Analysis
- max time kernel
96s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 22:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-02_f4c13a86ba44839529cd2ce2cdca3f13_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-02_f4c13a86ba44839529cd2ce2cdca3f13_elex_emotet_stop.exe
- Size 208KB
- Sample261002-2edl2shh48
- SHA256 381e4b268d61acce6b8f3ce75ab945a9b30ceb682645173ab14f0d3449a19377
- MD5 f4c13a86ba44839529cd2ce2cdca3f13
- SHA1 fb4d7a31bbfb645905a28f4f6f20ef7d986e0cec
- SHA512 5fbf8faeb92d7fec4fcd7320b5e5517690a4d7fdffe9a0faf46914306f09521c004a0fc2cb24675c361b5937dfa14c1055f19acfafef695691f30a498bc4604e
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfg4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOoQEj1
- TLSH T1B7247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4676 ZSKRU.exe 4436 PIYICTZ.exe 1184 VIFWTVA.exe 996 VOF.exe 4188 KRPPFV.exe 1140 KWPDHA.exe 4896 LZTZU.exe 5792 HXZWB.exe 4088 NXGKKCL.exe 820 RNNSX.exe 3464 ANP.exe 2880 VJMGK.exe 5544 MJOLOP.exe 2140 BEFQ.exe 3452 NXAJH.exe 5832 WFCOSO.exe 4760 PXSHCPA.exe 5012 VYZULRC.exe 2644 ZBXHL.exe 5680 OWH.exe 4464 SMNUQPI.exe 5564 CMP.exe 5408 CPTDZ.exe 4908 IQBQIFN.exe 4944 BTFM.exe 1172 BYFAX.exe 2860 ZOQDKN.exe 4780 FJPEPQ.exe 1944 VEZJ.exe 2572 RKFGPN.exe 416 MXJ.exe 3188 CIA.exe 2404 IIH.exe 5080 IBQCV.exe 5836 DOVLYNO.exe 4224 FBAV.exe 980 AXEESN.exe 2028 ACXTUA.exe 1876 UQB.exe 4336 AQJQN.exe 2044 XVPNU.exe 4540 IOSGCL.exe 2508 MWZG.exe 236 OUSI.exe 4984 YSFUCAH.exe 5412 JKA.exe 5596 SYLFSM.exe 3412 NLQ.exe 2228 EWO.exe 4472 TRXRV.exe 4804 NECAXTS.exe 3220 HXX.exe 5040 BSCCQ.exe 2524 WFHMAAL.exe 5200 HYKEAI.exe 4396 NYRS.exe 956 LYZGAM.exe 4844 KJPEAZ.exe 6124 TWAWQDM.exe 3904 EPD.exe 4100 KPLCH.exe 1160 EDPMJFR.exe 352 QVK.exe 4124 YBLT.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\WFCOSO.exe NXAJH.exe File opened for modification C:\windows\SysWOW64\QFSVW.exe BZM.exe File opened for modification C:\windows\SysWOW64\EVCT.exe QQXE.exe File created C:\windows\SysWOW64\LZTZU.exe KWPDHA.exe File created C:\windows\SysWOW64\VJMGK.exe.bat ANP.exe File created C:\windows\SysWOW64\NYRS.exe.bat HYKEAI.exe File created C:\windows\SysWOW64\HUVZKJS.exe YTTM.exe File created C:\windows\SysWOW64\YDTDMK.exe BXVOFA.exe File opened for modification C:\windows\SysWOW64\EWDJL.exe NLETMCM.exe File created C:\windows\SysWOW64\ANP.exe RNNSX.exe File created C:\windows\SysWOW64\JDD.exe YKIDECS.exe File created C:\windows\SysWOW64\NUZEE.exe.bat PTSQV.exe File created C:\windows\SysWOW64\LZTZU.exe.bat KWPDHA.exe File created C:\windows\SysWOW64\VJMGK.exe ANP.exe File created C:\windows\SysWOW64\OWUBACA.exe.bat IWMN.exe File opened for modification C:\windows\SysWOW64\COPQB.exe GIJ.exe File created C:\windows\SysWOW64\IWJETYU.exe.bat MQDOM.exe File created C:\windows\SysWOW64\EVCT.exe.bat QQXE.exe File opened for modification C:\windows\SysWOW64\BBIQUU.exe EVCT.exe File created C:\windows\SysWOW64\BBIQUU.exe.bat EVCT.exe File created C:\windows\SysWOW64\HKMWSR.exe BJEAJ.exe File created C:\windows\SysWOW64\TDOJN.exe XGI.exe File created C:\windows\SysWOW64\QFSVW.exe.bat BZM.exe File created C:\windows\SysWOW64\RTFLJ.exe.bat UOZ.exe File opened for modification C:\windows\SysWOW64\WFCOSO.exe NXAJH.exe File opened for modification C:\windows\SysWOW64\PXSHCPA.exe WFCOSO.exe File created C:\windows\SysWOW64\VEZJ.exe FJPEPQ.exe File created C:\windows\SysWOW64\VEZJ.exe.bat FJPEPQ.exe File created C:\windows\SysWOW64\COPQB.exe.bat GIJ.exe File created C:\windows\SysWOW64\NUZEE.exe PTSQV.exe File created C:\windows\SysWOW64\MQDOM.exe.bat MLLAL.exe File opened for modification C:\windows\SysWOW64\AHLOG.exe GUGE.exe File created C:\windows\SysWOW64\AOXEKXN.exe COPQB.exe File created C:\windows\SysWOW64\ZNZR.exe.bat RHZ.exe File created C:\windows\SysWOW64\PXSHCPA.exe WFCOSO.exe File created C:\windows\SysWOW64\GLHORJS.exe LXCEH.exe File opened for modification C:\windows\SysWOW64\UCCDS.exe XXW.exe File created C:\windows\SysWOW64\UQB.exe.bat ACXTUA.exe File opened for modification C:\windows\SysWOW64\EWO.exe NLQ.exe File created C:\windows\SysWOW64\PSW.exe DZTOZSU.exe File created C:\windows\SysWOW64\QFSVW.exe BZM.exe File created C:\windows\SysWOW64\UFSUI.exe FKJIXPS.exe File created C:\windows\SysWOW64\JKA.exe YSFUCAH.exe File created C:\windows\SysWOW64\AHLOG.exe GUGE.exe File opened for modification C:\windows\SysWOW64\VOF.exe BBIQUU.exe File created C:\windows\SysWOW64\UFSUI.exe.bat FKJIXPS.exe File created C:\windows\SysWOW64\OJH.exe.bat CQELYT.exe File opened for modification C:\windows\SysWOW64\MQDOM.exe MLLAL.exe File created C:\windows\SysWOW64\BXVOFA.exe.bat QFSVW.exe File opened for modification C:\windows\SysWOW64\KKXBOT.exe EJPO.exe File created C:\windows\SysWOW64\FXVN.exe.bat UFSUI.exe File opened for modification C:\windows\SysWOW64\OWUBACA.exe IWMN.exe File opened for modification C:\windows\SysWOW64\TDOJN.exe XGI.exe File opened for modification C:\windows\SysWOW64\UFSUI.exe FKJIXPS.exe File created C:\windows\SysWOW64\FXVN.exe UFSUI.exe File created C:\windows\SysWOW64\ANP.exe.bat RNNSX.exe File created C:\windows\SysWOW64\SMNUQPI.exe OWH.exe File created C:\windows\SysWOW64\UQB.exe ACXTUA.exe File opened for modification C:\windows\SysWOW64\NYRS.exe HYKEAI.exe File created C:\windows\SysWOW64\YDTDMK.exe.bat BXVOFA.exe File created C:\windows\SysWOW64\VOF.exe.bat BBIQUU.exe File opened for modification C:\windows\SysWOW64\NXAJH.exe BEFQ.exe File created C:\windows\SysWOW64\GLHORJS.exe.bat LXCEH.exe File created C:\windows\SysWOW64\AOXEKXN.exe.bat COPQB.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\OWH.exe ZBXHL.exe File opened for modification C:\windows\system\AXEESN.exe FBAV.exe File created C:\windows\XUEZS.exe RTFLJ.exe File created C:\windows\system\GUGE.exe.bat XUEZS.exe File opened for modification C:\windows\system\BDY.exe XNRLN.exe File opened for modification C:\windows\system\TCPHAYU.exe HKMWSR.exe File opened for modification C:\windows\system\LYZGAM.exe NYRS.exe File created C:\windows\system\YKIDECS.exe UCCDS.exe File created C:\windows\XUEZS.exe.bat RTFLJ.exe File created C:\windows\PIYICTZ.exe.bat ZSKRU.exe File created C:\windows\OWH.exe.bat ZBXHL.exe File created C:\windows\system\XXW.exe OWUBACA.exe File created C:\windows\system\TRM.exe.bat EWDJL.exe File created C:\windows\FKJIXPS.exe FWJCNK.exe File created C:\windows\system\CDBCXB.exe FXVN.exe File opened for modification C:\windows\system\CDBCXB.exe FXVN.exe File created C:\windows\QQXE.exe.bat VCS.exe File created C:\windows\system\FWJCNK.exe.bat TDOJN.exe File created C:\windows\RNNSX.exe NXGKKCL.exe File created C:\windows\BYFAX.exe BTFM.exe File opened for modification C:\windows\IUP.exe AOXEKXN.exe File opened for modification C:\windows\system\ACXTUA.exe AXEESN.exe File created C:\windows\system\KJPEAZ.exe.bat LYZGAM.exe File opened for modification C:\windows\EDPMJFR.exe KPLCH.exe File created C:\windows\system\LFCJL.exe ZNZR.exe File created C:\windows\system\GUGE.exe XUEZS.exe File created C:\windows\PIYICTZ.exe ZSKRU.exe File opened for modification C:\windows\RKFGPN.exe VEZJ.exe File created C:\windows\MXJ.exe RKFGPN.exe File created C:\windows\system\HXX.exe NECAXTS.exe File created C:\windows\system\CMP.exe SMNUQPI.exe File created C:\windows\IUP.exe.bat AOXEKXN.exe File opened for modification C:\windows\system\TRM.exe EWDJL.exe File opened for modification C:\windows\FKJIXPS.exe FWJCNK.exe File created C:\windows\AQJQN.exe.bat UQB.exe File created C:\windows\YTTM.exe YBLT.exe File opened for modification C:\windows\system\YKIDECS.exe UCCDS.exe File opened for modification C:\windows\system\WQGEZNJ.exe ZLAHSDP.exe File created C:\windows\OWH.exe ZBXHL.exe File opened for modification C:\windows\MXJ.exe RKFGPN.exe File created C:\windows\system\YKIDECS.exe.bat UCCDS.exe File created C:\windows\system\UOZ.exe JVWVURQ.exe File created C:\windows\VYZULRC.exe.bat PXSHCPA.exe File created C:\windows\FBAV.exe DOVLYNO.exe File opened for modification C:\windows\system\HYKEAI.exe WFHMAAL.exe File created C:\windows\system\IWMN.exe OJH.exe File opened for modification C:\windows\system\BJEAJ.exe VOF.exe File created C:\windows\OUSI.exe MWZG.exe File created C:\windows\QVK.exe.bat EDPMJFR.exe File created C:\windows\system\MLLAL.exe.bat MSCZX.exe File created C:\windows\system\BDY.exe.bat XNRLN.exe File created C:\windows\VCS.exe KKXBOT.exe File created C:\windows\system\CDBCXB.exe.bat FXVN.exe File opened for modification C:\windows\NXGKKCL.exe HXZWB.exe File opened for modification C:\windows\system\CMP.exe SMNUQPI.exe File opened for modification C:\windows\IQBQIFN.exe CPTDZ.exe File created C:\windows\system\BTFM.exe.bat IQBQIFN.exe File created C:\windows\MXJ.exe.bat RKFGPN.exe File opened for modification C:\windows\SYLFSM.exe JKA.exe File created C:\windows\MSCZX.exe GSULOVZ.exe File opened for modification C:\windows\VIFWTVA.exe PIYICTZ.exe File created C:\windows\system\UOZ.exe.bat JVWVURQ.exe File created C:\windows\system\MJOLOP.exe VJMGK.exe File created C:\windows\IOSGCL.exe XVPNU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2768 cmd.exe 3488 cmd.exe 4632 cmd.exe 5348 cmd.exe 5460 cmd.exe 1632 cmd.exe 4616 cmd.exe 4256 cmd.exe 4104 cmd.exe 2728 cmd.exe 1284 cmd.exe 4612 cmd.exe 5852 cmd.exe 5868 cmd.exe 544 cmd.exe 1296 cmd.exe 1156 cmd.exe 3356 cmd.exe 908 cmd.exe 3908 cmd.exe 1044 cmd.exe 4948 cmd.exe 5940 cmd.exe 5636 cmd.exe 1660 cmd.exe 5984 cmd.exe 3492 cmd.exe 3500 cmd.exe 752 cmd.exe 5808 cmd.exe 5008 cmd.exe 5100 cmd.exe 1780 cmd.exe 2804 cmd.exe 2328 cmd.exe 3828 cmd.exe 4732 cmd.exe 4976 cmd.exe 4660 cmd.exe 2108 cmd.exe 4856 cmd.exe 5452 cmd.exe 2344 cmd.exe 3940 cmd.exe 5576 cmd.exe 3380 cmd.exe 1996 cmd.exe 4900 cmd.exe 4704 cmd.exe 5156 cmd.exe 5968 cmd.exe 2460 cmd.exe 4136 cmd.exe 4372 cmd.exe 4484 cmd.exe 5016 cmd.exe 3820 cmd.exe 5740 cmd.exe 3964 cmd.exe 692 cmd.exe 1536 cmd.exe 5508 cmd.exe 5980 cmd.exe 3160 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2524 6072 WerFault.exe 88 3748 4676 WerFault.exe 94 4908 4436 WerFault.exe 100 3348 1184 WerFault.exe 105 5796 996 WerFault.exe 110 1988 4188 WerFault.exe 115 1040 1140 WerFault.exe 120 5476 4896 WerFault.exe 125 3160 5792 WerFault.exe 130 1980 4088 WerFault.exe 135 5292 820 WerFault.exe 140 4632 3464 WerFault.exe 145 4128 2880 WerFault.exe 150 4616 5544 WerFault.exe 155 2212 2140 WerFault.exe 160 1496 3452 WerFault.exe 165 1696 5832 WerFault.exe 170 1040 4760 WerFault.exe 175 3972 5012 WerFault.exe 180 1228 2644 WerFault.exe 185 2940 5680 WerFault.exe 190 3612 4464 WerFault.exe 195 460 5564 WerFault.exe 200 5716 5408 WerFault.exe 205 4704 4908 WerFault.exe 210 956 4944 WerFault.exe 215 1988 1172 WerFault.exe 220 3820 2860 WerFault.exe 225 1568 4780 WerFault.exe 230 3160 1944 WerFault.exe 235 2932 2572 WerFault.exe 240 5724 416 WerFault.exe 245 1320 3188 WerFault.exe 250 248 2404 WerFault.exe 255 120 5080 WerFault.exe 260 5412 5836 WerFault.exe 265 4428 4224 WerFault.exe 270 3356 980 WerFault.exe 275 2500 2028 WerFault.exe 280 4936 1876 WerFault.exe 286 1980 4336 WerFault.exe 291 5312 2044 WerFault.exe 296 5508 4540 WerFault.exe 301 3108 2508 WerFault.exe 306 2824 236 WerFault.exe 311 4852 4984 WerFault.exe 316 2076 5412 WerFault.exe 321 5204 5596 WerFault.exe 326 2388 3412 WerFault.exe 331 5004 2228 WerFault.exe 336 4444 4472 WerFault.exe 341 3764 4804 WerFault.exe 346 3284 3220 WerFault.exe 351 1316 5040 WerFault.exe 356 2840 2524 WerFault.exe 361 5952 5200 WerFault.exe 366 4892 4396 WerFault.exe 371 2556 956 WerFault.exe 376 4860 4844 WerFault.exe 381 3392 6124 WerFault.exe 386 2188 3904 WerFault.exe 391 3948 4100 WerFault.exe 396 2284 1160 WerFault.exe 401 5452 352 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language COPQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KRPPFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AQJQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NYRS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MLLAL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMNUQPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTFM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYZGAM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZTOZSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUEZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCPHAYU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BXVOFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TDOJN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEZJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NLQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKXBOT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBIQUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFSUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKMWSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVWVURQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXGKKCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSFUCAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YKIDECS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKJIXPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6072 2026-10-02_f4c13a86ba44839529cd2ce2cdca3f13_elex_emotet_stop.exe 6072 2026-10-02_f4c13a86ba44839529cd2ce2cdca3f13_elex_emotet_stop.exe 4676 ZSKRU.exe 4676 ZSKRU.exe 4436 PIYICTZ.exe 4436 PIYICTZ.exe 1184 VIFWTVA.exe 1184 VIFWTVA.exe 996 VOF.exe 996 VOF.exe 4188 KRPPFV.exe 4188 KRPPFV.exe 1140 KWPDHA.exe 1140 KWPDHA.exe 4896 LZTZU.exe 4896 LZTZU.exe 5792 HXZWB.exe 5792 HXZWB.exe 4088 NXGKKCL.exe 4088 NXGKKCL.exe 820 RNNSX.exe 820 RNNSX.exe 3464 ANP.exe 3464 ANP.exe 2880 VJMGK.exe 2880 VJMGK.exe 5544 MJOLOP.exe 5544 MJOLOP.exe 2140 BEFQ.exe 2140 BEFQ.exe 3452 NXAJH.exe 3452 NXAJH.exe 5832 WFCOSO.exe 5832 WFCOSO.exe 4760 PXSHCPA.exe 4760 PXSHCPA.exe 5012 VYZULRC.exe 5012 VYZULRC.exe 2644 ZBXHL.exe 2644 ZBXHL.exe 5680 OWH.exe 5680 OWH.exe 4464 SMNUQPI.exe 4464 SMNUQPI.exe 5564 CMP.exe 5564 CMP.exe 5408 CPTDZ.exe 5408 CPTDZ.exe 4908 IQBQIFN.exe 4908 IQBQIFN.exe 4944 BTFM.exe 4944 BTFM.exe 1172 BYFAX.exe 1172 BYFAX.exe 2860 ZOQDKN.exe 2860 ZOQDKN.exe 4780 FJPEPQ.exe 4780 FJPEPQ.exe 1944 VEZJ.exe 1944 VEZJ.exe 2572 RKFGPN.exe 2572 RKFGPN.exe 416 MXJ.exe 416 MXJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 6072 2026-10-02_f4c13a86ba44839529cd2ce2cdca3f13_elex_emotet_stop.exe 6072 2026-10-02_f4c13a86ba44839529cd2ce2cdca3f13_elex_emotet_stop.exe 4676 ZSKRU.exe 4676 ZSKRU.exe 4436 PIYICTZ.exe 4436 PIYICTZ.exe 1184 VIFWTVA.exe 1184 VIFWTVA.exe 996 VOF.exe 996 VOF.exe 4188 KRPPFV.exe 4188 KRPPFV.exe 1140 KWPDHA.exe 1140 KWPDHA.exe 4896 LZTZU.exe 4896 LZTZU.exe 5792 HXZWB.exe 5792 HXZWB.exe 4088 NXGKKCL.exe 4088 NXGKKCL.exe 820 RNNSX.exe 820 RNNSX.exe 3464 ANP.exe 3464 ANP.exe 2880 VJMGK.exe 2880 VJMGK.exe 5544 MJOLOP.exe 5544 MJOLOP.exe 2140 BEFQ.exe 2140 BEFQ.exe 3452 NXAJH.exe 3452 NXAJH.exe 5832 WFCOSO.exe 5832 WFCOSO.exe 4760 PXSHCPA.exe 4760 PXSHCPA.exe 5012 VYZULRC.exe 5012 VYZULRC.exe 2644 ZBXHL.exe 2644 ZBXHL.exe 5680 OWH.exe 5680 OWH.exe 4464 SMNUQPI.exe 4464 SMNUQPI.exe 5564 CMP.exe 5564 CMP.exe 5408 CPTDZ.exe 5408 CPTDZ.exe 4908 IQBQIFN.exe 4908 IQBQIFN.exe 4944 BTFM.exe 4944 BTFM.exe 1172 BYFAX.exe 1172 BYFAX.exe 2860 ZOQDKN.exe 2860 ZOQDKN.exe 4780 FJPEPQ.exe 4780 FJPEPQ.exe 1944 VEZJ.exe 1944 VEZJ.exe 2572 RKFGPN.exe 2572 RKFGPN.exe 416 MXJ.exe 416 MXJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6072 wrote to memory of 2456 6072 2026-10-02_f4c13a86ba44839529cd2ce2cdca3f13_elex_emotet_stop.exe 90 PID 2456 wrote to memory of 4676 2456 cmd.exe 94 PID 4676 wrote to memory of 840 4676 ZSKRU.exe 96 PID 840 wrote to memory of 4436 840 cmd.exe 100 PID 4436 wrote to memory of 5284 4436 PIYICTZ.exe 101 PID 5284 wrote to memory of 1184 5284 cmd.exe 105 PID 1184 wrote to memory of 5816 1184 VIFWTVA.exe 106 PID 5816 wrote to memory of 996 5816 cmd.exe 110 PID 996 wrote to memory of 5968 996 VOF.exe 111 PID 5968 wrote to memory of 4188 5968 cmd.exe 115 PID 4188 wrote to memory of 3964 4188 KRPPFV.exe 116 PID 3964 wrote to memory of 1140 3964 cmd.exe 120 PID 1140 wrote to memory of 4220 1140 KWPDHA.exe 121 PID 4220 wrote to memory of 4896 4220 cmd.exe 125 PID 4896 wrote to memory of 4300 4896 LZTZU.exe 126 PID 4300 wrote to memory of 5792 4300 cmd.exe 130 PID 5792 wrote to memory of 3944 5792 HXZWB.exe 131 PID 3944 wrote to memory of 4088 3944 cmd.exe 135 PID 4088 wrote to memory of 4432 4088 NXGKKCL.exe 136 PID 4432 wrote to memory of 820 4432 cmd.exe 140 PID 820 wrote to memory of 4312 820 RNNSX.exe 141 PID 4312 wrote to memory of 3464 4312 cmd.exe 145 PID 3464 wrote to memory of 3892 3464 ANP.exe 146 PID 3892 wrote to memory of 2880 3892 cmd.exe 150 PID 2880 wrote to memory of 2768 2880 VJMGK.exe 151 PID 2768 wrote to memory of 5544 2768 cmd.exe 155 PID 5544 wrote to memory of 1044 5544 MJOLOP.exe 156 PID 1044 wrote to memory of 2140 1044 cmd.exe 160 PID 2140 wrote to memory of 3488 2140 BEFQ.exe 161 PID 3488 wrote to memory of 3452 3488 cmd.exe 165 PID 3452 wrote to memory of 2380 3452 NXAJH.exe 166 PID 2380 wrote to memory of 5832 2380 cmd.exe 170 PID 5832 wrote to memory of 2844 5832 WFCOSO.exe 171 PID 2844 wrote to memory of 4760 2844 cmd.exe 175 PID 4760 wrote to memory of 2948 4760 PXSHCPA.exe 176 PID 2948 wrote to memory of 5012 2948 cmd.exe 180 PID 5012 wrote to memory of 2344 5012 VYZULRC.exe 181 PID 2344 wrote to memory of 2644 2344 cmd.exe 185 PID 2644 wrote to memory of 5456 2644 ZBXHL.exe 186 PID 5456 wrote to memory of 5680 5456 cmd.exe 190 PID 5680 wrote to memory of 3940 5680 OWH.exe 191 PID 3940 wrote to memory of 4464 3940 cmd.exe 195 PID 4464 wrote to memory of 5872 4464 SMNUQPI.exe 196 PID 5872 wrote to memory of 5564 5872 cmd.exe 200 PID 5564 wrote to memory of 4632 5564 CMP.exe 201 PID 4632 wrote to memory of 5408 4632 cmd.exe 205 PID 5408 wrote to memory of 4948 5408 CPTDZ.exe 206 PID 4948 wrote to memory of 4908 4948 cmd.exe 210 PID 4908 wrote to memory of 5348 4908 IQBQIFN.exe 211 PID 5348 wrote to memory of 4944 5348 cmd.exe 215 PID 4944 wrote to memory of 5984 4944 BTFM.exe 216 PID 5984 wrote to memory of 1172 5984 cmd.exe 220 PID 1172 wrote to memory of 4820 1172 BYFAX.exe 221 PID 4820 wrote to memory of 2860 4820 cmd.exe 225 PID 2860 wrote to memory of 4644 2860 ZOQDKN.exe 226 PID 4644 wrote to memory of 4780 4644 cmd.exe 230 PID 4780 wrote to memory of 2292 4780 FJPEPQ.exe 231 PID 2292 wrote to memory of 1944 2292 cmd.exe 235 PID 1944 wrote to memory of 4648 1944 VEZJ.exe 236 PID 4648 wrote to memory of 2572 4648 cmd.exe 240 PID 2572 wrote to memory of 5368 2572 RKFGPN.exe 241 PID 5368 wrote to memory of 416 5368 cmd.exe 245 PID 416 wrote to memory of 4208 416 MXJ.exe 246 PID 4208 wrote to memory of 3188 4208 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_f4c13a86ba44839529cd2ce2cdca3f13_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_f4c13a86ba44839529cd2ce2cdca3f13_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSKRU.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\windows\ZSKRU.exeC:\windows\ZSKRU.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PIYICTZ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:840 -
C:\windows\PIYICTZ.exeC:\windows\PIYICTZ.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VIFWTVA.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\windows\VIFWTVA.exeC:\windows\VIFWTVA.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VOF.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\windows\system\VOF.exeC:\windows\system\VOF.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KRPPFV.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\windows\SysWOW64\KRPPFV.exeC:\windows\system32\KRPPFV.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWPDHA.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\windows\SysWOW64\KWPDHA.exeC:\windows\system32\KWPDHA.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LZTZU.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\windows\SysWOW64\LZTZU.exeC:\windows\system32\LZTZU.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HXZWB.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\windows\HXZWB.exeC:\windows\HXZWB.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXGKKCL.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\windows\NXGKKCL.exeC:\windows\NXGKKCL.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RNNSX.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\windows\RNNSX.exeC:\windows\RNNSX.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANP.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\windows\SysWOW64\ANP.exeC:\windows\system32\ANP.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VJMGK.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\windows\SysWOW64\VJMGK.exeC:\windows\system32\VJMGK.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MJOLOP.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\windows\system\MJOLOP.exeC:\windows\system\MJOLOP.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEFQ.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\windows\SysWOW64\BEFQ.exeC:\windows\system32\BEFQ.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NXAJH.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\windows\SysWOW64\NXAJH.exeC:\windows\system32\NXAJH.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WFCOSO.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\windows\SysWOW64\WFCOSO.exeC:\windows\system32\WFCOSO.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PXSHCPA.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\windows\SysWOW64\PXSHCPA.exeC:\windows\system32\PXSHCPA.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VYZULRC.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\windows\VYZULRC.exeC:\windows\VYZULRC.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZBXHL.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\windows\system\ZBXHL.exeC:\windows\system\ZBXHL.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OWH.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\windows\OWH.exeC:\windows\OWH.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SMNUQPI.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\windows\SysWOW64\SMNUQPI.exeC:\windows\system32\SMNUQPI.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CMP.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\windows\system\CMP.exeC:\windows\system\CMP.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPTDZ.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\windows\system\CPTDZ.exeC:\windows\system\CPTDZ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQBQIFN.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\windows\IQBQIFN.exeC:\windows\IQBQIFN.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTFM.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\windows\system\BTFM.exeC:\windows\system\BTFM.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BYFAX.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\windows\BYFAX.exeC:\windows\BYFAX.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZOQDKN.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\windows\SysWOW64\ZOQDKN.exeC:\windows\system32\ZOQDKN.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FJPEPQ.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\windows\system\FJPEPQ.exeC:\windows\system\FJPEPQ.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEZJ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\windows\SysWOW64\VEZJ.exeC:\windows\system32\VEZJ.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RKFGPN.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\windows\RKFGPN.exeC:\windows\RKFGPN.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXJ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\windows\MXJ.exeC:\windows\MXJ.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CIA.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\windows\system\CIA.exeC:\windows\system\CIA.exe65⤵
- Executes dropped EXE
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIH.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:3920 -
C:\windows\IIH.exeC:\windows\IIH.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBQCV.exe.bat" "68⤵PID:3748
-
C:\windows\system\IBQCV.exeC:\windows\system\IBQCV.exe69⤵
- Executes dropped EXE
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOVLYNO.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:5000 -
C:\windows\system\DOVLYNO.exeC:\windows\system\DOVLYNO.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FBAV.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3588 -
C:\windows\FBAV.exeC:\windows\FBAV.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AXEESN.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4104 -
C:\windows\system\AXEESN.exeC:\windows\system\AXEESN.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ACXTUA.exe.bat" "76⤵PID:3248
-
C:\windows\system\ACXTUA.exeC:\windows\system\ACXTUA.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UQB.exe.bat" "78⤵PID:5972
-
C:\windows\SysWOW64\UQB.exeC:\windows\system32\UQB.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AQJQN.exe.bat" "80⤵PID:4696
-
C:\windows\AQJQN.exeC:\windows\AQJQN.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XVPNU.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3492 -
C:\windows\XVPNU.exeC:\windows\XVPNU.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOSGCL.exe.bat" "84⤵PID:5688
-
C:\windows\IOSGCL.exeC:\windows\IOSGCL.exe85⤵
- Executes dropped EXE
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MWZG.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5592 -
C:\windows\MWZG.exeC:\windows\MWZG.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OUSI.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2728 -
C:\windows\OUSI.exeC:\windows\OUSI.exe89⤵
- Executes dropped EXE
PID:236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YSFUCAH.exe.bat" "90⤵
- Executes a command shell one-liner
PID:544 -
C:\windows\YSFUCAH.exeC:\windows\YSFUCAH.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JKA.exe.bat" "92⤵PID:6016
-
C:\windows\SysWOW64\JKA.exeC:\windows\system32\JKA.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SYLFSM.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:1540 -
C:\windows\SYLFSM.exeC:\windows\SYLFSM.exe95⤵
- Executes dropped EXE
PID:5596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLQ.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:1288 -
C:\windows\system\NLQ.exeC:\windows\system\NLQ.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EWO.exe.bat" "98⤵PID:4576
-
C:\windows\SysWOW64\EWO.exeC:\windows\system32\EWO.exe99⤵
- Executes dropped EXE
PID:2228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRXRV.exe.bat" "100⤵PID:4992
-
C:\windows\system\TRXRV.exeC:\windows\system\TRXRV.exe101⤵
- Executes dropped EXE
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NECAXTS.exe.bat" "102⤵
- Executes a command shell one-liner
PID:1296 -
C:\windows\SysWOW64\NECAXTS.exeC:\windows\system32\NECAXTS.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HXX.exe.bat" "104⤵PID:2780
-
C:\windows\system\HXX.exeC:\windows\system\HXX.exe105⤵
- Executes dropped EXE
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BSCCQ.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5460 -
C:\windows\SysWOW64\BSCCQ.exeC:\windows\system32\BSCCQ.exe107⤵
- Executes dropped EXE
PID:5040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WFHMAAL.exe.bat" "108⤵PID:124
-
C:\windows\system\WFHMAAL.exeC:\windows\system\WFHMAAL.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HYKEAI.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4996 -
C:\windows\system\HYKEAI.exeC:\windows\system\HYKEAI.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYRS.exe.bat" "112⤵
- Executes a command shell one-liner
PID:2804 -
C:\windows\SysWOW64\NYRS.exeC:\windows\system32\NYRS.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYZGAM.exe.bat" "114⤵PID:4428
-
C:\windows\system\LYZGAM.exeC:\windows\system\LYZGAM.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KJPEAZ.exe.bat" "116⤵PID:3424
-
C:\windows\system\KJPEAZ.exeC:\windows\system\KJPEAZ.exe117⤵
- Executes dropped EXE
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWAWQDM.exe.bat" "118⤵PID:5072
-
C:\windows\system\TWAWQDM.exeC:\windows\system\TWAWQDM.exe119⤵
- Executes dropped EXE
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EPD.exe.bat" "120⤵PID:5864
-
C:\windows\system\EPD.exeC:\windows\system\EPD.exe121⤵
- Executes dropped EXE
PID:3904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-