Analysis
- max time kernel
94s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 17:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_ac66e68021a8dcb4a4d075ca1dd333f7_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-29_ac66e68021a8dcb4a4d075ca1dd333f7_elex_emotet_stop.exe
- Size 208KB
- Sample260930-v4rrms1sbx
- SHA256 b7cd88cace93430d877286153d6132da05a39cc0bfb0adfec371b0645ba54d4b
- MD5 ac66e68021a8dcb4a4d075ca1dd333f7
- SHA1 cb56d51611a754fa6e14ae6a14c6be460478a093
- SHA512 5dc993b1cf400620f9e21e7ad555d4807d0f2405dec26e1e1aff6b5d2d3f28e3cbd3bf8f159e53ccaa54d5a80408ace84a4925556b8e519cc3f81b8ff98a0dcb
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcKL+LOfS4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlcS+LO6kEj1
- TLSH T1ED247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3416 TRB.exe 1956 AXU.exe 4568 FCMD.exe 1912 XFQHVB.exe 700 WQTPD.exe 5904 CQBKMJF.exe 4672 RGC.exe 5472 KJFFYVW.exe 5924 GPLUFFY.exe 5996 KXSDSX.exe 5452 ONYD.exe 4696 WSL.exe 1604 OBNW.exe 756 RJUWEDB.exe 8 DBX.exe 5932 SRYGLG.exe 4416 WZEP.exe 5688 RVJYIY.exe 1452 EXSX.exe 1324 VGUCZ.exe 4136 IRCSO.exe 4936 DEHKYJQ.exe 4800 SUIBE.exe 5680 GXMI.exe 3760 KNSIWOW.exe 2292 VFV.exe 2728 ZNCAI.exe 2416 IWEGML.exe 5356 XRNS.exe 420 HOTM.exe 1352 YZRC.exe 5152 WPDFHGW.exe 1412 IIGY.exe 3528 ZQIDS.exe 3684 DYODXLB.exe 3856 AEUA.exe 5240 DUBAQF.exe 4928 NUD.exe 2668 ECFSFI.exe 3356 TADPMS.exe 5080 YAK.exe 2800 KTNW.exe 4512 QTVKMW.exe 3204 HBX.exe 4940 HMX.exe 5632 HRYW.exe 1456 SKBPN.exe 3112 YKIDECS.exe 6136 JDD.exe 5096 GIJ.exe 992 COPQB.exe 5852 RUVF.exe 5424 TJOHO.exe 5348 PPUEVDP.exe 4952 DAQDAV.exe 2852 XNVMKUH.exe 1468 SAZW.exe 2208 STIXBG.exe 3576 FWEEGY.exe 2260 QOHOOFU.exe 1372 HCR.exe 4544 SUUZ.exe 3464 HASWT.exe 5040 NNSXYW.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\DEHKYJQ.exe IRCSO.exe File created C:\windows\SysWOW64\KNSIWOW.exe.bat GXMI.exe File created C:\windows\SysWOW64\LGXJRBE.exe OIRMK.exe File created C:\windows\SysWOW64\RNJ.exe GUGE.exe File created C:\windows\SysWOW64\GVTQRX.exe.bat IAUPUU.exe File created C:\windows\SysWOW64\YAK.exe TADPMS.exe File opened for modification C:\windows\SysWOW64\OJEUR.exe TNZ.exe File opened for modification C:\windows\SysWOW64\RNJ.exe GUGE.exe File opened for modification C:\windows\SysWOW64\IIGY.exe WPDFHGW.exe File opened for modification C:\windows\SysWOW64\HASWT.exe SUUZ.exe File created C:\windows\SysWOW64\OIRMK.exe.bat SCTP.exe File created C:\windows\SysWOW64\FYIV.exe.bat VAUBIH.exe File created C:\windows\SysWOW64\KXSDSX.exe GPLUFFY.exe File opened for modification C:\windows\SysWOW64\WSL.exe ONYD.exe File opened for modification C:\windows\SysWOW64\OBNW.exe WSL.exe File opened for modification C:\windows\SysWOW64\VFV.exe KNSIWOW.exe File opened for modification C:\windows\SysWOW64\OIRMK.exe SCTP.exe File created C:\windows\SysWOW64\KOGQB.exe TGSKOGZ.exe File created C:\windows\SysWOW64\RKOB.exe NHQGWV.exe File opened for modification C:\windows\SysWOW64\HWC.exe MJXHVXQ.exe File opened for modification C:\windows\SysWOW64\KNSIWOW.exe GXMI.exe File opened for modification C:\windows\SysWOW64\ZNCAI.exe VFV.exe File opened for modification C:\windows\SysWOW64\XNVMKUH.exe DAQDAV.exe File opened for modification C:\windows\SysWOW64\WNEO.exe BAZ.exe File created C:\windows\SysWOW64\VFV.exe KNSIWOW.exe File created C:\windows\SysWOW64\OJEUR.exe.bat TNZ.exe File created C:\windows\SysWOW64\GVTQRX.exe IAUPUU.exe File created C:\windows\SysWOW64\ZNCAI.exe VFV.exe File opened for modification C:\windows\SysWOW64\JDD.exe YKIDECS.exe File created C:\windows\SysWOW64\DAQDAV.exe PPUEVDP.exe File created C:\windows\SysWOW64\JULMK.exe.bat JPLYI.exe File created C:\windows\SysWOW64\BAZ.exe RCU.exe File opened for modification C:\windows\SysWOW64\UYP.exe WNEO.exe File created C:\windows\SysWOW64\WSL.exe.bat ONYD.exe File created C:\windows\SysWOW64\IIGY.exe WPDFHGW.exe File created C:\windows\SysWOW64\SKBPN.exe HRYW.exe File created C:\windows\SysWOW64\PPUEVDP.exe.bat TJOHO.exe File opened for modification C:\windows\SysWOW64\RKOB.exe NHQGWV.exe File created C:\windows\SysWOW64\KXSDSX.exe.bat GPLUFFY.exe File created C:\windows\SysWOW64\KNSIWOW.exe GXMI.exe File created C:\windows\SysWOW64\HRYW.exe.bat HMX.exe File opened for modification C:\windows\SysWOW64\SKBPN.exe HRYW.exe File opened for modification C:\windows\SysWOW64\BZM.exe QGRFHCI.exe File created C:\windows\SysWOW64\HWC.exe MJXHVXQ.exe File created C:\windows\SysWOW64\SKBPN.exe.bat HRYW.exe File created C:\windows\SysWOW64\OBNW.exe WSL.exe File created C:\windows\SysWOW64\HBX.exe QTVKMW.exe File created C:\windows\SysWOW64\WSL.exe ONYD.exe File opened for modification C:\windows\SysWOW64\IRCSO.exe VGUCZ.exe File created C:\windows\SysWOW64\DEHKYJQ.exe IRCSO.exe File opened for modification C:\windows\SysWOW64\JPLYI.exe UMCTXJP.exe File opened for modification C:\windows\SysWOW64\HBX.exe QTVKMW.exe File created C:\windows\SysWOW64\LGXJRBE.exe.bat OIRMK.exe File created C:\windows\SysWOW64\VGUCZ.exe EXSX.exe File opened for modification C:\windows\SysWOW64\LGXJRBE.exe OIRMK.exe File opened for modification C:\windows\SysWOW64\GVTQRX.exe IAUPUU.exe File created C:\windows\SysWOW64\JPLYI.exe UMCTXJP.exe File created C:\windows\SysWOW64\OJEUR.exe TNZ.exe File created C:\windows\SysWOW64\KOGQB.exe.bat TGSKOGZ.exe File created C:\windows\SysWOW64\SARMV.exe BAPH.exe File opened for modification C:\windows\SysWOW64\SARMV.exe BAPH.exe File created C:\windows\SysWOW64\RCU.exe CMTTX.exe File created C:\windows\SysWOW64\CQBKMJF.exe WQTPD.exe File created C:\windows\SysWOW64\VFV.exe.bat KNSIWOW.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\ONYD.exe.bat KXSDSX.exe File opened for modification C:\windows\ZQIDS.exe IIGY.exe File created C:\windows\system\QTVKMW.exe KTNW.exe File opened for modification C:\windows\system\AOHCLB.exe WYA.exe File created C:\windows\QXTUJYY.exe WXEJZXQ.exe File created C:\windows\system\QGRFHCI.exe VTNWX.exe File created C:\windows\system\FBM.exe.bat FYIV.exe File created C:\windows\system\DKZDD.exe UCXY.exe File opened for modification C:\windows\system\WVVZMD.exe UYP.exe File opened for modification C:\windows\WPDFHGW.exe YZRC.exe File opened for modification C:\windows\system\UBIKY.exe AOD.exe File created C:\windows\system\DBX.exe RJUWEDB.exe File opened for modification C:\windows\UCXY.exe ZPSPPBA.exe File created C:\windows\system\RGC.exe CQBKMJF.exe File created C:\windows\system\WZEP.exe SRYGLG.exe File created C:\windows\system\TJOHO.exe RUVF.exe File opened for modification C:\windows\TNZ.exe NNSXYW.exe File created C:\windows\UGJFOE.exe.bat MVBE.exe File opened for modification C:\windows\XRNS.exe IWEGML.exe File opened for modification C:\windows\system\KTNW.exe YAK.exe File created C:\windows\system\NNSXYW.exe HASWT.exe File created C:\windows\TRB.exe.bat 2026-09-29_ac66e68021a8dcb4a4d075ca1dd333f7_elex_emotet_stop.exe File opened for modification C:\windows\system\NNSXYW.exe HASWT.exe File opened for modification C:\windows\QXTUJYY.exe WXEJZXQ.exe File created C:\windows\GIJ.exe.bat JDD.exe File created C:\windows\system\QOHOOFU.exe FWEEGY.exe File created C:\windows\HCR.exe.bat QOHOOFU.exe File created C:\windows\system\CMTTX.exe CYGMM.exe File created C:\windows\system\XFQHVB.exe FCMD.exe File created C:\windows\system\KJFFYVW.exe RGC.exe File opened for modification C:\windows\system\EXSX.exe RVJYIY.exe File created C:\windows\system\WVVZMD.exe.bat UYP.exe File created C:\windows\system\EXSX.exe RVJYIY.exe File created C:\windows\system\YKIDECS.exe.bat SKBPN.exe File created C:\windows\GIJ.exe JDD.exe File created C:\windows\UGJFOE.exe MVBE.exe File created C:\windows\TGSKOGZ.exe JIEYH.exe File created C:\windows\QBXQG.exe.bat KOGQB.exe File opened for modification C:\windows\system\RGC.exe CQBKMJF.exe File created C:\windows\system\SUIBE.exe DEHKYJQ.exe File created C:\windows\SAZW.exe XNVMKUH.exe File created C:\windows\UCXY.exe.bat ZPSPPBA.exe File created C:\windows\system\SUIBE.exe.bat DEHKYJQ.exe File opened for modification C:\windows\system\WZEP.exe SRYGLG.exe File created C:\windows\ECFSFI.exe NUD.exe File opened for modification C:\windows\system\RTCC.exe SARMV.exe File opened for modification C:\windows\GWLWGIS.exe GIKPEV.exe File opened for modification C:\windows\system\WQTPD.exe XFQHVB.exe File opened for modification C:\windows\UGJFOE.exe MVBE.exe File opened for modification C:\windows\system\WXEJZXQ.exe LEJQRQ.exe File created C:\windows\system\YDGBTWT.exe QXTUJYY.exe File created C:\windows\system\YKIDECS.exe SKBPN.exe File opened for modification C:\windows\system\IAUPUU.exe RNJ.exe File created C:\windows\JIEYH.exe TSR.exe File created C:\windows\system\WXEJZXQ.exe LEJQRQ.exe File created C:\windows\GWLWGIS.exe GIKPEV.exe File opened for modification C:\windows\system\UMCTXJP.exe UGJFOE.exe File created C:\windows\system\UMCTXJP.exe.bat UGJFOE.exe File created C:\windows\BAPH.exe AXZLDB.exe File opened for modification C:\windows\LQLKN.exe DKZDD.exe File created C:\windows\system\AEUA.exe.bat DYODXLB.exe File created C:\windows\system\UBIKY.exe AOD.exe File created C:\windows\AXZLDB.exe.bat UBIKY.exe File created C:\windows\system\WXEJZXQ.exe.bat LEJQRQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2920 cmd.exe 5192 cmd.exe 4644 cmd.exe 3956 cmd.exe 5844 cmd.exe 4500 cmd.exe 5108 cmd.exe 4680 cmd.exe 204 cmd.exe 1464 cmd.exe 4932 cmd.exe 1156 cmd.exe 4972 cmd.exe 2976 cmd.exe 5212 cmd.exe 3516 cmd.exe 1144 cmd.exe 5544 cmd.exe 1556 cmd.exe 5256 cmd.exe 2648 cmd.exe 248 cmd.exe 5100 cmd.exe 1684 cmd.exe 3380 cmd.exe 1112 cmd.exe 5304 cmd.exe 5292 cmd.exe 5076 cmd.exe 3076 cmd.exe 5764 cmd.exe 828 cmd.exe 952 cmd.exe 5328 cmd.exe 2772 cmd.exe 5960 cmd.exe 4700 cmd.exe 5720 cmd.exe 856 cmd.exe 1220 cmd.exe 3640 cmd.exe 3040 cmd.exe 5128 cmd.exe 6120 cmd.exe 5048 cmd.exe 2512 cmd.exe 4084 cmd.exe 2636 cmd.exe 3276 cmd.exe 5528 cmd.exe 5140 cmd.exe 4268 cmd.exe 3648 cmd.exe 6088 cmd.exe 4664 cmd.exe 5432 cmd.exe 4480 cmd.exe 5052 cmd.exe 2696 cmd.exe 4228 cmd.exe 5028 cmd.exe 2128 cmd.exe 2368 cmd.exe 5244 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5036 5232 WerFault.exe 88 1692 3416 WerFault.exe 94 952 1956 WerFault.exe 100 2344 4568 WerFault.exe 105 2472 1912 WerFault.exe 110 3112 700 WerFault.exe 115 5228 5904 WerFault.exe 120 4484 4672 WerFault.exe 125 4308 5472 WerFault.exe 130 3752 5924 WerFault.exe 135 5656 5996 WerFault.exe 140 2824 5452 WerFault.exe 145 1900 4696 WerFault.exe 150 1556 1604 WerFault.exe 155 5144 756 WerFault.exe 160 5064 8 WerFault.exe 165 2068 5932 WerFault.exe 170 2868 4416 WerFault.exe 175 3372 5688 WerFault.exe 180 4108 1452 WerFault.exe 185 3860 1324 WerFault.exe 190 504 4136 WerFault.exe 195 1332 4936 WerFault.exe 200 5192 4800 WerFault.exe 205 2104 5680 WerFault.exe 210 4340 3760 WerFault.exe 215 2792 2292 WerFault.exe 220 2068 2728 WerFault.exe 225 5864 2416 WerFault.exe 230 1080 5356 WerFault.exe 235 3168 420 WerFault.exe 240 1500 1352 WerFault.exe 245 3400 5152 WerFault.exe 250 5880 1412 WerFault.exe 255 3924 3528 WerFault.exe 260 4340 3684 WerFault.exe 265 2956 3856 WerFault.exe 270 2868 5240 WerFault.exe 275 1060 4928 WerFault.exe 281 5108 2668 WerFault.exe 286 3624 3356 WerFault.exe 291 3844 5080 WerFault.exe 296 3400 2800 WerFault.exe 301 980 4512 WerFault.exe 306 1776 3204 WerFault.exe 311 1756 4940 WerFault.exe 316 4500 5632 WerFault.exe 321 6036 1456 WerFault.exe 326 5864 3112 WerFault.exe 331 204 6136 WerFault.exe 336 5328 5096 WerFault.exe 341 2752 992 WerFault.exe 346 2628 5852 WerFault.exe 351 2332 5424 WerFault.exe 356 1724 5348 WerFault.exe 361 5228 4952 WerFault.exe 366 4388 2852 WerFault.exe 371 5212 1468 WerFault.exe 376 4480 2208 WerFault.exe 381 4460 3576 WerFault.exe 386 2024 2260 WerFault.exe 391 2632 1372 WerFault.exe 396 3036 4544 WerFault.exe 401 6112 3464 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NNSXYW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JPLYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAUPUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHQGWV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIKPEV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNCAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBXQG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KNSIWOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AXZLDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QXTUJYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZRC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UMCTXJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SARMV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HOTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECFSFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUUZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_ac66e68021a8dcb4a4d075ca1dd333f7_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language COPQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJEUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIEYH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGJFOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQTPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TADPMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKBPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHCVMIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DXOA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5232 2026-09-29_ac66e68021a8dcb4a4d075ca1dd333f7_elex_emotet_stop.exe 5232 2026-09-29_ac66e68021a8dcb4a4d075ca1dd333f7_elex_emotet_stop.exe 3416 TRB.exe 3416 TRB.exe 1956 AXU.exe 1956 AXU.exe 4568 FCMD.exe 4568 FCMD.exe 1912 XFQHVB.exe 1912 XFQHVB.exe 700 WQTPD.exe 700 WQTPD.exe 5904 CQBKMJF.exe 5904 CQBKMJF.exe 4672 RGC.exe 4672 RGC.exe 5472 KJFFYVW.exe 5472 KJFFYVW.exe 5924 GPLUFFY.exe 5924 GPLUFFY.exe 5996 KXSDSX.exe 5996 KXSDSX.exe 5452 ONYD.exe 5452 ONYD.exe 4696 WSL.exe 4696 WSL.exe 1604 OBNW.exe 1604 OBNW.exe 756 RJUWEDB.exe 756 RJUWEDB.exe 8 DBX.exe 8 DBX.exe 5932 SRYGLG.exe 5932 SRYGLG.exe 4416 WZEP.exe 4416 WZEP.exe 5688 RVJYIY.exe 5688 RVJYIY.exe 1452 EXSX.exe 1452 EXSX.exe 1324 VGUCZ.exe 1324 VGUCZ.exe 4136 IRCSO.exe 4136 IRCSO.exe 4936 DEHKYJQ.exe 4936 DEHKYJQ.exe 4800 SUIBE.exe 4800 SUIBE.exe 5680 GXMI.exe 5680 GXMI.exe 3760 KNSIWOW.exe 3760 KNSIWOW.exe 2292 VFV.exe 2292 VFV.exe 2728 ZNCAI.exe 2728 ZNCAI.exe 2416 IWEGML.exe 2416 IWEGML.exe 5356 XRNS.exe 5356 XRNS.exe 420 HOTM.exe 420 HOTM.exe 1352 YZRC.exe 1352 YZRC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5232 2026-09-29_ac66e68021a8dcb4a4d075ca1dd333f7_elex_emotet_stop.exe 5232 2026-09-29_ac66e68021a8dcb4a4d075ca1dd333f7_elex_emotet_stop.exe 3416 TRB.exe 3416 TRB.exe 1956 AXU.exe 1956 AXU.exe 4568 FCMD.exe 4568 FCMD.exe 1912 XFQHVB.exe 1912 XFQHVB.exe 700 WQTPD.exe 700 WQTPD.exe 5904 CQBKMJF.exe 5904 CQBKMJF.exe 4672 RGC.exe 4672 RGC.exe 5472 KJFFYVW.exe 5472 KJFFYVW.exe 5924 GPLUFFY.exe 5924 GPLUFFY.exe 5996 KXSDSX.exe 5996 KXSDSX.exe 5452 ONYD.exe 5452 ONYD.exe 4696 WSL.exe 4696 WSL.exe 1604 OBNW.exe 1604 OBNW.exe 756 RJUWEDB.exe 756 RJUWEDB.exe 8 DBX.exe 8 DBX.exe 5932 SRYGLG.exe 5932 SRYGLG.exe 4416 WZEP.exe 4416 WZEP.exe 5688 RVJYIY.exe 5688 RVJYIY.exe 1452 EXSX.exe 1452 EXSX.exe 1324 VGUCZ.exe 1324 VGUCZ.exe 4136 IRCSO.exe 4136 IRCSO.exe 4936 DEHKYJQ.exe 4936 DEHKYJQ.exe 4800 SUIBE.exe 4800 SUIBE.exe 5680 GXMI.exe 5680 GXMI.exe 3760 KNSIWOW.exe 3760 KNSIWOW.exe 2292 VFV.exe 2292 VFV.exe 2728 ZNCAI.exe 2728 ZNCAI.exe 2416 IWEGML.exe 2416 IWEGML.exe 5356 XRNS.exe 5356 XRNS.exe 420 HOTM.exe 420 HOTM.exe 1352 YZRC.exe 1352 YZRC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5232 wrote to memory of 2636 5232 2026-09-29_ac66e68021a8dcb4a4d075ca1dd333f7_elex_emotet_stop.exe 90 PID 2636 wrote to memory of 3416 2636 cmd.exe 94 PID 3416 wrote to memory of 3132 3416 TRB.exe 96 PID 3132 wrote to memory of 1956 3132 cmd.exe 100 PID 1956 wrote to memory of 2724 1956 AXU.exe 101 PID 2724 wrote to memory of 4568 2724 cmd.exe 105 PID 4568 wrote to memory of 1156 4568 FCMD.exe 106 PID 1156 wrote to memory of 1912 1156 cmd.exe 110 PID 1912 wrote to memory of 3424 1912 XFQHVB.exe 111 PID 3424 wrote to memory of 700 3424 cmd.exe 115 PID 700 wrote to memory of 2856 700 WQTPD.exe 116 PID 2856 wrote to memory of 5904 2856 cmd.exe 120 PID 5904 wrote to memory of 1448 5904 CQBKMJF.exe 121 PID 1448 wrote to memory of 4672 1448 cmd.exe 125 PID 4672 wrote to memory of 4848 4672 RGC.exe 126 PID 4848 wrote to memory of 5472 4848 cmd.exe 130 PID 5472 wrote to memory of 4668 5472 KJFFYVW.exe 131 PID 4668 wrote to memory of 5924 4668 cmd.exe 135 PID 5924 wrote to memory of 4596 5924 GPLUFFY.exe 136 PID 4596 wrote to memory of 5996 4596 cmd.exe 140 PID 5996 wrote to memory of 4968 5996 KXSDSX.exe 141 PID 4968 wrote to memory of 5452 4968 cmd.exe 145 PID 5452 wrote to memory of 3700 5452 ONYD.exe 146 PID 3700 wrote to memory of 4696 3700 cmd.exe 150 PID 4696 wrote to memory of 2796 4696 WSL.exe 151 PID 2796 wrote to memory of 1604 2796 cmd.exe 155 PID 1604 wrote to memory of 5928 1604 OBNW.exe 156 PID 5928 wrote to memory of 756 5928 cmd.exe 160 PID 756 wrote to memory of 604 756 RJUWEDB.exe 161 PID 604 wrote to memory of 8 604 cmd.exe 165 PID 8 wrote to memory of 4876 8 DBX.exe 166 PID 4876 wrote to memory of 5932 4876 cmd.exe 170 PID 5932 wrote to memory of 1684 5932 SRYGLG.exe 171 PID 1684 wrote to memory of 4416 1684 cmd.exe 175 PID 4416 wrote to memory of 3808 4416 WZEP.exe 176 PID 3808 wrote to memory of 5688 3808 cmd.exe 180 PID 5688 wrote to memory of 4964 5688 RVJYIY.exe 181 PID 4964 wrote to memory of 1452 4964 cmd.exe 185 PID 1452 wrote to memory of 3864 1452 EXSX.exe 186 PID 3864 wrote to memory of 1324 3864 cmd.exe 190 PID 1324 wrote to memory of 4584 1324 VGUCZ.exe 191 PID 4584 wrote to memory of 4136 4584 cmd.exe 195 PID 4136 wrote to memory of 2128 4136 IRCSO.exe 196 PID 2128 wrote to memory of 4936 2128 cmd.exe 200 PID 4936 wrote to memory of 5544 4936 DEHKYJQ.exe 201 PID 5544 wrote to memory of 4800 5544 cmd.exe 205 PID 4800 wrote to memory of 6060 4800 SUIBE.exe 206 PID 6060 wrote to memory of 5680 6060 cmd.exe 210 PID 5680 wrote to memory of 3628 5680 GXMI.exe 211 PID 3628 wrote to memory of 3760 3628 cmd.exe 215 PID 3760 wrote to memory of 2368 3760 KNSIWOW.exe 216 PID 2368 wrote to memory of 2292 2368 cmd.exe 220 PID 2292 wrote to memory of 6016 2292 VFV.exe 221 PID 6016 wrote to memory of 2728 6016 cmd.exe 225 PID 2728 wrote to memory of 3456 2728 ZNCAI.exe 226 PID 3456 wrote to memory of 2416 3456 cmd.exe 230 PID 2416 wrote to memory of 3380 2416 IWEGML.exe 231 PID 3380 wrote to memory of 5356 3380 cmd.exe 235 PID 5356 wrote to memory of 3372 5356 XRNS.exe 236 PID 3372 wrote to memory of 420 3372 cmd.exe 240 PID 420 wrote to memory of 4468 420 HOTM.exe 241 PID 4468 wrote to memory of 1352 4468 cmd.exe 245 PID 1352 wrote to memory of 5432 1352 YZRC.exe 246 PID 5432 wrote to memory of 5152 5432 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ac66e68021a8dcb4a4d075ca1dd333f7_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ac66e68021a8dcb4a4d075ca1dd333f7_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRB.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\windows\TRB.exeC:\windows\TRB.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AXU.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\windows\system\AXU.exeC:\windows\system\AXU.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FCMD.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\windows\system\FCMD.exeC:\windows\system\FCMD.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XFQHVB.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\windows\system\XFQHVB.exeC:\windows\system\XFQHVB.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQTPD.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\windows\system\WQTPD.exeC:\windows\system\WQTPD.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQBKMJF.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\windows\SysWOW64\CQBKMJF.exeC:\windows\system32\CQBKMJF.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGC.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\windows\system\RGC.exeC:\windows\system\RGC.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KJFFYVW.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\windows\system\KJFFYVW.exeC:\windows\system\KJFFYVW.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GPLUFFY.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\windows\SysWOW64\GPLUFFY.exeC:\windows\system32\GPLUFFY.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXSDSX.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\windows\SysWOW64\KXSDSX.exeC:\windows\system32\KXSDSX.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ONYD.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\windows\system\ONYD.exeC:\windows\system\ONYD.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSL.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\windows\SysWOW64\WSL.exeC:\windows\system32\WSL.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OBNW.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\windows\SysWOW64\OBNW.exeC:\windows\system32\OBNW.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJUWEDB.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\windows\RJUWEDB.exeC:\windows\RJUWEDB.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DBX.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:604 -
C:\windows\system\DBX.exeC:\windows\system\DBX.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SRYGLG.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\windows\SRYGLG.exeC:\windows\SRYGLG.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZEP.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\windows\system\WZEP.exeC:\windows\system\WZEP.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RVJYIY.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\windows\RVJYIY.exeC:\windows\RVJYIY.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXSX.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\windows\system\EXSX.exeC:\windows\system\EXSX.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VGUCZ.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\windows\SysWOW64\VGUCZ.exeC:\windows\system32\VGUCZ.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IRCSO.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\windows\SysWOW64\IRCSO.exeC:\windows\system32\IRCSO.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DEHKYJQ.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\windows\SysWOW64\DEHKYJQ.exeC:\windows\system32\DEHKYJQ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SUIBE.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\windows\system\SUIBE.exeC:\windows\system\SUIBE.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXMI.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\windows\system\GXMI.exeC:\windows\system\GXMI.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNSIWOW.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\windows\SysWOW64\KNSIWOW.exeC:\windows\system32\KNSIWOW.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFV.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\windows\SysWOW64\VFV.exeC:\windows\system32\VFV.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNCAI.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\windows\SysWOW64\ZNCAI.exeC:\windows\system32\ZNCAI.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWEGML.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\windows\IWEGML.exeC:\windows\IWEGML.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRNS.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\windows\XRNS.exeC:\windows\XRNS.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOTM.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\windows\system\HOTM.exeC:\windows\system\HOTM.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZRC.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\system\YZRC.exeC:\windows\system\YZRC.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPDFHGW.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\windows\WPDFHGW.exeC:\windows\WPDFHGW.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IIGY.exe.bat" "66⤵PID:5340
-
C:\windows\SysWOW64\IIGY.exeC:\windows\system32\IIGY.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQIDS.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:4112 -
C:\windows\ZQIDS.exeC:\windows\ZQIDS.exe69⤵
- Executes dropped EXE
PID:3528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYODXLB.exe.bat" "70⤵
- Executes a command shell one-liner
PID:6088 -
C:\windows\system\DYODXLB.exeC:\windows\system\DYODXLB.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AEUA.exe.bat" "72⤵PID:904
-
C:\windows\system\AEUA.exeC:\windows\system\AEUA.exe73⤵
- Executes dropped EXE
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DUBAQF.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:4464 -
C:\windows\system\DUBAQF.exeC:\windows\system\DUBAQF.exe75⤵
- Executes dropped EXE
PID:5240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NUD.exe.bat" "76⤵PID:3176
-
C:\windows\system\NUD.exeC:\windows\system\NUD.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ECFSFI.exe.bat" "78⤵PID:2120
-
C:\windows\ECFSFI.exeC:\windows\ECFSFI.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TADPMS.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4448 -
C:\windows\TADPMS.exeC:\windows\TADPMS.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAK.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:3224 -
C:\windows\SysWOW64\YAK.exeC:\windows\system32\YAK.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTNW.exe.bat" "84⤵PID:2828
-
C:\windows\system\KTNW.exeC:\windows\system\KTNW.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTVKMW.exe.bat" "86⤵PID:2088
-
C:\windows\system\QTVKMW.exeC:\windows\system\QTVKMW.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBX.exe.bat" "88⤵PID:5164
-
C:\windows\SysWOW64\HBX.exeC:\windows\system32\HBX.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMX.exe.bat" "90⤵PID:4704
-
C:\windows\HMX.exeC:\windows\HMX.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HRYW.exe.bat" "92⤵PID:2436
-
C:\windows\SysWOW64\HRYW.exeC:\windows\system32\HRYW.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SKBPN.exe.bat" "94⤵
- Executes a command shell one-liner
PID:5244 -
C:\windows\SysWOW64\SKBPN.exeC:\windows\system32\SKBPN.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YKIDECS.exe.bat" "96⤵PID:2520
-
C:\windows\system\YKIDECS.exeC:\windows\system\YKIDECS.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDD.exe.bat" "98⤵
- Executes a command shell one-liner
PID:4664 -
C:\windows\SysWOW64\JDD.exeC:\windows\system32\JDD.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIJ.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4752 -
C:\windows\GIJ.exeC:\windows\GIJ.exe101⤵
- Executes dropped EXE
PID:5096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COPQB.exe.bat" "102⤵PID:4336
-
C:\windows\SysWOW64\COPQB.exeC:\windows\system32\COPQB.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RUVF.exe.bat" "104⤵PID:5104
-
C:\windows\system\RUVF.exeC:\windows\system\RUVF.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJOHO.exe.bat" "106⤵
- Executes a command shell one-liner
PID:1112 -
C:\windows\system\TJOHO.exeC:\windows\system\TJOHO.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PPUEVDP.exe.bat" "108⤵PID:2892
-
C:\windows\SysWOW64\PPUEVDP.exeC:\windows\system32\PPUEVDP.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DAQDAV.exe.bat" "110⤵PID:464
-
C:\windows\SysWOW64\DAQDAV.exeC:\windows\system32\DAQDAV.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNVMKUH.exe.bat" "112⤵PID:1756
-
C:\windows\SysWOW64\XNVMKUH.exeC:\windows\system32\XNVMKUH.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SAZW.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4500 -
C:\windows\SAZW.exeC:\windows\SAZW.exe115⤵
- Executes dropped EXE
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\STIXBG.exe.bat" "116⤵
- Executes a command shell one-liner
PID:2920 -
C:\windows\STIXBG.exeC:\windows\STIXBG.exe117⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FWEEGY.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5304 -
C:\windows\SysWOW64\FWEEGY.exeC:\windows\system32\FWEEGY.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QOHOOFU.exe.bat" "120⤵PID:4208
-
C:\windows\system\QOHOOFU.exeC:\windows\system\QOHOOFU.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-