Analysis
- max time kernel
87s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/10/2026, 17:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_23d95690ce1687ca4d9463d6ec3b1d55_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-30_23d95690ce1687ca4d9463d6ec3b1d55_elex_emotet_stop.exe
- Size 208KB
- Sample261001-vzmbcsscpe
- SHA256 493a2d1bb4ff734a5565e64d0e39a96a878a2e48be8496a0bb886ed40505603d
- MD5 23d95690ce1687ca4d9463d6ec3b1d55
- SHA1 3517bf6b6ac2cf9d91b56381e237c3bfdbd544fb
- SHA512 8630603b36674295569a4d7ba33bb576569a8dc4fee406ff99fd3d94481827d33b86c102f556d5d8729af32dade0dc26c15f0ffb8e463d655b6d489d2d03d6d5
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfd4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOFkEj1
- TLSH T18C247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2440 XGL.exe 1264 TRJA.exe 3608 XHQABD.exe 4076 DIX.exe 3108 CSIDTLR.exe 3696 GAPMX.exe 5456 EWO.exe 856 GJTW.exe 5868 NECAXTS.exe 2700 DUDZ.exe 4720 XPIJO.exe 4964 JXPJA.exe 2816 NNVRFRF.exe 2416 DDWI.exe 3176 FTK.exe 4084 UWTPMI.exe 464 OKY.exe 5576 CHYKYT.exe 3900 MFEWFC.exe 2120 WDR.exe 5524 ATYZHC.exe 3164 JTAE.exe 3460 KWEAQQ.exe 4556 IHHQZ.exe 3764 FNZ.exe 2444 EXCVXFY.exe 600 XYR.exe 2464 KWRSJS.exe 760 MTXMY.exe 5736 WRK.exe 5168 GPQTNRQ.exe 4936 ZSUW.exe 5028 YDF.exe 2292 AQOO.exe 3692 TTA.exe 1644 DRFEP.exe 4920 WUJI.exe 2308 CHIIZ.exe 4508 AFTL.exe 3100 VSYVX.exe 3792 KIZM.exe 4156 CROR.exe 5948 CMR.exe 2352 VPVRB.exe 4112 IAM.exe 2736 HKPXYLN.exe 1988 YLR.exe 2552 AIWXJZY.exe 2584 BLAB.exe 4872 TOM.exe 3500 USQAH.exe 5344 ASXOYXM.exe 3396 YSFBH.exe 4660 EFWCMU.exe 1868 YBBMOUR.exe 2300 XQUPJZ.exe 4596 DMTP.exe 5848 FKZ.exe 5804 LKG.exe 5128 CKIDILB.exe 5632 VNMG.exe 5840 VQQCB.exe 2244 XOEWI.exe 616 SBBGSZJ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\IAM.exe VPVRB.exe File created C:\windows\SysWOW64\VNMG.exe CKIDILB.exe File created C:\windows\SysWOW64\ILTZTGV.exe PIP.exe File created C:\windows\SysWOW64\ILTZTGV.exe.bat PIP.exe File created C:\windows\SysWOW64\DDWI.exe.bat NNVRFRF.exe File created C:\windows\SysWOW64\ATYZHC.exe.bat WDR.exe File opened for modification C:\windows\SysWOW64\TTA.exe AQOO.exe File created C:\windows\SysWOW64\CROR.exe KIZM.exe File opened for modification C:\windows\SysWOW64\CROR.exe KIZM.exe File created C:\windows\SysWOW64\AIWXJZY.exe YLR.exe File created C:\windows\SysWOW64\OZDRITB.exe.bat KWFW.exe File opened for modification C:\windows\SysWOW64\QRT.exe ILTZTGV.exe File opened for modification C:\windows\SysWOW64\CSIDTLR.exe DIX.exe File created C:\windows\SysWOW64\DDWI.exe NNVRFRF.exe File created C:\windows\SysWOW64\WRK.exe MTXMY.exe File created C:\windows\SysWOW64\CMR.exe CROR.exe File opened for modification C:\windows\SysWOW64\IAM.exe VPVRB.exe File created C:\windows\SysWOW64\KKXBOT.exe.bat EJPO.exe File created C:\windows\SysWOW64\BUVBUQ.exe.bat HHQSK.exe File created C:\windows\SysWOW64\SMBN.exe OEVFSL.exe File created C:\windows\SysWOW64\NECAXTS.exe.bat GJTW.exe File created C:\windows\SysWOW64\ATYZHC.exe WDR.exe File created C:\windows\SysWOW64\JTAE.exe ATYZHC.exe File created C:\windows\SysWOW64\WRK.exe.bat MTXMY.exe File created C:\windows\SysWOW64\KIZM.exe.bat VSYVX.exe File created C:\windows\SysWOW64\HKPXYLN.exe.bat IAM.exe File created C:\windows\SysWOW64\QRT.exe.bat ILTZTGV.exe File created C:\windows\SysWOW64\DBCMJW.exe QRT.exe File opened for modification C:\windows\SysWOW64\ATYZHC.exe WDR.exe File created C:\windows\SysWOW64\BLAB.exe AIWXJZY.exe File opened for modification C:\windows\SysWOW64\BLAB.exe AIWXJZY.exe File created C:\windows\SysWOW64\KWFW.exe.bat YOYWWHL.exe File created C:\windows\SysWOW64\DBCMJW.exe.bat QRT.exe File opened for modification C:\windows\SysWOW64\SMBN.exe OEVFSL.exe File created C:\windows\SysWOW64\SMBN.exe.bat OEVFSL.exe File created C:\windows\SysWOW64\MGWK.exe WQVKK.exe File created C:\windows\SysWOW64\TTA.exe AQOO.exe File created C:\windows\SysWOW64\CHIIZ.exe WUJI.exe File created C:\windows\SysWOW64\CROR.exe.bat KIZM.exe File created C:\windows\SysWOW64\AIWXJZY.exe.bat YLR.exe File opened for modification C:\windows\SysWOW64\KKXBOT.exe EJPO.exe File created C:\windows\SysWOW64\FNIKV.exe.bat GPPPAPL.exe File created C:\windows\SysWOW64\MGWK.exe.bat WQVKK.exe File created C:\windows\SysWOW64\EXCVXFY.exe.bat FNZ.exe File created C:\windows\SysWOW64\CMR.exe.bat CROR.exe File created C:\windows\SysWOW64\KWFW.exe YOYWWHL.exe File created C:\windows\SysWOW64\MXOMVY.exe OZDRITB.exe File opened for modification C:\windows\SysWOW64\FYLUAMZ.exe MGWK.exe File created C:\windows\SysWOW64\YETUTSC.exe HWRPQV.exe File created C:\windows\SysWOW64\IAM.exe.bat VPVRB.exe File opened for modification C:\windows\SysWOW64\AIWXJZY.exe YLR.exe File created C:\windows\SysWOW64\EXCVXFY.exe FNZ.exe File created C:\windows\SysWOW64\KIZM.exe VSYVX.exe File opened for modification C:\windows\SysWOW64\HUIX.exe VMBXLRM.exe File opened for modification C:\windows\SysWOW64\BUVBUQ.exe HHQSK.exe File opened for modification C:\windows\SysWOW64\FNIKV.exe GPPPAPL.exe File created C:\windows\SysWOW64\CSIDTLR.exe.bat DIX.exe File created C:\windows\SysWOW64\JTAE.exe.bat ATYZHC.exe File created C:\windows\SysWOW64\CHIIZ.exe.bat WUJI.exe File created C:\windows\SysWOW64\QRT.exe ILTZTGV.exe File created C:\windows\SysWOW64\XQUPJZ.exe YBBMOUR.exe File opened for modification C:\windows\SysWOW64\WRK.exe MTXMY.exe File opened for modification C:\windows\SysWOW64\KIZM.exe VSYVX.exe File opened for modification C:\windows\SysWOW64\DBCMJW.exe QRT.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\YLR.exe HKPXYLN.exe File created C:\windows\system\USQAH.exe.bat TOM.exe File opened for modification C:\windows\system\XOEWI.exe VQQCB.exe File created C:\windows\system\NZPIATR.exe.bat VEL.exe File created C:\windows\YOYWWHL.exe.bat QTHK.exe File created C:\windows\system\OKY.exe.bat UWTPMI.exe File created C:\windows\WDR.exe.bat MFEWFC.exe File created C:\windows\system\XOEWI.exe.bat VQQCB.exe File opened for modification C:\windows\VEL.exe UBHJPN.exe File created C:\windows\system\NZPIATR.exe VEL.exe File opened for modification C:\windows\YOYWWHL.exe QTHK.exe File opened for modification C:\windows\system\XJLFCHR.exe HTKG.exe File opened for modification C:\windows\system\ALIW.exe FNIKV.exe File created C:\windows\GAPMX.exe CSIDTLR.exe File opened for modification C:\windows\YLR.exe HKPXYLN.exe File created C:\windows\CKIDILB.exe.bat LKG.exe File created C:\windows\system\TOMADV.exe ALIW.exe File created C:\windows\WCQNRW.exe.bat SMBN.exe File opened for modification C:\windows\RAWQYI.exe YETUTSC.exe File created C:\windows\system\CHYKYT.exe.bat OKY.exe File opened for modification C:\windows\FNZ.exe IHHQZ.exe File opened for modification C:\windows\CKIDILB.exe LKG.exe File created C:\windows\system\XOEWI.exe VQQCB.exe File created C:\windows\SBBGSZJ.exe.bat XOEWI.exe File created C:\windows\OEVFSL.exe.bat XWTAP.exe File created C:\windows\system\GJTW.exe EWO.exe File created C:\windows\FTK.exe DDWI.exe File created C:\windows\FNZ.exe.bat IHHQZ.exe File created C:\windows\MTXMY.exe.bat KWRSJS.exe File created C:\windows\FKZ.exe.bat DMTP.exe File created C:\windows\RAYTU.exe KKXBOT.exe File opened for modification C:\windows\GVH.exe RAYTU.exe File opened for modification C:\windows\RGAYPQ.exe AXMTCA.exe File created C:\windows\XGL.exe.bat 2026-09-30_23d95690ce1687ca4d9463d6ec3b1d55_elex_emotet_stop.exe File created C:\windows\XHQABD.exe.bat TRJA.exe File created C:\windows\system\XYR.exe.bat EXCVXFY.exe File created C:\windows\system\DRFEP.exe TTA.exe File opened for modification C:\windows\system\USQAH.exe TOM.exe File created C:\windows\RAYTU.exe.bat KKXBOT.exe File opened for modification C:\windows\system\SBEUU.exe RGAYPQ.exe File created C:\windows\system\UXZFZ.exe.bat BUVBUQ.exe File created C:\windows\system\MFEWFC.exe.bat CHYKYT.exe File created C:\windows\FNZ.exe IHHQZ.exe File created C:\windows\system\GPQTNRQ.exe.bat WRK.exe File created C:\windows\LKG.exe FKZ.exe File created C:\windows\system\QTHK.exe SBEUU.exe File opened for modification C:\windows\system\HTKG.exe UQBHHJ.exe File opened for modification C:\windows\system\NDKSUTG.exe WCQNRW.exe File opened for modification C:\windows\system\IHHQZ.exe KWEAQQ.exe File created C:\windows\AFTL.exe.bat CHIIZ.exe File created C:\windows\VSYVX.exe.bat AFTL.exe File opened for modification C:\windows\system\NNVRFRF.exe JXPJA.exe File created C:\windows\system\KWRSJS.exe.bat XYR.exe File created C:\windows\system\GPPPAPL.exe.bat DBCMJW.exe File created C:\windows\DIX.exe XHQABD.exe File created C:\windows\system\NNVRFRF.exe JXPJA.exe File created C:\windows\system\CHYKYT.exe OKY.exe File opened for modification C:\windows\system\XYR.exe EXCVXFY.exe File created C:\windows\system\GPQTNRQ.exe WRK.exe File created C:\windows\WUJI.exe.bat DRFEP.exe File opened for modification C:\windows\LKG.exe FKZ.exe File created C:\windows\system\HHQSK.exe.bat XJLFCHR.exe File opened for modification C:\windows\system\GJTW.exe EWO.exe File created C:\windows\DUDZ.exe.bat NECAXTS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4648 cmd.exe 1956 cmd.exe 2668 cmd.exe 1468 cmd.exe 4472 cmd.exe 1328 cmd.exe 716 cmd.exe 984 cmd.exe 248 cmd.exe 1408 cmd.exe 3592 cmd.exe 5500 cmd.exe 3708 cmd.exe 2032 cmd.exe 1552 cmd.exe 472 cmd.exe 4160 cmd.exe 4580 cmd.exe 1788 cmd.exe 484 cmd.exe 2972 cmd.exe 2036 cmd.exe 4092 cmd.exe 2524 cmd.exe 4968 cmd.exe 620 cmd.exe 5772 cmd.exe 1112 cmd.exe 796 cmd.exe 2964 cmd.exe 2052 cmd.exe 4628 cmd.exe 1500 cmd.exe 4248 cmd.exe 5260 cmd.exe 5520 cmd.exe 2720 cmd.exe 5944 cmd.exe 5332 cmd.exe 4380 cmd.exe 1464 cmd.exe 6000 cmd.exe 5004 cmd.exe 3444 cmd.exe 4420 cmd.exe 2344 cmd.exe 1840 cmd.exe 4876 cmd.exe 1332 cmd.exe 3400 cmd.exe 5280 cmd.exe 3040 cmd.exe 5236 cmd.exe 1592 cmd.exe 3268 cmd.exe 1096 cmd.exe 2848 cmd.exe 5440 cmd.exe 4432 cmd.exe 1244 cmd.exe 2008 cmd.exe 4224 cmd.exe 5824 cmd.exe 3184 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5956 6076 WerFault.exe 87 4100 2440 WerFault.exe 93 5708 1264 WerFault.exe 99 3320 3608 WerFault.exe 104 6000 4076 WerFault.exe 109 4660 3108 WerFault.exe 114 4160 3696 WerFault.exe 119 2780 5456 WerFault.exe 124 3424 856 WerFault.exe 129 4580 5868 WerFault.exe 134 4808 2700 WerFault.exe 139 5216 4720 WerFault.exe 144 3592 4964 WerFault.exe 149 3104 2816 WerFault.exe 154 4548 2416 WerFault.exe 159 1892 3176 WerFault.exe 164 2312 4084 WerFault.exe 169 2208 464 WerFault.exe 174 1212 5576 WerFault.exe 179 4904 3900 WerFault.exe 184 5504 2120 WerFault.exe 189 3968 5524 WerFault.exe 194 4092 3164 WerFault.exe 199 5252 3460 WerFault.exe 204 4548 4556 WerFault.exe 209 4924 3764 WerFault.exe 214 1148 2444 WerFault.exe 219 2068 600 WerFault.exe 224 4480 2464 WerFault.exe 229 1296 760 WerFault.exe 234 4244 5736 WerFault.exe 239 6092 5168 WerFault.exe 244 4192 4936 WerFault.exe 249 4744 5028 WerFault.exe 254 3104 2292 WerFault.exe 259 5780 3692 WerFault.exe 264 3532 1644 WerFault.exe 269 5588 4920 WerFault.exe 275 2336 2308 WerFault.exe 280 628 4508 WerFault.exe 285 2656 3100 WerFault.exe 290 3956 3792 WerFault.exe 295 4228 4156 WerFault.exe 300 4548 5948 WerFault.exe 305 4924 2352 WerFault.exe 310 1844 4112 WerFault.exe 315 1092 2736 WerFault.exe 320 1380 1988 WerFault.exe 325 3012 2552 WerFault.exe 330 860 2584 WerFault.exe 335 6092 4872 WerFault.exe 340 4100 3500 WerFault.exe 345 5824 5344 WerFault.exe 350 2776 3396 WerFault.exe 355 2140 4660 WerFault.exe 360 5396 1868 WerFault.exe 365 4792 2300 WerFault.exe 370 724 4596 WerFault.exe 375 832 5848 WerFault.exe 380 1204 5804 WerFault.exe 385 6024 5128 WerFault.exe 390 1544 5632 WerFault.exe 395 2296 5840 WerFault.exe 400 2708 2244 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCQNRW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKIDILB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAPMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWEAQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CHIIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKPXYLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USQAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AQOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKXBOT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTAE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBEUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBBMOUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AXMTCA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FASQBOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIWXJZY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGAYPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YETUTSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GJTW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UWTPMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GPQTNRQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFTL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6076 2026-09-30_23d95690ce1687ca4d9463d6ec3b1d55_elex_emotet_stop.exe 6076 2026-09-30_23d95690ce1687ca4d9463d6ec3b1d55_elex_emotet_stop.exe 2440 XGL.exe 2440 XGL.exe 1264 TRJA.exe 1264 TRJA.exe 3608 XHQABD.exe 3608 XHQABD.exe 4076 DIX.exe 4076 DIX.exe 3108 CSIDTLR.exe 3108 CSIDTLR.exe 3696 GAPMX.exe 3696 GAPMX.exe 5456 EWO.exe 5456 EWO.exe 856 GJTW.exe 856 GJTW.exe 5868 NECAXTS.exe 5868 NECAXTS.exe 2700 DUDZ.exe 2700 DUDZ.exe 4720 XPIJO.exe 4720 XPIJO.exe 4964 JXPJA.exe 4964 JXPJA.exe 2816 NNVRFRF.exe 2816 NNVRFRF.exe 2416 DDWI.exe 2416 DDWI.exe 3176 FTK.exe 3176 FTK.exe 4084 UWTPMI.exe 4084 UWTPMI.exe 464 OKY.exe 464 OKY.exe 5576 CHYKYT.exe 5576 CHYKYT.exe 3900 MFEWFC.exe 3900 MFEWFC.exe 2120 WDR.exe 2120 WDR.exe 5524 ATYZHC.exe 5524 ATYZHC.exe 3164 JTAE.exe 3164 JTAE.exe 3460 KWEAQQ.exe 3460 KWEAQQ.exe 4556 IHHQZ.exe 4556 IHHQZ.exe 3764 FNZ.exe 3764 FNZ.exe 2444 EXCVXFY.exe 2444 EXCVXFY.exe 600 XYR.exe 600 XYR.exe 2464 KWRSJS.exe 2464 KWRSJS.exe 760 MTXMY.exe 760 MTXMY.exe 5736 WRK.exe 5736 WRK.exe 5168 GPQTNRQ.exe 5168 GPQTNRQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 6076 2026-09-30_23d95690ce1687ca4d9463d6ec3b1d55_elex_emotet_stop.exe 6076 2026-09-30_23d95690ce1687ca4d9463d6ec3b1d55_elex_emotet_stop.exe 2440 XGL.exe 2440 XGL.exe 1264 TRJA.exe 1264 TRJA.exe 3608 XHQABD.exe 3608 XHQABD.exe 4076 DIX.exe 4076 DIX.exe 3108 CSIDTLR.exe 3108 CSIDTLR.exe 3696 GAPMX.exe 3696 GAPMX.exe 5456 EWO.exe 5456 EWO.exe 856 GJTW.exe 856 GJTW.exe 5868 NECAXTS.exe 5868 NECAXTS.exe 2700 DUDZ.exe 2700 DUDZ.exe 4720 XPIJO.exe 4720 XPIJO.exe 4964 JXPJA.exe 4964 JXPJA.exe 2816 NNVRFRF.exe 2816 NNVRFRF.exe 2416 DDWI.exe 2416 DDWI.exe 3176 FTK.exe 3176 FTK.exe 4084 UWTPMI.exe 4084 UWTPMI.exe 464 OKY.exe 464 OKY.exe 5576 CHYKYT.exe 5576 CHYKYT.exe 3900 MFEWFC.exe 3900 MFEWFC.exe 2120 WDR.exe 2120 WDR.exe 5524 ATYZHC.exe 5524 ATYZHC.exe 3164 JTAE.exe 3164 JTAE.exe 3460 KWEAQQ.exe 3460 KWEAQQ.exe 4556 IHHQZ.exe 4556 IHHQZ.exe 3764 FNZ.exe 3764 FNZ.exe 2444 EXCVXFY.exe 2444 EXCVXFY.exe 600 XYR.exe 600 XYR.exe 2464 KWRSJS.exe 2464 KWRSJS.exe 760 MTXMY.exe 760 MTXMY.exe 5736 WRK.exe 5736 WRK.exe 5168 GPQTNRQ.exe 5168 GPQTNRQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6076 wrote to memory of 1244 6076 2026-09-30_23d95690ce1687ca4d9463d6ec3b1d55_elex_emotet_stop.exe 89 PID 1244 wrote to memory of 2440 1244 cmd.exe 93 PID 2440 wrote to memory of 5236 2440 XGL.exe 95 PID 5236 wrote to memory of 1264 5236 cmd.exe 99 PID 1264 wrote to memory of 2448 1264 TRJA.exe 100 PID 2448 wrote to memory of 3608 2448 cmd.exe 104 PID 3608 wrote to memory of 5044 3608 XHQABD.exe 105 PID 5044 wrote to memory of 4076 5044 cmd.exe 109 PID 4076 wrote to memory of 4420 4076 DIX.exe 110 PID 4420 wrote to memory of 3108 4420 cmd.exe 114 PID 3108 wrote to memory of 3960 3108 CSIDTLR.exe 115 PID 3960 wrote to memory of 3696 3960 cmd.exe 119 PID 3696 wrote to memory of 4540 3696 GAPMX.exe 120 PID 4540 wrote to memory of 5456 4540 cmd.exe 124 PID 5456 wrote to memory of 2600 5456 EWO.exe 125 PID 2600 wrote to memory of 856 2600 cmd.exe 129 PID 856 wrote to memory of 3896 856 GJTW.exe 130 PID 3896 wrote to memory of 5868 3896 cmd.exe 134 PID 5868 wrote to memory of 2936 5868 NECAXTS.exe 135 PID 2936 wrote to memory of 2700 2936 cmd.exe 139 PID 2700 wrote to memory of 248 2700 DUDZ.exe 140 PID 248 wrote to memory of 4720 248 cmd.exe 144 PID 4720 wrote to memory of 620 4720 XPIJO.exe 145 PID 620 wrote to memory of 4964 620 cmd.exe 149 PID 4964 wrote to memory of 5032 4964 JXPJA.exe 150 PID 5032 wrote to memory of 2816 5032 cmd.exe 154 PID 2816 wrote to memory of 1592 2816 NNVRFRF.exe 155 PID 1592 wrote to memory of 2416 1592 cmd.exe 159 PID 2416 wrote to memory of 5772 2416 DDWI.exe 160 PID 5772 wrote to memory of 3176 5772 cmd.exe 164 PID 3176 wrote to memory of 1648 3176 FTK.exe 165 PID 1648 wrote to memory of 4084 1648 cmd.exe 169 PID 4084 wrote to memory of 3268 4084 UWTPMI.exe 170 PID 3268 wrote to memory of 464 3268 cmd.exe 174 PID 464 wrote to memory of 2100 464 OKY.exe 175 PID 2100 wrote to memory of 5576 2100 cmd.exe 179 PID 5576 wrote to memory of 916 5576 CHYKYT.exe 180 PID 916 wrote to memory of 3900 916 cmd.exe 184 PID 3900 wrote to memory of 4380 3900 MFEWFC.exe 185 PID 4380 wrote to memory of 2120 4380 cmd.exe 189 PID 2120 wrote to memory of 1736 2120 WDR.exe 190 PID 1736 wrote to memory of 5524 1736 cmd.exe 194 PID 5524 wrote to memory of 2940 5524 ATYZHC.exe 195 PID 2940 wrote to memory of 3164 2940 cmd.exe 199 PID 3164 wrote to memory of 3364 3164 JTAE.exe 200 PID 3364 wrote to memory of 3460 3364 cmd.exe 204 PID 3460 wrote to memory of 3040 3460 KWEAQQ.exe 205 PID 3040 wrote to memory of 4556 3040 cmd.exe 209 PID 4556 wrote to memory of 1692 4556 IHHQZ.exe 210 PID 1692 wrote to memory of 3764 1692 cmd.exe 214 PID 3764 wrote to memory of 5408 3764 FNZ.exe 215 PID 5408 wrote to memory of 2444 5408 cmd.exe 219 PID 2444 wrote to memory of 1256 2444 EXCVXFY.exe 220 PID 1256 wrote to memory of 600 1256 cmd.exe 224 PID 600 wrote to memory of 2972 600 XYR.exe 225 PID 2972 wrote to memory of 2464 2972 cmd.exe 229 PID 2464 wrote to memory of 1412 2464 KWRSJS.exe 230 PID 1412 wrote to memory of 760 1412 cmd.exe 234 PID 760 wrote to memory of 2032 760 MTXMY.exe 235 PID 2032 wrote to memory of 5736 2032 cmd.exe 239 PID 5736 wrote to memory of 5744 5736 WRK.exe 240 PID 5744 wrote to memory of 5168 5744 cmd.exe 244 PID 5168 wrote to memory of 4680 5168 GPQTNRQ.exe 245 PID 4680 wrote to memory of 4936 4680 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_23d95690ce1687ca4d9463d6ec3b1d55_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_23d95690ce1687ca4d9463d6ec3b1d55_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XGL.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\windows\XGL.exeC:\windows\XGL.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRJA.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\windows\TRJA.exeC:\windows\TRJA.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHQABD.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\windows\XHQABD.exeC:\windows\XHQABD.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DIX.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\windows\DIX.exeC:\windows\DIX.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CSIDTLR.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\windows\SysWOW64\CSIDTLR.exeC:\windows\system32\CSIDTLR.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GAPMX.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\windows\GAPMX.exeC:\windows\GAPMX.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EWO.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\windows\SysWOW64\EWO.exeC:\windows\system32\EWO.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GJTW.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\windows\system\GJTW.exeC:\windows\system\GJTW.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NECAXTS.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\windows\SysWOW64\NECAXTS.exeC:\windows\system32\NECAXTS.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DUDZ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\windows\DUDZ.exeC:\windows\DUDZ.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XPIJO.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:248 -
C:\windows\XPIJO.exeC:\windows\XPIJO.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JXPJA.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:620 -
C:\windows\system\JXPJA.exeC:\windows\system\JXPJA.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NNVRFRF.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\windows\system\NNVRFRF.exeC:\windows\system\NNVRFRF.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDWI.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\windows\SysWOW64\DDWI.exeC:\windows\system32\DDWI.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTK.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\windows\FTK.exeC:\windows\FTK.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UWTPMI.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\windows\UWTPMI.exeC:\windows\UWTPMI.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKY.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\windows\system\OKY.exeC:\windows\system\OKY.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CHYKYT.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\windows\system\CHYKYT.exeC:\windows\system\CHYKYT.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MFEWFC.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:916 -
C:\windows\system\MFEWFC.exeC:\windows\system\MFEWFC.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDR.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\windows\WDR.exeC:\windows\WDR.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ATYZHC.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\windows\SysWOW64\ATYZHC.exeC:\windows\system32\ATYZHC.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JTAE.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\windows\SysWOW64\JTAE.exeC:\windows\system32\JTAE.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KWEAQQ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\windows\KWEAQQ.exeC:\windows\KWEAQQ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IHHQZ.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\windows\system\IHHQZ.exeC:\windows\system\IHHQZ.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FNZ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\windows\FNZ.exeC:\windows\FNZ.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXCVXFY.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\windows\SysWOW64\EXCVXFY.exeC:\windows\system32\EXCVXFY.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XYR.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\windows\system\XYR.exeC:\windows\system\XYR.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWRSJS.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\windows\system\KWRSJS.exeC:\windows\system\KWRSJS.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTXMY.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\windows\MTXMY.exeC:\windows\MTXMY.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WRK.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\windows\SysWOW64\WRK.exeC:\windows\system32\WRK.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GPQTNRQ.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\windows\system\GPQTNRQ.exeC:\windows\system\GPQTNRQ.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSUW.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\windows\ZSUW.exeC:\windows\ZSUW.exe65⤵
- Executes dropped EXE
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDF.exe.bat" "66⤵PID:4376
-
C:\windows\system\YDF.exeC:\windows\system\YDF.exe67⤵
- Executes dropped EXE
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQOO.exe.bat" "68⤵PID:5708
-
C:\windows\system\AQOO.exeC:\windows\system\AQOO.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTA.exe.bat" "70⤵PID:1496
-
C:\windows\SysWOW64\TTA.exeC:\windows\system32\TTA.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DRFEP.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2344 -
C:\windows\system\DRFEP.exeC:\windows\system\DRFEP.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUJI.exe.bat" "74⤵PID:4836
-
C:\windows\WUJI.exeC:\windows\WUJI.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CHIIZ.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2008 -
C:\windows\SysWOW64\CHIIZ.exeC:\windows\system32\CHIIZ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFTL.exe.bat" "78⤵PID:3808
-
C:\windows\AFTL.exeC:\windows\AFTL.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSYVX.exe.bat" "80⤵
- Executes a command shell one-liner
PID:1552 -
C:\windows\VSYVX.exeC:\windows\VSYVX.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KIZM.exe.bat" "82⤵PID:5112
-
C:\windows\SysWOW64\KIZM.exeC:\windows\system32\KIZM.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CROR.exe.bat" "84⤵PID:3816
-
C:\windows\SysWOW64\CROR.exeC:\windows\system32\CROR.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CMR.exe.bat" "86⤵PID:4972
-
C:\windows\SysWOW64\CMR.exeC:\windows\system32\CMR.exe87⤵
- Executes dropped EXE
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPVRB.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:4136 -
C:\windows\SysWOW64\VPVRB.exeC:\windows\system32\VPVRB.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAM.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:1428 -
C:\windows\SysWOW64\IAM.exeC:\windows\system32\IAM.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKPXYLN.exe.bat" "92⤵
- Executes a command shell one-liner
PID:472 -
C:\windows\SysWOW64\HKPXYLN.exeC:\windows\system32\HKPXYLN.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YLR.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1096 -
C:\windows\YLR.exeC:\windows\YLR.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AIWXJZY.exe.bat" "96⤵
- Executes a command shell one-liner
PID:1840 -
C:\windows\SysWOW64\AIWXJZY.exeC:\windows\system32\AIWXJZY.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BLAB.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:4820 -
C:\windows\SysWOW64\BLAB.exeC:\windows\system32\BLAB.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TOM.exe.bat" "100⤵
- Executes a command shell one-liner
PID:2848 -
C:\windows\system\TOM.exeC:\windows\system\TOM.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USQAH.exe.bat" "102⤵
- Executes a command shell one-liner
PID:5440 -
C:\windows\system\USQAH.exeC:\windows\system\USQAH.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASXOYXM.exe.bat" "104⤵PID:4552
-
C:\windows\system\ASXOYXM.exeC:\windows\system\ASXOYXM.exe105⤵
- Executes dropped EXE
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSFBH.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:5160 -
C:\windows\system\YSFBH.exeC:\windows\system\YSFBH.exe107⤵
- Executes dropped EXE
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EFWCMU.exe.bat" "108⤵PID:2472
-
C:\windows\EFWCMU.exeC:\windows\EFWCMU.exe109⤵
- Executes dropped EXE
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBBMOUR.exe.bat" "110⤵PID:2040
-
C:\windows\system\YBBMOUR.exeC:\windows\system\YBBMOUR.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQUPJZ.exe.bat" "112⤵PID:4640
-
C:\windows\SysWOW64\XQUPJZ.exeC:\windows\system32\XQUPJZ.exe113⤵
- Executes dropped EXE
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMTP.exe.bat" "114⤵PID:2856
-
C:\windows\DMTP.exeC:\windows\DMTP.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FKZ.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:1472 -
C:\windows\FKZ.exeC:\windows\FKZ.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LKG.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:1400 -
C:\windows\LKG.exeC:\windows\LKG.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKIDILB.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:4840 -
C:\windows\CKIDILB.exeC:\windows\CKIDILB.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-