Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250610-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2025, 12:13

General

  • Target

    2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe

  • Size

    512KB

  • MD5

    cb4339057f37835db60db37e0723661c

  • SHA1

    8d2c86bf354b4999841c03ce50630ea008d52f5b

  • SHA256

    187b12e76b28d6c706cd833dccd0ac2a284fc21d3e892e950c3595e5803e82e5

  • SHA512

    b8dd316a9c60ecc8be1e34d17782029c2276fd18f51526b215bc0b77cea3b661aac6915abd2d1880fe12fddb724f348c11224d362ee9a6a17c8052f01bb5396e

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj60:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5x

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Windows\SysWOW64\hahskjdzwb.exe
      hahskjdzwb.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1588
      • C:\Windows\SysWOW64\benbqdxb.exe
        C:\Windows\system32\benbqdxb.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4724
    • C:\Windows\SysWOW64\srhbqidzphxrnge.exe
      srhbqidzphxrnge.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3436
    • C:\Windows\SysWOW64\benbqdxb.exe
      benbqdxb.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3900
    • C:\Windows\SysWOW64\gojgtnjakxrpm.exe
      gojgtnjakxrpm.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5164
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:5716
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c hahskjdzwb.exe
    1⤵
      PID:5064
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c srhbqidzphxrnge.exe
      1⤵
        PID:5112
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c gojgtnjakxrpm.exe
        1⤵
          PID:4736

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

                Filesize

                512KB

                MD5

                8bc9ce20a892b52912f073225133e47d

                SHA1

                95a84c41456625eaa6769496b8ec3b2502b2e45f

                SHA256

                ebc0119d367f832a8db4a89c815beea8d66650d7b150b28d55daaf22576edf17

                SHA512

                1d309c1b13ef309f5784d031650d93534220c39d4c4fe23446954a1605161e6cfa1487104b14f2828e7e637891f5d6152abd5d731cf2dd2a502171576a8db78a

              • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

                Filesize

                512KB

                MD5

                6aaaa73bcdf7d0206a8b6648c493afeb

                SHA1

                f4b46dea77119ad410c3a8a0f5f893810e7e8f36

                SHA256

                716cabd3fce3bd2c1b16a44529e0eb41127562108caee6dc1d1974eacd45a9f0

                SHA512

                16e58f3820155b242069430bb4f4b5b72b79580f4718c886a9490210b678739578f267c9737501c10ff4bee254bff31f4fbdab992280c7d50a11dee2adbe11bf

              • C:\Users\Admin\AppData\Local\Temp\TCDA39D.tmp\sist02.xsl

                Filesize

                245KB

                MD5

                f883b260a8d67082ea895c14bf56dd56

                SHA1

                7954565c1f243d46ad3b1e2f1baf3281451fc14b

                SHA256

                ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

                SHA512

                d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

              • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

                Filesize

                309B

                MD5

                fed9010112e641295f358cbf2b793a96

                SHA1

                0144ae4751bdba4aad32148c024a3597601525ae

                SHA256

                38a70abe1a4c96a41948dfa670d01c46eb131284c87199920b22736c21f531e5

                SHA512

                7f3796b7fe6400d3324092a7e66365d397eb1a32514e35a0e3cf2f38029f96c89b566efdccf0636d7bbe6b6c3ae2ae21285ea5fd6747d927de64dbd39a386a16

              • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

                Filesize

                16B

                MD5

                d29962abc88624befc0135579ae485ec

                SHA1

                e40a6458296ec6a2427bcb280572d023a9862b31

                SHA256

                a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

                SHA512

                4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

                Filesize

                1KB

                MD5

                ef76364b7ae7766287587f2e4be9fba6

                SHA1

                bc8453e008ddd2ebc7b910c3079732f96cdb5d45

                SHA256

                6f026fbdf1e196cdf4a7bb3d041eafc0c2e50d49083fd33ef8f95c93d2ded389

                SHA512

                3ced87a6dd5aeb9cdea60075f98afcb594524bcc17e0ae3d9809b4ce3dae2b490b2796aff2fc01e696a70735fc8d2817d3e66370e079f3f84717378e07bf9765

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

                Filesize

                1KB

                MD5

                6372b423309cde1c3a913e77833a33c6

                SHA1

                25fa14b9b30133137d908aafb6d52dea4bb005ec

                SHA256

                4718d4976171341b22ea4df646a503ed50d8748aef7f37fe6331aef9dc8f763d

                SHA512

                3acf2051969e6c3670d05bd03d284d3f909d416830a2068be7d8e9df9d0d26041a48479333c47faff970e96f7e79e182442f1aa023b66d66ee4af8f538857262

              • C:\Users\Admin\Downloads\PopRepair.doc.exe

                Filesize

                512KB

                MD5

                19d8e04ddfb4a7aa8ea63afaf7f79e06

                SHA1

                6e93513a7839464d044086e265df773608c65276

                SHA256

                1e1d23d3f56698088c2a0c8913a46d9fb53018fc3b0899099e89c7cf181f65f3

                SHA512

                bd08d08a0eafe611e7cca9a283d2001eaea6b3cb0f7048678891450df5b3c1817a837242a8a389cb11d8576d169910885b89ad38fb29864d75fff43bb97de5df

              • C:\Windows\SysWOW64\benbqdxb.exe

                Filesize

                512KB

                MD5

                056b2df0bc8a854869800e9be5198870

                SHA1

                2da716acaa3d79598f4382bb5a15e609ebb41ae1

                SHA256

                a4d47b55915381ab5caf05c41f7be607b86e9099123569fc8ee06656e24cf780

                SHA512

                0779713a0de04ce0cf927ebc9ffc93791f71159ca916f64569c035184b49ea854ef6725b2472e1f91decfc4c37033a1b48ac5eedc29676e469fba94778c52dcf

              • C:\Windows\SysWOW64\gojgtnjakxrpm.exe

                Filesize

                512KB

                MD5

                da72332f0c19362fa643e25a2b9fdcb3

                SHA1

                0866754e780707c92cab21ee6853424f6452b8e7

                SHA256

                a5012d514f1697745c729a8454b09beab6f426e9cb67c86a3ced7b6d90839fce

                SHA512

                a86772698ec80784ab4bcf35d91bcad8b5cfac4302d2656e4f7a58acbb242936b2901a8c3cbc4f6e32cbbea41258233aa7ec91e8d5a1b1527e1721f96713ec71

              • C:\Windows\SysWOW64\hahskjdzwb.exe

                Filesize

                512KB

                MD5

                44cd7b8ba24e967a8ddf820d8104b0f1

                SHA1

                2a901482118893ed40d2923809af8245fb9853c0

                SHA256

                8a129f0bc39a131ad6d7ca89a54218bc8649983548b46dbc9a3d4ab39fb1ebd0

                SHA512

                eea01b9e027469d178726a1b6f1d12528c7482769b1bf179c0f421d7e85a946806a5f1b8f779db61841ab553c11d90208c018455bca2d9c0a3e078343ca344bf

              • C:\Windows\SysWOW64\srhbqidzphxrnge.exe

                Filesize

                512KB

                MD5

                bfdd05e3e30de711a0e6a53a4c4fa57c

                SHA1

                1f7939530960d821db1b25fb8a6bf8218c87395d

                SHA256

                5f4546864d0c9788f57502316bbbc4e4c0d58cbcc4e9c613c464d63659e17e3c

                SHA512

                022ad307a4d84e67048ef1efc4683403f10a9127d3e90926144ff0ea5d18aba0daeb8c0445ac4232d23d0d68e8c9401a08d27ba61e1de08d2e6ec418ccc0ee77

              • C:\Windows\mydoc.rtf

                Filesize

                223B

                MD5

                06604e5941c126e2e7be02c5cd9f62ec

                SHA1

                4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

                SHA256

                85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

                SHA512

                803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

              • \??\c:\Users\Admin\Desktop\ConfirmReset.doc.exe

                Filesize

                512KB

                MD5

                f441a68ad26fd8ad4dad050f3ed18c1a

                SHA1

                fea19feb4648b52cdf628298121cdc6f56782f9c

                SHA256

                12960947ae2a769c5684f8ad11b0910ce5b917f311d8ca98f607d72c600dbedd

                SHA512

                0b68ef8b0af950e54b58c52f07966c9948295f82fad455ab2bba1051efd502094fa791fc26c2e1c6271de349298f73956ccbfd06478b4a84f520f0fc2ef24cbf

              • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

                Filesize

                512KB

                MD5

                4ba130c948842e117aed9bff02163fbe

                SHA1

                ca5742b9388dcfdc796da425d2469884d02f7e59

                SHA256

                8bd30ab352b34ad2e0e840b35a7559b912b8aff9f0a4b0a7bc600fa2d14a3664

                SHA512

                1ce9ab9ff645229b8bc7e828a78fbd5331df9974a4ba956b6f1eae24e761a2b28eaa96beb70c2efa8e765a80410e059beb221bb8fdd42f3a7676df1f8cf13ab9

              • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

                Filesize

                512KB

                MD5

                807ae0f47448f1c7ffb90dcf7a3c67a5

                SHA1

                ca0f2237f1e38aabc5048f523d453da29cade224

                SHA256

                33303182d446da2e3e5263337ba4d9af680d5eccf6efff1700b5343dfbc258e3

                SHA512

                1874d1380611dfcd82abcc81e12f6ecf3a14536a239eacab63fb0f8c95d497486cc123641561776f3989d669a6d022664366bf88cebacd1dd73276da860e3fc3

              • memory/1508-0-0x0000000000400000-0x0000000000496000-memory.dmp

                Filesize

                600KB

              • memory/5716-37-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp

                Filesize

                64KB

              • memory/5716-43-0x00007FFC22380000-0x00007FFC22390000-memory.dmp

                Filesize

                64KB

              • memory/5716-40-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp

                Filesize

                64KB

              • memory/5716-38-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp

                Filesize

                64KB

              • memory/5716-41-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp

                Filesize

                64KB

              • memory/5716-39-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp

                Filesize

                64KB

              • memory/5716-42-0x00007FFC22380000-0x00007FFC22390000-memory.dmp

                Filesize

                64KB

              • memory/5716-614-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp

                Filesize

                64KB

              • memory/5716-612-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp

                Filesize

                64KB

              • memory/5716-613-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp

                Filesize

                64KB

              • memory/5716-611-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp

                Filesize

                64KB