Analysis
- max time kernel
86s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/10/2026, 14:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-19_88eeca5bbf0046ea91311ea4b977487c_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-19_88eeca5bbf0046ea91311ea4b977487c_elex_emotet_stop.exe
- Size 208KB
- Sample261020-rfpqlabh29
- SHA256 7274d5fa0a01a2ff8ad673c298dc35a87c972dae7f48687b39a15cc937f0d0fa
- MD5 88eeca5bbf0046ea91311ea4b977487c
- SHA1 2d0bb33da41876e0d97d0d2a9b1f4c680a5622bb
- SHA512 3f977477e33e4622eb235f9d10dbcd2cb7224562d69cf66f3d8a1e8d9796ada47891f15c951bbb9c27a67b3280d2d522e15e380c455354da0555ab96839ec7b4
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfE4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOskEj1
- TLSH T18D247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1752 KZWU.exe 4628 USFUNR.exe 5160 JNPG.exe 1712 EAUPJE.exe 3972 ZNZ.exe 2580 KGUS.exe 3744 BOWXX.exe 1668 WBAGHQA.exe 3764 QPFQ.exe 1060 GSPCCDY.exe 5464 GXPIMQS.exe 2356 ALUA.exe 1912 PGDEHCQ.exe 1384 VBCFE.exe 1460 OEGJRVH.exe 2472 TKYYHYB.exe 1704 LFCU.exe 5536 MIG.exe 3476 QYNXEW.exe 264 WLMYJA.exe 1952 JWUXXC.exe 484 NEJX.exe 1188 IZOOMU.exe 4544 ZZITPSY.exe 3928 YKSJYG.exe 1624 NNCO.exe 2984 IAHXTS.exe 1456 AEKBHIT.exe 1648 SEMGKO.exe 3780 MRRPUOK.exe 2784 BMB.exe 3428 NFEMO.exe 2688 HAJWQI.exe 5064 CNF.exe 5592 CTGU.exe 1656 WGKDMU.exe 3692 IWRLY.exe 2364 BZVHECS.exe 4284 SFFZT.exe 4348 SSFNV.exe 5940 NFKXFMY.exe 3396 CAUJQ.exe 4080 CGUYAL.exe 2384 DJY.exe 4964 MWILV.exe 1944 OKNVXYN.exe 1616 OPF.exe 6096 UQN.exe 4632 PDSGAFY.exe 120 AVVZAU.exe 2552 LOYSJCD.exe 3132 IUVP.exe 4028 CHAYAL.exe 1272 IHI.exe 1032 UALFRNC.exe 2388 OVQO.exe 4764 XVSTFSB.exe 5004 SJWD.exe 2668 JWHVF.exe 4400 LUAXDD.exe 4316 LEJQRQ.exe 1092 CNLDVND.exe 4856 RSIT.exe 4160 CLLLK.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\XVSPG.exe.bat RZTO.exe File created C:\windows\SysWOW64\KZWU.exe 2026-10-19_88eeca5bbf0046ea91311ea4b977487c_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\ZNZ.exe EAUPJE.exe File created C:\windows\SysWOW64\NEJX.exe.bat JWUXXC.exe File opened for modification C:\windows\SysWOW64\SEMGKO.exe AEKBHIT.exe File created C:\windows\SysWOW64\SJWD.exe XVSTFSB.exe File opened for modification C:\windows\SysWOW64\SJWD.exe XVSTFSB.exe File created C:\windows\SysWOW64\RSIT.exe CNLDVND.exe File created C:\windows\SysWOW64\PPPSCC.exe.bat SRRC.exe File created C:\windows\SysWOW64\JWUXXC.exe.bat WLMYJA.exe File created C:\windows\SysWOW64\KZWU.exe.bat 2026-10-19_88eeca5bbf0046ea91311ea4b977487c_elex_emotet_stop.exe File created C:\windows\SysWOW64\OEGJRVH.exe VBCFE.exe File opened for modification C:\windows\SysWOW64\RSIT.exe CNLDVND.exe File opened for modification C:\windows\SysWOW64\QNLJNMJ.exe OAGAC.exe File created C:\windows\SysWOW64\LHD.exe UUSZOVO.exe File created C:\windows\SysWOW64\GDMLV.exe.bat XCKGSP.exe File opened for modification C:\windows\SysWOW64\RZTO.exe TZLASLX.exe File opened for modification C:\windows\SysWOW64\WBAGHQA.exe BOWXX.exe File opened for modification C:\windows\SysWOW64\TKYYHYB.exe OEGJRVH.exe File created C:\windows\SysWOW64\MIG.exe LFCU.exe File opened for modification C:\windows\SysWOW64\NEJX.exe JWUXXC.exe File opened for modification C:\windows\SysWOW64\MRRPUOK.exe SEMGKO.exe File created C:\windows\SysWOW64\PDSGAFY.exe UQN.exe File created C:\windows\SysWOW64\MVTQN.exe.bat XAJMCCW.exe File opened for modification C:\windows\SysWOW64\AJWKU.exe KTNLNNH.exe File created C:\windows\SysWOW64\OEGJRVH.exe.bat VBCFE.exe File created C:\windows\SysWOW64\NEJX.exe JWUXXC.exe File opened for modification C:\windows\SysWOW64\BMB.exe MRRPUOK.exe File created C:\windows\SysWOW64\LOYSJCD.exe AVVZAU.exe File created C:\windows\SysWOW64\AHOJN.exe.bat LJJ.exe File created C:\windows\SysWOW64\RZTO.exe TZLASLX.exe File created C:\windows\SysWOW64\RZTO.exe.bat TZLASLX.exe File created C:\windows\SysWOW64\IZOOMU.exe.bat NEJX.exe File opened for modification C:\windows\SysWOW64\NNCO.exe YKSJYG.exe File created C:\windows\SysWOW64\SEMGKO.exe.bat AEKBHIT.exe File created C:\windows\SysWOW64\WGKDMU.exe CTGU.exe File created C:\windows\SysWOW64\RSIT.exe.bat CNLDVND.exe File created C:\windows\SysWOW64\MVTQN.exe XAJMCCW.exe File created C:\windows\SysWOW64\GDMLV.exe XCKGSP.exe File opened for modification C:\windows\SysWOW64\GDMLV.exe XCKGSP.exe File created C:\windows\SysWOW64\WBAGHQA.exe.bat BOWXX.exe File opened for modification C:\windows\SysWOW64\OEGJRVH.exe VBCFE.exe File created C:\windows\SysWOW64\BMB.exe MRRPUOK.exe File opened for modification C:\windows\SysWOW64\XVSPG.exe RZTO.exe File created C:\windows\SysWOW64\AJWKU.exe KTNLNNH.exe File created C:\windows\SysWOW64\SRRC.exe.bat OBKUJIK.exe File created C:\windows\SysWOW64\QPFQ.exe WBAGHQA.exe File created C:\windows\SysWOW64\ZZITPSY.exe IZOOMU.exe File created C:\windows\SysWOW64\NNCO.exe.bat YKSJYG.exe File created C:\windows\SysWOW64\WGKDMU.exe.bat CTGU.exe File created C:\windows\SysWOW64\XAJMCCW.exe NCERUTO.exe File opened for modification C:\windows\SysWOW64\GQAHL.exe MDV.exe File created C:\windows\SysWOW64\QPFQ.exe.bat WBAGHQA.exe File opened for modification C:\windows\SysWOW64\GSPCCDY.exe QPFQ.exe File created C:\windows\SysWOW64\MRRPUOK.exe.bat SEMGKO.exe File created C:\windows\SysWOW64\HAJWQI.exe.bat NFEMO.exe File opened for modification C:\windows\SysWOW64\PDSGAFY.exe UQN.exe File created C:\windows\SysWOW64\AHOJN.exe LJJ.exe File created C:\windows\SysWOW64\GQAHL.exe MDV.exe File created C:\windows\SysWOW64\AJWKU.exe.bat KTNLNNH.exe File created C:\windows\SysWOW64\ZNZ.exe EAUPJE.exe File created C:\windows\SysWOW64\ZNZ.exe.bat EAUPJE.exe File created C:\windows\SysWOW64\GSPCCDY.exe.bat QPFQ.exe File created C:\windows\SysWOW64\TKYYHYB.exe.bat OEGJRVH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\UUSZOVO.exe UOALNIL.exe File created C:\windows\KTNLNNH.exe.bat VYDG.exe File opened for modification C:\windows\SFFZT.exe BZVHECS.exe File created C:\windows\system\JWHVF.exe.bat SJWD.exe File opened for modification C:\windows\OTSTWWI.exe CLLLK.exe File opened for modification C:\windows\system\OAGAC.exe XPDKCG.exe File created C:\windows\TAALSHV.exe RCZR.exe File opened for modification C:\windows\UQN.exe OPF.exe File opened for modification C:\windows\system\GXPIMQS.exe GSPCCDY.exe File opened for modification C:\windows\CLLLK.exe RSIT.exe File opened for modification C:\windows\XBUY.exe OTSTWWI.exe File created C:\windows\system\OBKUJIK.exe ZLB.exe File created C:\windows\system\VBCFE.exe.bat PGDEHCQ.exe File created C:\windows\system\SSFNV.exe SFFZT.exe File created C:\windows\KQSRR.exe MVTQN.exe File created C:\windows\KTNLNNH.exe VYDG.exe File opened for modification C:\windows\TAALSHV.exe RCZR.exe File opened for modification C:\windows\system\WLMYJA.exe QYNXEW.exe File opened for modification C:\windows\system\IAHXTS.exe NNCO.exe File created C:\windows\system\OPF.exe.bat OKNVXYN.exe File created C:\windows\system\CHAYAL.exe IUVP.exe File opened for modification C:\windows\system\MDV.exe DCTSXH.exe File created C:\windows\system\MDV.exe.bat DCTSXH.exe File created C:\windows\system\AVVZAU.exe PDSGAFY.exe File created C:\windows\system\IHI.exe.bat CHAYAL.exe File created C:\windows\RPU.exe JKU.exe File opened for modification C:\windows\CGUYAL.exe CAUJQ.exe File created C:\windows\system\OKNVXYN.exe MWILV.exe File opened for modification C:\windows\LEJQRQ.exe LUAXDD.exe File opened for modification C:\windows\system\XPDKCG.exe EXART.exe File opened for modification C:\windows\QYNXEW.exe MIG.exe File opened for modification C:\windows\system\YKSJYG.exe ZZITPSY.exe File created C:\windows\JNPG.exe.bat USFUNR.exe File created C:\windows\OVQO.exe UALFRNC.exe File created C:\windows\system\JWHVF.exe SJWD.exe File opened for modification C:\windows\DJY.exe CGUYAL.exe File created C:\windows\system\MWILV.exe DJY.exe File created C:\windows\SOZIK.exe XBUY.exe File created C:\windows\XIUOG.exe QNLJNMJ.exe File created C:\windows\TZLASLX.exe.bat NZEN.exe File created C:\windows\SFFZT.exe.bat BZVHECS.exe File opened for modification C:\windows\system\OBKUJIK.exe ZLB.exe File opened for modification C:\windows\SDGVHJH.exe MDZHY.exe File created C:\windows\system\UUSZOVO.exe UOALNIL.exe File created C:\windows\XCKGSP.exe.bat WZGC.exe File created C:\windows\system\HLMM.exe BLFYVM.exe File created C:\windows\RCZR.exe LCRDCQ.exe File opened for modification C:\windows\system\IWRLY.exe WGKDMU.exe File created C:\windows\system\WZGC.exe LHD.exe File created C:\windows\FGXC.exe WGVPGHE.exe File created C:\windows\LGFQBH.exe.bat FGXC.exe File opened for modification C:\windows\system\CTGU.exe CNF.exe File created C:\windows\CAUJQ.exe NFKXFMY.exe File opened for modification C:\windows\SOZIK.exe XBUY.exe File opened for modification C:\windows\FGXC.exe WGVPGHE.exe File created C:\windows\TAALSHV.exe.bat RCZR.exe File created C:\windows\system\EAUPJE.exe.bat JNPG.exe File created C:\windows\system\YKSJYG.exe ZZITPSY.exe File opened for modification C:\windows\system\AVVZAU.exe PDSGAFY.exe File created C:\windows\system\NCERUTO.exe.bat SOZIK.exe File created C:\windows\QDO.exe.bat SDGVHJH.exe File opened for modification C:\windows\system\KRTS.exe QDO.exe File opened for modification C:\windows\system\EXART.exe UOYM.exe File created C:\windows\system\MDZHY.exe RPU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2232 cmd.exe 4452 cmd.exe 5868 cmd.exe 3108 cmd.exe 5508 cmd.exe 4680 cmd.exe 4868 cmd.exe 692 cmd.exe 3360 cmd.exe 2416 cmd.exe 1652 cmd.exe 3628 cmd.exe 3380 cmd.exe 4216 cmd.exe 980 cmd.exe 2460 cmd.exe 4864 cmd.exe 4624 cmd.exe 3308 cmd.exe 2576 cmd.exe 4708 cmd.exe 6068 cmd.exe 3824 cmd.exe 1500 cmd.exe 4084 cmd.exe 5748 cmd.exe 4104 cmd.exe 2720 cmd.exe 4208 cmd.exe 5792 cmd.exe 3588 cmd.exe 5380 cmd.exe 3192 cmd.exe 2820 cmd.exe 4448 cmd.exe 1772 cmd.exe 5148 cmd.exe 3040 cmd.exe 5460 cmd.exe 4128 cmd.exe 944 cmd.exe 4296 cmd.exe 3196 cmd.exe 1996 cmd.exe 5788 cmd.exe 5152 cmd.exe 1404 cmd.exe 6024 cmd.exe 3076 cmd.exe 4776 cmd.exe 2840 cmd.exe 2508 cmd.exe 4816 cmd.exe 2532 cmd.exe 1300 cmd.exe 5724 cmd.exe 5500 cmd.exe 2412 cmd.exe 5772 cmd.exe 2964 cmd.exe 5016 cmd.exe 2352 cmd.exe 4472 cmd.exe 5824 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5596 1320 WerFault.exe 86 940 1752 WerFault.exe 92 4804 4628 WerFault.exe 98 3968 5160 WerFault.exe 103 4764 1712 WerFault.exe 108 5456 3972 WerFault.exe 113 1088 2580 WerFault.exe 118 3040 3744 WerFault.exe 123 980 1668 WerFault.exe 128 5940 3764 WerFault.exe 133 5492 1060 WerFault.exe 138 2776 5464 WerFault.exe 143 3216 2356 WerFault.exe 148 2116 1912 WerFault.exe 153 4100 1384 WerFault.exe 158 1156 1460 WerFault.exe 163 1604 2472 WerFault.exe 168 4040 1704 WerFault.exe 173 2028 5536 WerFault.exe 178 3196 3476 WerFault.exe 183 4176 264 WerFault.exe 188 5752 1952 WerFault.exe 193 2940 484 WerFault.exe 198 4956 1188 WerFault.exe 203 4864 4544 WerFault.exe 208 5364 3928 WerFault.exe 213 5480 1624 WerFault.exe 218 1144 2984 WerFault.exe 223 1436 1456 WerFault.exe 228 592 1648 WerFault.exe 233 900 3780 WerFault.exe 238 5044 2784 WerFault.exe 243 1264 3428 WerFault.exe 248 2384 2688 WerFault.exe 253 4444 5064 WerFault.exe 258 2412 5592 WerFault.exe 263 692 1656 WerFault.exe 268 1604 3692 WerFault.exe 273 2668 2364 WerFault.exe 278 4140 4284 WerFault.exe 284 5624 4348 WerFault.exe 289 3132 5940 WerFault.exe 294 5596 3396 WerFault.exe 299 6092 4080 WerFault.exe 304 4704 2384 WerFault.exe 309 240 4964 WerFault.exe 314 2372 1944 WerFault.exe 319 1404 1616 WerFault.exe 324 6100 6096 WerFault.exe 329 2796 4632 WerFault.exe 334 3196 120 WerFault.exe 339 2280 2552 WerFault.exe 344 3380 3132 WerFault.exe 349 5872 4028 WerFault.exe 354 4796 1272 WerFault.exe 359 3212 1032 WerFault.exe 364 4128 2388 WerFault.exe 369 5952 4764 WerFault.exe 374 4680 5004 WerFault.exe 379 1976 2668 WerFault.exe 384 4000 4400 WerFault.exe 389 4912 4316 WerFault.exe 394 2828 1092 WerFault.exe 399 3700 4856 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNLDVND.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DJY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKNVXYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVTQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MIG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_88eeca5bbf0046ea91311ea4b977487c_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEGJRVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZOOMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFKXFMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLMYJA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PPPSCC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NNCO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CGUYAL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEKBHIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WGKDMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWILV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UALFRNC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QNLJNMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUAXDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AHOJN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XIUOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LEJQRQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KQSRR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNZ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1320 2026-10-19_88eeca5bbf0046ea91311ea4b977487c_elex_emotet_stop.exe 1320 2026-10-19_88eeca5bbf0046ea91311ea4b977487c_elex_emotet_stop.exe 1752 KZWU.exe 1752 KZWU.exe 4628 USFUNR.exe 4628 USFUNR.exe 5160 JNPG.exe 5160 JNPG.exe 1712 EAUPJE.exe 1712 EAUPJE.exe 3972 ZNZ.exe 3972 ZNZ.exe 2580 KGUS.exe 2580 KGUS.exe 3744 BOWXX.exe 3744 BOWXX.exe 1668 WBAGHQA.exe 1668 WBAGHQA.exe 3764 QPFQ.exe 3764 QPFQ.exe 1060 GSPCCDY.exe 1060 GSPCCDY.exe 5464 GXPIMQS.exe 5464 GXPIMQS.exe 2356 ALUA.exe 2356 ALUA.exe 1912 PGDEHCQ.exe 1912 PGDEHCQ.exe 1384 VBCFE.exe 1384 VBCFE.exe 1460 OEGJRVH.exe 1460 OEGJRVH.exe 2472 TKYYHYB.exe 2472 TKYYHYB.exe 1704 LFCU.exe 1704 LFCU.exe 5536 MIG.exe 5536 MIG.exe 3476 QYNXEW.exe 3476 QYNXEW.exe 264 WLMYJA.exe 264 WLMYJA.exe 1952 JWUXXC.exe 1952 JWUXXC.exe 484 NEJX.exe 484 NEJX.exe 1188 IZOOMU.exe 1188 IZOOMU.exe 4544 ZZITPSY.exe 4544 ZZITPSY.exe 3928 YKSJYG.exe 3928 YKSJYG.exe 1624 NNCO.exe 1624 NNCO.exe 2984 IAHXTS.exe 2984 IAHXTS.exe 1456 AEKBHIT.exe 1456 AEKBHIT.exe 1648 SEMGKO.exe 1648 SEMGKO.exe 3780 MRRPUOK.exe 3780 MRRPUOK.exe 2784 BMB.exe 2784 BMB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1320 2026-10-19_88eeca5bbf0046ea91311ea4b977487c_elex_emotet_stop.exe 1320 2026-10-19_88eeca5bbf0046ea91311ea4b977487c_elex_emotet_stop.exe 1752 KZWU.exe 1752 KZWU.exe 4628 USFUNR.exe 4628 USFUNR.exe 5160 JNPG.exe 5160 JNPG.exe 1712 EAUPJE.exe 1712 EAUPJE.exe 3972 ZNZ.exe 3972 ZNZ.exe 2580 KGUS.exe 2580 KGUS.exe 3744 BOWXX.exe 3744 BOWXX.exe 1668 WBAGHQA.exe 1668 WBAGHQA.exe 3764 QPFQ.exe 3764 QPFQ.exe 1060 GSPCCDY.exe 1060 GSPCCDY.exe 5464 GXPIMQS.exe 5464 GXPIMQS.exe 2356 ALUA.exe 2356 ALUA.exe 1912 PGDEHCQ.exe 1912 PGDEHCQ.exe 1384 VBCFE.exe 1384 VBCFE.exe 1460 OEGJRVH.exe 1460 OEGJRVH.exe 2472 TKYYHYB.exe 2472 TKYYHYB.exe 1704 LFCU.exe 1704 LFCU.exe 5536 MIG.exe 5536 MIG.exe 3476 QYNXEW.exe 3476 QYNXEW.exe 264 WLMYJA.exe 264 WLMYJA.exe 1952 JWUXXC.exe 1952 JWUXXC.exe 484 NEJX.exe 484 NEJX.exe 1188 IZOOMU.exe 1188 IZOOMU.exe 4544 ZZITPSY.exe 4544 ZZITPSY.exe 3928 YKSJYG.exe 3928 YKSJYG.exe 1624 NNCO.exe 1624 NNCO.exe 2984 IAHXTS.exe 2984 IAHXTS.exe 1456 AEKBHIT.exe 1456 AEKBHIT.exe 1648 SEMGKO.exe 1648 SEMGKO.exe 3780 MRRPUOK.exe 3780 MRRPUOK.exe 2784 BMB.exe 2784 BMB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1320 wrote to memory of 6024 1320 2026-10-19_88eeca5bbf0046ea91311ea4b977487c_elex_emotet_stop.exe 88 PID 6024 wrote to memory of 1752 6024 cmd.exe 92 PID 1752 wrote to memory of 2360 1752 KZWU.exe 94 PID 2360 wrote to memory of 4628 2360 cmd.exe 98 PID 4628 wrote to memory of 3892 4628 USFUNR.exe 99 PID 3892 wrote to memory of 5160 3892 cmd.exe 103 PID 5160 wrote to memory of 5904 5160 JNPG.exe 104 PID 5904 wrote to memory of 1712 5904 cmd.exe 108 PID 1712 wrote to memory of 4208 1712 EAUPJE.exe 109 PID 4208 wrote to memory of 3972 4208 cmd.exe 113 PID 3972 wrote to memory of 3304 3972 ZNZ.exe 114 PID 3304 wrote to memory of 2580 3304 cmd.exe 118 PID 2580 wrote to memory of 5792 2580 KGUS.exe 119 PID 5792 wrote to memory of 3744 5792 cmd.exe 123 PID 3744 wrote to memory of 2004 3744 BOWXX.exe 124 PID 2004 wrote to memory of 1668 2004 cmd.exe 128 PID 1668 wrote to memory of 3192 1668 WBAGHQA.exe 129 PID 3192 wrote to memory of 3764 3192 cmd.exe 133 PID 3764 wrote to memory of 5964 3764 QPFQ.exe 134 PID 5964 wrote to memory of 1060 5964 cmd.exe 138 PID 1060 wrote to memory of 2972 1060 GSPCCDY.exe 139 PID 2972 wrote to memory of 5464 2972 cmd.exe 143 PID 5464 wrote to memory of 1348 5464 GXPIMQS.exe 144 PID 1348 wrote to memory of 2356 1348 cmd.exe 148 PID 2356 wrote to memory of 4088 2356 ALUA.exe 149 PID 4088 wrote to memory of 1912 4088 cmd.exe 153 PID 1912 wrote to memory of 1492 1912 PGDEHCQ.exe 154 PID 1492 wrote to memory of 1384 1492 cmd.exe 158 PID 1384 wrote to memory of 4012 1384 VBCFE.exe 159 PID 4012 wrote to memory of 1460 4012 cmd.exe 163 PID 1460 wrote to memory of 2556 1460 OEGJRVH.exe 164 PID 2556 wrote to memory of 2472 2556 cmd.exe 168 PID 2472 wrote to memory of 5916 2472 TKYYHYB.exe 169 PID 5916 wrote to memory of 1704 5916 cmd.exe 173 PID 1704 wrote to memory of 4740 1704 LFCU.exe 174 PID 4740 wrote to memory of 5536 4740 cmd.exe 178 PID 5536 wrote to memory of 5572 5536 MIG.exe 179 PID 5572 wrote to memory of 3476 5572 cmd.exe 183 PID 3476 wrote to memory of 980 3476 QYNXEW.exe 184 PID 980 wrote to memory of 264 980 cmd.exe 188 PID 264 wrote to memory of 2460 264 WLMYJA.exe 189 PID 2460 wrote to memory of 1952 2460 cmd.exe 193 PID 1952 wrote to memory of 1884 1952 JWUXXC.exe 194 PID 1884 wrote to memory of 484 1884 cmd.exe 198 PID 484 wrote to memory of 5988 484 NEJX.exe 199 PID 5988 wrote to memory of 1188 5988 cmd.exe 203 PID 1188 wrote to memory of 3204 1188 IZOOMU.exe 204 PID 3204 wrote to memory of 4544 3204 cmd.exe 208 PID 4544 wrote to memory of 2820 4544 ZZITPSY.exe 209 PID 2820 wrote to memory of 3928 2820 cmd.exe 213 PID 3928 wrote to memory of 1672 3928 YKSJYG.exe 214 PID 1672 wrote to memory of 1624 1672 cmd.exe 218 PID 1624 wrote to memory of 1920 1624 NNCO.exe 219 PID 1920 wrote to memory of 2984 1920 cmd.exe 223 PID 2984 wrote to memory of 2576 2984 IAHXTS.exe 224 PID 2576 wrote to memory of 1456 2576 cmd.exe 228 PID 1456 wrote to memory of 5724 1456 AEKBHIT.exe 229 PID 5724 wrote to memory of 1648 5724 cmd.exe 233 PID 1648 wrote to memory of 3076 1648 SEMGKO.exe 234 PID 3076 wrote to memory of 3780 3076 cmd.exe 238 PID 3780 wrote to memory of 2036 3780 MRRPUOK.exe 239 PID 2036 wrote to memory of 2784 2036 cmd.exe 243 PID 2784 wrote to memory of 5544 2784 BMB.exe 244 PID 5544 wrote to memory of 3428 5544 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_88eeca5bbf0046ea91311ea4b977487c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_88eeca5bbf0046ea91311ea4b977487c_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZWU.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\windows\SysWOW64\KZWU.exeC:\windows\system32\KZWU.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\USFUNR.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\windows\USFUNR.exeC:\windows\USFUNR.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JNPG.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\windows\JNPG.exeC:\windows\JNPG.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EAUPJE.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\windows\system\EAUPJE.exeC:\windows\system\EAUPJE.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNZ.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\windows\SysWOW64\ZNZ.exeC:\windows\system32\ZNZ.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KGUS.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\windows\system\KGUS.exeC:\windows\system\KGUS.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOWXX.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\windows\BOWXX.exeC:\windows\BOWXX.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WBAGHQA.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\windows\SysWOW64\WBAGHQA.exeC:\windows\system32\WBAGHQA.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QPFQ.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\windows\SysWOW64\QPFQ.exeC:\windows\system32\QPFQ.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSPCCDY.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\windows\SysWOW64\GSPCCDY.exeC:\windows\system32\GSPCCDY.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXPIMQS.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\windows\system\GXPIMQS.exeC:\windows\system\GXPIMQS.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ALUA.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\windows\ALUA.exeC:\windows\ALUA.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PGDEHCQ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\windows\PGDEHCQ.exeC:\windows\PGDEHCQ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBCFE.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\windows\system\VBCFE.exeC:\windows\system\VBCFE.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OEGJRVH.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\windows\SysWOW64\OEGJRVH.exeC:\windows\system32\OEGJRVH.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKYYHYB.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\windows\SysWOW64\TKYYHYB.exeC:\windows\system32\TKYYHYB.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFCU.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\windows\LFCU.exeC:\windows\LFCU.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIG.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\windows\SysWOW64\MIG.exeC:\windows\system32\MIG.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYNXEW.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\windows\QYNXEW.exeC:\windows\QYNXEW.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WLMYJA.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:980 -
C:\windows\system\WLMYJA.exeC:\windows\system\WLMYJA.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JWUXXC.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\windows\SysWOW64\JWUXXC.exeC:\windows\system32\JWUXXC.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NEJX.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\windows\SysWOW64\NEJX.exeC:\windows\system32\NEJX.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IZOOMU.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\windows\SysWOW64\IZOOMU.exeC:\windows\system32\IZOOMU.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZZITPSY.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\windows\SysWOW64\ZZITPSY.exeC:\windows\system32\ZZITPSY.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YKSJYG.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\windows\system\YKSJYG.exeC:\windows\system\YKSJYG.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NNCO.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\windows\SysWOW64\NNCO.exeC:\windows\system32\NNCO.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IAHXTS.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\windows\system\IAHXTS.exeC:\windows\system\IAHXTS.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AEKBHIT.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\windows\AEKBHIT.exeC:\windows\AEKBHIT.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEMGKO.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\windows\SysWOW64\SEMGKO.exeC:\windows\system32\SEMGKO.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MRRPUOK.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\windows\SysWOW64\MRRPUOK.exeC:\windows\system32\MRRPUOK.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMB.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\windows\SysWOW64\BMB.exeC:\windows\system32\BMB.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFEMO.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\windows\NFEMO.exeC:\windows\NFEMO.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HAJWQI.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4448 -
C:\windows\SysWOW64\HAJWQI.exeC:\windows\system32\HAJWQI.exe67⤵
- Executes dropped EXE
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNF.exe.bat" "68⤵PID:2676
-
C:\windows\CNF.exeC:\windows\CNF.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CTGU.exe.bat" "70⤵PID:4956
-
C:\windows\system\CTGU.exeC:\windows\system\CTGU.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WGKDMU.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4864 -
C:\windows\SysWOW64\WGKDMU.exeC:\windows\system32\WGKDMU.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IWRLY.exe.bat" "74⤵PID:5364
-
C:\windows\system\IWRLY.exeC:\windows\system\IWRLY.exe75⤵
- Executes dropped EXE
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZVHECS.exe.bat" "76⤵
- Executes a command shell one-liner
PID:1772 -
C:\windows\BZVHECS.exeC:\windows\BZVHECS.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFFZT.exe.bat" "78⤵PID:1120
-
C:\windows\SFFZT.exeC:\windows\SFFZT.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SSFNV.exe.bat" "80⤵PID:2812
-
C:\windows\system\SSFNV.exeC:\windows\system\SSFNV.exe81⤵
- Executes dropped EXE
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFKXFMY.exe.bat" "82⤵PID:2636
-
C:\windows\NFKXFMY.exeC:\windows\NFKXFMY.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAUJQ.exe.bat" "84⤵PID:4176
-
C:\windows\CAUJQ.exeC:\windows\CAUJQ.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CGUYAL.exe.bat" "86⤵PID:1564
-
C:\windows\CGUYAL.exeC:\windows\CGUYAL.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DJY.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:4192 -
C:\windows\DJY.exeC:\windows\DJY.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MWILV.exe.bat" "90⤵PID:3280
-
C:\windows\system\MWILV.exeC:\windows\system\MWILV.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKNVXYN.exe.bat" "92⤵PID:5060
-
C:\windows\system\OKNVXYN.exeC:\windows\system\OKNVXYN.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OPF.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2720 -
C:\windows\system\OPF.exeC:\windows\system\OPF.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UQN.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5016 -
C:\windows\UQN.exeC:\windows\UQN.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDSGAFY.exe.bat" "98⤵PID:5768
-
C:\windows\SysWOW64\PDSGAFY.exeC:\windows\system32\PDSGAFY.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AVVZAU.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4776 -
C:\windows\system\AVVZAU.exeC:\windows\system\AVVZAU.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LOYSJCD.exe.bat" "102⤵PID:2572
-
C:\windows\SysWOW64\LOYSJCD.exeC:\windows\system32\LOYSJCD.exe103⤵
- Executes dropped EXE
PID:2552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IUVP.exe.bat" "104⤵PID:1452
-
C:\windows\system\IUVP.exeC:\windows\system\IUVP.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CHAYAL.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:1960 -
C:\windows\system\CHAYAL.exeC:\windows\system\CHAYAL.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IHI.exe.bat" "108⤵PID:2708
-
C:\windows\system\IHI.exeC:\windows\system\IHI.exe109⤵
- Executes dropped EXE
PID:1272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UALFRNC.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4444 -
C:\windows\system\UALFRNC.exeC:\windows\system\UALFRNC.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OVQO.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:3908 -
C:\windows\OVQO.exeC:\windows\OVQO.exe113⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XVSTFSB.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:692 -
C:\windows\XVSTFSB.exeC:\windows\XVSTFSB.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SJWD.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5500 -
C:\windows\SysWOW64\SJWD.exeC:\windows\system32\SJWD.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWHVF.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4032 -
C:\windows\system\JWHVF.exeC:\windows\system\JWHVF.exe119⤵
- Executes dropped EXE
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LUAXDD.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5868 -
C:\windows\system\LUAXDD.exeC:\windows\system\LUAXDD.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-