C:\windows\system\EADZ.exe QFRYMRM.exe File opened for modification C:\windows\system\MBGLFZV.exe UGC.exe File created C:\windows\system\PJBPCFJ.exe JNCO.exe File created C:\windows\FPF.exe TZQZFU.exe File created C:\windows\system\DLHE.exe TNBJ.exe File created C:\windows\system\OIT.exe MKNQ.exe File created C:\windows\HTCW.exe.bat IJRGO.exe File created C:\windows\system\MXJA.exe.bat ZRJ.exe File created C:\windows\system\MBGLFZV.exe.bat UGC.exe File created C:\windows\system\UPYBHP.exe.bat EFVLYJI.exe File opened for modification C:\windows\system\ZOJ.exe BTJKD.exe File created C:\windows\VZHUMJP.exe.bat WPF.exe File opened for modification C:\windows\system\DLHE.exe TNBJ.exe File created C:\windows\system\OIT.exe.bat MKNQ.exe File created C:\windows\TVWJKN.exe.bat ZVGYAV.exe File created C:\windows\system\CIA.exe PKABPVA.exe File opened for modification C:\windows\KWMTBFF.exe CIA.exe File opened for modification C:\windows\JMWFP.exe ZOJ.exe File created C:\windows\system\OAXFVKF.exe VZHUMJP.exe File created C:\windows\IGXNBBS.exe NTSWRC.exe File created C:\windows\IGXNBBS.exe.bat NTSWRC.exe File created C:\windows\THBV.exe.bat SEL.exe File created C:\windows\BKR.exe.bat HWSKD.exe File created C:\windows\system\GYIMZO.exe EADZ.exe File created C:\windows\system\KDABQKY.exe.bat GYIMZO.exe File created C:\windows\system\NTSWRC.exe.bat JDD.exe File created C:\windows\THBV.exe SEL.exe File created C:\windows\QBZ.exe.bat RQXZ.exe File opened for modification C:\windows\system\CIA.exe PKABPVA.exe File created C:\windows\KWMTBFF.exe.bat CIA.exe File created C:\windows\NJEVUZ.exe KWMTBFF.exe File created C:\windows\GAPMX.exe.bat QVQFMM.exe File opened for modification C:\windows\ROOKC.exe GAPMX.exe File opened for modification C:\windows\system\EFVLYJI.exe OKMY.exe File opened for modification C:\windows\system\VOK.exe DLHE.exe File opened for modification C:\windows\HTCW.exe IJRGO.exe File created C:\windows\system\PKABPVA.exe MXJA.exe File created C:\windows\system\ERS.exe NJEVUZ.exe File created C:\windows\KGDUU.exe ROOKC.exe File created C:\windows\KIWVTB.exe RFTRFLB.exe File opened for modification C:\windows\system\OKMY.exe EMYM.exe File created C:\windows\JMWFP.exe.bat ZOJ.exe File created C:\windows\VZHUMJP.exe WPF.exe File created C:\windows\LOLET.exe PJBPCFJ.exe File created C:\windows\system\ERS.exe.bat NJEVUZ.exe File opened for modification C:\windows\system\EADZ.exe QFRYMRM.exe File created C:\windows\system\TJFQAI.exe KDABQKY.exe File opened for modification C:\windows\system\IJBJ.exe IGXNBBS.exe File opened for modification C:\windows\BPJG.exe KPVB.exe File created C:\windows\BPJG.exe.bat KPVB.exe File opened for modification C:\windows\DTXOBKB.exe VOK.exe File opened for modification C:\windows\system\MKNQ.exe CMAE.exe File created C:\windows\system\BME.exe IJBJ.exe File opened for modification C:\windows\system\BME.exe IJBJ.exe File created C:\windows\system\QTDJRLN.exe.bat NGMHYZY.exe File opened for modification C:\windows\system\HDBJTS.exe RTQBKMK.exe File created C:\windows\BKR.exe HWSKD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1016 cmd.exe 2012 cmd.exe 5352 cmd.exe 5020 cmd.exe 3952 cmd.exe 2268 cmd.exe 1932 cmd.exe 4336 cmd.exe 2528 cmd.exe 5940 cmd.exe 5200 cmd.exe 968 cmd.exe 3080 cmd.exe 5212 cmd.exe 3120 cmd.exe 1832 cmd.exe 2196 cmd.exe 1912 cmd.exe 2676 cmd.exe 5348 cmd.exe 4312 cmd.exe 4840 cmd.exe 4164 cmd.exe 1196 cmd.exe 1188 cmd.exe 5392 cmd.exe 5632 cmd.exe 5420 cmd.exe 2680 cmd.exe 5112 cmd.exe 892 cmd.exe 5976 cmd.exe 5512 cmd.exe 3216 cmd.exe 2648 cmd.exe 3484 cmd.exe 2216 cmd.exe 6052 cmd.exe 3140 cmd.exe 2868 cmd.exe 2120 cmd.exe 4528 cmd.exe 4376 cmd.exe 5964 cmd.exe 1888 cmd.exe 1516 cmd.exe 2888 cmd.exe 5536 cmd.exe 1720 cmd.exe 2008 cmd.exe 5896 cmd.exe 2724 cmd.exe 4680 cmd.exe 5760 cmd.exe 5372 cmd.exe 5556 cmd.exe 2072 cmd.exe 1368 cmd.exe 5480 cmd.exe 5080 cmd.exe 3704 cmd.exe 4900 cmd.exe 364 cmd.exe 4832 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1304 4896 WerFault.exe 88 4404 1900 WerFault.exe 93 348 5224 WerFault.exe 99 4300 248 WerFault.exe 104 4604 3360 WerFault.exe 109 5976 2584 WerFault.exe 114 1744 1292 WerFault.exe 119 3280 1740 WerFault.exe 124 1888 1184 WerFault.exe 128 1012 2200 WerFault.exe 134 2084 3492 WerFault.exe 139 4752 5640 WerFault.exe 144 5092 2464 WerFault.exe 149 256 1304 WerFault.exe 154 5660 2876 WerFault.exe 159 1968 5692 WerFault.exe 164 5536 3476 WerFault.exe 169 5856 1928 WerFault.exe 174 5392 1404 WerFault.exe 179 1212 752 WerFault.exe 184 3372 2504 WerFault.exe 189 1816 4648 WerFault.exe 194 2448 3016 WerFault.exe 199 5092 2572 WerFault.exe 204 3356 2400 WerFault.exe 209 1128 2892 WerFault.exe 214 4996 1600 WerFault.exe 219 2696 2004 WerFault.exe 224 716 5168 WerFault.exe 229 2212 1072 WerFault.exe 234 4124 4052 WerFault.exe 239 5148 4760 WerFault.exe 244 4636 5932 WerFault.exe 249 5360 4596 WerFault.exe 254 2356 4752 WerFault.exe 260 4704 5192 WerFault.exe 265 4284 1400 WerFault.exe 270 2100 4872 WerFault.exe 275 5716 3432 WerFault.exe 280 1500 1560 WerFault.exe 285 2212 3312 WerFault.exe 290 5804 4940 WerFault.exe 295 3372 5984 WerFault.exe 300 2072 4492 WerFault.exe 305 2448 5364 WerFault.exe 310 3940 5808 WerFault.exe 315 1040 5652 WerFault.exe 320 2716 5172 WerFault.exe 325 1976 3116 WerFault.exe 330 2580 4100 WerFault.exe 335 5816 1328 WerFault.exe 340 3408 3320 WerFault.exe 345 2996 544 WerFault.exe 350 788 4260 WerFault.exe 355 3684 1840 WerFault.exe 360 3416 5092 WerFault.exe 365 3392 3284 WerFault.exe 370 5060 1164 WerFault.exe 375 700 3648 WerFault.exe 380 4428 3088 WerFault.exe 385 2024 932 WerFault.exe 390 5704 3744 WerFault.exe 395 2008 1296 WerFault.exe 400 3436 5360 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWMTBFF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BME.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OAXFVKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADJRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTSWRC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJBJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RCTTHH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIWVTB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JNCO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KPVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTDJRLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTJKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STTRIMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BWSWLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAPMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DTXOBKB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBVHPPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VZHUMJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UJKJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQXZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVQFMM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGDUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TZQZFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMAE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TVWJKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4896 2026-09-29_c609a03a589b3e44f99871fec6d879dc_elex_emotet_stop.exe 4896 2026-09-29_c609a03a589b3e44f99871fec6d879dc_elex_emotet_stop.exe 1900 XSA.exe 1900 XSA.exe 5224 JEMY.exe 5224 JEMY.exe 248 CRLWB.exe 248 CRLWB.exe 3360 FECYU.exe 3360 FECYU.exe 2584 LANZA.exe 2584 LANZA.exe 1292 IAXBEC.exe 1292 IAXBEC.exe 1740 KNGDXNW.exe 1740 KNGDXNW.exe 1184 STTRIMS.exe 1184 STTRIMS.exe 2200 GZTDK.exe 2200 GZTDK.exe 3492 ZRJ.exe 3492 ZRJ.exe 5640 MXJA.exe 5640 MXJA.exe 2464 PKABPVA.exe 2464 PKABPVA.exe 1304 CIA.exe 1304 CIA.exe 2876 KWMTBFF.exe 2876 KWMTBFF.exe 5692 NJEVUZ.exe 5692 NJEVUZ.exe 3476 ERS.exe 3476 ERS.exe 1928 QFRYMRM.exe 1928 QFRYMRM.exe 1404 EADZ.exe 1404 EADZ.exe 752 GYIMZO.exe 752 GYIMZO.exe 2504 KDABQKY.exe 2504 KDABQKY.exe 4648 TJFQAI.exe 4648 TJFQAI.exe 3016 BWSWLO.exe 3016 BWSWLO.exe 2572 VEBLS.exe 2572 VEBLS.exe 2400 JAMMYXB.exe 2400 JAMMYXB.exe 2892 QVQFMM.exe 2892 QVQFMM.exe 1600 GAPMX.exe 1600 GAPMX.exe 2004 ROOKC.exe 2004 ROOKC.exe 5168 KGDUU.exe 5168 KGDUU.exe 1072 JZGKCMG.exe 1072 JZGKCMG.exe 4052 RFTRFLB.exe 4052 RFTRFLB.exe 4760 KIWVTB.exe 4760 KIWVTB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4896 2026-09-29_c609a03a589b3e44f99871fec6d879dc_elex_emotet_stop.exe 4896 2026-09-29_c609a03a589b3e44f99871fec6d879dc_elex_emotet_stop.exe 1900 XSA.exe 1900 XSA.exe 5224 JEMY.exe 5224 JEMY.exe 248 CRLWB.exe 248 CRLWB.exe 3360 FECYU.exe 3360 FECYU.exe 2584 LANZA.exe 2584 LANZA.exe 1292 IAXBEC.exe 1292 IAXBEC.exe 1740 KNGDXNW.exe 1740 KNGDXNW.exe 1184 STTRIMS.exe 1184 STTRIMS.exe 2200 GZTDK.exe 2200 GZTDK.exe 3492 ZRJ.exe 3492 ZRJ.exe 5640 MXJA.exe 5640 MXJA.exe 2464 PKABPVA.exe 2464 PKABPVA.exe 1304 CIA.exe 1304 CIA.exe 2876 KWMTBFF.exe 2876 KWMTBFF.exe 5692 NJEVUZ.exe 5692 NJEVUZ.exe 3476 ERS.exe 3476 ERS.exe 1928 QFRYMRM.exe 1928 QFRYMRM.exe 1404 EADZ.exe 1404 EADZ.exe 752 GYIMZO.exe 752 GYIMZO.exe 2504 KDABQKY.exe 2504 KDABQKY.exe 4648 TJFQAI.exe 4648 TJFQAI.exe 3016 BWSWLO.exe 3016 BWSWLO.exe 2572 VEBLS.exe 2572 VEBLS.exe 2400 JAMMYXB.exe 2400 JAMMYXB.exe 2892 QVQFMM.exe 2892 QVQFMM.exe 1600 GAPMX.exe 1600 GAPMX.exe 2004 ROOKC.exe 2004 ROOKC.exe 5168 KGDUU.exe 5168 KGDUU.exe 1072 JZGKCMG.exe 1072 JZGKCMG.exe 4052 RFTRFLB.exe 4052 RFTRFLB.exe 4760 KIWVTB.exe 4760 KIWVTB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4896 wrote to memory of 4608 4896 2026-09-29_c609a03a589b3e44f99871fec6d879dc_elex_emotet_stop.exe 89 PID 4608 wrote to memory of 1900 4608 cmd.exe 93 PID 1900 wrote to memory of 5940 1900 XSA.exe 95 PID 5940 wrote to memory of 5224 5940 cmd.exe 99 PID 5224 wrote to memory of 5352 5224 JEMY.exe 100 PID 5352 wrote to memory of 248 5352 cmd.exe 104 PID 248 wrote to memory of 1788 248 CRLWB.exe 105 PID 1788 wrote to memory of 3360 1788 cmd.exe 109 PID 3360 wrote to memory of 792 3360 FECYU.exe 110 PID 792 wrote to memory of 2584 792 cmd.exe 114 PID 2584 wrote to memory of 2648 2584 LANZA.exe 115 PID 2648 wrote to memory of 1292 2648 cmd.exe 119 PID 1292 wrote to memory of 6092 1292 IAXBEC.exe 120 PID 6092 wrote to memory of 1740 6092 cmd.exe 124 PID 1740 wrote to memory of 5068 1740 KNGDXNW.exe 125 PID 5068 wrote to memory of 1184 5068 cmd.exe 128 PID 1184 wrote to memory of 2128 1184 STTRIMS.exe 130 PID 2128 wrote to memory of 2200 2128 cmd.exe 134 PID 2200 wrote to memory of 1924 2200 GZTDK.exe 135 PID 1924 wrote to memory of 3492 1924 cmd.exe 139 PID 3492 wrote to memory of 1196 3492 ZRJ.exe 140 PID 1196 wrote to memory of 5640 1196 cmd.exe 144 PID 5640 wrote to memory of 1288 5640 MXJA.exe 145 PID 1288 wrote to memory of 2464 1288 cmd.exe 149 PID 2464 wrote to memory of 4504 2464 PKABPVA.exe 150 PID 4504 wrote to memory of 1304 4504 cmd.exe 154 PID 1304 wrote to memory of 2392 1304 CIA.exe 155 PID 2392 wrote to memory of 2876 2392 cmd.exe 159 PID 2876 wrote to memory of 3484 2876 KWMTBFF.exe 160 PID 3484 wrote to memory of 5692 3484 cmd.exe 164 PID 5692 wrote to memory of 2336 5692 NJEVUZ.exe 165 PID 2336 wrote to memory of 3476 2336 cmd.exe 169 PID 3476 wrote to memory of 4264 3476 ERS.exe 170 PID 4264 wrote to memory of 1928 4264 cmd.exe 174 PID 1928 wrote to memory of 5020 1928 QFRYMRM.exe 175 PID 5020 wrote to memory of 1404 5020 cmd.exe 179 PID 1404 wrote to memory of 1644 1404 EADZ.exe 180 PID 1644 wrote to memory of 752 1644 cmd.exe 184 PID 752 wrote to memory of 2680 752 GYIMZO.exe 185 PID 2680 wrote to memory of 2504 2680 cmd.exe 189 PID 2504 wrote to memory of 3780 2504 KDABQKY.exe 190 PID 3780 wrote to memory of 4648 3780 cmd.exe 194 PID 4648 wrote to memory of 1368 4648 TJFQAI.exe 195 PID 1368 wrote to memory of 3016 1368 cmd.exe 199 PID 3016 wrote to memory of 4688 3016 BWSWLO.exe 200 PID 4688 wrote to memory of 2572 4688 cmd.exe 204 PID 2572 wrote to memory of 5896 2572 VEBLS.exe 205 PID 5896 wrote to memory of 2400 5896 cmd.exe 209 PID 2400 wrote to memory of 4376 2400 JAMMYXB.exe 210 PID 4376 wrote to memory of 2892 4376 cmd.exe 214 PID 2892 wrote to memory of 5964 2892 QVQFMM.exe 215 PID 5964 wrote to memory of 1600 5964 cmd.exe 219 PID 1600 wrote to memory of 2444 1600 GAPMX.exe 220 PID 2444 wrote to memory of 2004 2444 cmd.exe 224 PID 2004 wrote to memory of 5948 2004 ROOKC.exe 225 PID 5948 wrote to memory of 5168 5948 cmd.exe 229 PID 5168 wrote to memory of 432 5168 KGDUU.exe 230 PID 432 wrote to memory of 1072 432 cmd.exe 234 PID 1072 wrote to memory of 4780 1072 JZGKCMG.exe 235 PID 4780 wrote to memory of 4052 4780 cmd.exe 239 PID 4052 wrote to memory of 2216 4052 RFTRFLB.exe 240 PID 2216 wrote to memory of 4760 2216 cmd.exe 244 PID 4760 wrote to memory of 4884 4760 KIWVTB.exe 245 PID 4884 wrote to memory of 5932 4884 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_c609a03a589b3e44f99871fec6d879dc_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_c609a03a589b3e44f99871fec6d879dc_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSA.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\windows\SysWOW64\XSA.exeC:\windows\system32\XSA.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JEMY.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\windows\JEMY.exeC:\windows\JEMY.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CRLWB.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\windows\SysWOW64\CRLWB.exeC:\windows\system32\CRLWB.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FECYU.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\windows\system\FECYU.exeC:\windows\system\FECYU.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LANZA.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:792 -
C:\windows\SysWOW64\LANZA.exeC:\windows\system32\LANZA.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IAXBEC.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\windows\IAXBEC.exeC:\windows\IAXBEC.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNGDXNW.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\windows\SysWOW64\KNGDXNW.exeC:\windows\system32\KNGDXNW.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STTRIMS.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\windows\SysWOW64\STTRIMS.exeC:\windows\system32\STTRIMS.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GZTDK.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\windows\SysWOW64\GZTDK.exeC:\windows\system32\GZTDK.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZRJ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\windows\SysWOW64\ZRJ.exeC:\windows\system32\ZRJ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXJA.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\windows\system\MXJA.exeC:\windows\system\MXJA.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PKABPVA.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\windows\system\PKABPVA.exeC:\windows\system\PKABPVA.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CIA.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\windows\system\CIA.exeC:\windows\system\CIA.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KWMTBFF.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\windows\KWMTBFF.exeC:\windows\KWMTBFF.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NJEVUZ.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\windows\NJEVUZ.exeC:\windows\NJEVUZ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ERS.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\windows\system\ERS.exeC:\windows\system\ERS.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFRYMRM.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\windows\system\QFRYMRM.exeC:\windows\system\QFRYMRM.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EADZ.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\windows\system\EADZ.exeC:\windows\system\EADZ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GYIMZO.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\windows\system\GYIMZO.exeC:\windows\system\GYIMZO.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDABQKY.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\windows\system\KDABQKY.exeC:\windows\system\KDABQKY.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJFQAI.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\windows\system\TJFQAI.exeC:\windows\system\TJFQAI.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BWSWLO.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\windows\SysWOW64\BWSWLO.exeC:\windows\system32\BWSWLO.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEBLS.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\windows\SysWOW64\VEBLS.exeC:\windows\system32\VEBLS.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JAMMYXB.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\windows\JAMMYXB.exeC:\windows\JAMMYXB.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVQFMM.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\windows\SysWOW64\QVQFMM.exeC:\windows\system32\QVQFMM.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GAPMX.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\windows\GAPMX.exeC:\windows\GAPMX.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ROOKC.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\windows\ROOKC.exeC:\windows\ROOKC.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGDUU.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\windows\KGDUU.exeC:\windows\KGDUU.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JZGKCMG.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:432 -
C:\windows\SysWOW64\JZGKCMG.exeC:\windows\system32\JZGKCMG.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RFTRFLB.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\windows\SysWOW64\RFTRFLB.exeC:\windows\system32\RFTRFLB.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIWVTB.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\windows\KIWVTB.exeC:\windows\KIWVTB.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGC.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\windows\system\UGC.exeC:\windows\system\UGC.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MBGLFZV.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5200 -
C:\windows\system\MBGLFZV.exeC:\windows\system\MBGLFZV.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYTFV.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:2364 -
C:\windows\SysWOW64\WYTFV.exeC:\windows\system32\WYTFV.exe69⤵
- Executes dropped EXE
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMYM.exe.bat" "70⤵PID:1280
-
C:\windows\system\EMYM.exeC:\windows\system\EMYM.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKMY.exe.bat" "72⤵PID:1152
-
C:\windows\system\OKMY.exeC:\windows\system\OKMY.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EFVLYJI.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1188 -
C:\windows\system\EFVLYJI.exeC:\windows\system\EFVLYJI.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UPYBHP.exe.bat" "76⤵PID:3656
-
C:\windows\system\UPYBHP.exeC:\windows\system\UPYBHP.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VTC.exe.bat" "78⤵PID:2412
-
C:\windows\SysWOW64\VTC.exeC:\windows\system32\VTC.exe79⤵
- Executes dropped EXE
PID:1560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTJKD.exe.bat" "80⤵
- Executes a command shell one-liner
PID:2724 -
C:\windows\system\BTJKD.exeC:\windows\system\BTJKD.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOJ.exe.bat" "82⤵PID:6064
-
C:\windows\system\ZOJ.exeC:\windows\system\ZOJ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMWFP.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5392 -
C:\windows\JMWFP.exeC:\windows\JMWFP.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WPF.exe.bat" "86⤵
- Executes a command shell one-liner
PID:1888 -
C:\windows\SysWOW64\WPF.exeC:\windows\system32\WPF.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VZHUMJP.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5480 -
C:\windows\VZHUMJP.exeC:\windows\VZHUMJP.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OAXFVKF.exe.bat" "90⤵PID:2352
-
C:\windows\system\OAXFVKF.exeC:\windows\system\OAXFVKF.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JNCO.exe.bat" "92⤵PID:4672
-
C:\windows\JNCO.exeC:\windows\JNCO.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJBPCFJ.exe.bat" "94⤵PID:1944
-
C:\windows\system\PJBPCFJ.exeC:\windows\system\PJBPCFJ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LOLET.exe.bat" "96⤵PID:4320
-
C:\windows\LOLET.exeC:\windows\LOLET.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRJ.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5080 -
C:\windows\SysWOW64\PRJ.exeC:\windows\system32\PRJ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TZQZFU.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5112 -
C:\windows\SysWOW64\TZQZFU.exeC:\windows\system32\TZQZFU.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FPF.exe.bat" "102⤵PID:5860
-
C:\windows\FPF.exeC:\windows\FPF.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ADJRB.exe.bat" "104⤵PID:5740
-
C:\windows\ADJRB.exeC:\windows\ADJRB.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDD.exe.bat" "106⤵
- Executes a command shell one-liner
PID:3704 -
C:\windows\SysWOW64\JDD.exeC:\windows\system32\JDD.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NTSWRC.exe.bat" "108⤵PID:4216
-
C:\windows\system\NTSWRC.exeC:\windows\system\NTSWRC.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IGXNBBS.exe.bat" "110⤵PID:1848
-
C:\windows\IGXNBBS.exeC:\windows\IGXNBBS.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IJBJ.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:264 -
C:\windows\system\IJBJ.exeC:\windows\system\IJBJ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BME.exe.bat" "114⤵PID:4304
-
C:\windows\system\BME.exeC:\windows\system\BME.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KPVB.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:1128 -
C:\windows\SysWOW64\KPVB.exeC:\windows\system32\KPVB.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BPJG.exe.bat" "118⤵
- Executes a command shell one-liner
PID:892 -
C:\windows\BPJG.exeC:\windows\BPJG.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JDOM.exe.bat" "120⤵PID:2320
-
C:\windows\JDOM.exeC:\windows\JDOM.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-