Analysis
- max time kernel
92s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/10/2026, 15:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-21_9e7d39e386aca2f9a9441d9e61e3e354_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-21_9e7d39e386aca2f9a9441d9e61e3e354_elex_emotet_stop.exe
- Size 208KB
- Sample261022-sycdnaaf65
- SHA256 27941d2554f8e2180438ced38ba40b5389707e75203bd98bd04302bbbff1e13d
- MD5 9e7d39e386aca2f9a9441d9e61e3e354
- SHA1 d7d8b812587c69d8786b74670b47e3b41dab3501
- SHA512 fc91673a2d5dd040c931c14a12f4bd3cb01c7ed49ce9243f23cd10674f44512af1d58b0aaea4286ea82b24937c24668837011503594164345e5a7fae532cd9ba
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOf/4NLthEjQT6c:MlZtbLWIgd1LZ9oECZbclc5+LOXQEje
- TLSH T1AF247D2235D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5304 VHA.exe 944 ZHDW.exe 4060 HNPD.exe 5660 KDWDIX.exe 1992 RQZ.exe 4476 PJKUE.exe 3680 HJZRRRM.exe 560 TZFZ.exe 3316 VXLLLSR.exe 4176 KNMLJ.exe 4800 DGBWB.exe 4652 CQEM.exe 2452 VTIIPK.exe 4224 IEYG.exe 260 ZEALHSJ.exe 2320 USFV.exe 4792 MVJYWI.exe 3220 YDQ.exe 3252 GTRYPOK.exe 4796 IOVH.exe 2652 MWCHEG.exe 3080 HKH.exe 1484 QSJE.exe 1116 UAP.exe 4604 AAXR.exe 408 MQE.exe 5412 MWEG.exe 5328 FZIKOT.exe 5548 JESZEO.exe 600 XCALG.exe 3304 ASHLSSU.exe 2164 BNKO.exe 5508 FDROKS.exe 4924 JLYWWL.exe 2516 PHXXTOD.exe 2664 IKBTGD.exe 604 XFK.exe 296 XIWBX.exe 3328 HIYGIMR.exe 5368 UTGFWWM.exe 1900 VWK.exe 1244 THNQKSK.exe 2860 HRDPZ.exe 5532 FCGF.exe 4868 APLPKJ.exe 5584 PGMOQ.exe 1736 FBV.exe 4872 XEZW.exe 4356 JMOWTZD.exe 4584 QCPVA.exe 3848 MMX.exe 1412 GACVY.exe 4344 ZDGZ.exe 2448 KVJSM.exe 3048 FJOBWDP.exe 5280 LJVPFXQ.exe 5236 FWAY.exe 2812 NKSNR.exe 4968 IXXWBJ.exe 5676 OXFK.exe 2804 GAJ.exe 5628 KIPOC.exe 3152 SOPCDZ.exe 6012 IRZH.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\VHA.exe 2026-10-21_9e7d39e386aca2f9a9441d9e61e3e354_elex_emotet_stop.exe File created C:\windows\SysWOW64\THNQKSK.exe VWK.exe File created C:\windows\SysWOW64\NKSNR.exe FWAY.exe File created C:\windows\SysWOW64\MMX.exe.bat QCPVA.exe File opened for modification C:\windows\SysWOW64\LDXLW.exe ALUA.exe File opened for modification C:\windows\SysWOW64\AAZ.exe AFVKJS.exe File created C:\windows\SysWOW64\THNQKSK.exe.bat VWK.exe File opened for modification C:\windows\SysWOW64\OXFK.exe IXXWBJ.exe File created C:\windows\SysWOW64\HJZRRRM.exe PJKUE.exe File created C:\windows\SysWOW64\CQEM.exe DGBWB.exe File created C:\windows\SysWOW64\UAP.exe QSJE.exe File created C:\windows\SysWOW64\AFVKJS.exe HCR.exe File created C:\windows\SysWOW64\ZHDW.exe VHA.exe File opened for modification C:\windows\SysWOW64\JESZEO.exe FZIKOT.exe File created C:\windows\SysWOW64\ZDGZ.exe.bat GACVY.exe File created C:\windows\SysWOW64\OXFK.exe IXXWBJ.exe File created C:\windows\SysWOW64\KJH.exe AMBABW.exe File opened for modification C:\windows\SysWOW64\KJH.exe AMBABW.exe File created C:\windows\SysWOW64\ZBCNFF.exe MRL.exe File opened for modification C:\windows\SysWOW64\HNPD.exe ZHDW.exe File created C:\windows\SysWOW64\CQEM.exe.bat DGBWB.exe File created C:\windows\SysWOW64\MWEG.exe MQE.exe File opened for modification C:\windows\SysWOW64\XIWBX.exe XFK.exe File created C:\windows\SysWOW64\ZDGZ.exe GACVY.exe File created C:\windows\SysWOW64\NEMGZX.exe EEKBV.exe File created C:\windows\SysWOW64\LDXLW.exe ALUA.exe File created C:\windows\SysWOW64\AAZ.exe AFVKJS.exe File created C:\windows\SysWOW64\LEOZLH.exe.bat HWZR.exe File created C:\windows\SysWOW64\VCLPRZ.exe.bat SUFP.exe File opened for modification C:\windows\SysWOW64\MWEG.exe MQE.exe File created C:\windows\SysWOW64\VHA.exe.bat 2026-10-21_9e7d39e386aca2f9a9441d9e61e3e354_elex_emotet_stop.exe File created C:\windows\SysWOW64\KDWDIX.exe HNPD.exe File opened for modification C:\windows\SysWOW64\CQEM.exe DGBWB.exe File opened for modification C:\windows\SysWOW64\QSJE.exe HKH.exe File opened for modification C:\windows\SysWOW64\MQE.exe AAXR.exe File created C:\windows\SysWOW64\MVERKZK.exe.bat GUXEB.exe File opened for modification C:\windows\SysWOW64\HJZRRRM.exe PJKUE.exe File created C:\windows\SysWOW64\ZEALHSJ.exe IEYG.exe File created C:\windows\SysWOW64\UAP.exe.bat QSJE.exe File opened for modification C:\windows\SysWOW64\XCALG.exe JESZEO.exe File created C:\windows\SysWOW64\DBGYIK.exe.bat OGP.exe File created C:\windows\SysWOW64\KJH.exe.bat AMBABW.exe File created C:\windows\SysWOW64\OEGJRVH.exe HOFJK.exe File created C:\windows\SysWOW64\HJZRRRM.exe.bat PJKUE.exe File created C:\windows\SysWOW64\FDROKS.exe BNKO.exe File created C:\windows\SysWOW64\IKBTGD.exe.bat PHXXTOD.exe File opened for modification C:\windows\SysWOW64\THNQKSK.exe VWK.exe File opened for modification C:\windows\SysWOW64\MMX.exe QCPVA.exe File opened for modification C:\windows\SysWOW64\PJKUE.exe RQZ.exe File created C:\windows\SysWOW64\VWK.exe.bat UTGFWWM.exe File created C:\windows\SysWOW64\XFK.exe.bat IKBTGD.exe File created C:\windows\SysWOW64\CHIIZ.exe.bat CCIU.exe File created C:\windows\SysWOW64\OEGJRVH.exe.bat HOFJK.exe File created C:\windows\SysWOW64\ZBCNFF.exe.bat MRL.exe File created C:\windows\SysWOW64\MVERKZK.exe GUXEB.exe File opened for modification C:\windows\SysWOW64\MVERKZK.exe GUXEB.exe File created C:\windows\SysWOW64\VHA.exe 2026-10-21_9e7d39e386aca2f9a9441d9e61e3e354_elex_emotet_stop.exe File created C:\windows\SysWOW64\KDWDIX.exe.bat HNPD.exe File created C:\windows\SysWOW64\XCALG.exe.bat JESZEO.exe File created C:\windows\SysWOW64\QSJE.exe HKH.exe File opened for modification C:\windows\SysWOW64\NEMGZX.exe EEKBV.exe File created C:\windows\SysWOW64\BZE.exe.bat XRY.exe File created C:\windows\SysWOW64\TZFZ.exe.bat HJZRRRM.exe File created C:\windows\SysWOW64\QSJE.exe.bat HKH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\SUFP.exe AMDKC.exe File created C:\windows\system\YKIDECS.exe.bat WUV.exe File created C:\windows\USFV.exe.bat ZEALHSJ.exe File created C:\windows\system\HRDPZ.exe THNQKSK.exe File created C:\windows\system\QCPVA.exe.bat JMOWTZD.exe File created C:\windows\system\XRY.exe WOUUTM.exe File opened for modification C:\windows\KIBTA.exe AAZ.exe File opened for modification C:\windows\system\AMBABW.exe DGJKL.exe File created C:\windows\WYA.exe WTAOYE.exe File created C:\windows\system\DKUW.exe.bat DPQSYZR.exe File opened for modification C:\windows\GTRYPOK.exe YDQ.exe File created C:\windows\MWCHEG.exe.bat IOVH.exe File created C:\windows\system\JLYWWL.exe FDROKS.exe File created C:\windows\system\AMBABW.exe.bat DGJKL.exe File created C:\windows\system\DPQSYZR.exe PEIBKWW.exe File created C:\windows\system\MLT.exe RADBB.exe File opened for modification C:\windows\YPIY.exe OSDEE.exe File created C:\windows\YPIY.exe.bat OSDEE.exe File opened for modification C:\windows\system\GAJ.exe OXFK.exe File created C:\windows\system\EEKBV.exe.bat DBGYIK.exe File created C:\windows\HCR.exe.bat OEGJRVH.exe File created C:\windows\YPIY.exe OSDEE.exe File created C:\windows\system\MVJYWI.exe.bat USFV.exe File opened for modification C:\windows\FZIKOT.exe MWEG.exe File created C:\windows\system\HIYGIMR.exe XIWBX.exe File opened for modification C:\windows\system\LJVPFXQ.exe FJOBWDP.exe File created C:\windows\system\YKIDECS.exe WUV.exe File created C:\windows\ZSQVDEN.exe KPHI.exe File opened for modification C:\windows\system\HWZR.exe GTWVT.exe File opened for modification C:\windows\system\AMDKC.exe IRZH.exe File created C:\windows\system\JLYWWL.exe.bat FDROKS.exe File created C:\windows\system\SOPCDZ.exe.bat KIPOC.exe File opened for modification C:\windows\OGP.exe VCLPRZ.exe File created C:\windows\WOUUTM.exe.bat PTK.exe File created C:\windows\system\PEIBKWW.exe.bat JJITNT.exe File opened for modification C:\windows\RADBB.exe WNG.exe File created C:\windows\JMOWTZD.exe.bat XEZW.exe File created C:\windows\FJOBWDP.exe KVJSM.exe File created C:\windows\WTAOYE.exe KKT.exe File created C:\windows\system\HWZR.exe GTWVT.exe File opened for modification C:\windows\system\MVJYWI.exe USFV.exe File opened for modification C:\windows\HKH.exe MWCHEG.exe File opened for modification C:\windows\system\JLYWWL.exe FDROKS.exe File created C:\windows\system\GACVY.exe MMX.exe File created C:\windows\system\IRZH.exe SOPCDZ.exe File opened for modification C:\windows\system\EEKBV.exe DBGYIK.exe File created C:\windows\ALUA.exe IIQWJZG.exe File created C:\windows\HCR.exe OEGJRVH.exe File created C:\windows\GTRYPOK.exe.bat YDQ.exe File created C:\windows\system\IEYG.exe.bat VTIIPK.exe File opened for modification C:\windows\system\SOPCDZ.exe KIPOC.exe File created C:\windows\system\IIQWJZG.exe CHIIZ.exe File opened for modification C:\windows\ALUA.exe IIQWJZG.exe File opened for modification C:\windows\KPHI.exe KJH.exe File created C:\windows\KKT.exe ZSQVDEN.exe File opened for modification C:\windows\KKT.exe ZSQVDEN.exe File created C:\windows\VTIIPK.exe CQEM.exe File opened for modification C:\windows\system\IEYG.exe VTIIPK.exe File created C:\windows\IXXWBJ.exe NKSNR.exe File created C:\windows\WOUUTM.exe PTK.exe File created C:\windows\system\IIQWJZG.exe.bat CHIIZ.exe File created C:\windows\KPHI.exe.bat KJH.exe File opened for modification C:\windows\WTAOYE.exe KKT.exe File created C:\windows\system\WNG.exe DKUW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4708 cmd.exe 4964 cmd.exe 4816 cmd.exe 2420 cmd.exe 1648 cmd.exe 4492 cmd.exe 5896 cmd.exe 5432 cmd.exe 5472 cmd.exe 4140 cmd.exe 1700 cmd.exe 848 cmd.exe 5752 cmd.exe 1720 cmd.exe 1336 cmd.exe 1688 cmd.exe 1508 cmd.exe 5732 cmd.exe 1824 cmd.exe 2900 cmd.exe 1504 cmd.exe 2976 cmd.exe 3096 cmd.exe 4616 cmd.exe 724 cmd.exe 4260 cmd.exe 2924 cmd.exe 712 cmd.exe 3532 cmd.exe 5168 cmd.exe 3432 cmd.exe 4292 cmd.exe 5580 cmd.exe 5220 cmd.exe 5760 cmd.exe 1808 cmd.exe 5916 cmd.exe 4444 cmd.exe 2088 cmd.exe 4540 cmd.exe 5440 cmd.exe 4116 cmd.exe 4932 cmd.exe 3608 cmd.exe 2740 cmd.exe 4936 cmd.exe 4592 cmd.exe 5348 cmd.exe 4788 cmd.exe 5620 cmd.exe 1376 cmd.exe 3584 cmd.exe 1756 cmd.exe 3372 cmd.exe 1100 cmd.exe 5704 cmd.exe 2920 cmd.exe 2604 cmd.exe 2760 cmd.exe 5112 cmd.exe 4828 cmd.exe 3344 cmd.exe 4528 cmd.exe 3892 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5432 3000 WerFault.exe 87 1480 5304 WerFault.exe 93 4632 944 WerFault.exe 99 4776 4060 WerFault.exe 104 5424 5660 WerFault.exe 109 4452 1992 WerFault.exe 114 3140 4476 WerFault.exe 119 824 3680 WerFault.exe 124 5264 560 WerFault.exe 129 632 3316 WerFault.exe 134 3432 4176 WerFault.exe 139 2192 4800 WerFault.exe 144 4320 4652 WerFault.exe 149 5956 2452 WerFault.exe 154 1360 4224 WerFault.exe 159 2936 260 WerFault.exe 164 2920 2320 WerFault.exe 169 1172 4792 WerFault.exe 174 2060 3220 WerFault.exe 179 1772 3252 WerFault.exe 184 3008 4796 WerFault.exe 189 3892 2652 WerFault.exe 194 1680 3080 WerFault.exe 199 3696 1484 WerFault.exe 204 6076 1116 WerFault.exe 209 2532 4604 WerFault.exe 214 5480 408 WerFault.exe 219 5424 5412 WerFault.exe 224 6036 5328 WerFault.exe 229 3676 5548 WerFault.exe 234 1100 600 WerFault.exe 239 1648 3304 WerFault.exe 244 4788 2164 WerFault.exe 249 5300 5508 WerFault.exe 254 2412 4924 WerFault.exe 259 3572 2516 WerFault.exe 264 1520 2664 WerFault.exe 269 5948 604 WerFault.exe 274 3364 296 WerFault.exe 279 916 3328 WerFault.exe 284 2072 5368 WerFault.exe 289 1124 1900 WerFault.exe 294 3808 1244 WerFault.exe 299 5724 2860 WerFault.exe 304 964 5532 WerFault.exe 309 5084 4868 WerFault.exe 314 4320 5584 WerFault.exe 319 5224 1736 WerFault.exe 324 3040 4872 WerFault.exe 329 5852 4356 WerFault.exe 334 4144 4584 WerFault.exe 339 2072 3848 WerFault.exe 344 1264 1412 WerFault.exe 349 3084 4344 WerFault.exe 354 2656 2448 WerFault.exe 359 2704 3048 WerFault.exe 364 4100 5280 WerFault.exe 369 3644 5236 WerFault.exe 374 1976 2812 WerFault.exe 379 4424 4968 WerFault.exe 384 5844 5676 WerFault.exe 389 1064 2804 WerFault.exe 394 2648 5628 WerFault.exe 399 2140 3152 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JMOWTZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCPVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTGFWWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VHA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DGBWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VXLLLSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBGYIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KPHI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GTWVT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMDKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSJE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKBTGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJVPFXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIBTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DGJKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGMOQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCALG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWEG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEYG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THNQKSK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HCR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCLPRZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIPOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUFP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZHDW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDROKS.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3000 2026-10-21_9e7d39e386aca2f9a9441d9e61e3e354_elex_emotet_stop.exe 3000 2026-10-21_9e7d39e386aca2f9a9441d9e61e3e354_elex_emotet_stop.exe 5304 VHA.exe 5304 VHA.exe 944 ZHDW.exe 944 ZHDW.exe 4060 HNPD.exe 4060 HNPD.exe 5660 KDWDIX.exe 5660 KDWDIX.exe 1992 RQZ.exe 1992 RQZ.exe 4476 PJKUE.exe 4476 PJKUE.exe 3680 HJZRRRM.exe 3680 HJZRRRM.exe 560 TZFZ.exe 560 TZFZ.exe 3316 VXLLLSR.exe 3316 VXLLLSR.exe 4176 KNMLJ.exe 4176 KNMLJ.exe 4800 DGBWB.exe 4800 DGBWB.exe 4652 CQEM.exe 4652 CQEM.exe 2452 VTIIPK.exe 2452 VTIIPK.exe 4224 IEYG.exe 4224 IEYG.exe 260 ZEALHSJ.exe 260 ZEALHSJ.exe 2320 USFV.exe 2320 USFV.exe 4792 MVJYWI.exe 4792 MVJYWI.exe 3220 YDQ.exe 3220 YDQ.exe 3252 GTRYPOK.exe 3252 GTRYPOK.exe 4796 IOVH.exe 4796 IOVH.exe 2652 MWCHEG.exe 2652 MWCHEG.exe 3080 HKH.exe 3080 HKH.exe 1484 QSJE.exe 1484 QSJE.exe 1116 UAP.exe 1116 UAP.exe 4604 AAXR.exe 4604 AAXR.exe 408 MQE.exe 408 MQE.exe 5412 MWEG.exe 5412 MWEG.exe 5328 FZIKOT.exe 5328 FZIKOT.exe 5548 JESZEO.exe 5548 JESZEO.exe 600 XCALG.exe 600 XCALG.exe 3304 ASHLSSU.exe 3304 ASHLSSU.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3000 2026-10-21_9e7d39e386aca2f9a9441d9e61e3e354_elex_emotet_stop.exe 3000 2026-10-21_9e7d39e386aca2f9a9441d9e61e3e354_elex_emotet_stop.exe 5304 VHA.exe 5304 VHA.exe 944 ZHDW.exe 944 ZHDW.exe 4060 HNPD.exe 4060 HNPD.exe 5660 KDWDIX.exe 5660 KDWDIX.exe 1992 RQZ.exe 1992 RQZ.exe 4476 PJKUE.exe 4476 PJKUE.exe 3680 HJZRRRM.exe 3680 HJZRRRM.exe 560 TZFZ.exe 560 TZFZ.exe 3316 VXLLLSR.exe 3316 VXLLLSR.exe 4176 KNMLJ.exe 4176 KNMLJ.exe 4800 DGBWB.exe 4800 DGBWB.exe 4652 CQEM.exe 4652 CQEM.exe 2452 VTIIPK.exe 2452 VTIIPK.exe 4224 IEYG.exe 4224 IEYG.exe 260 ZEALHSJ.exe 260 ZEALHSJ.exe 2320 USFV.exe 2320 USFV.exe 4792 MVJYWI.exe 4792 MVJYWI.exe 3220 YDQ.exe 3220 YDQ.exe 3252 GTRYPOK.exe 3252 GTRYPOK.exe 4796 IOVH.exe 4796 IOVH.exe 2652 MWCHEG.exe 2652 MWCHEG.exe 3080 HKH.exe 3080 HKH.exe 1484 QSJE.exe 1484 QSJE.exe 1116 UAP.exe 1116 UAP.exe 4604 AAXR.exe 4604 AAXR.exe 408 MQE.exe 408 MQE.exe 5412 MWEG.exe 5412 MWEG.exe 5328 FZIKOT.exe 5328 FZIKOT.exe 5548 JESZEO.exe 5548 JESZEO.exe 600 XCALG.exe 600 XCALG.exe 3304 ASHLSSU.exe 3304 ASHLSSU.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 4240 3000 2026-10-21_9e7d39e386aca2f9a9441d9e61e3e354_elex_emotet_stop.exe 89 PID 4240 wrote to memory of 5304 4240 cmd.exe 93 PID 5304 wrote to memory of 4328 5304 VHA.exe 95 PID 4328 wrote to memory of 944 4328 cmd.exe 99 PID 944 wrote to memory of 2672 944 ZHDW.exe 100 PID 2672 wrote to memory of 4060 2672 cmd.exe 104 PID 4060 wrote to memory of 2260 4060 HNPD.exe 105 PID 2260 wrote to memory of 5660 2260 cmd.exe 109 PID 5660 wrote to memory of 2944 5660 KDWDIX.exe 110 PID 2944 wrote to memory of 1992 2944 cmd.exe 114 PID 1992 wrote to memory of 2088 1992 RQZ.exe 115 PID 2088 wrote to memory of 4476 2088 cmd.exe 119 PID 4476 wrote to memory of 4504 4476 PJKUE.exe 120 PID 4504 wrote to memory of 3680 4504 cmd.exe 124 PID 3680 wrote to memory of 4540 3680 HJZRRRM.exe 125 PID 4540 wrote to memory of 560 4540 cmd.exe 129 PID 560 wrote to memory of 2380 560 TZFZ.exe 130 PID 2380 wrote to memory of 3316 2380 cmd.exe 134 PID 3316 wrote to memory of 5992 3316 VXLLLSR.exe 135 PID 5992 wrote to memory of 4176 5992 cmd.exe 139 PID 4176 wrote to memory of 4380 4176 KNMLJ.exe 140 PID 4380 wrote to memory of 4800 4380 cmd.exe 144 PID 4800 wrote to memory of 5440 4800 DGBWB.exe 145 PID 5440 wrote to memory of 4652 5440 cmd.exe 149 PID 4652 wrote to memory of 1604 4652 CQEM.exe 150 PID 1604 wrote to memory of 2452 1604 cmd.exe 154 PID 2452 wrote to memory of 1760 2452 VTIIPK.exe 155 PID 1760 wrote to memory of 4224 1760 cmd.exe 159 PID 4224 wrote to memory of 2708 4224 IEYG.exe 160 PID 2708 wrote to memory of 260 2708 cmd.exe 164 PID 260 wrote to memory of 5968 260 ZEALHSJ.exe 165 PID 5968 wrote to memory of 2320 5968 cmd.exe 169 PID 2320 wrote to memory of 3524 2320 USFV.exe 170 PID 3524 wrote to memory of 4792 3524 cmd.exe 174 PID 4792 wrote to memory of 5580 4792 MVJYWI.exe 175 PID 5580 wrote to memory of 3220 5580 cmd.exe 179 PID 3220 wrote to memory of 3096 3220 YDQ.exe 180 PID 3096 wrote to memory of 3252 3096 cmd.exe 184 PID 3252 wrote to memory of 5472 3252 GTRYPOK.exe 185 PID 5472 wrote to memory of 4796 5472 cmd.exe 189 PID 4796 wrote to memory of 4480 4796 IOVH.exe 190 PID 4480 wrote to memory of 2652 4480 cmd.exe 194 PID 2652 wrote to memory of 2464 2652 MWCHEG.exe 195 PID 2464 wrote to memory of 3080 2464 cmd.exe 199 PID 3080 wrote to memory of 3836 3080 HKH.exe 200 PID 3836 wrote to memory of 1484 3836 cmd.exe 204 PID 1484 wrote to memory of 5484 1484 QSJE.exe 205 PID 5484 wrote to memory of 1116 5484 cmd.exe 209 PID 1116 wrote to memory of 1552 1116 UAP.exe 210 PID 1552 wrote to memory of 4604 1552 cmd.exe 214 PID 4604 wrote to memory of 1700 4604 AAXR.exe 215 PID 1700 wrote to memory of 408 1700 cmd.exe 219 PID 408 wrote to memory of 6024 408 MQE.exe 220 PID 6024 wrote to memory of 5412 6024 cmd.exe 224 PID 5412 wrote to memory of 1376 5412 MWEG.exe 225 PID 1376 wrote to memory of 5328 1376 cmd.exe 229 PID 5328 wrote to memory of 3568 5328 FZIKOT.exe 230 PID 3568 wrote to memory of 5548 3568 cmd.exe 234 PID 5548 wrote to memory of 2596 5548 JESZEO.exe 235 PID 2596 wrote to memory of 600 2596 cmd.exe 239 PID 600 wrote to memory of 1708 600 XCALG.exe 240 PID 1708 wrote to memory of 3304 1708 cmd.exe 244 PID 3304 wrote to memory of 5264 3304 ASHLSSU.exe 245 PID 5264 wrote to memory of 2164 5264 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-21_9e7d39e386aca2f9a9441d9e61e3e354_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-21_9e7d39e386aca2f9a9441d9e61e3e354_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VHA.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\windows\SysWOW64\VHA.exeC:\windows\system32\VHA.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZHDW.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\windows\SysWOW64\ZHDW.exeC:\windows\system32\ZHDW.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HNPD.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\windows\SysWOW64\HNPD.exeC:\windows\system32\HNPD.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KDWDIX.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\windows\SysWOW64\KDWDIX.exeC:\windows\system32\KDWDIX.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RQZ.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\windows\system\RQZ.exeC:\windows\system\RQZ.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJKUE.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\windows\SysWOW64\PJKUE.exeC:\windows\system32\PJKUE.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HJZRRRM.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\windows\SysWOW64\HJZRRRM.exeC:\windows\system32\HJZRRRM.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TZFZ.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\windows\SysWOW64\TZFZ.exeC:\windows\system32\TZFZ.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VXLLLSR.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\windows\VXLLLSR.exeC:\windows\VXLLLSR.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNMLJ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\windows\SysWOW64\KNMLJ.exeC:\windows\system32\KNMLJ.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DGBWB.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\windows\system\DGBWB.exeC:\windows\system\DGBWB.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQEM.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\windows\SysWOW64\CQEM.exeC:\windows\system32\CQEM.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VTIIPK.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\windows\VTIIPK.exeC:\windows\VTIIPK.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IEYG.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\windows\system\IEYG.exeC:\windows\system\IEYG.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZEALHSJ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\windows\SysWOW64\ZEALHSJ.exeC:\windows\system32\ZEALHSJ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\USFV.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\windows\USFV.exeC:\windows\USFV.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MVJYWI.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\windows\system\MVJYWI.exeC:\windows\system\MVJYWI.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDQ.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\windows\system\YDQ.exeC:\windows\system\YDQ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTRYPOK.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\windows\GTRYPOK.exeC:\windows\GTRYPOK.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IOVH.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\windows\SysWOW64\IOVH.exeC:\windows\system32\IOVH.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MWCHEG.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\windows\MWCHEG.exeC:\windows\MWCHEG.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HKH.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\windows\HKH.exeC:\windows\HKH.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QSJE.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\windows\SysWOW64\QSJE.exeC:\windows\system32\QSJE.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UAP.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\windows\SysWOW64\UAP.exeC:\windows\system32\UAP.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAXR.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\windows\SysWOW64\AAXR.exeC:\windows\system32\AAXR.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MQE.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\windows\SysWOW64\MQE.exeC:\windows\system32\MQE.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MWEG.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\windows\SysWOW64\MWEG.exeC:\windows\system32\MWEG.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZIKOT.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\windows\FZIKOT.exeC:\windows\FZIKOT.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JESZEO.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\windows\SysWOW64\JESZEO.exeC:\windows\system32\JESZEO.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XCALG.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\windows\SysWOW64\XCALG.exeC:\windows\system32\XCALG.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASHLSSU.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\windows\system\ASHLSSU.exeC:\windows\system\ASHLSSU.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNKO.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\windows\BNKO.exeC:\windows\BNKO.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FDROKS.exe.bat" "66⤵PID:2792
-
C:\windows\SysWOW64\FDROKS.exeC:\windows\system32\FDROKS.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLYWWL.exe.bat" "68⤵PID:4064
-
C:\windows\system\JLYWWL.exeC:\windows\system\JLYWWL.exe69⤵
- Executes dropped EXE
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHXXTOD.exe.bat" "70⤵
- Executes a command shell one-liner
PID:3432 -
C:\windows\system\PHXXTOD.exeC:\windows\system\PHXXTOD.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IKBTGD.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4828 -
C:\windows\SysWOW64\IKBTGD.exeC:\windows\system32\IKBTGD.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFK.exe.bat" "74⤵PID:556
-
C:\windows\SysWOW64\XFK.exeC:\windows\system32\XFK.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XIWBX.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4292 -
C:\windows\SysWOW64\XIWBX.exeC:\windows\system32\XIWBX.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HIYGIMR.exe.bat" "78⤵
- Executes a command shell one-liner
PID:5704 -
C:\windows\system\HIYGIMR.exeC:\windows\system\HIYGIMR.exe79⤵
- Executes dropped EXE
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UTGFWWM.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:252 -
C:\windows\UTGFWWM.exeC:\windows\UTGFWWM.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWK.exe.bat" "82⤵
- Executes a command shell one-liner
PID:2920 -
C:\windows\SysWOW64\VWK.exeC:\windows\system32\VWK.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THNQKSK.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4708 -
C:\windows\SysWOW64\THNQKSK.exeC:\windows\system32\THNQKSK.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HRDPZ.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:2416 -
C:\windows\system\HRDPZ.exeC:\windows\system\HRDPZ.exe87⤵
- Executes dropped EXE
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FCGF.exe.bat" "88⤵PID:4532
-
C:\windows\system\FCGF.exeC:\windows\system\FCGF.exe89⤵
- Executes dropped EXE
PID:5532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\APLPKJ.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2816 -
C:\windows\APLPKJ.exeC:\windows\APLPKJ.exe91⤵
- Executes dropped EXE
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGMOQ.exe.bat" "92⤵PID:3632
-
C:\windows\system\PGMOQ.exeC:\windows\system\PGMOQ.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FBV.exe.bat" "94⤵PID:3696
-
C:\windows\system\FBV.exeC:\windows\system\FBV.exe95⤵
- Executes dropped EXE
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XEZW.exe.bat" "96⤵
- Executes a command shell one-liner
PID:1508 -
C:\windows\XEZW.exeC:\windows\XEZW.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMOWTZD.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2604 -
C:\windows\JMOWTZD.exeC:\windows\JMOWTZD.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QCPVA.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4964 -
C:\windows\system\QCPVA.exeC:\windows\system\QCPVA.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMX.exe.bat" "102⤵PID:3400
-
C:\windows\SysWOW64\MMX.exeC:\windows\system32\MMX.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GACVY.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4140 -
C:\windows\system\GACVY.exeC:\windows\system\GACVY.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDGZ.exe.bat" "106⤵PID:4500
-
C:\windows\SysWOW64\ZDGZ.exeC:\windows\system32\ZDGZ.exe107⤵
- Executes dropped EXE
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KVJSM.exe.bat" "108⤵PID:4992
-
C:\windows\KVJSM.exeC:\windows\KVJSM.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJOBWDP.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:1932 -
C:\windows\FJOBWDP.exeC:\windows\FJOBWDP.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LJVPFXQ.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:4660 -
C:\windows\system\LJVPFXQ.exeC:\windows\system\LJVPFXQ.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWAY.exe.bat" "114⤵PID:1600
-
C:\windows\system\FWAY.exeC:\windows\system\FWAY.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NKSNR.exe.bat" "116⤵PID:5972
-
C:\windows\SysWOW64\NKSNR.exeC:\windows\system32\NKSNR.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IXXWBJ.exe.bat" "118⤵PID:2800
-
C:\windows\IXXWBJ.exeC:\windows\IXXWBJ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OXFK.exe.bat" "120⤵
- Executes a command shell one-liner
PID:3584 -
C:\windows\SysWOW64\OXFK.exeC:\windows\system32\OXFK.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-