Analysis
- max time kernel
98s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/10/2026, 23:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-06_9442b12c814e6607ac4f41140c4d6108_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-06_9442b12c814e6607ac4f41140c4d6108_elex_emotet_stop.exe
- Size 208KB
- Sample261007-281nnsfw91
- SHA256 1cf6be16d9cddfd7cfc0417d8d7e5c016243d2e1dbfbac943ae923bc05fbf27e
- MD5 9442b12c814e6607ac4f41140c4d6108
- SHA1 58688d89758acea816f29620e3880b0fb6dc16f9
- SHA512 48e78dee402cbbfee58bbf8407f427679fb50058a65f0d02862f58f7875878ddc886cc5825a7870063b9d0bb34cb6730c9efb9fb127a1ca9901edbdc777a3a7f
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfv4pLthEjQT65:/lZtbLWIgd1LZ9oECZbDlUd+LOHkEjP
- TLSH T1C6247C1236D2C073E4B7023188F6C7787BB6BDA19B36928B6BC03B4D6E715968E35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1808 TENXE.exe 4676 FQFR.exe 3684 XLIVWO.exe 5288 AGN.exe 5724 WDFU.exe 4500 WRGI.exe 2176 AZMIKOL.exe 4948 MPTI.exe 4520 WPVVA.exe 1984 WSZR.exe 2156 UTGFWWM.exe 4652 VWK.exe 4116 PJPSM.exe 260 FZQJ.exe 5416 HXWEAQ.exe 4080 WSNI.exe 3644 WVR.exe 1736 RIWVB.exe 3792 KLZZGII.exe 5088 SREFRP.exe 4624 EHLF.exe 4072 NHNLHFU.exe 1452 RXBT.exe 5132 SSFOYN.exe 240 BBHTKKT.exe 3420 QWQGV.exe 1300 HWSL.exe 4260 AZWGMS.exe 2976 VMBYOSU.exe 6040 KPLCH.exe 3488 EDPMJFR.exe 5032 DNSCST.exe 4132 DTSQTYI.exe 4400 GOX.exe 3228 NJHEXS.exe 3356 EKJ.exe 5860 XNMNGGJ.exe 3820 SAR.exe 5964 JNCO.exe 4272 JTUDH.exe 4864 YOL.exe 3004 ZRPLYAZ.exe 4868 KJKDGH.exe 2084 TSMJ.exe 2708 UNQEXC.exe 1600 OIV.exe 1844 EDMASP.exe 4720 NDGFWMR.exe 2376 MORVEA.exe 5476 KMCQ.exe 1912 KSCFT.exe 968 LVGI.exe 5652 AQQNRVA.exe 2480 JYS.exe 244 ELWBF.exe 5692 PEZUNI.exe 2524 BMGC.exe 3924 UPKYF.exe 2252 OCPHPQT.exe 5852 UDWVY.exe 3300 PQBMIK.exe 2780 PDTTKXM.exe 2144 EYLFV.exe 5972 PRGYDZ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\NHNLHFU.exe.bat EHLF.exe File created C:\windows\SysWOW64\SSFOYN.exe.bat RXBT.exe File created C:\windows\SysWOW64\AZWGMS.exe.bat HWSL.exe File created C:\windows\SysWOW64\YOL.exe.bat JTUDH.exe File created C:\windows\SysWOW64\OCPHPQT.exe.bat UPKYF.exe File opened for modification C:\windows\SysWOW64\EBLZLX.exe RGYZS.exe File opened for modification C:\windows\SysWOW64\JVTMOX.exe JSQQ.exe File opened for modification C:\windows\SysWOW64\RXBT.exe NHNLHFU.exe File created C:\windows\SysWOW64\KJKDGH.exe.bat ZRPLYAZ.exe File created C:\windows\SysWOW64\KMCQ.exe MORVEA.exe File created C:\windows\SysWOW64\OOTX.exe.bat UAO.exe File created C:\windows\SysWOW64\WPVVA.exe.bat MPTI.exe File created C:\windows\SysWOW64\WSZR.exe.bat WPVVA.exe File created C:\windows\SysWOW64\VWK.exe UTGFWWM.exe File created C:\windows\SysWOW64\RXBT.exe.bat NHNLHFU.exe File opened for modification C:\windows\SysWOW64\AZWGMS.exe HWSL.exe File opened for modification C:\windows\SysWOW64\MORVEA.exe NDGFWMR.exe File opened for modification C:\windows\SysWOW64\KMCQ.exe MORVEA.exe File opened for modification C:\windows\SysWOW64\ZCAOB.exe KHQ.exe File created C:\windows\SysWOW64\HXWEAQ.exe FZQJ.exe File opened for modification C:\windows\SysWOW64\KLZZGII.exe RIWVB.exe File created C:\windows\SysWOW64\QNW.exe WARWBW.exe File opened for modification C:\windows\SysWOW64\QNW.exe WARWBW.exe File created C:\windows\SysWOW64\ZCAOB.exe.bat KHQ.exe File opened for modification C:\windows\SysWOW64\KGS.exe LIPECA.exe File created C:\windows\SysWOW64\TDNIWJ.exe.bat LXVTU.exe File created C:\windows\SysWOW64\JSQQ.exe QOMMW.exe File created C:\windows\SysWOW64\YOL.exe JTUDH.exe File created C:\windows\SysWOW64\MORVEA.exe.bat NDGFWMR.exe File created C:\windows\SysWOW64\OCPHPQT.exe UPKYF.exe File opened for modification C:\windows\SysWOW64\OCPHPQT.exe UPKYF.exe File opened for modification C:\windows\SysWOW64\CVF.exe RCCTMWH.exe File opened for modification C:\windows\SysWOW64\TDNIWJ.exe LXVTU.exe File opened for modification C:\windows\SysWOW64\JSQQ.exe QOMMW.exe File created C:\windows\SysWOW64\JVTMOX.exe.bat JSQQ.exe File opened for modification C:\windows\SysWOW64\EYLFV.exe PDTTKXM.exe File created C:\windows\SysWOW64\WARWBW.exe.bat BNNM.exe File created C:\windows\SysWOW64\EBLZLX.exe RGYZS.exe File opened for modification C:\windows\SysWOW64\TQIWLXI.exe TDIIKS.exe File created C:\windows\SysWOW64\ZLVE.exe XYQVUEJ.exe File opened for modification C:\windows\SysWOW64\ZLVE.exe XYQVUEJ.exe File created C:\windows\SysWOW64\PEOY.exe.bat URJPMYF.exe File created C:\windows\SysWOW64\EKMVD.exe.bat PEOY.exe File created C:\windows\SysWOW64\WPVVA.exe MPTI.exe File created C:\windows\SysWOW64\WSZR.exe WPVVA.exe File created C:\windows\SysWOW64\HXWEAQ.exe.bat FZQJ.exe File opened for modification C:\windows\SysWOW64\RIWVB.exe WVR.exe File opened for modification C:\windows\SysWOW64\SAR.exe XNMNGGJ.exe File created C:\windows\SysWOW64\KMCQ.exe.bat MORVEA.exe File created C:\windows\SysWOW64\WARWBW.exe BNNM.exe File opened for modification C:\windows\SysWOW64\HMQNCI.exe MQLE.exe File opened for modification C:\windows\SysWOW64\WSZR.exe WPVVA.exe File created C:\windows\SysWOW64\RIWVB.exe WVR.exe File created C:\windows\SysWOW64\KLZZGII.exe RIWVB.exe File created C:\windows\SysWOW64\EYLFV.exe.bat PDTTKXM.exe File created C:\windows\SysWOW64\PEOY.exe URJPMYF.exe File opened for modification C:\windows\SysWOW64\OOTX.exe UAO.exe File opened for modification C:\windows\SysWOW64\TENXE.exe 2026-10-06_9442b12c814e6607ac4f41140c4d6108_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\NHNLHFU.exe EHLF.exe File created C:\windows\SysWOW64\ZCAOB.exe KHQ.exe File opened for modification C:\windows\SysWOW64\AZMIKOL.exe WRGI.exe File created C:\windows\SysWOW64\SSFOYN.exe RXBT.exe File created C:\windows\SysWOW64\KJKDGH.exe ZRPLYAZ.exe File created C:\windows\SysWOW64\MORVEA.exe NDGFWMR.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\JNCO.exe.bat SAR.exe File created C:\windows\system\OQS.exe.bat TDNIWJ.exe File created C:\windows\TSMJ.exe.bat KJKDGH.exe File created C:\windows\system\EMRBL.exe AEKBHIT.exe File opened for modification C:\windows\ZQJ.exe PSVF.exe File created C:\windows\XNMNGGJ.exe.bat EKJ.exe File opened for modification C:\windows\system\PDTTKXM.exe PQBMIK.exe File created C:\windows\system\XYQVUEJ.exe.bat CLLLK.exe File created C:\windows\system\NCERUTO.exe.bat SOZIK.exe File created C:\windows\system\AGN.exe XLIVWO.exe File created C:\windows\DTSQTYI.exe DNSCST.exe File created C:\windows\system\XPDKCG.exe.bat LZXC.exe File created C:\windows\system\JTUDH.exe.bat JNCO.exe File opened for modification C:\windows\system\AQQNRVA.exe LVGI.exe File created C:\windows\ZPI.exe.bat EBLZLX.exe File created C:\windows\system\SZGDB.exe.bat FXXMNGN.exe File created C:\windows\DTSQTYI.exe.bat DNSCST.exe File created C:\windows\system\NJHEXS.exe.bat GOX.exe File created C:\windows\system\AQQNRVA.exe.bat LVGI.exe File created C:\windows\system\LIPECA.exe CVF.exe File created C:\windows\RGYZS.exe.bat OQS.exe File created C:\windows\PSVF.exe.bat UFQWLMW.exe File created C:\windows\CLLLK.exe.bat TCJG.exe File created C:\windows\MQLE.exe SDGVHJH.exe File created C:\windows\system\QWQGV.exe.bat BBHTKKT.exe File created C:\windows\system\VMBYOSU.exe AZWGMS.exe File created C:\windows\system\EMRBL.exe.bat AEKBHIT.exe File created C:\windows\UFQWLMW.exe FKHJ.exe File opened for modification C:\windows\system\PSB.exe EKMVD.exe File created C:\windows\XNMNGGJ.exe EKJ.exe File created C:\windows\UEY.exe.bat KGS.exe File created C:\windows\system\BOCUJSB.exe.bat ZQJ.exe File opened for modification C:\windows\system\ZJPK.exe TQIWLXI.exe File opened for modification C:\windows\KFXF.exe PSB.exe File opened for modification C:\windows\WDFU.exe AGN.exe File opened for modification C:\windows\DTSQTYI.exe DNSCST.exe File created C:\windows\system\NJHEXS.exe GOX.exe File opened for modification C:\windows\ZPI.exe EBLZLX.exe File opened for modification C:\windows\FJXXLT.exe ZJPK.exe File opened for modification C:\windows\TSMJ.exe KJKDGH.exe File opened for modification C:\windows\ELWBF.exe JYS.exe File created C:\windows\KFXF.exe.bat PSB.exe File opened for modification C:\windows\system\VMBYOSU.exe AZWGMS.exe File opened for modification C:\windows\BMGC.exe PEZUNI.exe File created C:\windows\system\ZJPK.exe.bat TQIWLXI.exe File created C:\windows\system\FQFR.exe.bat TENXE.exe File created C:\windows\JNCO.exe SAR.exe File created C:\windows\KFXF.exe PSB.exe File opened for modification C:\windows\MQLE.exe SDGVHJH.exe File opened for modification C:\windows\XNMNGGJ.exe EKJ.exe File created C:\windows\AEKBHIT.exe.bat IAHXTS.exe File created C:\windows\system\BOCUJSB.exe ZQJ.exe File created C:\windows\system\FXXMNGN.exe FJXXLT.exe File created C:\windows\RHW.exe.bat NCERUTO.exe File created C:\windows\system\ZKDCHB.exe.bat KFXF.exe File created C:\windows\SDI.exe XPDKCG.exe File created C:\windows\system\PEZUNI.exe.bat ELWBF.exe File opened for modification C:\windows\system\FKHJ.exe ZPI.exe File created C:\windows\system\ZOKH.exe.bat BOCUJSB.exe File opened for modification C:\windows\system\ZKDCHB.exe KFXF.exe File opened for modification C:\windows\system\NJHEXS.exe GOX.exe File created C:\windows\system\OIV.exe UNQEXC.exe File opened for modification C:\windows\system\UDWVY.exe OCPHPQT.exe File opened for modification C:\windows\system\EMRBL.exe AEKBHIT.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5980 cmd.exe 2116 cmd.exe 4176 cmd.exe 2968 cmd.exe 3264 cmd.exe 2516 cmd.exe 2500 cmd.exe 5580 cmd.exe 1376 cmd.exe 1812 cmd.exe 5708 cmd.exe 5348 cmd.exe 780 cmd.exe 1016 cmd.exe 5700 cmd.exe 4592 cmd.exe 1660 cmd.exe 3468 cmd.exe 1348 cmd.exe 2360 cmd.exe 3248 cmd.exe 3288 cmd.exe 5712 cmd.exe 4672 cmd.exe 4892 cmd.exe 2488 cmd.exe 5248 cmd.exe 4620 cmd.exe 1840 cmd.exe 1496 cmd.exe 3940 cmd.exe 3092 cmd.exe 1516 cmd.exe 4320 cmd.exe 5500 cmd.exe 5272 cmd.exe 6064 cmd.exe 4060 cmd.exe 2056 cmd.exe 5360 cmd.exe 5116 cmd.exe 3540 cmd.exe 1256 cmd.exe 3096 cmd.exe 1868 cmd.exe 5396 cmd.exe 6012 cmd.exe 4076 cmd.exe 1420 cmd.exe 236 cmd.exe 4924 cmd.exe 1548 cmd.exe 5128 cmd.exe 2620 cmd.exe 4464 cmd.exe 4604 cmd.exe 1668 cmd.exe 5716 cmd.exe 3888 cmd.exe 1032 cmd.exe 5200 cmd.exe 4756 cmd.exe 2840 cmd.exe 4444 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1596 2616 WerFault.exe 87 3248 1808 WerFault.exe 93 2500 4676 WerFault.exe 99 2888 3684 WerFault.exe 104 4524 5288 WerFault.exe 109 5660 5724 WerFault.exe 113 3888 4500 WerFault.exe 119 3448 2176 WerFault.exe 124 4936 4948 WerFault.exe 129 2448 4520 WerFault.exe 134 2056 1984 WerFault.exe 139 1360 2156 WerFault.exe 144 972 4652 WerFault.exe 149 4764 4116 WerFault.exe 154 5004 260 WerFault.exe 159 2444 5416 WerFault.exe 164 5664 4080 WerFault.exe 169 1084 3644 WerFault.exe 174 3204 1736 WerFault.exe 179 2596 3792 WerFault.exe 184 3284 5088 WerFault.exe 189 3128 4624 WerFault.exe 194 3024 4072 WerFault.exe 199 3344 1452 WerFault.exe 204 3296 5132 WerFault.exe 209 3088 240 WerFault.exe 214 4660 3420 WerFault.exe 219 2040 1300 WerFault.exe 224 4180 4260 WerFault.exe 229 2240 2976 WerFault.exe 234 4968 6040 WerFault.exe 239 5028 3488 WerFault.exe 244 5624 5032 WerFault.exe 249 5500 4132 WerFault.exe 254 5720 4400 WerFault.exe 259 3124 3228 WerFault.exe 264 1596 3356 WerFault.exe 269 1260 5860 WerFault.exe 274 3588 3820 WerFault.exe 279 5704 5964 WerFault.exe 284 5892 4272 WerFault.exe 289 2900 4864 WerFault.exe 294 5052 3004 WerFault.exe 299 2056 4868 WerFault.exe 304 1612 2084 WerFault.exe 309 3412 2708 WerFault.exe 314 2892 1600 WerFault.exe 319 708 1844 WerFault.exe 324 3588 4720 WerFault.exe 329 2292 2376 WerFault.exe 334 5680 5476 WerFault.exe 339 5276 1912 WerFault.exe 344 6100 968 WerFault.exe 349 6088 5652 WerFault.exe 354 5272 2480 WerFault.exe 359 3188 244 WerFault.exe 364 5484 5692 WerFault.exe 369 4424 2524 WerFault.exe 374 2876 3924 WerFault.exe 379 2276 2252 WerFault.exe 384 4212 5852 WerFault.exe 389 4768 3300 WerFault.exe 394 4600 2780 WerFault.exe 399 4828 2144 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QNW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVTMOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MQLE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYLFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSCFT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLZZGII.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SREFRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXVTU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDWVY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZCAOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZJPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDGVHJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSNI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSFOYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNMNGGJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DTSQTYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QWQGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TENXE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VMBYOSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYQVUEJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WVR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDTTKXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHGTIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2616 2026-10-06_9442b12c814e6607ac4f41140c4d6108_elex_emotet_stop.exe 2616 2026-10-06_9442b12c814e6607ac4f41140c4d6108_elex_emotet_stop.exe 1808 TENXE.exe 1808 TENXE.exe 4676 FQFR.exe 4676 FQFR.exe 3684 XLIVWO.exe 3684 XLIVWO.exe 5288 AGN.exe 5288 AGN.exe 5724 WDFU.exe 5724 WDFU.exe 4500 WRGI.exe 4500 WRGI.exe 2176 AZMIKOL.exe 2176 AZMIKOL.exe 4948 MPTI.exe 4948 MPTI.exe 4520 WPVVA.exe 4520 WPVVA.exe 1984 WSZR.exe 1984 WSZR.exe 2156 UTGFWWM.exe 2156 UTGFWWM.exe 4652 VWK.exe 4652 VWK.exe 4116 PJPSM.exe 4116 PJPSM.exe 260 FZQJ.exe 260 FZQJ.exe 5416 HXWEAQ.exe 5416 HXWEAQ.exe 4080 WSNI.exe 4080 WSNI.exe 3644 WVR.exe 3644 WVR.exe 1736 RIWVB.exe 1736 RIWVB.exe 3792 KLZZGII.exe 3792 KLZZGII.exe 5088 SREFRP.exe 5088 SREFRP.exe 4624 EHLF.exe 4624 EHLF.exe 4072 NHNLHFU.exe 4072 NHNLHFU.exe 1452 RXBT.exe 1452 RXBT.exe 5132 SSFOYN.exe 5132 SSFOYN.exe 240 BBHTKKT.exe 240 BBHTKKT.exe 3420 QWQGV.exe 3420 QWQGV.exe 1300 HWSL.exe 1300 HWSL.exe 4260 AZWGMS.exe 4260 AZWGMS.exe 2976 VMBYOSU.exe 2976 VMBYOSU.exe 6040 KPLCH.exe 6040 KPLCH.exe 3488 EDPMJFR.exe 3488 EDPMJFR.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2616 2026-10-06_9442b12c814e6607ac4f41140c4d6108_elex_emotet_stop.exe 2616 2026-10-06_9442b12c814e6607ac4f41140c4d6108_elex_emotet_stop.exe 1808 TENXE.exe 1808 TENXE.exe 4676 FQFR.exe 4676 FQFR.exe 3684 XLIVWO.exe 3684 XLIVWO.exe 5288 AGN.exe 5288 AGN.exe 5724 WDFU.exe 5724 WDFU.exe 4500 WRGI.exe 4500 WRGI.exe 2176 AZMIKOL.exe 2176 AZMIKOL.exe 4948 MPTI.exe 4948 MPTI.exe 4520 WPVVA.exe 4520 WPVVA.exe 1984 WSZR.exe 1984 WSZR.exe 2156 UTGFWWM.exe 2156 UTGFWWM.exe 4652 VWK.exe 4652 VWK.exe 4116 PJPSM.exe 4116 PJPSM.exe 260 FZQJ.exe 260 FZQJ.exe 5416 HXWEAQ.exe 5416 HXWEAQ.exe 4080 WSNI.exe 4080 WSNI.exe 3644 WVR.exe 3644 WVR.exe 1736 RIWVB.exe 1736 RIWVB.exe 3792 KLZZGII.exe 3792 KLZZGII.exe 5088 SREFRP.exe 5088 SREFRP.exe 4624 EHLF.exe 4624 EHLF.exe 4072 NHNLHFU.exe 4072 NHNLHFU.exe 1452 RXBT.exe 1452 RXBT.exe 5132 SSFOYN.exe 5132 SSFOYN.exe 240 BBHTKKT.exe 240 BBHTKKT.exe 3420 QWQGV.exe 3420 QWQGV.exe 1300 HWSL.exe 1300 HWSL.exe 4260 AZWGMS.exe 4260 AZWGMS.exe 2976 VMBYOSU.exe 2976 VMBYOSU.exe 6040 KPLCH.exe 6040 KPLCH.exe 3488 EDPMJFR.exe 3488 EDPMJFR.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2616 wrote to memory of 1516 2616 2026-10-06_9442b12c814e6607ac4f41140c4d6108_elex_emotet_stop.exe 89 PID 1516 wrote to memory of 1808 1516 cmd.exe 93 PID 1808 wrote to memory of 4316 1808 TENXE.exe 95 PID 4316 wrote to memory of 4676 4316 cmd.exe 99 PID 4676 wrote to memory of 236 4676 FQFR.exe 100 PID 236 wrote to memory of 3684 236 cmd.exe 104 PID 3684 wrote to memory of 3212 3684 XLIVWO.exe 105 PID 3212 wrote to memory of 5288 3212 cmd.exe 109 PID 5288 wrote to memory of 5708 5288 AGN.exe 110 PID 5708 wrote to memory of 5724 5708 cmd.exe 113 PID 5724 wrote to memory of 4436 5724 WDFU.exe 115 PID 4436 wrote to memory of 4500 4436 cmd.exe 119 PID 4500 wrote to memory of 5732 4500 WRGI.exe 120 PID 5732 wrote to memory of 2176 5732 cmd.exe 124 PID 2176 wrote to memory of 1520 2176 AZMIKOL.exe 125 PID 1520 wrote to memory of 4948 1520 cmd.exe 129 PID 4948 wrote to memory of 4476 4948 MPTI.exe 130 PID 4476 wrote to memory of 4520 4476 cmd.exe 134 PID 4520 wrote to memory of 1148 4520 WPVVA.exe 135 PID 1148 wrote to memory of 1984 1148 cmd.exe 139 PID 1984 wrote to memory of 2224 1984 WSZR.exe 140 PID 2224 wrote to memory of 2156 2224 cmd.exe 144 PID 2156 wrote to memory of 2836 2156 UTGFWWM.exe 145 PID 2836 wrote to memory of 4652 2836 cmd.exe 149 PID 4652 wrote to memory of 2220 4652 VWK.exe 150 PID 2220 wrote to memory of 4116 2220 cmd.exe 154 PID 4116 wrote to memory of 3632 4116 PJPSM.exe 155 PID 3632 wrote to memory of 260 3632 cmd.exe 159 PID 260 wrote to memory of 3812 260 FZQJ.exe 160 PID 3812 wrote to memory of 5416 3812 cmd.exe 164 PID 5416 wrote to memory of 6080 5416 HXWEAQ.exe 165 PID 6080 wrote to memory of 4080 6080 cmd.exe 169 PID 4080 wrote to memory of 2796 4080 WSNI.exe 170 PID 2796 wrote to memory of 3644 2796 cmd.exe 174 PID 3644 wrote to memory of 4112 3644 WVR.exe 175 PID 4112 wrote to memory of 1736 4112 cmd.exe 179 PID 1736 wrote to memory of 1668 1736 RIWVB.exe 180 PID 1668 wrote to memory of 3792 1668 cmd.exe 184 PID 3792 wrote to memory of 2116 3792 KLZZGII.exe 185 PID 2116 wrote to memory of 5088 2116 cmd.exe 189 PID 5088 wrote to memory of 2764 5088 SREFRP.exe 190 PID 2764 wrote to memory of 4624 2764 cmd.exe 194 PID 4624 wrote to memory of 5756 4624 EHLF.exe 195 PID 5756 wrote to memory of 4072 5756 cmd.exe 199 PID 4072 wrote to memory of 5716 4072 NHNLHFU.exe 200 PID 5716 wrote to memory of 1452 5716 cmd.exe 204 PID 1452 wrote to memory of 2288 1452 RXBT.exe 205 PID 2288 wrote to memory of 5132 2288 cmd.exe 209 PID 5132 wrote to memory of 1660 5132 SSFOYN.exe 210 PID 1660 wrote to memory of 240 1660 cmd.exe 214 PID 240 wrote to memory of 1812 240 BBHTKKT.exe 215 PID 1812 wrote to memory of 3420 1812 cmd.exe 219 PID 3420 wrote to memory of 4604 3420 QWQGV.exe 220 PID 4604 wrote to memory of 1300 4604 cmd.exe 224 PID 1300 wrote to memory of 5980 1300 HWSL.exe 225 PID 5980 wrote to memory of 4260 5980 cmd.exe 229 PID 4260 wrote to memory of 5396 4260 AZWGMS.exe 230 PID 5396 wrote to memory of 2976 5396 cmd.exe 234 PID 2976 wrote to memory of 3888 2976 VMBYOSU.exe 235 PID 3888 wrote to memory of 6040 3888 cmd.exe 239 PID 6040 wrote to memory of 2840 6040 KPLCH.exe 240 PID 2840 wrote to memory of 3488 2840 cmd.exe 244 PID 3488 wrote to memory of 3400 3488 EDPMJFR.exe 245 PID 3400 wrote to memory of 5032 3400 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-06_9442b12c814e6607ac4f41140c4d6108_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-06_9442b12c814e6607ac4f41140c4d6108_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TENXE.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\windows\SysWOW64\TENXE.exeC:\windows\system32\TENXE.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQFR.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\windows\system\FQFR.exeC:\windows\system\FQFR.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XLIVWO.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:236 -
C:\windows\XLIVWO.exeC:\windows\XLIVWO.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AGN.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\windows\system\AGN.exeC:\windows\system\AGN.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDFU.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\windows\WDFU.exeC:\windows\WDFU.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WRGI.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\windows\WRGI.exeC:\windows\WRGI.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZMIKOL.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\windows\SysWOW64\AZMIKOL.exeC:\windows\system32\AZMIKOL.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MPTI.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\windows\system\MPTI.exeC:\windows\system\MPTI.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WPVVA.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\windows\SysWOW64\WPVVA.exeC:\windows\system32\WPVVA.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSZR.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\windows\SysWOW64\WSZR.exeC:\windows\system32\WSZR.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UTGFWWM.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\windows\UTGFWWM.exeC:\windows\UTGFWWM.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWK.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\windows\SysWOW64\VWK.exeC:\windows\system32\VWK.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJPSM.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\windows\system\PJPSM.exeC:\windows\system\PJPSM.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZQJ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\windows\FZQJ.exeC:\windows\FZQJ.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXWEAQ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\windows\SysWOW64\HXWEAQ.exeC:\windows\system32\HXWEAQ.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSNI.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\windows\system\WSNI.exeC:\windows\system\WSNI.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WVR.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\windows\system\WVR.exeC:\windows\system\WVR.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIWVB.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\windows\SysWOW64\RIWVB.exeC:\windows\system32\RIWVB.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLZZGII.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\windows\SysWOW64\KLZZGII.exeC:\windows\system32\KLZZGII.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SREFRP.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\windows\SREFRP.exeC:\windows\SREFRP.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHLF.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\windows\EHLF.exeC:\windows\EHLF.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NHNLHFU.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\windows\SysWOW64\NHNLHFU.exeC:\windows\system32\NHNLHFU.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RXBT.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\windows\SysWOW64\RXBT.exeC:\windows\system32\RXBT.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSFOYN.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\windows\SysWOW64\SSFOYN.exeC:\windows\system32\SSFOYN.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBHTKKT.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\windows\system\BBHTKKT.exeC:\windows\system\BBHTKKT.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWQGV.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\windows\system\QWQGV.exeC:\windows\system\QWQGV.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWSL.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\windows\system\HWSL.exeC:\windows\system\HWSL.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZWGMS.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\windows\SysWOW64\AZWGMS.exeC:\windows\system32\AZWGMS.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMBYOSU.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\windows\system\VMBYOSU.exeC:\windows\system\VMBYOSU.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPLCH.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\windows\KPLCH.exeC:\windows\KPLCH.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDPMJFR.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\windows\EDPMJFR.exeC:\windows\EDPMJFR.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNSCST.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\windows\DNSCST.exeC:\windows\DNSCST.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DTSQTYI.exe.bat" "66⤵PID:4496
-
C:\windows\DTSQTYI.exeC:\windows\DTSQTYI.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GOX.exe.bat" "68⤵PID:5044
-
C:\windows\system\GOX.exeC:\windows\system\GOX.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NJHEXS.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3468 -
C:\windows\system\NJHEXS.exeC:\windows\system\NJHEXS.exe71⤵
- Executes dropped EXE
PID:3228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EKJ.exe.bat" "72⤵PID:2392
-
C:\windows\EKJ.exeC:\windows\EKJ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XNMNGGJ.exe.bat" "74⤵
- Executes a command shell one-liner
PID:1348 -
C:\windows\XNMNGGJ.exeC:\windows\XNMNGGJ.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SAR.exe.bat" "76⤵
- Executes a command shell one-liner
PID:1032 -
C:\windows\SysWOW64\SAR.exeC:\windows\system32\SAR.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JNCO.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4892 -
C:\windows\JNCO.exeC:\windows\JNCO.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JTUDH.exe.bat" "80⤵
- Executes a command shell one-liner
PID:2360 -
C:\windows\system\JTUDH.exeC:\windows\system\JTUDH.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YOL.exe.bat" "82⤵PID:2788
-
C:\windows\SysWOW64\YOL.exeC:\windows\system32\YOL.exe83⤵
- Executes dropped EXE
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRPLYAZ.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4044 -
C:\windows\system\ZRPLYAZ.exeC:\windows\system\ZRPLYAZ.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJKDGH.exe.bat" "86⤵PID:5884
-
C:\windows\SysWOW64\KJKDGH.exeC:\windows\system32\KJKDGH.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSMJ.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4464 -
C:\windows\TSMJ.exeC:\windows\TSMJ.exe89⤵
- Executes dropped EXE
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNQEXC.exe.bat" "90⤵PID:4952
-
C:\windows\system\UNQEXC.exeC:\windows\system\UNQEXC.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OIV.exe.bat" "92⤵PID:468
-
C:\windows\system\OIV.exeC:\windows\system\OIV.exe93⤵
- Executes dropped EXE
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDMASP.exe.bat" "94⤵
- Executes a command shell one-liner
PID:5360 -
C:\windows\EDMASP.exeC:\windows\EDMASP.exe95⤵
- Executes dropped EXE
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDGFWMR.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4560 -
C:\windows\NDGFWMR.exeC:\windows\NDGFWMR.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MORVEA.exe.bat" "98⤵PID:1464
-
C:\windows\SysWOW64\MORVEA.exeC:\windows\system32\MORVEA.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMCQ.exe.bat" "100⤵PID:5376
-
C:\windows\SysWOW64\KMCQ.exeC:\windows\system32\KMCQ.exe101⤵
- Executes dropped EXE
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KSCFT.exe.bat" "102⤵PID:4220
-
C:\windows\system\KSCFT.exeC:\windows\system\KSCFT.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVGI.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:1080 -
C:\windows\system\LVGI.exeC:\windows\system\LVGI.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQQNRVA.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:1712 -
C:\windows\system\AQQNRVA.exeC:\windows\system\AQQNRVA.exe107⤵
- Executes dropped EXE
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JYS.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4820 -
C:\windows\SysWOW64\JYS.exeC:\windows\system32\JYS.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ELWBF.exe.bat" "110⤵
- Executes a command shell one-liner
PID:1376 -
C:\windows\ELWBF.exeC:\windows\ELWBF.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEZUNI.exe.bat" "112⤵PID:4588
-
C:\windows\system\PEZUNI.exeC:\windows\system\PEZUNI.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMGC.exe.bat" "114⤵PID:908
-
C:\windows\BMGC.exeC:\windows\BMGC.exe115⤵
- Executes dropped EXE
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPKYF.exe.bat" "116⤵PID:2268
-
C:\windows\UPKYF.exeC:\windows\UPKYF.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OCPHPQT.exe.bat" "118⤵PID:3588
-
C:\windows\SysWOW64\OCPHPQT.exeC:\windows\system32\OCPHPQT.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDWVY.exe.bat" "120⤵PID:1308
-
C:\windows\system\UDWVY.exeC:\windows\system\UDWVY.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-