Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 01:04
Behavioral task
behavioral1
Sample
2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe
Resource
win11-20260130-en
windows11-21h2-x64
27 signatures
150 seconds
General
- Target 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe
- Size 512KB
- Sample260511-be39lag16x
- SHA256 59a05d11c016eb00a82a59344b350234f4016f3cd2d9671a559db8209e4673da
- MD5 356c8910114a2e82debf1b92c5bc474d
- SHA1 03fc21dd8fb7c55980aaa215291f44ed9cbd50ac
- SHA512 4b50733b51a854304619fe018104bfb2d3fffc7a8bd68037c89fbabd800b7095fb4d6502c18b4e0069709fd357504a566b585375674b5c6bfb94f5d0983d58de
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm58
- TLSH T13DB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 8 IoCs
resource yara_rule behavioral2/files/0x001b00000002b247-5.dat family_sohanad behavioral2/files/0x001900000002b321-32.dat family_sohanad behavioral2/files/0x001a00000002b320-29.dat family_sohanad behavioral2/files/0x002a00000002b13f-19.dat family_sohanad behavioral2/files/0x000200000002a189-57.dat family_sohanad behavioral2/files/0x001900000002b330-66.dat family_sohanad behavioral2/files/0x0015000000025cdd-497.dat family_sohanad behavioral2/files/0x0015000000025cdd-501.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" jniyzcpode.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jniyzcpode.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jniyzcpode.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jniyzcpode.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jniyzcpode.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jniyzcpode.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jniyzcpode.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jniyzcpode.exe - Executes dropped EXE 5 IoCs
pid Process 1908 jniyzcpode.exe 4712 qllbjmzybxjhbzc.exe 4052 ahlqoabf.exe 4992 kbsmznwofpujr.exe 2496 ahlqoabf.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jniyzcpode.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" jniyzcpode.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jniyzcpode.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jniyzcpode.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jniyzcpode.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jniyzcpode.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nijhulkb = "jniyzcpode.exe" qllbjmzybxjhbzc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lprsmomz = "qllbjmzybxjhbzc.exe" qllbjmzybxjhbzc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "kbsmznwofpujr.exe" qllbjmzybxjhbzc.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\k: ahlqoabf.exe File opened (read-only) \??\m: ahlqoabf.exe File opened (read-only) \??\z: ahlqoabf.exe File opened (read-only) \??\r: jniyzcpode.exe File opened (read-only) \??\a: ahlqoabf.exe File opened (read-only) \??\l: ahlqoabf.exe File opened (read-only) \??\a: jniyzcpode.exe File opened (read-only) \??\v: jniyzcpode.exe File opened (read-only) \??\r: ahlqoabf.exe File opened (read-only) \??\v: ahlqoabf.exe File opened (read-only) \??\y: ahlqoabf.exe File opened (read-only) \??\a: ahlqoabf.exe File opened (read-only) \??\o: ahlqoabf.exe File opened (read-only) \??\i: jniyzcpode.exe File opened (read-only) \??\p: jniyzcpode.exe File opened (read-only) \??\w: jniyzcpode.exe File opened (read-only) \??\e: ahlqoabf.exe File opened (read-only) \??\m: ahlqoabf.exe File opened (read-only) \??\u: ahlqoabf.exe File opened (read-only) \??\n: ahlqoabf.exe File opened (read-only) \??\n: ahlqoabf.exe File opened (read-only) \??\x: ahlqoabf.exe File opened (read-only) \??\i: ahlqoabf.exe File opened (read-only) \??\j: ahlqoabf.exe File opened (read-only) \??\b: jniyzcpode.exe File opened (read-only) \??\n: jniyzcpode.exe File opened (read-only) \??\h: ahlqoabf.exe File opened (read-only) \??\s: ahlqoabf.exe File opened (read-only) \??\v: ahlqoabf.exe File opened (read-only) \??\l: jniyzcpode.exe File opened (read-only) \??\m: jniyzcpode.exe File opened (read-only) \??\s: jniyzcpode.exe File opened (read-only) \??\g: ahlqoabf.exe File opened (read-only) \??\k: ahlqoabf.exe File opened (read-only) \??\o: ahlqoabf.exe File opened (read-only) \??\x: ahlqoabf.exe File opened (read-only) \??\g: ahlqoabf.exe File opened (read-only) \??\s: ahlqoabf.exe File opened (read-only) \??\y: ahlqoabf.exe File opened (read-only) \??\e: jniyzcpode.exe File opened (read-only) \??\o: jniyzcpode.exe File opened (read-only) \??\t: ahlqoabf.exe File opened (read-only) \??\t: ahlqoabf.exe File opened (read-only) \??\j: jniyzcpode.exe File opened (read-only) \??\y: jniyzcpode.exe File opened (read-only) \??\b: ahlqoabf.exe File opened (read-only) \??\q: ahlqoabf.exe File opened (read-only) \??\r: ahlqoabf.exe File opened (read-only) \??\t: jniyzcpode.exe File opened (read-only) \??\u: jniyzcpode.exe File opened (read-only) \??\q: ahlqoabf.exe File opened (read-only) \??\w: ahlqoabf.exe File opened (read-only) \??\e: ahlqoabf.exe File opened (read-only) \??\h: ahlqoabf.exe File opened (read-only) \??\h: jniyzcpode.exe File opened (read-only) \??\w: ahlqoabf.exe File opened (read-only) \??\g: jniyzcpode.exe File opened (read-only) \??\j: ahlqoabf.exe File opened (read-only) \??\u: ahlqoabf.exe File opened (read-only) \??\p: ahlqoabf.exe File opened (read-only) \??\i: ahlqoabf.exe File opened (read-only) \??\p: ahlqoabf.exe File opened (read-only) \??\z: ahlqoabf.exe File opened (read-only) \??\k: jniyzcpode.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" jniyzcpode.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" jniyzcpode.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1916-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x001b00000002b247-5.dat autoit_exe behavioral2/files/0x001900000002b321-32.dat autoit_exe behavioral2/files/0x001a00000002b320-29.dat autoit_exe behavioral2/files/0x002a00000002b13f-19.dat autoit_exe behavioral2/files/0x000200000002a189-57.dat autoit_exe behavioral2/files/0x001900000002b330-66.dat autoit_exe behavioral2/files/0x0015000000025cdd-497.dat autoit_exe behavioral2/files/0x0015000000025cdd-501.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ahlqoabf.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ahlqoabf.exe File opened for modification C:\Windows\SysWOW64\qllbjmzybxjhbzc.exe 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe File created C:\Windows\SysWOW64\ahlqoabf.exe 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\ahlqoabf.exe 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe File created C:\Windows\SysWOW64\kbsmznwofpujr.exe 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\kbsmznwofpujr.exe 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ahlqoabf.exe File created C:\Windows\SysWOW64\jniyzcpode.exe 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\jniyzcpode.exe 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe File created C:\Windows\SysWOW64\qllbjmzybxjhbzc.exe 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll jniyzcpode.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ahlqoabf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ahlqoabf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ahlqoabf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ahlqoabf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ahlqoabf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ahlqoabf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ahlqoabf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ahlqoabf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ahlqoabf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ahlqoabf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ahlqoabf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ahlqoabf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ahlqoabf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ahlqoabf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ahlqoabf.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe ahlqoabf.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe ahlqoabf.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe ahlqoabf.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe ahlqoabf.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe ahlqoabf.exe File opened for modification C:\Windows\mydoc.rtf 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe ahlqoabf.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe ahlqoabf.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe ahlqoabf.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ahlqoabf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jniyzcpode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qllbjmzybxjhbzc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ahlqoabf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kbsmznwofpujr.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BB4FAB8F961F1E0837A3B3581EA3E98B08D03FC43620348E1CC45EA08A9" 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFAFFFC4F5A851C9032D7297E92BDE2E134584766426334D6ED" 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184CC70E14E0DBC3B8C97C90ED9337BC" 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat jniyzcpode.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh jniyzcpode.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" jniyzcpode.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" jniyzcpode.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs jniyzcpode.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc jniyzcpode.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" jniyzcpode.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg jniyzcpode.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33302C769C2082566D3676D377262CAA7DF364DC" 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FCAB15B47E238E353B8BAD332E8D7B9" 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7846BC3FE6E21D0D10CD0A28A0B9113" 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" jniyzcpode.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" jniyzcpode.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" jniyzcpode.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf jniyzcpode.exe Key created \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3152 WINWORD.EXE 3152 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1908 jniyzcpode.exe 1908 jniyzcpode.exe 1908 jniyzcpode.exe 1908 jniyzcpode.exe 1908 jniyzcpode.exe 1908 jniyzcpode.exe 4712 qllbjmzybxjhbzc.exe 1908 jniyzcpode.exe 4712 qllbjmzybxjhbzc.exe 1908 jniyzcpode.exe 4712 qllbjmzybxjhbzc.exe 1908 jniyzcpode.exe 4712 qllbjmzybxjhbzc.exe 1908 jniyzcpode.exe 4712 qllbjmzybxjhbzc.exe 4712 qllbjmzybxjhbzc.exe 4712 qllbjmzybxjhbzc.exe 4712 qllbjmzybxjhbzc.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4712 qllbjmzybxjhbzc.exe 4712 qllbjmzybxjhbzc.exe 4052 ahlqoabf.exe 4052 ahlqoabf.exe 4052 ahlqoabf.exe 4052 ahlqoabf.exe 4052 ahlqoabf.exe 4052 ahlqoabf.exe 4052 ahlqoabf.exe 4052 ahlqoabf.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4712 qllbjmzybxjhbzc.exe 4712 qllbjmzybxjhbzc.exe 2496 ahlqoabf.exe 2496 ahlqoabf.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1908 jniyzcpode.exe 1908 jniyzcpode.exe 1908 jniyzcpode.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4712 qllbjmzybxjhbzc.exe 4712 qllbjmzybxjhbzc.exe 4712 qllbjmzybxjhbzc.exe 4052 ahlqoabf.exe 4052 ahlqoabf.exe 4052 ahlqoabf.exe 2496 ahlqoabf.exe 2496 ahlqoabf.exe 2496 ahlqoabf.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 1908 jniyzcpode.exe 1908 jniyzcpode.exe 1908 jniyzcpode.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4992 kbsmznwofpujr.exe 4712 qllbjmzybxjhbzc.exe 4712 qllbjmzybxjhbzc.exe 4712 qllbjmzybxjhbzc.exe 4052 ahlqoabf.exe 4052 ahlqoabf.exe 4052 ahlqoabf.exe 2496 ahlqoabf.exe 2496 ahlqoabf.exe 2496 ahlqoabf.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 3152 WINWORD.EXE 3152 WINWORD.EXE 3152 WINWORD.EXE 3152 WINWORD.EXE 3152 WINWORD.EXE 3152 WINWORD.EXE 3152 WINWORD.EXE 3152 WINWORD.EXE 3152 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1916 wrote to memory of 1908 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 80 PID 1916 wrote to memory of 4712 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 81 PID 1916 wrote to memory of 4052 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 82 PID 1916 wrote to memory of 4992 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 83 PID 1916 wrote to memory of 3152 1916 2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe 84 PID 1908 wrote to memory of 2496 1908 jniyzcpode.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_356c8910114a2e82debf1b92c5bc474d_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\jniyzcpode.exejniyzcpode.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\ahlqoabf.exeC:\Windows\system32\ahlqoabf.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2496
-
-
-
C:\Windows\SysWOW64\qllbjmzybxjhbzc.exeqllbjmzybxjhbzc.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4712
-
-
C:\Windows\SysWOW64\ahlqoabf.exeahlqoabf.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4052
-
-
C:\Windows\SysWOW64\kbsmznwofpujr.exekbsmznwofpujr.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4992
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3152
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 27ef119d6800fa73c214db85ef63a4be33a4458364e5709c0cb8a3c94b0c0073
- MD5 42e7e42d645200b736dccb0ccf77a000
- SHA1 baf1b848a7fa34a8e7a787e6d05cbc46b0f93fc4
- SHA512 d607df5972242c5f83f9fa1e7e3ecaa0d932fde6bb8f7dd1ed80ab9a547f4da57fbeeca8bf70678a40e0c5b004295918e6b2929295df81ae6a77f15c2fa32000
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6j:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5e
- TLSH T178B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 62e3cbf25dd129fdf60a8e4bff80773c4bb035419bff849044d023e32286f424
- MD5 8c4ece68ab20fc036f693d905e50bebd
- SHA1 0a1898122e876503f87afaf990f01e8e5f90d567
- SHA512 f06ec25e1f0e98255d6c80e3b7ff4e67126c2e05db2e82ff93caec78885cd424e1655f1b7307263f66a1aea76370086ba55746dae54434bf31277d4068fe9b19
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6U:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5x
- TLSH T156B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCD7D19.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- TLSH T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 353B
- SHA256 154143f210e7d89683ea41c1d90ed99a2473e5e4f5a824954f4a2965f1956209
- MD5 ff1d130cce55ec4a58fbf74368eee03b
- SHA1 f216553baa7a527a351f2f14c2218d24298526bf
- SHA512 9bc46f6f3774da8d168b11cf288e2ff6e0f555dfa504b71dcc288696cb2132a8ff2d4abe05a035fa58d2aff8de05319e6def78e1ab9dda73833ee844dcee351c
- TLSH T127E04F3B6B79F7F2877D46F439364DF49BF284A8E179612124CC9CD50D6025314A7009
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 09b3e0c1d4d00c048c3b9babb8d030dea1a476b32eb19e89cfc0532457900123
- MD5 462960e554287578df8fa7ae5d11c4c8
- SHA1 f17fd88aef6db9e382a4216874510e41fbd1ee8e
- SHA512 3d977e988a6c0a859fe7e05728bc5c3adb62e5df4af91a7830754ac1f81e7710e1342dc28e797d62b85784929819cc3769198b5d6513f5466dcb37db1182d3ab
- TLSH T18921BE221BDB6F62E0B103F70126030AEFF07811F655510F6044357BADB4A016F5DB68
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 386b2e8778e3aa92db0bdc8f963bd0a134569c05b84fb0c1c5486b02eba0a290
- MD5 a93a24c3fc0bdf3968b6f0cef1c3c9d0
- SHA1 6c9c1e3ebbe123b36d729f96cf7251cd1cf022ac
- SHA512 b87ccc5047109431e3f40eebed750213e8cdf4633138b4f11776e68acc326b0ef71f506278193b4fb1cfd91077fac9481ac76ade13e93bcd7a3e500ef75ef14d
- TLSH T12041FC021B9BAF62E0B543BB011A030BEFF07812F704560F504432BBAEB4B116E5DA69
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\ahlqoabf.exe
- Size 512KB
- SHA256 78500875faf496f0fa1176a7cd767f9a668c0de2d0e59be5fc9df4dd92f650f6
- MD5 d761a71c6b1409df891fded9a40107e5
- SHA1 4e03adc0a6211bb3c47df1f423a84acb2855cc7d
- SHA512 15cc615b044c95109d365f606f24a5154b1d1c0cc9235c4283cb34fdf97f4eea49fd719c712bed25e287f8700e84820d9baeaa815f651b079a8ad79108cd3e93
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6K:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm53
- TLSH T181B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\jniyzcpode.exe
- Size 512KB
- SHA256 18927642b30d187ba99bca7e1bf37f3c0f2c17baa0dc2878fb66ce56cc99e17c
- MD5 0a4e353901de60dfe1c2c7bbcf77f709
- SHA1 f52f973f008485c3c9c553745670ab14314bbf52
- SHA512 88cf0de387a211233d0504dabbaf508f35ec8480b950d5c09c7dc2fc79718bb987b046c56149f14a3bc78dad21e85e42ef99f6eef3e9ff79d1dbfe13662eed60
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6r:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm52
- TLSH T110B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\kbsmznwofpujr.exe
- Size 512KB
- SHA256 7427b32454ecf82f436e306fa1486da7a7e6457eb98023b0fcacb257816c4bc3
- MD5 72fa568dd4ccef3a7c8d4269a2572caa
- SHA1 b6fcd6e4c9c0437cf9465aecffbfaf72613ac01e
- SHA512 96a7eaf9bbaf4eecd2806b8081397414caa7c543c26c8b8cd409b187778dc2bd27b250cf1feab0206f2233c018a9d620533695a1553b0abecd2cbcd2a1ac61e9
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6+:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5j
- TLSH T10BB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\qllbjmzybxjhbzc.exe
- Size 512KB
- SHA256 2d1bb6f76dc7746c902e1af350ed5ba53763c85463e58c6c840c176af83205bd
- MD5 b2b1bf9aa191cb921e7c907f622fa0c0
- SHA1 a9309598aaa0b8d6b54f3ab42db35672c2e6d26d
- SHA512 6555fb14d156d5edb79b2406b15f1e8dde936e508bbcd6162d75f4f73cd6c13c7de247881e36cf44b3d8c229e458453cdfca49d4b80f11f341f20c47d0ec3cb6
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6r:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5K
- TLSH T14FB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 97650eba6557022a9017132ed68f411f9546681cf8504420c8a7e5d56e0faf43
- MD5 3a8dd14b206cd6e434f2436740d6b654
- SHA1 ceb86305c8380c8c1ea6492fb9b5366b52e20d43
- SHA512 411f9599430d3f35de9dcbc62e5d61f7d92b1746c03532d797e0569f0883d86f83ac4bbaac43d7d9e515ad0428f7a304c91c1278bb189dee474332df92a6af79
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj69:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5S
- TLSH T181B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 dd407f6c8ed6fff28cf138464a7c56167d3434e38506c7151747d14bd6391663
- MD5 4c544a138e8772a9d13926d582cac8fc
- SHA1 66cde6afc1fa3676e7efb4fe587e15cc7f18e01b
- SHA512 f42f6e50595f4b6df981153222f8226aceeacc58ac9fe5b77a214c1ae5487a935da9c8c6c07b4549381b7e87240826b38c4461a8ceb20c2fd11d11f3869dd52e
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6j:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5U
- TLSH T117B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH