Analysis
- max time kernel
58s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 00:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_8a52646eae5f9080693fd79357b2808b_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-28_8a52646eae5f9080693fd79357b2808b_elex_emotet_stop.exe
- Size 208KB
- Sample261030-afmgssvs2j
- SHA256 2d825e5b7834b0d6f36db7eda170f22b9d7b2aba51dbfdabe9d6c2d8a349ab8a
- MD5 8a52646eae5f9080693fd79357b2808b
- SHA1 f4fcd436e3154fb542e0bf0a192850a7f79addb4
- SHA512 5461d2d17ed726ff9798ed645b06362cfe564e150835085d55c95de64a15cdf07d7f62af4d4eba7358347271fef4fd0148e3a36031b8f7c0296fd98d9ba535b7
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5Xb8lUKL+LOfU4pLthEjQT6j:MlZtbLWIgd1LZ9oECZb8lUS+LOckEj1
- TLSH T123247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4324 UTAJ.exe 1644 PYZFM.exe 4572 FOAFKQB.exe 4480 IWHFXJ.exe 4696 DKM.exe 4124 YXRGR.exe 4140 IVWSZJB.exe 2364 TNZ.exe 2560 MQDOM.exe 4952 BLM.exe 4640 ZWL.exe 260 ZPTKLH.exe 6036 ASXOYXM.exe 4768 YSFBH.exe 5016 UQDZ.exe 4492 ALCZTEF.exe 2352 JYM.exe 4820 EMRBL.exe 3184 MRRPUOK.exe 2884 SRZ.exe 5300 WHGDQ.exe 2980 LYHC.exe 3828 NVM.exe 5732 IJRGO.exe 1440 CWWQQEI.exe 2288 SMX.exe 5384 WCDPJKL.exe 3252 HVGIRRB.exe 2808 KIL.exe 4676 ZDVVNL.exe 600 GTWVT.exe 5368 VOF.exe 2396 UZQPNAK.exe 6032 NZXAWBA.exe 4644 ZNEYC.exe 2652 LVL.exe 1572 PDSGAFY.exe 1608 CJASCQ.exe 1536 VBHD.exe 3420 ZRO.exe 5984 NPWXZN.exe 4748 EXCUMEQ.exe 1476 RASTA.exe 3632 ZOXZ.exe 4348 XEKRBUX.exe 2948 EJEEHOS.exe 6020 XFXCVC.exe 5000 ANGRC.exe 1912 LQKL.exe 3516 JGXD.exe 4972 RUKJ.exe 4924 ZZO.exe 1160 MFBUNY.exe 3492 PNJRMKU.exe 5112 QQA.exe 2336 JETDOPL.exe 5948 JMZABGG.exe 5036 NPKN.exe 2968 VCXU.exe 3840 DIJ.exe 1436 LNO.exe 2952 IOYRUKE.exe 3280 YBPQG.exe 3548 RPI.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\HVGIRRB.exe.bat WCDPJKL.exe File opened for modification C:\windows\SysWOW64\ZDVVNL.exe KIL.exe File created C:\windows\SysWOW64\NZXAWBA.exe.bat UZQPNAK.exe File created C:\windows\SysWOW64\RUKJ.exe JGXD.exe File created C:\windows\SysWOW64\MFBUNY.exe.bat ZZO.exe File created C:\windows\SysWOW64\AIN.exe.bat HXDAKC.exe File created C:\windows\SysWOW64\MRRPUOK.exe.bat EMRBL.exe File created C:\windows\SysWOW64\NVM.exe.bat LYHC.exe File created C:\windows\SysWOW64\WCDPJKL.exe.bat SMX.exe File created C:\windows\SysWOW64\NPWXZN.exe ZRO.exe File created C:\windows\SysWOW64\JGXD.exe LQKL.exe File created C:\windows\SysWOW64\RPI.exe.bat YBPQG.exe File created C:\windows\SysWOW64\HVGIRRB.exe WCDPJKL.exe File opened for modification C:\windows\SysWOW64\ZZO.exe RUKJ.exe File created C:\windows\SysWOW64\ZZO.exe.bat RUKJ.exe File created C:\windows\SysWOW64\MFBUNY.exe ZZO.exe File created C:\windows\SysWOW64\RPI.exe YBPQG.exe File created C:\windows\SysWOW64\ZWL.exe BLM.exe File created C:\windows\SysWOW64\MRRPUOK.exe EMRBL.exe File created C:\windows\SysWOW64\WHGDQ.exe.bat SRZ.exe File created C:\windows\SysWOW64\CWWQQEI.exe IJRGO.exe File opened for modification C:\windows\SysWOW64\MFBUNY.exe ZZO.exe File created C:\windows\SysWOW64\ALCZTEF.exe UQDZ.exe File opened for modification C:\windows\SysWOW64\ALCZTEF.exe UQDZ.exe File opened for modification C:\windows\SysWOW64\WHGDQ.exe SRZ.exe File opened for modification C:\windows\SysWOW64\SMX.exe CWWQQEI.exe File created C:\windows\SysWOW64\VOF.exe GTWVT.exe File opened for modification C:\windows\SysWOW64\XFXCVC.exe EJEEHOS.exe File created C:\windows\SysWOW64\NVM.exe LYHC.exe File opened for modification C:\windows\SysWOW64\CWWQQEI.exe IJRGO.exe File opened for modification C:\windows\SysWOW64\WCDPJKL.exe SMX.exe File created C:\windows\SysWOW64\XFXCVC.exe EJEEHOS.exe File created C:\windows\SysWOW64\LNO.exe.bat DIJ.exe File opened for modification C:\windows\SysWOW64\YXRGR.exe DKM.exe File opened for modification C:\windows\SysWOW64\NVM.exe LYHC.exe File created C:\windows\SysWOW64\NZXAWBA.exe UZQPNAK.exe File created C:\windows\SysWOW64\LVL.exe ZNEYC.exe File created C:\windows\SysWOW64\PDSGAFY.exe LVL.exe File opened for modification C:\windows\SysWOW64\PDSGAFY.exe LVL.exe File created C:\windows\SysWOW64\ZZO.exe RUKJ.exe File created C:\windows\SysWOW64\QQA.exe PNJRMKU.exe File opened for modification C:\windows\SysWOW64\HVGIRRB.exe WCDPJKL.exe File created C:\windows\SysWOW64\PDSGAFY.exe.bat LVL.exe File created C:\windows\SysWOW64\JGXD.exe.bat LQKL.exe File created C:\windows\SysWOW64\AIN.exe HXDAKC.exe File opened for modification C:\windows\SysWOW64\AIN.exe HXDAKC.exe File created C:\windows\SysWOW64\SMX.exe.bat CWWQQEI.exe File created C:\windows\SysWOW64\YXRGR.exe DKM.exe File created C:\windows\SysWOW64\ZDVVNL.exe.bat KIL.exe File opened for modification C:\windows\SysWOW64\RUKJ.exe JGXD.exe File opened for modification C:\windows\SysWOW64\ZWL.exe BLM.exe File created C:\windows\SysWOW64\VOF.exe.bat GTWVT.exe File created C:\windows\SysWOW64\XFXCVC.exe.bat EJEEHOS.exe File opened for modification C:\windows\SysWOW64\QQA.exe PNJRMKU.exe File created C:\windows\SysWOW64\ZWL.exe.bat BLM.exe File created C:\windows\SysWOW64\NPWXZN.exe.bat ZRO.exe File created C:\windows\SysWOW64\MQDOM.exe TNZ.exe File opened for modification C:\windows\SysWOW64\MRRPUOK.exe EMRBL.exe File opened for modification C:\windows\SysWOW64\VOF.exe GTWVT.exe File opened for modification C:\windows\SysWOW64\LVL.exe ZNEYC.exe File created C:\windows\SysWOW64\LVL.exe.bat ZNEYC.exe File created C:\windows\SysWOW64\YXRGR.exe.bat DKM.exe File created C:\windows\SysWOW64\WCDPJKL.exe SMX.exe File opened for modification C:\windows\SysWOW64\LNO.exe DIJ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\IVWSZJB.exe.bat YXRGR.exe File opened for modification C:\windows\ZRO.exe VBHD.exe File created C:\windows\EXCUMEQ.exe NPWXZN.exe File created C:\windows\FOAFKQB.exe.bat PYZFM.exe File opened for modification C:\windows\system\SRZ.exe MRRPUOK.exe File created C:\windows\system\IVWSZJB.exe YXRGR.exe File created C:\windows\system\UQDZ.exe YSFBH.exe File created C:\windows\system\SRZ.exe MRRPUOK.exe File created C:\windows\system\UZQPNAK.exe.bat VOF.exe File created C:\windows\system\ANGRC.exe XFXCVC.exe File created C:\windows\PYZFM.exe.bat UTAJ.exe File created C:\windows\system\BLM.exe.bat MQDOM.exe File created C:\windows\system\YSFBH.exe.bat ASXOYXM.exe File created C:\windows\system\LYHC.exe.bat WHGDQ.exe File created C:\windows\system\LQKL.exe.bat ANGRC.exe File opened for modification C:\windows\system\VCXU.exe NPKN.exe File opened for modification C:\windows\system\KIL.exe HVGIRRB.exe File created C:\windows\system\UTAJ.exe.bat 2026-10-28_8a52646eae5f9080693fd79357b2808b_elex_emotet_stop.exe File opened for modification C:\windows\system\DKM.exe IWHFXJ.exe File created C:\windows\system\ZNEYC.exe NZXAWBA.exe File created C:\windows\VBHD.exe CJASCQ.exe File created C:\windows\system\UZQPNAK.exe VOF.exe File created C:\windows\RASTA.exe.bat EXCUMEQ.exe File opened for modification C:\windows\ZOXZ.exe RASTA.exe File created C:\windows\DIJ.exe VCXU.exe File created C:\windows\system\BLM.exe MQDOM.exe File created C:\windows\system\ASXOYXM.exe ZPTKLH.exe File created C:\windows\IJRGO.exe NVM.exe File opened for modification C:\windows\IJRGO.exe NVM.exe File created C:\windows\IWHFXJ.exe FOAFKQB.exe File opened for modification C:\windows\system\IVWSZJB.exe YXRGR.exe File created C:\windows\ZPTKLH.exe ZWL.exe File created C:\windows\ZPTKLH.exe.bat ZWL.exe File created C:\windows\system\JYM.exe ALCZTEF.exe File created C:\windows\system\ASXOYXM.exe.bat ZPTKLH.exe File created C:\windows\system\ZNEYC.exe.bat NZXAWBA.exe File created C:\windows\ZOXZ.exe.bat RASTA.exe File opened for modification C:\windows\DIJ.exe VCXU.exe File opened for modification C:\windows\system\BLM.exe MQDOM.exe File created C:\windows\system\KIL.exe HVGIRRB.exe File opened for modification C:\windows\VBHD.exe CJASCQ.exe File opened for modification C:\windows\system\HXDAKC.exe RPI.exe File created C:\windows\EXCUMEQ.exe.bat NPWXZN.exe File opened for modification C:\windows\system\ANGRC.exe XFXCVC.exe File opened for modification C:\windows\FOAFKQB.exe PYZFM.exe File created C:\windows\TNZ.exe.bat IVWSZJB.exe File created C:\windows\system\LQKL.exe ANGRC.exe File created C:\windows\PNJRMKU.exe.bat MFBUNY.exe File created C:\windows\system\VCXU.exe NPKN.exe File created C:\windows\system\HXDAKC.exe RPI.exe File opened for modification C:\windows\system\NPKN.exe JMZABGG.exe File created C:\windows\FOAFKQB.exe PYZFM.exe File created C:\windows\RASTA.exe EXCUMEQ.exe File created C:\windows\EJEEHOS.exe XEKRBUX.exe File created C:\windows\system\NPKN.exe JMZABGG.exe File created C:\windows\YBPQG.exe IOYRUKE.exe File opened for modification C:\windows\system\UZQPNAK.exe VOF.exe File created C:\windows\CJASCQ.exe PDSGAFY.exe File created C:\windows\EJEEHOS.exe.bat XEKRBUX.exe File created C:\windows\system\ANGRC.exe.bat XFXCVC.exe File opened for modification C:\windows\system\JMZABGG.exe JETDOPL.exe File created C:\windows\ZOXZ.exe RASTA.exe File created C:\windows\system\IOYRUKE.exe LNO.exe File created C:\windows\PYZFM.exe UTAJ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5376 cmd.exe 1688 cmd.exe 2308 cmd.exe 1120 cmd.exe 4688 cmd.exe 5776 cmd.exe 2468 cmd.exe 5004 cmd.exe 4220 cmd.exe 4032 cmd.exe 5464 cmd.exe 4896 cmd.exe 5128 cmd.exe 296 cmd.exe 3036 cmd.exe 4540 cmd.exe 4436 cmd.exe 2780 cmd.exe 3432 cmd.exe 3384 cmd.exe 4900 cmd.exe 4308 cmd.exe 4888 cmd.exe 3500 cmd.exe 1704 cmd.exe 4732 cmd.exe 4116 cmd.exe 4284 cmd.exe 1544 cmd.exe 3680 cmd.exe 4588 cmd.exe 4408 cmd.exe 2024 cmd.exe 4500 cmd.exe 5424 cmd.exe 2056 cmd.exe 2996 cmd.exe 2700 cmd.exe 836 cmd.exe 1516 cmd.exe 1724 cmd.exe 3032 cmd.exe 4036 cmd.exe 3128 cmd.exe 720 cmd.exe 2016 cmd.exe 4556 cmd.exe 1988 cmd.exe 5484 cmd.exe 1584 cmd.exe 4964 cmd.exe 2464 cmd.exe 2328 cmd.exe 1684 cmd.exe 5596 cmd.exe 4244 cmd.exe 6140 cmd.exe 4196 cmd.exe 4440 cmd.exe 5216 cmd.exe 4608 cmd.exe 3468 cmd.exe 860 cmd.exe 4844 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5160 4796 WerFault.exe 87 4392 4324 WerFault.exe 92 4132 1644 WerFault.exe 98 2440 4572 WerFault.exe 103 4816 4480 WerFault.exe 108 3264 4696 WerFault.exe 113 3468 4124 WerFault.exe 118 1768 4140 WerFault.exe 123 4700 2364 WerFault.exe 128 2568 2560 WerFault.exe 133 5136 4952 WerFault.exe 138 3632 4640 WerFault.exe 143 4660 260 WerFault.exe 148 264 6036 WerFault.exe 153 4176 4768 WerFault.exe 158 5716 5016 WerFault.exe 163 1608 4492 WerFault.exe 168 5432 2352 WerFault.exe 173 5360 4820 WerFault.exe 178 5792 3184 WerFault.exe 183 5812 2884 WerFault.exe 188 2084 5300 WerFault.exe 193 1160 2980 WerFault.exe 198 4348 3828 WerFault.exe 203 2652 5732 WerFault.exe 208 4168 1440 WerFault.exe 213 3980 2288 WerFault.exe 218 2924 5384 WerFault.exe 223 4216 3252 WerFault.exe 228 4944 2808 WerFault.exe 233 1384 4676 WerFault.exe 238 2720 600 WerFault.exe 243 3008 5368 WerFault.exe 248 4004 2396 WerFault.exe 253 4476 6032 WerFault.exe 258 3188 4644 WerFault.exe 263 3860 2652 WerFault.exe 268 5140 1572 WerFault.exe 273 5196 1608 WerFault.exe 279 2384 1536 WerFault.exe 284 2952 3420 WerFault.exe 289 4508 5984 WerFault.exe 294 5296 4748 WerFault.exe 299 5784 1476 WerFault.exe 304 1456 3632 WerFault.exe 309 2124 4348 WerFault.exe 314 1948 2948 WerFault.exe 319 1584 6020 WerFault.exe 324 6060 5000 WerFault.exe 329 4552 1912 WerFault.exe 334 3020 3516 WerFault.exe 339 5856 4972 WerFault.exe 344 3040 4924 WerFault.exe 349 2856 1160 WerFault.exe 354 4844 3492 WerFault.exe 359 3176 5112 WerFault.exe 364 2476 2336 WerFault.exe 369 3380 5948 WerFault.exe 374 3312 5036 WerFault.exe 379 2864 2968 WerFault.exe 384 2660 3840 WerFault.exe 389 2456 1436 WerFault.exe 394 5648 2952 WerFault.exe 399 2328 3280 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVWSZJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NPKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXRGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XEKRBUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MQDOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJASCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VOF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JETDOPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PYZFM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GTWVT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LQKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFBUNY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALDWDG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DIJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVGIRRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXDAKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MRRPUOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WHGDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCDPJKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOXZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANGRC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JMZABGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4796 2026-10-28_8a52646eae5f9080693fd79357b2808b_elex_emotet_stop.exe 4796 2026-10-28_8a52646eae5f9080693fd79357b2808b_elex_emotet_stop.exe 4324 UTAJ.exe 4324 UTAJ.exe 1644 PYZFM.exe 1644 PYZFM.exe 4572 FOAFKQB.exe 4572 FOAFKQB.exe 4480 IWHFXJ.exe 4480 IWHFXJ.exe 4696 DKM.exe 4696 DKM.exe 4124 YXRGR.exe 4124 YXRGR.exe 4140 IVWSZJB.exe 4140 IVWSZJB.exe 2364 TNZ.exe 2364 TNZ.exe 2560 MQDOM.exe 2560 MQDOM.exe 4952 BLM.exe 4952 BLM.exe 4640 ZWL.exe 4640 ZWL.exe 260 ZPTKLH.exe 260 ZPTKLH.exe 6036 ASXOYXM.exe 6036 ASXOYXM.exe 4768 YSFBH.exe 4768 YSFBH.exe 5016 UQDZ.exe 5016 UQDZ.exe 4492 ALCZTEF.exe 4492 ALCZTEF.exe 2352 JYM.exe 2352 JYM.exe 4820 EMRBL.exe 4820 EMRBL.exe 3184 MRRPUOK.exe 3184 MRRPUOK.exe 2884 SRZ.exe 2884 SRZ.exe 5300 WHGDQ.exe 5300 WHGDQ.exe 2980 LYHC.exe 2980 LYHC.exe 3828 NVM.exe 3828 NVM.exe 5732 IJRGO.exe 5732 IJRGO.exe 1440 CWWQQEI.exe 1440 CWWQQEI.exe 2288 SMX.exe 2288 SMX.exe 5384 WCDPJKL.exe 5384 WCDPJKL.exe 3252 HVGIRRB.exe 3252 HVGIRRB.exe 2808 KIL.exe 2808 KIL.exe 4676 ZDVVNL.exe 4676 ZDVVNL.exe 600 GTWVT.exe 600 GTWVT.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4796 2026-10-28_8a52646eae5f9080693fd79357b2808b_elex_emotet_stop.exe 4796 2026-10-28_8a52646eae5f9080693fd79357b2808b_elex_emotet_stop.exe 4324 UTAJ.exe 4324 UTAJ.exe 1644 PYZFM.exe 1644 PYZFM.exe 4572 FOAFKQB.exe 4572 FOAFKQB.exe 4480 IWHFXJ.exe 4480 IWHFXJ.exe 4696 DKM.exe 4696 DKM.exe 4124 YXRGR.exe 4124 YXRGR.exe 4140 IVWSZJB.exe 4140 IVWSZJB.exe 2364 TNZ.exe 2364 TNZ.exe 2560 MQDOM.exe 2560 MQDOM.exe 4952 BLM.exe 4952 BLM.exe 4640 ZWL.exe 4640 ZWL.exe 260 ZPTKLH.exe 260 ZPTKLH.exe 6036 ASXOYXM.exe 6036 ASXOYXM.exe 4768 YSFBH.exe 4768 YSFBH.exe 5016 UQDZ.exe 5016 UQDZ.exe 4492 ALCZTEF.exe 4492 ALCZTEF.exe 2352 JYM.exe 2352 JYM.exe 4820 EMRBL.exe 4820 EMRBL.exe 3184 MRRPUOK.exe 3184 MRRPUOK.exe 2884 SRZ.exe 2884 SRZ.exe 5300 WHGDQ.exe 5300 WHGDQ.exe 2980 LYHC.exe 2980 LYHC.exe 3828 NVM.exe 3828 NVM.exe 5732 IJRGO.exe 5732 IJRGO.exe 1440 CWWQQEI.exe 1440 CWWQQEI.exe 2288 SMX.exe 2288 SMX.exe 5384 WCDPJKL.exe 5384 WCDPJKL.exe 3252 HVGIRRB.exe 3252 HVGIRRB.exe 2808 KIL.exe 2808 KIL.exe 4676 ZDVVNL.exe 4676 ZDVVNL.exe 600 GTWVT.exe 600 GTWVT.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4796 wrote to memory of 4688 4796 2026-10-28_8a52646eae5f9080693fd79357b2808b_elex_emotet_stop.exe 88 PID 4688 wrote to memory of 4324 4688 cmd.exe 92 PID 4324 wrote to memory of 1976 4324 UTAJ.exe 94 PID 1976 wrote to memory of 1644 1976 cmd.exe 98 PID 1644 wrote to memory of 1832 1644 PYZFM.exe 99 PID 1832 wrote to memory of 4572 1832 cmd.exe 103 PID 4572 wrote to memory of 2772 4572 FOAFKQB.exe 104 PID 2772 wrote to memory of 4480 2772 cmd.exe 108 PID 4480 wrote to memory of 836 4480 IWHFXJ.exe 109 PID 836 wrote to memory of 4696 836 cmd.exe 113 PID 4696 wrote to memory of 1692 4696 DKM.exe 114 PID 1692 wrote to memory of 4124 1692 cmd.exe 118 PID 4124 wrote to memory of 3816 4124 YXRGR.exe 119 PID 3816 wrote to memory of 4140 3816 cmd.exe 123 PID 4140 wrote to memory of 5108 4140 IVWSZJB.exe 124 PID 5108 wrote to memory of 2364 5108 cmd.exe 128 PID 2364 wrote to memory of 5924 2364 TNZ.exe 129 PID 5924 wrote to memory of 2560 5924 cmd.exe 133 PID 2560 wrote to memory of 928 2560 MQDOM.exe 134 PID 928 wrote to memory of 4952 928 cmd.exe 138 PID 4952 wrote to memory of 1288 4952 BLM.exe 139 PID 1288 wrote to memory of 4640 1288 cmd.exe 143 PID 4640 wrote to memory of 2700 4640 ZWL.exe 144 PID 2700 wrote to memory of 260 2700 cmd.exe 148 PID 260 wrote to memory of 1172 260 ZPTKLH.exe 149 PID 1172 wrote to memory of 6036 1172 cmd.exe 153 PID 6036 wrote to memory of 2676 6036 ASXOYXM.exe 154 PID 2676 wrote to memory of 4768 2676 cmd.exe 158 PID 4768 wrote to memory of 1684 4768 YSFBH.exe 159 PID 1684 wrote to memory of 5016 1684 cmd.exe 163 PID 5016 wrote to memory of 3560 5016 UQDZ.exe 164 PID 3560 wrote to memory of 4492 3560 cmd.exe 168 PID 4492 wrote to memory of 5596 4492 ALCZTEF.exe 169 PID 5596 wrote to memory of 2352 5596 cmd.exe 173 PID 2352 wrote to memory of 6084 2352 JYM.exe 174 PID 6084 wrote to memory of 4820 6084 cmd.exe 178 PID 4820 wrote to memory of 4160 4820 EMRBL.exe 179 PID 4160 wrote to memory of 3184 4160 cmd.exe 183 PID 3184 wrote to memory of 2252 3184 MRRPUOK.exe 184 PID 2252 wrote to memory of 2884 2252 cmd.exe 188 PID 2884 wrote to memory of 2148 2884 SRZ.exe 189 PID 2148 wrote to memory of 5300 2148 cmd.exe 193 PID 5300 wrote to memory of 1144 5300 WHGDQ.exe 194 PID 1144 wrote to memory of 2980 1144 cmd.exe 198 PID 2980 wrote to memory of 2664 2980 LYHC.exe 199 PID 2664 wrote to memory of 3828 2664 cmd.exe 203 PID 3828 wrote to memory of 5484 3828 NVM.exe 204 PID 5484 wrote to memory of 5732 5484 cmd.exe 208 PID 5732 wrote to memory of 1444 5732 IJRGO.exe 209 PID 1444 wrote to memory of 1440 1444 cmd.exe 213 PID 1440 wrote to memory of 1636 1440 CWWQQEI.exe 214 PID 1636 wrote to memory of 2288 1636 cmd.exe 218 PID 2288 wrote to memory of 4896 2288 SMX.exe 219 PID 4896 wrote to memory of 5384 4896 cmd.exe 223 PID 5384 wrote to memory of 3264 5384 WCDPJKL.exe 224 PID 3264 wrote to memory of 3252 3264 cmd.exe 228 PID 3252 wrote to memory of 2576 3252 HVGIRRB.exe 229 PID 2576 wrote to memory of 2808 2576 cmd.exe 233 PID 2808 wrote to memory of 4940 2808 KIL.exe 234 PID 4940 wrote to memory of 4676 4940 cmd.exe 238 PID 4676 wrote to memory of 2420 4676 ZDVVNL.exe 239 PID 2420 wrote to memory of 600 2420 cmd.exe 243 PID 600 wrote to memory of 5024 600 GTWVT.exe 244 PID 5024 wrote to memory of 5368 5024 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_8a52646eae5f9080693fd79357b2808b_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_8a52646eae5f9080693fd79357b2808b_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTAJ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\windows\system\UTAJ.exeC:\windows\system\UTAJ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PYZFM.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\windows\PYZFM.exeC:\windows\PYZFM.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FOAFKQB.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\windows\FOAFKQB.exeC:\windows\FOAFKQB.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWHFXJ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\windows\IWHFXJ.exeC:\windows\IWHFXJ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKM.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:836 -
C:\windows\system\DKM.exeC:\windows\system\DKM.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXRGR.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\windows\SysWOW64\YXRGR.exeC:\windows\system32\YXRGR.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IVWSZJB.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\windows\system\IVWSZJB.exeC:\windows\system\IVWSZJB.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TNZ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\windows\TNZ.exeC:\windows\TNZ.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MQDOM.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\windows\SysWOW64\MQDOM.exeC:\windows\system32\MQDOM.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BLM.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:928 -
C:\windows\system\BLM.exeC:\windows\system\BLM.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZWL.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\windows\SysWOW64\ZWL.exeC:\windows\system32\ZWL.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPTKLH.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\windows\ZPTKLH.exeC:\windows\ZPTKLH.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASXOYXM.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\windows\system\ASXOYXM.exeC:\windows\system\ASXOYXM.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSFBH.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\windows\system\YSFBH.exeC:\windows\system\YSFBH.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UQDZ.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\windows\system\UQDZ.exeC:\windows\system\UQDZ.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ALCZTEF.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\windows\SysWOW64\ALCZTEF.exeC:\windows\system32\ALCZTEF.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JYM.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\windows\system\JYM.exeC:\windows\system\JYM.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMRBL.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\windows\system\EMRBL.exeC:\windows\system\EMRBL.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MRRPUOK.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\windows\SysWOW64\MRRPUOK.exeC:\windows\system32\MRRPUOK.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SRZ.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\windows\system\SRZ.exeC:\windows\system\SRZ.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WHGDQ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\windows\SysWOW64\WHGDQ.exeC:\windows\system32\WHGDQ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYHC.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\windows\system\LYHC.exeC:\windows\system\LYHC.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVM.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\windows\SysWOW64\NVM.exeC:\windows\system32\NVM.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IJRGO.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\windows\IJRGO.exeC:\windows\IJRGO.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWWQQEI.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\windows\SysWOW64\CWWQQEI.exeC:\windows\system32\CWWQQEI.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SMX.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\windows\SysWOW64\SMX.exeC:\windows\system32\SMX.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCDPJKL.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\windows\SysWOW64\WCDPJKL.exeC:\windows\system32\WCDPJKL.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVGIRRB.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\windows\SysWOW64\HVGIRRB.exeC:\windows\system32\HVGIRRB.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KIL.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\windows\system\KIL.exeC:\windows\system\KIL.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDVVNL.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\windows\SysWOW64\ZDVVNL.exeC:\windows\system32\ZDVVNL.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GTWVT.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\windows\system\GTWVT.exeC:\windows\system\GTWVT.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VOF.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\windows\SysWOW64\VOF.exeC:\windows\system32\VOF.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UZQPNAK.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4888 -
C:\windows\system\UZQPNAK.exeC:\windows\system\UZQPNAK.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NZXAWBA.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:4992 -
C:\windows\SysWOW64\NZXAWBA.exeC:\windows\system32\NZXAWBA.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZNEYC.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4540 -
C:\windows\system\ZNEYC.exeC:\windows\system\ZNEYC.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LVL.exe.bat" "72⤵PID:472
-
C:\windows\SysWOW64\LVL.exeC:\windows\system32\LVL.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDSGAFY.exe.bat" "74⤵
- Executes a command shell one-liner
PID:1544 -
C:\windows\SysWOW64\PDSGAFY.exeC:\windows\system32\PDSGAFY.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CJASCQ.exe.bat" "76⤵PID:2600
-
C:\windows\CJASCQ.exeC:\windows\CJASCQ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VBHD.exe.bat" "78⤵
- Executes a command shell one-liner
PID:1516 -
C:\windows\VBHD.exeC:\windows\VBHD.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZRO.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5776 -
C:\windows\ZRO.exeC:\windows\ZRO.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NPWXZN.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4436 -
C:\windows\SysWOW64\NPWXZN.exeC:\windows\system32\NPWXZN.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EXCUMEQ.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:2568 -
C:\windows\EXCUMEQ.exeC:\windows\EXCUMEQ.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RASTA.exe.bat" "86⤵PID:4076
-
C:\windows\RASTA.exeC:\windows\RASTA.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOXZ.exe.bat" "88⤵PID:3008
-
C:\windows\ZOXZ.exeC:\windows\ZOXZ.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XEKRBUX.exe.bat" "90⤵PID:2088
-
C:\windows\SysWOW64\XEKRBUX.exeC:\windows\system32\XEKRBUX.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EJEEHOS.exe.bat" "92⤵
- Executes a command shell one-liner
PID:4964 -
C:\windows\EJEEHOS.exeC:\windows\EJEEHOS.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFXCVC.exe.bat" "94⤵PID:5664
-
C:\windows\SysWOW64\XFXCVC.exeC:\windows\system32\XFXCVC.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ANGRC.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4388 -
C:\windows\system\ANGRC.exeC:\windows\system\ANGRC.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LQKL.exe.bat" "98⤵PID:5140
-
C:\windows\system\LQKL.exeC:\windows\system\LQKL.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JGXD.exe.bat" "100⤵PID:3344
-
C:\windows\SysWOW64\JGXD.exeC:\windows\system32\JGXD.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUKJ.exe.bat" "102⤵PID:2528
-
C:\windows\SysWOW64\RUKJ.exeC:\windows\system32\RUKJ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZZO.exe.bat" "104⤵
- Executes a command shell one-liner
PID:3468 -
C:\windows\SysWOW64\ZZO.exeC:\windows\system32\ZZO.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MFBUNY.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5376 -
C:\windows\SysWOW64\MFBUNY.exeC:\windows\system32\MFBUNY.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PNJRMKU.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3500 -
C:\windows\PNJRMKU.exeC:\windows\PNJRMKU.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QQA.exe.bat" "110⤵PID:1216
-
C:\windows\SysWOW64\QQA.exeC:\windows\system32\QQA.exe111⤵
- Executes dropped EXE
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JETDOPL.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:3920 -
C:\windows\system\JETDOPL.exeC:\windows\system\JETDOPL.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JMZABGG.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:4868 -
C:\windows\system\JMZABGG.exeC:\windows\system\JMZABGG.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NPKN.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:688 -
C:\windows\system\NPKN.exeC:\windows\system\NPKN.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VCXU.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4904 -
C:\windows\system\VCXU.exeC:\windows\system\VCXU.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DIJ.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:4156 -
C:\windows\DIJ.exeC:\windows\DIJ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-