Analysis
- max time kernel
150s - max time network
146s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/05/2026, 11:14
Behavioral task
behavioral1
Sample
2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe
Resource
win11-20260513-en
windows11-21h2-x64
27 signatures
150 seconds
General
- Target 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe
- Size 512KB
- Sample260517-nb8fcsfv4v
- SHA256 b09eea47ef36f1f89de26d12b5952b54db35eab6b83184924404053842b017be
- MD5 f76d2b187e66dd57a043f5f9408d859b
- SHA1 f8edb86066bff14ded4dfa04c3d4a12c93e9ad35
- SHA512 ca8f4953b955dd621339affe369dbf20f7a41c13640f6061db18bb8932314dfac067f2aaceb09acbe03fa1981fe52ce622ba48200d350d63f76a33a242d61ca8
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5R
- TLSH T198B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 8 IoCs
resource yara_rule behavioral2/files/0x000700000002501f-5.dat family_sohanad behavioral2/files/0x000500000001026b-18.dat family_sohanad behavioral2/files/0x00040000000259e8-25.dat family_sohanad behavioral2/files/0x0009000000028ec9-32.dat family_sohanad behavioral2/files/0x001900000002b5c6-56.dat family_sohanad behavioral2/files/0x001900000002b5c7-59.dat family_sohanad behavioral2/files/0x002200000002b5fb-370.dat family_sohanad behavioral2/files/0x002200000002b5fb-373.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" bcwozgnbnx.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bcwozgnbnx.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" bcwozgnbnx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" bcwozgnbnx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" bcwozgnbnx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" bcwozgnbnx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" bcwozgnbnx.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bcwozgnbnx.exe - Executes dropped EXE 5 IoCs
pid Process 2212 bcwozgnbnx.exe 1752 uiubjkvgpnvbmku.exe 3712 izrlsqbq.exe 3920 rczrqvrxyjuza.exe 1636 izrlsqbq.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" bcwozgnbnx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" bcwozgnbnx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" bcwozgnbnx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" bcwozgnbnx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" bcwozgnbnx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" bcwozgnbnx.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nzlqisdl = "bcwozgnbnx.exe" uiubjkvgpnvbmku.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\njsqlgaq = "uiubjkvgpnvbmku.exe" uiubjkvgpnvbmku.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "rczrqvrxyjuza.exe" uiubjkvgpnvbmku.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: izrlsqbq.exe File opened (read-only) \??\s: izrlsqbq.exe File opened (read-only) \??\l: bcwozgnbnx.exe File opened (read-only) \??\s: bcwozgnbnx.exe File opened (read-only) \??\x: bcwozgnbnx.exe File opened (read-only) \??\m: izrlsqbq.exe File opened (read-only) \??\a: bcwozgnbnx.exe File opened (read-only) \??\h: izrlsqbq.exe File opened (read-only) \??\e: izrlsqbq.exe File opened (read-only) \??\l: izrlsqbq.exe File opened (read-only) \??\p: izrlsqbq.exe File opened (read-only) \??\o: bcwozgnbnx.exe File opened (read-only) \??\e: izrlsqbq.exe File opened (read-only) \??\t: izrlsqbq.exe File opened (read-only) \??\k: bcwozgnbnx.exe File opened (read-only) \??\h: izrlsqbq.exe File opened (read-only) \??\l: izrlsqbq.exe File opened (read-only) \??\k: izrlsqbq.exe File opened (read-only) \??\n: izrlsqbq.exe File opened (read-only) \??\r: izrlsqbq.exe File opened (read-only) \??\v: bcwozgnbnx.exe File opened (read-only) \??\g: izrlsqbq.exe File opened (read-only) \??\a: izrlsqbq.exe File opened (read-only) \??\w: izrlsqbq.exe File opened (read-only) \??\i: bcwozgnbnx.exe File opened (read-only) \??\y: bcwozgnbnx.exe File opened (read-only) \??\k: izrlsqbq.exe File opened (read-only) \??\p: izrlsqbq.exe File opened (read-only) \??\v: izrlsqbq.exe File opened (read-only) \??\z: izrlsqbq.exe File opened (read-only) \??\r: bcwozgnbnx.exe File opened (read-only) \??\n: izrlsqbq.exe File opened (read-only) \??\j: bcwozgnbnx.exe File opened (read-only) \??\t: bcwozgnbnx.exe File opened (read-only) \??\w: bcwozgnbnx.exe File opened (read-only) \??\e: bcwozgnbnx.exe File opened (read-only) \??\g: izrlsqbq.exe File opened (read-only) \??\v: izrlsqbq.exe File opened (read-only) \??\u: izrlsqbq.exe File opened (read-only) \??\x: izrlsqbq.exe File opened (read-only) \??\b: izrlsqbq.exe File opened (read-only) \??\t: izrlsqbq.exe File opened (read-only) \??\u: izrlsqbq.exe File opened (read-only) \??\g: bcwozgnbnx.exe File opened (read-only) \??\z: bcwozgnbnx.exe File opened (read-only) \??\j: izrlsqbq.exe File opened (read-only) \??\o: izrlsqbq.exe File opened (read-only) \??\y: izrlsqbq.exe File opened (read-only) \??\n: bcwozgnbnx.exe File opened (read-only) \??\q: bcwozgnbnx.exe File opened (read-only) \??\b: izrlsqbq.exe File opened (read-only) \??\q: izrlsqbq.exe File opened (read-only) \??\w: izrlsqbq.exe File opened (read-only) \??\m: bcwozgnbnx.exe File opened (read-only) \??\p: bcwozgnbnx.exe File opened (read-only) \??\u: bcwozgnbnx.exe File opened (read-only) \??\i: izrlsqbq.exe File opened (read-only) \??\r: izrlsqbq.exe File opened (read-only) \??\y: izrlsqbq.exe File opened (read-only) \??\b: bcwozgnbnx.exe File opened (read-only) \??\m: izrlsqbq.exe File opened (read-only) \??\o: izrlsqbq.exe File opened (read-only) \??\a: izrlsqbq.exe File opened (read-only) \??\j: izrlsqbq.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" bcwozgnbnx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" bcwozgnbnx.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4864-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000700000002501f-5.dat autoit_exe behavioral2/files/0x000500000001026b-18.dat autoit_exe behavioral2/files/0x00040000000259e8-25.dat autoit_exe behavioral2/files/0x0009000000028ec9-32.dat autoit_exe behavioral2/files/0x001900000002b5c6-56.dat autoit_exe behavioral2/files/0x001900000002b5c7-59.dat autoit_exe behavioral2/files/0x002200000002b5fb-370.dat autoit_exe behavioral2/files/0x002200000002b5fb-373.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\bcwozgnbnx.exe 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\bcwozgnbnx.exe 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe File created C:\Windows\SysWOW64\uiubjkvgpnvbmku.exe 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\uiubjkvgpnvbmku.exe 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe File created C:\Windows\SysWOW64\izrlsqbq.exe 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\izrlsqbq.exe 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\rczrqvrxyjuza.exe 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe izrlsqbq.exe File created C:\Windows\SysWOW64\rczrqvrxyjuza.exe 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll bcwozgnbnx.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe izrlsqbq.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe izrlsqbq.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe izrlsqbq.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe izrlsqbq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal izrlsqbq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe izrlsqbq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe izrlsqbq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal izrlsqbq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal izrlsqbq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe izrlsqbq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe izrlsqbq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe izrlsqbq.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe izrlsqbq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe izrlsqbq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe izrlsqbq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe izrlsqbq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal izrlsqbq.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe izrlsqbq.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe izrlsqbq.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe izrlsqbq.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe izrlsqbq.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe izrlsqbq.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe izrlsqbq.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe izrlsqbq.exe File opened for modification C:\Windows\mydoc.rtf 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe izrlsqbq.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bcwozgnbnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uiubjkvgpnvbmku.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language izrlsqbq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rczrqvrxyjuza.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language izrlsqbq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" bcwozgnbnx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" bcwozgnbnx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg bcwozgnbnx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" bcwozgnbnx.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCFFABDFE13F1E0837A3B4A819D3996B38F02FA4215033BE1BA42EB09D6" 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC2B020449739EE52CDB9D332E8D4BC" 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184EC67B14E1DBC5B8C87CE3ED9F37C8" 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" bcwozgnbnx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc bcwozgnbnx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" bcwozgnbnx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat bcwozgnbnx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" bcwozgnbnx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs bcwozgnbnx.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33412C7B9D5583506D3676D770512CDC7D8065A8" 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F88FFFF4F2A82139040D6217E97BCE5E640593666426234D7EC" 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh bcwozgnbnx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf bcwozgnbnx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78468C6FE6822D9D279D1D48A7D9166" 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 5164 WINWORD.EXE 5164 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 3920 rczrqvrxyjuza.exe 2212 bcwozgnbnx.exe 3920 rczrqvrxyjuza.exe 3920 rczrqvrxyjuza.exe 3920 rczrqvrxyjuza.exe 2212 bcwozgnbnx.exe 3920 rczrqvrxyjuza.exe 3920 rczrqvrxyjuza.exe 3920 rczrqvrxyjuza.exe 3920 rczrqvrxyjuza.exe 2212 bcwozgnbnx.exe 2212 bcwozgnbnx.exe 3920 rczrqvrxyjuza.exe 3920 rczrqvrxyjuza.exe 3920 rczrqvrxyjuza.exe 3920 rczrqvrxyjuza.exe 2212 bcwozgnbnx.exe 2212 bcwozgnbnx.exe 2212 bcwozgnbnx.exe 2212 bcwozgnbnx.exe 2212 bcwozgnbnx.exe 2212 bcwozgnbnx.exe 1752 uiubjkvgpnvbmku.exe 1752 uiubjkvgpnvbmku.exe 3712 izrlsqbq.exe 1752 uiubjkvgpnvbmku.exe 3712 izrlsqbq.exe 1752 uiubjkvgpnvbmku.exe 1752 uiubjkvgpnvbmku.exe 3712 izrlsqbq.exe 1752 uiubjkvgpnvbmku.exe 3712 izrlsqbq.exe 1752 uiubjkvgpnvbmku.exe 1752 uiubjkvgpnvbmku.exe 3712 izrlsqbq.exe 3712 izrlsqbq.exe 3712 izrlsqbq.exe 3712 izrlsqbq.exe 1752 uiubjkvgpnvbmku.exe 1752 uiubjkvgpnvbmku.exe 3920 rczrqvrxyjuza.exe 3920 rczrqvrxyjuza.exe 3920 rczrqvrxyjuza.exe 3920 rczrqvrxyjuza.exe 1752 uiubjkvgpnvbmku.exe 1752 uiubjkvgpnvbmku.exe 3920 rczrqvrxyjuza.exe 3920 rczrqvrxyjuza.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 2212 bcwozgnbnx.exe 2212 bcwozgnbnx.exe 2212 bcwozgnbnx.exe 3920 rczrqvrxyjuza.exe 3920 rczrqvrxyjuza.exe 1752 uiubjkvgpnvbmku.exe 3920 rczrqvrxyjuza.exe 3712 izrlsqbq.exe 3712 izrlsqbq.exe 1752 uiubjkvgpnvbmku.exe 1752 uiubjkvgpnvbmku.exe 3712 izrlsqbq.exe 1636 izrlsqbq.exe 1636 izrlsqbq.exe 1636 izrlsqbq.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 2212 bcwozgnbnx.exe 2212 bcwozgnbnx.exe 2212 bcwozgnbnx.exe 3920 rczrqvrxyjuza.exe 3920 rczrqvrxyjuza.exe 3920 rczrqvrxyjuza.exe 3712 izrlsqbq.exe 1752 uiubjkvgpnvbmku.exe 3712 izrlsqbq.exe 1752 uiubjkvgpnvbmku.exe 1752 uiubjkvgpnvbmku.exe 3712 izrlsqbq.exe 1636 izrlsqbq.exe 1636 izrlsqbq.exe 1636 izrlsqbq.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 5164 WINWORD.EXE 5164 WINWORD.EXE 5164 WINWORD.EXE 5164 WINWORD.EXE 5164 WINWORD.EXE 5164 WINWORD.EXE 5164 WINWORD.EXE 5164 WINWORD.EXE 5164 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4864 wrote to memory of 2212 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 80 PID 4864 wrote to memory of 1752 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 81 PID 4864 wrote to memory of 3712 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 82 PID 4864 wrote to memory of 3920 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 83 PID 4864 wrote to memory of 5164 4864 2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe 84 PID 2212 wrote to memory of 1636 2212 bcwozgnbnx.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_f76d2b187e66dd57a043f5f9408d859b_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\bcwozgnbnx.exebcwozgnbnx.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\izrlsqbq.exeC:\Windows\system32\izrlsqbq.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1636
-
-
-
C:\Windows\SysWOW64\uiubjkvgpnvbmku.exeuiubjkvgpnvbmku.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1752
-
-
C:\Windows\SysWOW64\izrlsqbq.exeizrlsqbq.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3712
-
-
C:\Windows\SysWOW64\rczrqvrxyjuza.exerczrqvrxyjuza.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3920
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5164
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 4b126efbbadde107df432a750b02e5321cc15d2018a8526fb5fb162fc80165ba
- MD5 5088756f94f95fbfa20dc5d0572224e6
- SHA1 83d2be7bb5d640f84434af0d5e4ada1248458181
- SHA512 39c994c81730c63b5c18a9469e7cbe3ba634ed2301ad4a3e4c755991e402c14d3fc0db95fb2bdb354df39d19d6ebdf5c1e87e26aeebab06ccd8d9f4964a6f814
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D
- TLSH T11CB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 fcb1a95ad17e386b03f436253b9349b36c89e36d6b732249254a03fb61e68f9b
- MD5 045b9c96938cd504a2a8cd460eaeecdd
- SHA1 a2dc029589059ef6de92a51955ccba33f93e4e7b
- SHA512 608a2195073dd2d7a485ad49c01a6247451d7be35db4b2a2ca3ac06a57aa0b7219dac5b8df16da6dca00b4ca909a01b89a10777556a4872e25e2f47ea06d2c43
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6f:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm58
- TLSH T18CB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCDAEA7.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- TLSH T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 317B
- SHA256 300da28cc50ab854ad838830a929757e626c96f6ba9889d08dc07863fe9e81fd
- MD5 d502a5015da2e0837ce7dbfb2238763b
- SHA1 5f1a3f9b82d06fac265edb237443464c43927bdb
- SHA512 dbf17cfe588b34045ebd3635ac9004eb8310ed36ecc539de81126cc73ada9d43f8e36a5f8ba41d2df2def349fed2451ddc381b9b16d3ea5c78a4b46816df8919
- TLSH T156E012A78726EBF497BD91A67A38DCF49FF1488CF26900341CCC0D960E00A03B1AB589
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 3e0f9ead95b01f64002d2b3894371bd9cb9686579c2b275c340f6ee4f41d1ecf
- MD5 2de71ccd1528033927b57940bab8ae77
- SHA1 ed721fb5e56a760a14459810907b89fce6b0918f
- SHA512 7c25c9fb0492d6bda83667427999ab6f53f2d0adffe8369e4f399b05558b36a22abc59953cabbd16111eed6c99471ee12b3c7a19eaf7e8a9eccf0794c1d3e4e7
- TLSH T18621DD816A87AEB1E09047B5256B1721EB34FE03DE166A0D4104B72A7DA5B015E8C3AB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 683B
- SHA256 5579a85ebc541800affae4225ded3b292ce71a732c397acdfb21ec2a3fe6d323
- MD5 a3616a85bf1a64fbd3abda3693a54814
- SHA1 776a6353461c6dbd9430f1f29bd62029e5acb962
- SHA512 a2aed63116ba475d8aefaf7270015d738754a1a45ce479d33f555a98d914b46fcb8e1a8d2821189b2ce38b02297e9f2ab1c347eeaf62c41b569b726dd468b45c
- TLSH T17801E1417ACB2A66E49007B526370331E734FD03EA157A0D5544773B2D65E005E8C3B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\bcwozgnbnx.exe
- Size 512KB
- SHA256 be9c91e307a8890703c8232e0e8c2bd0d196899be4abfe17cdb9d97e9b65256f
- MD5 5ffe0e50e90bd19501b755039fff2ec7
- SHA1 8cee3b982e07f3c639fa1d1351d15f065a149f94
- SHA512 9f4bc363cfba1da057a8696a8332896a63e643bc3d7546a7f796be6db46af0eb67c8438444656b0130d94ce400d6654dba0141b8edb1dedc6be4c5ff5cd62c5d
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6h:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Q
- TLSH T1C0B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\izrlsqbq.exe
- Size 512KB
- SHA256 3412f51a7d80745c32f5d74c3249b764df7e274151fd511767a4f0eaf4788d67
- MD5 419fc374f813678d60807e8d7c3e03c5
- SHA1 c931a15f0b27629d6248f5737eb26e7e18cb6c85
- SHA512 585c49f75e81aa5f3dfb490d3690fe5710a5056b45bcd2d808260605f6e143ead6d8a8ab6767caa5c23bd607d73e5f54dd055cd3aa3fa03ae3063383492e1587
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Q:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm59
- TLSH T174B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\rczrqvrxyjuza.exe
- Size 512KB
- SHA256 01b930a0e8fa20f089e86703972122316885b423dacaac795417a1cdd436a935
- MD5 57b7feee39a16e12da609954c029ef1e
- SHA1 bcabf281ad6249fbe58bb029d7d78b120d4882b8
- SHA512 ceb6339d25d3ce85e0aedf87b53a1255413318f0b3c6e319f3b094ffb732b4c6ae68b95bc031f908172b7ab50b747aa524bec05d56158ada32913d9e8df7b29f
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj60:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5J
- TLSH T108B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\uiubjkvgpnvbmku.exe
- Size 512KB
- SHA256 def513fc15b509193b3e0530afd6bd55f0c31775898b1d8d600b02cd123eb00a
- MD5 2ef35d6e9732571461d544fa69866d78
- SHA1 1221c2170c75c4a94d53c5b33190d1506d74e9e2
- SHA512 f7ae9abe8798f1e991d77922b5431f6c9a5f8af90d5a9cc5a21586be9e63d2c99e15538ebbd1a98d9492ec6adb3564ca380988252c86169c0cfa7a6296323de9
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6W:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P
- TLSH T19DB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 bb9f7da3e3ee82e11276e8042e74fedf5396d7e75a7b70e7812fc31256e85ea6
- MD5 684353352e2cb311c13638526a7d2b85
- SHA1 f1e415bb3ebe26bcac311b12c4521270faf522fe
- SHA512 73eb4482ae855633a429598f381dac9348bcc42c048ecb0697e9e4f8ab4aecbc914bf8cd1867a1d2de8b3b58d6b9a256a793eea6dbc51d7360dda0e940c79711
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55
- TLSH T18AB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 ef45839ff64c4a27d7c815a0d9008fb34a34fa2a7ef4661a6638022dc34b2fce
- MD5 6e8d864a4c9a7dcf25cfe631d216cd9a
- SHA1 cf690c1d126c974fbfb7db4ef2c7474260ec8100
- SHA512 59213640281d9bc855c5b319ce7e557fba247c1abe5b67b100c04b5ab4ddc88077cfac4f39cb5e623a5bd4b6baba15aa9c73440fc4a57549798883bb62ed8d23
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6m:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5v
- TLSH T1DBB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH