Analysis
- max time kernel
89s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/10/2026, 21:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-25_8914c8e54e5baa0ef4fcfa2edc623516_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-25_8914c8e54e5baa0ef4fcfa2edc623516_elex_emotet_stop.exe
- Size 208KB
- Sample261026-zzwx1sgw21
- SHA256 93a5e8d82937a0b56b69b26469363a7e2d41697266e098808b81bc934bb98a9c
- MD5 8914c8e54e5baa0ef4fcfa2edc623516
- SHA1 9756eb0451e21500dd279ab3d8084796cb084288
- SHA512 766917204e378058725a6b2aaedc92f29a244858435ff08d4d0d5770e6ac761917dfbbd793a14bb81034d5576bdad8f740ccd00561ce9524f4918029d1b13764
- SSDEEP 3072:ILQaL9tbLkRIgd1Lye9yjE2hWAN5XbxlUKL+LOfs4pLthEjQT6j:slZtbLWIgd1LZ9oECZbxlUS+LO0kEj1
- TLSH T100247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4688 NJKN.exe 2204 AXCNWF.exe 4280 CVQH.exe 5984 GLXPXF.exe 5872 XLZV.exe 5628 NOIZMQJ.exe 1388 CEJ.exe 4996 RZSDEY.exe 2808 PMSD.exe 5100 OKD.exe 264 SNBBDZ.exe 4180 MBGLFZV.exe 4556 CEXPY.exe 1696 MBD.exe 5160 XPC.exe 1876 CMUXBZV.exe 4844 MKARJH.exe 5688 LYP.exe 1680 DTSQTYI.exe 3660 PJZQ.exe 4884 EEIDZLF.exe 3120 CZIDV.exe 5640 ZXNA.exe 5304 ZPOUQ.exe 4524 KIRNZJ.exe 5388 VBUFHQI.exe 2596 PTP.exe 5940 JHUIR.exe 3268 YMAFYHO.exe 4964 EMHSPKP.exe 4936 VNJXT.exe 2952 JSPVA.exe 1072 PTXIJLV.exe 1244 RQQ.exe 4528 ETMJUZG.exe 3420 IJBJ.exe 6020 DXFSRR.exe 2436 SSPF.exe 2788 DKKPK.exe 2980 DYKEMY.exe 4880 JYS.exe 4700 RJA.exe 3124 ARCYMCT.exe 4800 XOAVBM.exe 4848 GXC.exe 4392 HAGEKHZ.exe 2964 NSOS.exe 5376 HNSBDB.exe 2724 AIWXJZY.exe 3368 RRYK.exe 464 PRGYDZ.exe 424 BZM.exe 5788 WURHA.exe 1236 SSXEHTG.exe 3264 SFX.exe 4368 LBBOO.exe 1764 RBJCFYM.exe 4264 XBQQ.exe 2324 THON.exe 4340 VEPP.exe 6044 BFXDKTG.exe 2364 WSC.exe 3192 YQVG.exe 5168 JJY.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\TLKP.exe TFK.exe File created C:\windows\SysWOW64\AIWXJZY.exe HNSBDB.exe File created C:\windows\SysWOW64\NKT.exe WXJRLPA.exe File created C:\windows\SysWOW64\DZULK.exe.bat UMK.exe File created C:\windows\SysWOW64\FXVN.exe.bat DZULK.exe File created C:\windows\SysWOW64\PEOY.exe.bat SYIB.exe File created C:\windows\SysWOW64\EFYRJXX.exe.bat VEWMFS.exe File created C:\windows\SysWOW64\PEIXTN.exe HYQIKA.exe File created C:\windows\SysWOW64\AXCNWF.exe.bat NJKN.exe File created C:\windows\SysWOW64\PRGYDZ.exe RRYK.exe File opened for modification C:\windows\SysWOW64\BZM.exe PRGYDZ.exe File created C:\windows\SysWOW64\SULW.exe.bat MTDJCBO.exe File created C:\windows\SysWOW64\ZPOUQ.exe.bat ZXNA.exe File created C:\windows\SysWOW64\PTG.exe JTHBP.exe File created C:\windows\SysWOW64\TLKP.exe.bat TFK.exe File created C:\windows\SysWOW64\ETMJUZG.exe RQQ.exe File opened for modification C:\windows\SysWOW64\QSXH.exe EAUPF.exe File created C:\windows\SysWOW64\IVERVQL.exe.bat EFYRJXX.exe File opened for modification C:\windows\SysWOW64\THON.exe XBQQ.exe File opened for modification C:\windows\SysWOW64\YQVG.exe WSC.exe File created C:\windows\SysWOW64\IXYTL.exe.bat NKT.exe File created C:\windows\SysWOW64\SYIB.exe STI.exe File created C:\windows\SysWOW64\STI.exe HANUYUH.exe File opened for modification C:\windows\SysWOW64\PMSD.exe RZSDEY.exe File created C:\windows\SysWOW64\PTXIJLV.exe JSPVA.exe File opened for modification C:\windows\SysWOW64\WURHA.exe BZM.exe File opened for modification C:\windows\SysWOW64\NOIZMQJ.exe XLZV.exe File created C:\windows\SysWOW64\JSPVA.exe.bat VNJXT.exe File created C:\windows\SysWOW64\RQQ.exe.bat PTXIJLV.exe File created C:\windows\SysWOW64\RRYK.exe AIWXJZY.exe File created C:\windows\SysWOW64\BFXDKTG.exe VEPP.exe File created C:\windows\SysWOW64\JSPVA.exe VNJXT.exe File created C:\windows\SysWOW64\XOAVBM.exe.bat ARCYMCT.exe File created C:\windows\SysWOW64\SGC.exe.bat QSXH.exe File created C:\windows\SysWOW64\PEIXTN.exe.bat HYQIKA.exe File opened for modification C:\windows\SysWOW64\KIRNZJ.exe ZPOUQ.exe File created C:\windows\SysWOW64\JYS.exe DYKEMY.exe File created C:\windows\SysWOW64\WURHA.exe.bat BZM.exe File created C:\windows\SysWOW64\YQVG.exe.bat WSC.exe File created C:\windows\SysWOW64\NOIZMQJ.exe XLZV.exe File opened for modification C:\windows\SysWOW64\PTXIJLV.exe JSPVA.exe File created C:\windows\SysWOW64\IVERVQL.exe EFYRJXX.exe File opened for modification C:\windows\SysWOW64\XOAVBM.exe ARCYMCT.exe File created C:\windows\SysWOW64\SGC.exe QSXH.exe File created C:\windows\SysWOW64\ETMJUZG.exe.bat RQQ.exe File created C:\windows\SysWOW64\VNJXT.exe.bat EMHSPKP.exe File created C:\windows\SysWOW64\PTXIJLV.exe.bat JSPVA.exe File created C:\windows\SysWOW64\JYS.exe.bat DYKEMY.exe File opened for modification C:\windows\SysWOW64\SULW.exe MTDJCBO.exe File opened for modification C:\windows\SysWOW64\PEOY.exe SYIB.exe File created C:\windows\SysWOW64\EFYRJXX.exe VEWMFS.exe File created C:\windows\SysWOW64\PMSD.exe.bat RZSDEY.exe File created C:\windows\SysWOW64\KIRNZJ.exe ZPOUQ.exe File opened for modification C:\windows\SysWOW64\VNJXT.exe EMHSPKP.exe File created C:\windows\SysWOW64\SSPF.exe DXFSRR.exe File created C:\windows\SysWOW64\NOIZMQJ.exe.bat XLZV.exe File created C:\windows\SysWOW64\KIRNZJ.exe.bat ZPOUQ.exe File created C:\windows\SysWOW64\DZULK.exe UMK.exe File created C:\windows\SysWOW64\FXVN.exe DZULK.exe File created C:\windows\SysWOW64\EAUPF.exe THRW.exe File opened for modification C:\windows\SysWOW64\JYS.exe DYKEMY.exe File created C:\windows\SysWOW64\IXYTL.exe NKT.exe File opened for modification C:\windows\SysWOW64\DPVQGL.exe NML.exe File opened for modification C:\windows\SysWOW64\RRYK.exe AIWXJZY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\NSOS.exe HAGEKHZ.exe File created C:\windows\system\SFX.exe SSXEHTG.exe File opened for modification C:\windows\system\RBJCFYM.exe LBBOO.exe File created C:\windows\JTHBP.exe JJY.exe File opened for modification C:\windows\JTHBP.exe JJY.exe File opened for modification C:\windows\RGYZS.exe MGR.exe File opened for modification C:\windows\ZMUMNWT.exe PHKUX.exe File opened for modification C:\windows\system\DYKEMY.exe DKKPK.exe File created C:\windows\system\DYKEMY.exe.bat DKKPK.exe File created C:\windows\SSXEHTG.exe.bat WURHA.exe File created C:\windows\system\NGFWLMO.exe.bat ETUEVP.exe File opened for modification C:\windows\THRW.exe ZMUMNWT.exe File created C:\windows\system\NML.exe NHTXTMG.exe File opened for modification C:\windows\system\NML.exe NHTXTMG.exe File created C:\windows\UOYM.exe LJO.exe File created C:\windows\PJZQ.exe.bat DTSQTYI.exe File created C:\windows\system\MAZXIUV.exe.bat RFUOX.exe File created C:\windows\RGYZS.exe.bat MGR.exe File opened for modification C:\windows\ETUEVP.exe SARMV.exe File created C:\windows\system\XAED.exe.bat CMHUF.exe File opened for modification C:\windows\system\XBRPKR.exe TLKP.exe File created C:\windows\system\MKARJH.exe CMUXBZV.exe File created C:\windows\EEIDZLF.exe.bat PJZQ.exe File opened for modification C:\windows\system\YMAFYHO.exe JHUIR.exe File opened for modification C:\windows\system\IJBJ.exe ETMJUZG.exe File opened for modification C:\windows\QNDC.exe DPVQGL.exe File opened for modification C:\windows\CEXPY.exe MBGLFZV.exe File created C:\windows\DXFSRR.exe IJBJ.exe File created C:\windows\system\RJA.exe JYS.exe File opened for modification C:\windows\ARCYMCT.exe RJA.exe File created C:\windows\SSXEHTG.exe WURHA.exe File opened for modification C:\windows\system\MTDJCBO.exe RGYZS.exe File opened for modification C:\windows\system\PHKUX.exe YYI.exe File created C:\windows\system\IGMKKSX.exe CGEWT.exe File created C:\windows\XLZV.exe GLXPXF.exe File created C:\windows\system\EMHSPKP.exe.bat YMAFYHO.exe File opened for modification C:\windows\RGAYPQ.exe IXYTL.exe File opened for modification C:\windows\UMK.exe OZTSPUW.exe File created C:\windows\system\NML.exe.bat NHTXTMG.exe File created C:\windows\QNDC.exe DPVQGL.exe File created C:\windows\system\HANUYUH.exe QNDC.exe File opened for modification C:\windows\system\CVQH.exe AXCNWF.exe File opened for modification C:\windows\CMUXBZV.exe XPC.exe File created C:\windows\system\DYKEMY.exe DKKPK.exe File created C:\windows\system\GXC.exe.bat XOAVBM.exe File created C:\windows\MGR.exe MAZXIUV.exe File created C:\windows\system\MTDJCBO.exe.bat RGYZS.exe File created C:\windows\system\IYLE.exe ODG.exe File created C:\windows\system\HANUYUH.exe.bat QNDC.exe File opened for modification C:\windows\GLXPXF.exe CVQH.exe File opened for modification C:\windows\system\EMHSPKP.exe YMAFYHO.exe File created C:\windows\system\IJBJ.exe ETMJUZG.exe File created C:\windows\system\SFX.exe.bat SSXEHTG.exe File created C:\windows\WSC.exe.bat BFXDKTG.exe File created C:\windows\RGYZS.exe MGR.exe File created C:\windows\RGAYPQ.exe.bat IXYTL.exe File opened for modification C:\windows\UOYM.exe LJO.exe File created C:\windows\SNBBDZ.exe.bat OKD.exe File opened for modification C:\windows\system\MKARJH.exe CMUXBZV.exe File created C:\windows\DTSQTYI.exe.bat LYP.exe File created C:\windows\CZIDV.exe EEIDZLF.exe File created C:\windows\ZXNA.exe CZIDV.exe File created C:\windows\system\YMAFYHO.exe.bat JHUIR.exe File created C:\windows\DKKPK.exe.bat SSPF.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4384 cmd.exe 2848 cmd.exe 4328 cmd.exe 1296 cmd.exe 2072 cmd.exe 3472 cmd.exe 4784 cmd.exe 2300 cmd.exe 5176 cmd.exe 5044 cmd.exe 3340 cmd.exe 3544 cmd.exe 3032 cmd.exe 5524 cmd.exe 2552 cmd.exe 2372 cmd.exe 3528 cmd.exe 2632 cmd.exe 5428 cmd.exe 4124 cmd.exe 1968 cmd.exe 2944 cmd.exe 5836 cmd.exe 1004 cmd.exe 3288 cmd.exe 1516 cmd.exe 360 cmd.exe 4216 cmd.exe 2536 cmd.exe 964 cmd.exe 4084 cmd.exe 3616 cmd.exe 1292 cmd.exe 4664 cmd.exe 4728 cmd.exe 4376 cmd.exe 4232 cmd.exe 5344 cmd.exe 1960 cmd.exe 2500 cmd.exe 552 cmd.exe 3904 cmd.exe 4248 cmd.exe 4820 cmd.exe 3212 cmd.exe 708 cmd.exe 3456 cmd.exe 1800 cmd.exe 4324 cmd.exe 5284 cmd.exe 1956 cmd.exe 6076 cmd.exe 4332 cmd.exe 3008 cmd.exe 5272 cmd.exe 2572 cmd.exe 4596 cmd.exe 2108 cmd.exe 3936 cmd.exe 5116 cmd.exe 5124 cmd.exe 5652 cmd.exe 5404 cmd.exe 5600 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 6124 1232 WerFault.exe 88 1696 4688 WerFault.exe 93 5044 2204 WerFault.exe 99 4564 4280 WerFault.exe 104 5912 5984 WerFault.exe 109 3304 5872 WerFault.exe 114 5836 5628 WerFault.exe 119 3212 1388 WerFault.exe 124 5428 4996 WerFault.exe 129 5052 2808 WerFault.exe 134 260 5100 WerFault.exe 139 4384 264 WerFault.exe 144 2744 4180 WerFault.exe 149 628 4556 WerFault.exe 154 2612 1696 WerFault.exe 159 4608 5160 WerFault.exe 164 2192 1876 WerFault.exe 169 3708 4844 WerFault.exe 174 1864 5688 WerFault.exe 178 5576 1680 WerFault.exe 184 4456 3660 WerFault.exe 189 2488 4884 WerFault.exe 194 5632 3120 WerFault.exe 199 2072 5640 WerFault.exe 204 3772 5304 WerFault.exe 209 1384 4524 WerFault.exe 214 1512 5388 WerFault.exe 219 2352 2596 WerFault.exe 224 3436 5940 WerFault.exe 229 4444 3268 WerFault.exe 234 2704 4964 WerFault.exe 239 4184 4936 WerFault.exe 244 5976 2952 WerFault.exe 249 2316 1072 WerFault.exe 254 4816 1244 WerFault.exe 259 2468 4528 WerFault.exe 264 1248 3420 WerFault.exe 269 5132 6020 WerFault.exe 274 6132 2436 WerFault.exe 279 1504 2788 WerFault.exe 284 3496 2980 WerFault.exe 289 1904 4880 WerFault.exe 294 4200 4700 WerFault.exe 299 2848 3124 WerFault.exe 304 6124 4800 WerFault.exe 309 5600 4848 WerFault.exe 314 1048 4392 WerFault.exe 319 1772 2964 WerFault.exe 324 5468 5376 WerFault.exe 329 5796 2724 WerFault.exe 334 4976 3368 WerFault.exe 339 760 464 WerFault.exe 344 2972 424 WerFault.exe 349 952 5788 WerFault.exe 354 6124 1236 WerFault.exe 359 2420 3264 WerFault.exe 364 5972 4368 WerFault.exe 369 3896 1764 WerFault.exe 374 4252 4264 WerFault.exe 379 5040 2324 WerFault.exe 384 5812 4340 WerFault.exe 389 4384 6044 WerFault.exe 394 5852 2364 WerFault.exe 399 2744 3192 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DXFSRR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-25_8914c8e54e5baa0ef4fcfa2edc623516_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNJXT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMHSPKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJBJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHKUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DTSQTYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QNDC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTHBP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYLE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVERVQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEXPY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIRNZJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HANUYUH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLXPXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBJCFYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXYTL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGAYPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PEOY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFYRJXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HYQIKA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAUPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SULW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1232 2026-10-25_8914c8e54e5baa0ef4fcfa2edc623516_elex_emotet_stop.exe 1232 2026-10-25_8914c8e54e5baa0ef4fcfa2edc623516_elex_emotet_stop.exe 4688 NJKN.exe 4688 NJKN.exe 2204 AXCNWF.exe 2204 AXCNWF.exe 4280 CVQH.exe 4280 CVQH.exe 5984 GLXPXF.exe 5984 GLXPXF.exe 5872 XLZV.exe 5872 XLZV.exe 5628 NOIZMQJ.exe 5628 NOIZMQJ.exe 1388 CEJ.exe 1388 CEJ.exe 4996 RZSDEY.exe 4996 RZSDEY.exe 2808 PMSD.exe 2808 PMSD.exe 5100 OKD.exe 5100 OKD.exe 264 SNBBDZ.exe 264 SNBBDZ.exe 4180 MBGLFZV.exe 4180 MBGLFZV.exe 4556 CEXPY.exe 4556 CEXPY.exe 1696 MBD.exe 1696 MBD.exe 5160 XPC.exe 5160 XPC.exe 1876 CMUXBZV.exe 1876 CMUXBZV.exe 4844 MKARJH.exe 4844 MKARJH.exe 5688 LYP.exe 5688 LYP.exe 1680 DTSQTYI.exe 1680 DTSQTYI.exe 3660 PJZQ.exe 3660 PJZQ.exe 4884 EEIDZLF.exe 4884 EEIDZLF.exe 3120 CZIDV.exe 3120 CZIDV.exe 5640 ZXNA.exe 5640 ZXNA.exe 5304 ZPOUQ.exe 5304 ZPOUQ.exe 4524 KIRNZJ.exe 4524 KIRNZJ.exe 5388 VBUFHQI.exe 5388 VBUFHQI.exe 2596 PTP.exe 2596 PTP.exe 5940 JHUIR.exe 5940 JHUIR.exe 3268 YMAFYHO.exe 3268 YMAFYHO.exe 4964 EMHSPKP.exe 4964 EMHSPKP.exe 4936 VNJXT.exe 4936 VNJXT.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1232 2026-10-25_8914c8e54e5baa0ef4fcfa2edc623516_elex_emotet_stop.exe 1232 2026-10-25_8914c8e54e5baa0ef4fcfa2edc623516_elex_emotet_stop.exe 4688 NJKN.exe 4688 NJKN.exe 2204 AXCNWF.exe 2204 AXCNWF.exe 4280 CVQH.exe 4280 CVQH.exe 5984 GLXPXF.exe 5984 GLXPXF.exe 5872 XLZV.exe 5872 XLZV.exe 5628 NOIZMQJ.exe 5628 NOIZMQJ.exe 1388 CEJ.exe 1388 CEJ.exe 4996 RZSDEY.exe 4996 RZSDEY.exe 2808 PMSD.exe 2808 PMSD.exe 5100 OKD.exe 5100 OKD.exe 264 SNBBDZ.exe 264 SNBBDZ.exe 4180 MBGLFZV.exe 4180 MBGLFZV.exe 4556 CEXPY.exe 4556 CEXPY.exe 1696 MBD.exe 1696 MBD.exe 5160 XPC.exe 5160 XPC.exe 1876 CMUXBZV.exe 1876 CMUXBZV.exe 4844 MKARJH.exe 4844 MKARJH.exe 5688 LYP.exe 5688 LYP.exe 1680 DTSQTYI.exe 1680 DTSQTYI.exe 3660 PJZQ.exe 3660 PJZQ.exe 4884 EEIDZLF.exe 4884 EEIDZLF.exe 3120 CZIDV.exe 3120 CZIDV.exe 5640 ZXNA.exe 5640 ZXNA.exe 5304 ZPOUQ.exe 5304 ZPOUQ.exe 4524 KIRNZJ.exe 4524 KIRNZJ.exe 5388 VBUFHQI.exe 5388 VBUFHQI.exe 2596 PTP.exe 2596 PTP.exe 5940 JHUIR.exe 5940 JHUIR.exe 3268 YMAFYHO.exe 3268 YMAFYHO.exe 4964 EMHSPKP.exe 4964 EMHSPKP.exe 4936 VNJXT.exe 4936 VNJXT.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1232 wrote to memory of 1888 1232 2026-10-25_8914c8e54e5baa0ef4fcfa2edc623516_elex_emotet_stop.exe 89 PID 1888 wrote to memory of 4688 1888 cmd.exe 93 PID 4688 wrote to memory of 4728 4688 NJKN.exe 95 PID 4728 wrote to memory of 2204 4728 cmd.exe 99 PID 2204 wrote to memory of 2748 2204 AXCNWF.exe 100 PID 2748 wrote to memory of 4280 2748 cmd.exe 104 PID 4280 wrote to memory of 4216 4280 CVQH.exe 105 PID 4216 wrote to memory of 5984 4216 cmd.exe 109 PID 5984 wrote to memory of 5732 5984 GLXPXF.exe 110 PID 5732 wrote to memory of 5872 5732 cmd.exe 114 PID 5872 wrote to memory of 5016 5872 XLZV.exe 115 PID 5016 wrote to memory of 5628 5016 cmd.exe 119 PID 5628 wrote to memory of 1116 5628 NOIZMQJ.exe 120 PID 1116 wrote to memory of 1388 1116 cmd.exe 124 PID 1388 wrote to memory of 3792 1388 CEJ.exe 125 PID 3792 wrote to memory of 4996 3792 cmd.exe 129 PID 4996 wrote to memory of 6072 4996 RZSDEY.exe 130 PID 6072 wrote to memory of 2808 6072 cmd.exe 134 PID 2808 wrote to memory of 5668 2808 PMSD.exe 135 PID 5668 wrote to memory of 5100 5668 cmd.exe 139 PID 5100 wrote to memory of 2904 5100 OKD.exe 140 PID 2904 wrote to memory of 264 2904 cmd.exe 144 PID 264 wrote to memory of 2688 264 SNBBDZ.exe 145 PID 2688 wrote to memory of 4180 2688 cmd.exe 149 PID 4180 wrote to memory of 5648 4180 MBGLFZV.exe 150 PID 5648 wrote to memory of 4556 5648 cmd.exe 154 PID 4556 wrote to memory of 3032 4556 CEXPY.exe 155 PID 3032 wrote to memory of 1696 3032 cmd.exe 159 PID 1696 wrote to memory of 1968 1696 MBD.exe 160 PID 1968 wrote to memory of 5160 1968 cmd.exe 164 PID 5160 wrote to memory of 3744 5160 XPC.exe 165 PID 3744 wrote to memory of 1876 3744 cmd.exe 169 PID 1876 wrote to memory of 3400 1876 CMUXBZV.exe 170 PID 3400 wrote to memory of 4844 3400 cmd.exe 174 PID 4844 wrote to memory of 6016 4844 MKARJH.exe 175 PID 6016 wrote to memory of 5688 6016 cmd.exe 178 PID 5688 wrote to memory of 3904 5688 LYP.exe 180 PID 3904 wrote to memory of 1680 3904 cmd.exe 184 PID 1680 wrote to memory of 1868 1680 DTSQTYI.exe 185 PID 1868 wrote to memory of 3660 1868 cmd.exe 189 PID 3660 wrote to memory of 3348 3660 PJZQ.exe 190 PID 3348 wrote to memory of 4884 3348 cmd.exe 194 PID 4884 wrote to memory of 4248 4884 EEIDZLF.exe 195 PID 4248 wrote to memory of 3120 4248 cmd.exe 199 PID 3120 wrote to memory of 2584 3120 CZIDV.exe 200 PID 2584 wrote to memory of 5640 2584 cmd.exe 204 PID 5640 wrote to memory of 2836 5640 ZXNA.exe 205 PID 2836 wrote to memory of 5304 2836 cmd.exe 209 PID 5304 wrote to memory of 4820 5304 ZPOUQ.exe 210 PID 4820 wrote to memory of 4524 4820 cmd.exe 214 PID 4524 wrote to memory of 5524 4524 KIRNZJ.exe 215 PID 5524 wrote to memory of 5388 5524 cmd.exe 219 PID 5388 wrote to memory of 3608 5388 VBUFHQI.exe 220 PID 3608 wrote to memory of 2596 3608 cmd.exe 224 PID 2596 wrote to memory of 416 2596 PTP.exe 225 PID 416 wrote to memory of 5940 416 cmd.exe 229 PID 5940 wrote to memory of 3304 5940 JHUIR.exe 230 PID 3304 wrote to memory of 3268 3304 cmd.exe 234 PID 3268 wrote to memory of 3212 3268 YMAFYHO.exe 235 PID 3212 wrote to memory of 4964 3212 cmd.exe 239 PID 4964 wrote to memory of 3852 4964 EMHSPKP.exe 240 PID 3852 wrote to memory of 4936 3852 cmd.exe 244 PID 4936 wrote to memory of 2572 4936 VNJXT.exe 245 PID 2572 wrote to memory of 2952 2572 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_8914c8e54e5baa0ef4fcfa2edc623516_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_8914c8e54e5baa0ef4fcfa2edc623516_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NJKN.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\windows\NJKN.exeC:\windows\NJKN.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AXCNWF.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\windows\SysWOW64\AXCNWF.exeC:\windows\system32\AXCNWF.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CVQH.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\windows\system\CVQH.exeC:\windows\system\CVQH.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLXPXF.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\GLXPXF.exeC:\windows\GLXPXF.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XLZV.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\windows\XLZV.exeC:\windows\XLZV.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOIZMQJ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\windows\SysWOW64\NOIZMQJ.exeC:\windows\system32\NOIZMQJ.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEJ.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\windows\CEJ.exeC:\windows\CEJ.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RZSDEY.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\windows\system\RZSDEY.exeC:\windows\system\RZSDEY.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMSD.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\windows\SysWOW64\PMSD.exeC:\windows\system32\PMSD.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKD.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\windows\system\OKD.exeC:\windows\system\OKD.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNBBDZ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\windows\SNBBDZ.exeC:\windows\SNBBDZ.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MBGLFZV.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\windows\system\MBGLFZV.exeC:\windows\system\MBGLFZV.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEXPY.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\windows\CEXPY.exeC:\windows\CEXPY.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MBD.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\windows\MBD.exeC:\windows\MBD.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPC.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\windows\system\XPC.exeC:\windows\system\XPC.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMUXBZV.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\windows\CMUXBZV.exeC:\windows\CMUXBZV.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKARJH.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\windows\system\MKARJH.exeC:\windows\system\MKARJH.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LYP.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\windows\LYP.exeC:\windows\LYP.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DTSQTYI.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\windows\DTSQTYI.exeC:\windows\DTSQTYI.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJZQ.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\windows\PJZQ.exeC:\windows\PJZQ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEIDZLF.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\windows\EEIDZLF.exeC:\windows\EEIDZLF.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZIDV.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\windows\CZIDV.exeC:\windows\CZIDV.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZXNA.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\windows\ZXNA.exeC:\windows\ZXNA.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZPOUQ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\windows\SysWOW64\ZPOUQ.exeC:\windows\system32\ZPOUQ.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KIRNZJ.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\windows\SysWOW64\KIRNZJ.exeC:\windows\system32\KIRNZJ.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VBUFHQI.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\windows\SysWOW64\VBUFHQI.exeC:\windows\system32\VBUFHQI.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PTP.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\windows\system\PTP.exeC:\windows\system\PTP.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JHUIR.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:416 -
C:\windows\system\JHUIR.exeC:\windows\system\JHUIR.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YMAFYHO.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\windows\system\YMAFYHO.exeC:\windows\system\YMAFYHO.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMHSPKP.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\windows\system\EMHSPKP.exeC:\windows\system\EMHSPKP.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNJXT.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\windows\SysWOW64\VNJXT.exeC:\windows\system32\VNJXT.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSPVA.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\windows\SysWOW64\JSPVA.exeC:\windows\system32\JSPVA.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PTXIJLV.exe.bat" "66⤵
- Executes a command shell one-liner
PID:2300 -
C:\windows\SysWOW64\PTXIJLV.exeC:\windows\system32\PTXIJLV.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RQQ.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5284 -
C:\windows\SysWOW64\RQQ.exeC:\windows\system32\RQQ.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ETMJUZG.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5652 -
C:\windows\SysWOW64\ETMJUZG.exeC:\windows\system32\ETMJUZG.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IJBJ.exe.bat" "72⤵PID:3132
-
C:\windows\system\IJBJ.exeC:\windows\system\IJBJ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DXFSRR.exe.bat" "74⤵PID:4104
-
C:\windows\DXFSRR.exeC:\windows\DXFSRR.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSPF.exe.bat" "76⤵PID:2448
-
C:\windows\SysWOW64\SSPF.exeC:\windows\system32\SSPF.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DKKPK.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:3612 -
C:\windows\DKKPK.exeC:\windows\DKKPK.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYKEMY.exe.bat" "80⤵PID:5276
-
C:\windows\system\DYKEMY.exeC:\windows\system\DYKEMY.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JYS.exe.bat" "82⤵PID:2780
-
C:\windows\SysWOW64\JYS.exeC:\windows\system32\JYS.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RJA.exe.bat" "84⤵
- Executes a command shell one-liner
PID:5176 -
C:\windows\system\RJA.exeC:\windows\system\RJA.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ARCYMCT.exe.bat" "86⤵
- Executes a command shell one-liner
PID:5404 -
C:\windows\ARCYMCT.exeC:\windows\ARCYMCT.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOAVBM.exe.bat" "88⤵PID:4208
-
C:\windows\SysWOW64\XOAVBM.exeC:\windows\system32\XOAVBM.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXC.exe.bat" "90⤵PID:5060
-
C:\windows\system\GXC.exeC:\windows\system\GXC.exe91⤵
- Executes dropped EXE
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAGEKHZ.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4772 -
C:\windows\HAGEKHZ.exeC:\windows\HAGEKHZ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSOS.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2944 -
C:\windows\system\NSOS.exeC:\windows\system\NSOS.exe95⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HNSBDB.exe.bat" "96⤵PID:5108
-
C:\windows\SysWOW64\HNSBDB.exeC:\windows\system32\HNSBDB.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AIWXJZY.exe.bat" "98⤵
- Executes a command shell one-liner
PID:4596 -
C:\windows\SysWOW64\AIWXJZY.exeC:\windows\system32\AIWXJZY.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RRYK.exe.bat" "100⤵PID:4288
-
C:\windows\SysWOW64\RRYK.exeC:\windows\system32\RRYK.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRGYDZ.exe.bat" "102⤵PID:2508
-
C:\windows\SysWOW64\PRGYDZ.exeC:\windows\system32\PRGYDZ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BZM.exe.bat" "104⤵PID:2704
-
C:\windows\SysWOW64\BZM.exeC:\windows\system32\BZM.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WURHA.exe.bat" "106⤵PID:4812
-
C:\windows\SysWOW64\WURHA.exeC:\windows\system32\WURHA.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSXEHTG.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:2444 -
C:\windows\SSXEHTG.exeC:\windows\SSXEHTG.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFX.exe.bat" "110⤵PID:4864
-
C:\windows\system\SFX.exeC:\windows\system\SFX.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LBBOO.exe.bat" "112⤵PID:1852
-
C:\windows\LBBOO.exeC:\windows\LBBOO.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBJCFYM.exe.bat" "114⤵PID:4312
-
C:\windows\system\RBJCFYM.exeC:\windows\system\RBJCFYM.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBQQ.exe.bat" "116⤵PID:2720
-
C:\windows\XBQQ.exeC:\windows\XBQQ.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THON.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4604 -
C:\windows\SysWOW64\THON.exeC:\windows\system32\THON.exe119⤵
- Executes dropped EXE
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VEPP.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5836 -
C:\windows\system\VEPP.exeC:\windows\system\VEPP.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-