Analysis
- max time kernel
74s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/10/2026, 16:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-25_ab95688e8f377779822c215706b956a2_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-25_ab95688e8f377779822c215706b956a2_elex_emotet_stop.exe
- Size 208KB
- Sample261026-tzmfpaf18q
- SHA256 3a3d4229af2346ac2a576f366d1d82ac20fc80cfa7eed4168148ed39c2ae301e
- MD5 ab95688e8f377779822c215706b956a2
- SHA1 f5aff1bfeaebee5ccf2f6ced3ef9bed4e49e213c
- SHA512 e3ccd3dc2f7fe36eba357c28ce079d36ac143d7a584144d31f865e2c1a2d32332249937b49ec401e2403d74c4d7a64a1d31a1a4c25e3969bc2dc468fc32cf084
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcKL+LOfn4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlcS+LO/kEj1
- TLSH T1A6247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5724 UDIONH.exe 4272 WJNZL.exe 1984 VUYP.exe 2160 DZDW.exe 4160 FXIQMG.exe 3876 YQYBVG.exe 2704 XIBRE.exe 708 ZGO.exe 4460 MEO.exe 4720 BZYBGT.exe 2112 THMZTK.exe 4448 KCSRTCP.exe 2944 GNAIH.exe 1060 RGQTZ.exe 3392 XBPBVQ.exe 3316 BRW.exe 3764 GKYE.exe 5332 TUOCAQI.exe 2624 MNVNRJQ.exe 3548 DYGDAX.exe 5208 POND.exe 4376 TRLYMAC.exe 2196 XZSY.exe 1244 FMEN.exe 3552 JULNNJ.exe 2464 HNODW.exe 4516 AIRZBNG.exe 1104 KGFTRV.exe 4932 LJJ.exe 4712 AESBHY.exe 1576 RPVRQ.exe 2320 BNJMF.exe 2876 KVDRJS.exe 3056 WDR.exe 3528 DTSQTYI.exe 3752 JTAE.exe 4604 EEIDZLF.exe 6032 OEK.exe 5424 TFSVLK.exe 4332 FXVOTSY.exe 4300 JNCO.exe 2616 JQFKLA.exe 4984 JWGY.exe 3748 LULTCN.exe 4704 XCSB.exe 4632 WUV.exe 1540 NFGZYAF.exe 4228 CAPL.exe 1664 DDTHWK.exe 1520 GLZPAV.exe 1420 FWK.exe 5232 VMLWQW.exe 5764 IXUV.exe 4572 MFA.exe 3832 SAZW.exe 5496 YBHJEWX.exe 3636 CROR.exe 1748 RHPJPCI.exe 4152 EJFHD.exe 588 IAM.exe 916 HKPXYLN.exe 2372 HNSBDB.exe 4980 GYD.exe 3704 TJM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\MFA.exe IXUV.exe File created C:\windows\SysWOW64\GYJI.exe.bat CQDIFGU.exe File opened for modification C:\windows\SysWOW64\STQXFVZ.exe RQMBAF.exe File created C:\windows\SysWOW64\SULW.exe XGGNBWB.exe File opened for modification C:\windows\SysWOW64\YPKXQ.exe SULW.exe File opened for modification C:\windows\SysWOW64\OEK.exe EEIDZLF.exe File created C:\windows\SysWOW64\YBHJEWX.exe SAZW.exe File opened for modification C:\windows\SysWOW64\CQDIFGU.exe YAW.exe File created C:\windows\SysWOW64\HNODW.exe.bat JULNNJ.exe File opened for modification C:\windows\SysWOW64\DDTHWK.exe CAPL.exe File created C:\windows\SysWOW64\HKPXYLN.exe.bat IAM.exe File created C:\windows\SysWOW64\BRW.exe XBPBVQ.exe File opened for modification C:\windows\SysWOW64\AIRZBNG.exe HNODW.exe File created C:\windows\SysWOW64\LJJ.exe.bat KGFTRV.exe File created C:\windows\SysWOW64\KVDRJS.exe.bat BNJMF.exe File opened for modification C:\windows\SysWOW64\CROR.exe YBHJEWX.exe File opened for modification C:\windows\SysWOW64\FXIQMG.exe DZDW.exe File opened for modification C:\windows\SysWOW64\GKYE.exe BRW.exe File created C:\windows\SysWOW64\KGFTRV.exe AIRZBNG.exe File created C:\windows\SysWOW64\AESBHY.exe LJJ.exe File opened for modification C:\windows\SysWOW64\GYJI.exe CQDIFGU.exe File opened for modification C:\windows\SysWOW64\SULW.exe XGGNBWB.exe File created C:\windows\SysWOW64\THMZTK.exe BZYBGT.exe File opened for modification C:\windows\SysWOW64\BRW.exe XBPBVQ.exe File created C:\windows\SysWOW64\AIRZBNG.exe.bat HNODW.exe File created C:\windows\SysWOW64\IXUV.exe VMLWQW.exe File opened for modification C:\windows\SysWOW64\HKPXYLN.exe IAM.exe File created C:\windows\SysWOW64\HNSBDB.exe HKPXYLN.exe File opened for modification C:\windows\SysWOW64\RQMBAF.exe GYJI.exe File created C:\windows\SysWOW64\RQMBAF.exe.bat GYJI.exe File created C:\windows\SysWOW64\FXIQMG.exe DZDW.exe File created C:\windows\SysWOW64\FXIQMG.exe.bat DZDW.exe File created C:\windows\SysWOW64\AESBHY.exe.bat LJJ.exe File created C:\windows\SysWOW64\JTAE.exe DTSQTYI.exe File created C:\windows\SysWOW64\OEK.exe.bat EEIDZLF.exe File opened for modification C:\windows\SysWOW64\MFA.exe IXUV.exe File opened for modification C:\windows\SysWOW64\HNSBDB.exe HKPXYLN.exe File created C:\windows\SysWOW64\LIX.exe.bat VSWL.exe File created C:\windows\SysWOW64\THMZTK.exe.bat BZYBGT.exe File created C:\windows\SysWOW64\AIRZBNG.exe HNODW.exe File opened for modification C:\windows\SysWOW64\KVDRJS.exe BNJMF.exe File created C:\windows\SysWOW64\CROR.exe YBHJEWX.exe File created C:\windows\SysWOW64\CQDIFGU.exe YAW.exe File created C:\windows\SysWOW64\SULW.exe.bat XGGNBWB.exe File opened for modification C:\windows\SysWOW64\THMZTK.exe BZYBGT.exe File opened for modification C:\windows\SysWOW64\HNODW.exe JULNNJ.exe File created C:\windows\SysWOW64\DDTHWK.exe.bat CAPL.exe File created C:\windows\SysWOW64\GYJI.exe CQDIFGU.exe File created C:\windows\SysWOW64\HNP.exe LIX.exe File created C:\windows\SysWOW64\YPKXQ.exe SULW.exe File created C:\windows\SysWOW64\YPKXQ.exe.bat SULW.exe File opened for modification C:\windows\SysWOW64\KGFTRV.exe AIRZBNG.exe File created C:\windows\SysWOW64\MFA.exe.bat IXUV.exe File opened for modification C:\windows\SysWOW64\YBHJEWX.exe SAZW.exe File created C:\windows\SysWOW64\RHPJPCI.exe CROR.exe File created C:\windows\SysWOW64\LIX.exe VSWL.exe File created C:\windows\SysWOW64\GKYE.exe.bat BRW.exe File created C:\windows\SysWOW64\HNODW.exe JULNNJ.exe File created C:\windows\SysWOW64\KVDRJS.exe BNJMF.exe File created C:\windows\SysWOW64\DDTHWK.exe CAPL.exe File opened for modification C:\windows\SysWOW64\IXUV.exe VMLWQW.exe File opened for modification C:\windows\SysWOW64\YQYBVG.exe FXIQMG.exe File created C:\windows\SysWOW64\JTAE.exe.bat DTSQTYI.exe File created C:\windows\SysWOW64\OEK.exe EEIDZLF.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\WJNZL.exe UDIONH.exe File opened for modification C:\windows\BZYBGT.exe MEO.exe File created C:\windows\KCSRTCP.exe.bat THMZTK.exe File opened for modification C:\windows\system\XBPBVQ.exe RGQTZ.exe File created C:\windows\system\JQFKLA.exe.bat JNCO.exe File created C:\windows\CAPL.exe.bat NFGZYAF.exe File created C:\windows\system\TJM.exe.bat GYD.exe File created C:\windows\MHVO.exe.bat STQXFVZ.exe File opened for modification C:\windows\MEO.exe ZGO.exe File opened for modification C:\windows\system\FMEN.exe XZSY.exe File created C:\windows\WDR.exe KVDRJS.exe File created C:\windows\BER.exe.bat ABNYBS.exe File created C:\windows\system\UDIONH.exe 2026-10-25_ab95688e8f377779822c215706b956a2_elex_emotet_stop.exe File opened for modification C:\windows\KCSRTCP.exe THMZTK.exe File created C:\windows\system\MNVNRJQ.exe TUOCAQI.exe File created C:\windows\system\RPVRQ.exe.bat AESBHY.exe File opened for modification C:\windows\system\TOM.exe TJM.exe File created C:\windows\system\BVLT.exe.bat TPHM.exe File created C:\windows\BZYBGT.exe MEO.exe File created C:\windows\system\RGQTZ.exe.bat GNAIH.exe File created C:\windows\system\XCSB.exe.bat LULTCN.exe File created C:\windows\system\EJFHD.exe.bat RHPJPCI.exe File created C:\windows\VUYP.exe WJNZL.exe File created C:\windows\system\MNVNRJQ.exe.bat TUOCAQI.exe File opened for modification C:\windows\FWK.exe GLZPAV.exe File created C:\windows\VMLWQW.exe FWK.exe File opened for modification C:\windows\MHVO.exe STQXFVZ.exe File opened for modification C:\windows\LKG.exe FKZ.exe File created C:\windows\POND.exe DYGDAX.exe File created C:\windows\JULNNJ.exe.bat FMEN.exe File opened for modification C:\windows\WDR.exe KVDRJS.exe File created C:\windows\system\GLZPAV.exe DDTHWK.exe File created C:\windows\system\USQAH.exe.bat TOM.exe File created C:\windows\system\NPUQ.exe.bat TCPHAYU.exe File created C:\windows\system\UDIONH.exe.bat 2026-10-25_ab95688e8f377779822c215706b956a2_elex_emotet_stop.exe File opened for modification C:\windows\system\MNVNRJQ.exe TUOCAQI.exe File created C:\windows\WDR.exe.bat KVDRJS.exe File created C:\windows\system\EJFHD.exe RHPJPCI.exe File created C:\windows\system\TJM.exe GYD.exe File created C:\windows\TPHM.exe.bat LKG.exe File created C:\windows\system\ZTFW.exe BVLT.exe File opened for modification C:\windows\AQTVT.exe HNP.exe File created C:\windows\system\XBPBVQ.exe.bat RGQTZ.exe File created C:\windows\TUOCAQI.exe GKYE.exe File opened for modification C:\windows\system\FXVOTSY.exe TFSVLK.exe File created C:\windows\system\TCPHAYU.exe YPKXQ.exe File created C:\windows\system\TCPHAYU.exe.bat YPKXQ.exe File created C:\windows\system\NPUQ.exe TCPHAYU.exe File opened for modification C:\windows\LULTCN.exe JWGY.exe File created C:\windows\LULTCN.exe.bat JWGY.exe File created C:\windows\MHVO.exe STQXFVZ.exe File created C:\windows\GNAIH.exe.bat KCSRTCP.exe File created C:\windows\system\XZSY.exe.bat TRLYMAC.exe File opened for modification C:\windows\system\RPVRQ.exe AESBHY.exe File created C:\windows\EEIDZLF.exe.bat JTAE.exe File opened for modification C:\windows\system\GLZPAV.exe DDTHWK.exe File created C:\windows\LKG.exe.bat FKZ.exe File opened for modification C:\windows\system\XGGNBWB.exe AQTVT.exe File created C:\windows\WJNZL.exe.bat UDIONH.exe File opened for modification C:\windows\VUYP.exe WJNZL.exe File created C:\windows\system\DZDW.exe.bat VUYP.exe File opened for modification C:\windows\POND.exe DYGDAX.exe File created C:\windows\SAZW.exe MFA.exe File created C:\windows\system\VSWL.exe BER.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5944 cmd.exe 2692 cmd.exe 4524 cmd.exe 3240 cmd.exe 5528 cmd.exe 5540 cmd.exe 1764 cmd.exe 3120 cmd.exe 764 cmd.exe 4336 cmd.exe 236 cmd.exe 5216 cmd.exe 6104 cmd.exe 2388 cmd.exe 1156 cmd.exe 1852 cmd.exe 5044 cmd.exe 5164 cmd.exe 4916 cmd.exe 2732 cmd.exe 5040 cmd.exe 6060 cmd.exe 4848 cmd.exe 2796 cmd.exe 6040 cmd.exe 2492 cmd.exe 2300 cmd.exe 4760 cmd.exe 5548 cmd.exe 2888 cmd.exe 5356 cmd.exe 4568 cmd.exe 1280 cmd.exe 3040 cmd.exe 4996 cmd.exe 5640 cmd.exe 4952 cmd.exe 1892 cmd.exe 5696 cmd.exe 5824 cmd.exe 5828 cmd.exe 2736 cmd.exe 5644 cmd.exe 2276 cmd.exe 4424 cmd.exe 1196 cmd.exe 364 cmd.exe 2240 cmd.exe 5664 cmd.exe 4196 cmd.exe 2988 cmd.exe 2640 cmd.exe 1968 cmd.exe 3404 cmd.exe 4224 cmd.exe 2808 cmd.exe 828 cmd.exe 6052 cmd.exe 796 cmd.exe 1232 cmd.exe 4564 cmd.exe 4128 cmd.exe 4584 cmd.exe 5376 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2944 3280 WerFault.exe 87 3784 5724 WerFault.exe 93 5816 4272 WerFault.exe 99 4692 1984 WerFault.exe 104 4604 2160 WerFault.exe 109 5396 4160 WerFault.exe 114 4268 3876 WerFault.exe 119 2840 2704 WerFault.exe 124 3828 708 WerFault.exe 129 2276 4460 WerFault.exe 134 2060 4720 WerFault.exe 139 2372 2112 WerFault.exe 144 3912 4448 WerFault.exe 149 5720 2944 WerFault.exe 154 5512 1060 WerFault.exe 159 1400 3392 WerFault.exe 164 2816 3316 WerFault.exe 169 3020 3764 WerFault.exe 174 688 5332 WerFault.exe 179 5240 2624 WerFault.exe 184 964 3548 WerFault.exe 189 2784 5208 WerFault.exe 194 6044 4376 WerFault.exe 199 2200 2196 WerFault.exe 204 540 1244 WerFault.exe 209 1224 3552 WerFault.exe 214 2116 2464 WerFault.exe 219 1760 4516 WerFault.exe 224 2044 1104 WerFault.exe 229 5148 4932 WerFault.exe 233 588 4712 WerFault.exe 239 4592 1576 WerFault.exe 244 4348 2320 WerFault.exe 249 2120 2876 WerFault.exe 254 4772 3056 WerFault.exe 259 3068 3528 WerFault.exe 264 5828 3752 WerFault.exe 270 1760 4604 WerFault.exe 275 2384 6032 WerFault.exe 280 1520 5424 WerFault.exe 285 3612 4332 WerFault.exe 290 548 4300 WerFault.exe 295 5664 2616 WerFault.exe 300 1476 4984 WerFault.exe 305 3048 3748 WerFault.exe 310 2976 4704 WerFault.exe 315 5132 4632 WerFault.exe 320 2836 1540 WerFault.exe 325 4800 4228 WerFault.exe 330 5488 1664 WerFault.exe 335 5240 1520 WerFault.exe 340 5952 1420 WerFault.exe 345 296 5232 WerFault.exe 350 4956 5764 WerFault.exe 355 3444 4572 WerFault.exe 360 6048 3832 WerFault.exe 365 5072 5496 WerFault.exe 370 1856 3636 WerFault.exe 375 1212 1748 WerFault.exe 380 2060 4152 WerFault.exe 385 5176 588 WerFault.exe 390 2960 916 WerFault.exe 395 5708 2372 WerFault.exe 400 4576 4980 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQDIFGU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZTFW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKPXYLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AQTVT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DTSQTYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XIBRE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFSVLK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDTHWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USQAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGGNBWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THMZTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language POND.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFGZYAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VMLWQW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQMBAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NPUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQDOY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XZSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJFHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HNSBDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HNP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZYBGT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABNYBS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-25_ab95688e8f377779822c215706b956a2_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEIDZLF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BRW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LULTCN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3280 2026-10-25_ab95688e8f377779822c215706b956a2_elex_emotet_stop.exe 3280 2026-10-25_ab95688e8f377779822c215706b956a2_elex_emotet_stop.exe 5724 UDIONH.exe 5724 UDIONH.exe 4272 WJNZL.exe 4272 WJNZL.exe 1984 VUYP.exe 1984 VUYP.exe 2160 DZDW.exe 2160 DZDW.exe 4160 FXIQMG.exe 4160 FXIQMG.exe 3876 YQYBVG.exe 3876 YQYBVG.exe 2704 XIBRE.exe 2704 XIBRE.exe 708 ZGO.exe 708 ZGO.exe 4460 MEO.exe 4460 MEO.exe 4720 BZYBGT.exe 4720 BZYBGT.exe 2112 THMZTK.exe 2112 THMZTK.exe 4448 KCSRTCP.exe 4448 KCSRTCP.exe 2944 GNAIH.exe 2944 GNAIH.exe 1060 RGQTZ.exe 1060 RGQTZ.exe 3392 XBPBVQ.exe 3392 XBPBVQ.exe 3316 BRW.exe 3316 BRW.exe 3764 GKYE.exe 3764 GKYE.exe 5332 TUOCAQI.exe 5332 TUOCAQI.exe 2624 MNVNRJQ.exe 2624 MNVNRJQ.exe 3548 DYGDAX.exe 3548 DYGDAX.exe 5208 POND.exe 5208 POND.exe 4376 TRLYMAC.exe 4376 TRLYMAC.exe 2196 XZSY.exe 2196 XZSY.exe 1244 FMEN.exe 1244 FMEN.exe 3552 JULNNJ.exe 3552 JULNNJ.exe 2464 HNODW.exe 2464 HNODW.exe 4516 AIRZBNG.exe 4516 AIRZBNG.exe 1104 KGFTRV.exe 1104 KGFTRV.exe 4932 LJJ.exe 4932 LJJ.exe 4712 AESBHY.exe 4712 AESBHY.exe 1576 RPVRQ.exe 1576 RPVRQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3280 2026-10-25_ab95688e8f377779822c215706b956a2_elex_emotet_stop.exe 3280 2026-10-25_ab95688e8f377779822c215706b956a2_elex_emotet_stop.exe 5724 UDIONH.exe 5724 UDIONH.exe 4272 WJNZL.exe 4272 WJNZL.exe 1984 VUYP.exe 1984 VUYP.exe 2160 DZDW.exe 2160 DZDW.exe 4160 FXIQMG.exe 4160 FXIQMG.exe 3876 YQYBVG.exe 3876 YQYBVG.exe 2704 XIBRE.exe 2704 XIBRE.exe 708 ZGO.exe 708 ZGO.exe 4460 MEO.exe 4460 MEO.exe 4720 BZYBGT.exe 4720 BZYBGT.exe 2112 THMZTK.exe 2112 THMZTK.exe 4448 KCSRTCP.exe 4448 KCSRTCP.exe 2944 GNAIH.exe 2944 GNAIH.exe 1060 RGQTZ.exe 1060 RGQTZ.exe 3392 XBPBVQ.exe 3392 XBPBVQ.exe 3316 BRW.exe 3316 BRW.exe 3764 GKYE.exe 3764 GKYE.exe 5332 TUOCAQI.exe 5332 TUOCAQI.exe 2624 MNVNRJQ.exe 2624 MNVNRJQ.exe 3548 DYGDAX.exe 3548 DYGDAX.exe 5208 POND.exe 5208 POND.exe 4376 TRLYMAC.exe 4376 TRLYMAC.exe 2196 XZSY.exe 2196 XZSY.exe 1244 FMEN.exe 1244 FMEN.exe 3552 JULNNJ.exe 3552 JULNNJ.exe 2464 HNODW.exe 2464 HNODW.exe 4516 AIRZBNG.exe 4516 AIRZBNG.exe 1104 KGFTRV.exe 1104 KGFTRV.exe 4932 LJJ.exe 4932 LJJ.exe 4712 AESBHY.exe 4712 AESBHY.exe 1576 RPVRQ.exe 1576 RPVRQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3280 wrote to memory of 796 3280 2026-10-25_ab95688e8f377779822c215706b956a2_elex_emotet_stop.exe 89 PID 796 wrote to memory of 5724 796 cmd.exe 93 PID 5724 wrote to memory of 3560 5724 UDIONH.exe 95 PID 3560 wrote to memory of 4272 3560 cmd.exe 99 PID 4272 wrote to memory of 2016 4272 WJNZL.exe 100 PID 2016 wrote to memory of 1984 2016 cmd.exe 104 PID 1984 wrote to memory of 1156 1984 VUYP.exe 105 PID 1156 wrote to memory of 2160 1156 cmd.exe 109 PID 2160 wrote to memory of 1148 2160 DZDW.exe 110 PID 1148 wrote to memory of 4160 1148 cmd.exe 114 PID 4160 wrote to memory of 1968 4160 FXIQMG.exe 115 PID 1968 wrote to memory of 3876 1968 cmd.exe 119 PID 3876 wrote to memory of 824 3876 YQYBVG.exe 120 PID 824 wrote to memory of 2704 824 cmd.exe 124 PID 2704 wrote to memory of 4888 2704 XIBRE.exe 125 PID 4888 wrote to memory of 708 4888 cmd.exe 129 PID 708 wrote to memory of 5516 708 ZGO.exe 130 PID 5516 wrote to memory of 4460 5516 cmd.exe 134 PID 4460 wrote to memory of 5916 4460 MEO.exe 135 PID 5916 wrote to memory of 4720 5916 cmd.exe 139 PID 4720 wrote to memory of 616 4720 BZYBGT.exe 140 PID 616 wrote to memory of 2112 616 cmd.exe 144 PID 2112 wrote to memory of 988 2112 THMZTK.exe 145 PID 988 wrote to memory of 4448 988 cmd.exe 149 PID 4448 wrote to memory of 2240 4448 KCSRTCP.exe 150 PID 2240 wrote to memory of 2944 2240 cmd.exe 154 PID 2944 wrote to memory of 52 2944 GNAIH.exe 155 PID 52 wrote to memory of 1060 52 cmd.exe 159 PID 1060 wrote to memory of 3120 1060 RGQTZ.exe 160 PID 3120 wrote to memory of 3392 3120 cmd.exe 164 PID 3392 wrote to memory of 4524 3392 XBPBVQ.exe 165 PID 4524 wrote to memory of 3316 4524 cmd.exe 169 PID 3316 wrote to memory of 1852 3316 BRW.exe 170 PID 1852 wrote to memory of 3764 1852 cmd.exe 174 PID 3764 wrote to memory of 3500 3764 GKYE.exe 175 PID 3500 wrote to memory of 5332 3500 cmd.exe 179 PID 5332 wrote to memory of 5772 5332 TUOCAQI.exe 180 PID 5772 wrote to memory of 2624 5772 cmd.exe 184 PID 2624 wrote to memory of 4872 2624 MNVNRJQ.exe 185 PID 4872 wrote to memory of 3548 4872 cmd.exe 189 PID 3548 wrote to memory of 3828 3548 DYGDAX.exe 190 PID 3828 wrote to memory of 5208 3828 cmd.exe 194 PID 5208 wrote to memory of 5684 5208 POND.exe 195 PID 5684 wrote to memory of 4376 5684 cmd.exe 199 PID 4376 wrote to memory of 2888 4376 TRLYMAC.exe 200 PID 2888 wrote to memory of 2196 2888 cmd.exe 204 PID 2196 wrote to memory of 5040 2196 XZSY.exe 205 PID 5040 wrote to memory of 1244 5040 cmd.exe 209 PID 1244 wrote to memory of 5356 1244 FMEN.exe 210 PID 5356 wrote to memory of 3552 5356 cmd.exe 214 PID 3552 wrote to memory of 4568 3552 JULNNJ.exe 215 PID 4568 wrote to memory of 2464 4568 cmd.exe 219 PID 2464 wrote to memory of 5260 2464 HNODW.exe 220 PID 5260 wrote to memory of 4516 5260 cmd.exe 224 PID 4516 wrote to memory of 4952 4516 AIRZBNG.exe 225 PID 4952 wrote to memory of 1104 4952 cmd.exe 229 PID 1104 wrote to memory of 2608 1104 KGFTRV.exe 230 PID 2608 wrote to memory of 4932 2608 cmd.exe 233 PID 4932 wrote to memory of 6060 4932 LJJ.exe 235 PID 6060 wrote to memory of 4712 6060 cmd.exe 239 PID 4712 wrote to memory of 764 4712 AESBHY.exe 240 PID 764 wrote to memory of 1576 764 cmd.exe 244 PID 1576 wrote to memory of 5680 1576 RPVRQ.exe 245 PID 5680 wrote to memory of 2320 5680 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_ab95688e8f377779822c215706b956a2_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_ab95688e8f377779822c215706b956a2_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDIONH.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:796 -
C:\windows\system\UDIONH.exeC:\windows\system\UDIONH.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WJNZL.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\windows\WJNZL.exeC:\windows\WJNZL.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUYP.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\windows\VUYP.exeC:\windows\VUYP.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DZDW.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\windows\system\DZDW.exeC:\windows\system\DZDW.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FXIQMG.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\windows\SysWOW64\FXIQMG.exeC:\windows\system32\FXIQMG.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YQYBVG.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\windows\SysWOW64\YQYBVG.exeC:\windows\system32\YQYBVG.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XIBRE.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\windows\system\XIBRE.exeC:\windows\system\XIBRE.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGO.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\windows\ZGO.exeC:\windows\ZGO.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MEO.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\windows\MEO.exeC:\windows\MEO.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZYBGT.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\windows\BZYBGT.exeC:\windows\BZYBGT.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THMZTK.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\windows\SysWOW64\THMZTK.exeC:\windows\system32\THMZTK.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KCSRTCP.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:988 -
C:\windows\KCSRTCP.exeC:\windows\KCSRTCP.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GNAIH.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\windows\GNAIH.exeC:\windows\GNAIH.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGQTZ.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:52 -
C:\windows\system\RGQTZ.exeC:\windows\system\RGQTZ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XBPBVQ.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\windows\system\XBPBVQ.exeC:\windows\system\XBPBVQ.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRW.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\windows\SysWOW64\BRW.exeC:\windows\system32\BRW.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GKYE.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\windows\SysWOW64\GKYE.exeC:\windows\system32\GKYE.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TUOCAQI.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\windows\TUOCAQI.exeC:\windows\TUOCAQI.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MNVNRJQ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\windows\system\MNVNRJQ.exeC:\windows\system\MNVNRJQ.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYGDAX.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\windows\DYGDAX.exeC:\windows\DYGDAX.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\POND.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\windows\POND.exeC:\windows\POND.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRLYMAC.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\windows\system\TRLYMAC.exeC:\windows\system\TRLYMAC.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XZSY.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\windows\system\XZSY.exeC:\windows\system\XZSY.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FMEN.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\windows\system\FMEN.exeC:\windows\system\FMEN.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JULNNJ.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\windows\JULNNJ.exeC:\windows\JULNNJ.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HNODW.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\windows\SysWOW64\HNODW.exeC:\windows\system32\HNODW.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AIRZBNG.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\windows\SysWOW64\AIRZBNG.exeC:\windows\system32\AIRZBNG.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGFTRV.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\windows\SysWOW64\KGFTRV.exeC:\windows\system32\KGFTRV.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJJ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\windows\SysWOW64\LJJ.exeC:\windows\system32\LJJ.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AESBHY.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\windows\SysWOW64\AESBHY.exeC:\windows\system32\AESBHY.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPVRQ.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:764 -
C:\windows\system\RPVRQ.exeC:\windows\system\RPVRQ.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNJMF.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\windows\BNJMF.exeC:\windows\BNJMF.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVDRJS.exe.bat" "66⤵PID:4764
-
C:\windows\SysWOW64\KVDRJS.exeC:\windows\system32\KVDRJS.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDR.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1892 -
C:\windows\WDR.exeC:\windows\WDR.exe69⤵
- Executes dropped EXE
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DTSQTYI.exe.bat" "70⤵PID:3372
-
C:\windows\DTSQTYI.exeC:\windows\DTSQTYI.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JTAE.exe.bat" "72⤵PID:2904
-
C:\windows\SysWOW64\JTAE.exeC:\windows\system32\JTAE.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEIDZLF.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:1444 -
C:\windows\EEIDZLF.exeC:\windows\EEIDZLF.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OEK.exe.bat" "76⤵PID:3948
-
C:\windows\SysWOW64\OEK.exeC:\windows\system32\OEK.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFSVLK.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:2936 -
C:\windows\system\TFSVLK.exeC:\windows\system\TFSVLK.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXVOTSY.exe.bat" "80⤵PID:5656
-
C:\windows\system\FXVOTSY.exeC:\windows\system\FXVOTSY.exe81⤵
- Executes dropped EXE
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JNCO.exe.bat" "82⤵
- Executes a command shell one-liner
PID:2276 -
C:\windows\JNCO.exeC:\windows\JNCO.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JQFKLA.exe.bat" "84⤵
- Executes a command shell one-liner
PID:1280 -
C:\windows\system\JQFKLA.exeC:\windows\system\JQFKLA.exe85⤵
- Executes dropped EXE
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWGY.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:4452 -
C:\windows\system\JWGY.exeC:\windows\system\JWGY.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LULTCN.exe.bat" "88⤵
- Executes a command shell one-liner
PID:5696 -
C:\windows\LULTCN.exeC:\windows\LULTCN.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCSB.exe.bat" "90⤵PID:1632
-
C:\windows\system\XCSB.exeC:\windows\system\XCSB.exe91⤵
- Executes dropped EXE
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUV.exe.bat" "92⤵PID:4252
-
C:\windows\WUV.exeC:\windows\WUV.exe93⤵
- Executes dropped EXE
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFGZYAF.exe.bat" "94⤵PID:5804
-
C:\windows\NFGZYAF.exeC:\windows\NFGZYAF.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAPL.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:2020 -
C:\windows\CAPL.exeC:\windows\CAPL.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDTHWK.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:2044 -
C:\windows\SysWOW64\DDTHWK.exeC:\windows\system32\DDTHWK.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GLZPAV.exe.bat" "100⤵
- Executes a command shell one-liner
PID:6104 -
C:\windows\system\GLZPAV.exeC:\windows\system\GLZPAV.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWK.exe.bat" "102⤵PID:3000
-
C:\windows\FWK.exeC:\windows\FWK.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VMLWQW.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3404 -
C:\windows\VMLWQW.exeC:\windows\VMLWQW.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXUV.exe.bat" "106⤵PID:4708
-
C:\windows\SysWOW64\IXUV.exeC:\windows\system32\IXUV.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MFA.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5824 -
C:\windows\SysWOW64\MFA.exeC:\windows\system32\MFA.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SAZW.exe.bat" "110⤵PID:540
-
C:\windows\SAZW.exeC:\windows\SAZW.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YBHJEWX.exe.bat" "112⤵PID:2332
-
C:\windows\SysWOW64\YBHJEWX.exeC:\windows\system32\YBHJEWX.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CROR.exe.bat" "114⤵PID:1564
-
C:\windows\SysWOW64\CROR.exeC:\windows\system32\CROR.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHPJPCI.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4424 -
C:\windows\SysWOW64\RHPJPCI.exeC:\windows\system32\RHPJPCI.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EJFHD.exe.bat" "118⤵PID:688
-
C:\windows\system\EJFHD.exeC:\windows\system\EJFHD.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAM.exe.bat" "120⤵PID:1296
-
C:\windows\SysWOW64\IAM.exeC:\windows\system32\IAM.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-