Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/05/2026, 22:24
Behavioral task
behavioral1
Sample
2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe
Resource
win11-20260513-en
windows11-21h2-x64
27 signatures
150 seconds
General
- Target 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe
- Size 512KB
- Sample260528-2bkaesdx9l
- SHA256 ce01877ef80342f5e8c1180b38627d1db08f430620cb367b7fc0cf7fdbdcb433
- MD5 9840d01a032eea67e8a64906499cb35b
- SHA1 4a1449b316aa405d079f824cf4380377cca01a08
- SHA512 d65325edab1fcd56a592e21dd966c501e1a50a26707b23d5485519d974e73a98b2161497674d8ac4ed4a9cc23868482ec4278e36dea873965348d30e52d20cc3
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj67:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5g
- TLSH T1D4B4AF2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 9 IoCs
resource yara_rule behavioral2/files/0x001a00000002b624-5.dat family_sohanad behavioral2/files/0x000c000000026fd3-18.dat family_sohanad behavioral2/files/0x001900000002b628-32.dat family_sohanad behavioral2/files/0x001a00000002b627-28.dat family_sohanad behavioral2/files/0x002400000002a2a3-66.dat family_sohanad behavioral2/files/0x001900000002b638-70.dat family_sohanad behavioral2/files/0x001900000002b63d-84.dat family_sohanad behavioral2/files/0x002400000002b640-297.dat family_sohanad behavioral2/files/0x002400000002b640-299.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" uhxxnloulb.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" uhxxnloulb.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" uhxxnloulb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" uhxxnloulb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" uhxxnloulb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" uhxxnloulb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" uhxxnloulb.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uhxxnloulb.exe - Executes dropped EXE 5 IoCs
pid Process 6092 uhxxnloulb.exe 1392 rmuvhjmogdrzpxe.exe 792 baxqbqcb.exe 6104 oljotqirmxjof.exe 1592 baxqbqcb.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" uhxxnloulb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" uhxxnloulb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" uhxxnloulb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" uhxxnloulb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" uhxxnloulb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" uhxxnloulb.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qdxpcrrj = "uhxxnloulb.exe" rmuvhjmogdrzpxe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\expxeztg = "rmuvhjmogdrzpxe.exe" rmuvhjmogdrzpxe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "oljotqirmxjof.exe" rmuvhjmogdrzpxe.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\m: baxqbqcb.exe File opened (read-only) \??\p: uhxxnloulb.exe File opened (read-only) \??\s: uhxxnloulb.exe File opened (read-only) \??\u: uhxxnloulb.exe File opened (read-only) \??\i: baxqbqcb.exe File opened (read-only) \??\n: baxqbqcb.exe File opened (read-only) \??\k: uhxxnloulb.exe File opened (read-only) \??\t: baxqbqcb.exe File opened (read-only) \??\p: baxqbqcb.exe File opened (read-only) \??\o: uhxxnloulb.exe File opened (read-only) \??\q: baxqbqcb.exe File opened (read-only) \??\x: baxqbqcb.exe File opened (read-only) \??\g: baxqbqcb.exe File opened (read-only) \??\s: baxqbqcb.exe File opened (read-only) \??\t: baxqbqcb.exe File opened (read-only) \??\w: baxqbqcb.exe File opened (read-only) \??\y: uhxxnloulb.exe File opened (read-only) \??\a: baxqbqcb.exe File opened (read-only) \??\v: uhxxnloulb.exe File opened (read-only) \??\l: baxqbqcb.exe File opened (read-only) \??\n: uhxxnloulb.exe File opened (read-only) \??\e: uhxxnloulb.exe File opened (read-only) \??\w: uhxxnloulb.exe File opened (read-only) \??\x: uhxxnloulb.exe File opened (read-only) \??\b: baxqbqcb.exe File opened (read-only) \??\y: baxqbqcb.exe File opened (read-only) \??\z: baxqbqcb.exe File opened (read-only) \??\a: uhxxnloulb.exe File opened (read-only) \??\b: uhxxnloulb.exe File opened (read-only) \??\j: baxqbqcb.exe File opened (read-only) \??\w: baxqbqcb.exe File opened (read-only) \??\h: baxqbqcb.exe File opened (read-only) \??\o: baxqbqcb.exe File opened (read-only) \??\v: baxqbqcb.exe File opened (read-only) \??\l: uhxxnloulb.exe File opened (read-only) \??\r: uhxxnloulb.exe File opened (read-only) \??\s: baxqbqcb.exe File opened (read-only) \??\e: baxqbqcb.exe File opened (read-only) \??\j: baxqbqcb.exe File opened (read-only) \??\y: baxqbqcb.exe File opened (read-only) \??\i: uhxxnloulb.exe File opened (read-only) \??\t: uhxxnloulb.exe File opened (read-only) \??\z: uhxxnloulb.exe File opened (read-only) \??\u: baxqbqcb.exe File opened (read-only) \??\u: baxqbqcb.exe File opened (read-only) \??\g: uhxxnloulb.exe File opened (read-only) \??\a: baxqbqcb.exe File opened (read-only) \??\g: baxqbqcb.exe File opened (read-only) \??\h: baxqbqcb.exe File opened (read-only) \??\x: baxqbqcb.exe File opened (read-only) \??\q: uhxxnloulb.exe File opened (read-only) \??\i: baxqbqcb.exe File opened (read-only) \??\z: baxqbqcb.exe File opened (read-only) \??\e: baxqbqcb.exe File opened (read-only) \??\k: baxqbqcb.exe File opened (read-only) \??\r: baxqbqcb.exe File opened (read-only) \??\v: baxqbqcb.exe File opened (read-only) \??\r: baxqbqcb.exe File opened (read-only) \??\m: uhxxnloulb.exe File opened (read-only) \??\o: baxqbqcb.exe File opened (read-only) \??\k: baxqbqcb.exe File opened (read-only) \??\q: baxqbqcb.exe File opened (read-only) \??\h: uhxxnloulb.exe File opened (read-only) \??\b: baxqbqcb.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" uhxxnloulb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" uhxxnloulb.exe - AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/5004-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x001a00000002b624-5.dat autoit_exe behavioral2/files/0x000c000000026fd3-18.dat autoit_exe behavioral2/files/0x001900000002b628-32.dat autoit_exe behavioral2/files/0x001a00000002b627-28.dat autoit_exe behavioral2/files/0x002400000002a2a3-66.dat autoit_exe behavioral2/files/0x001900000002b638-70.dat autoit_exe behavioral2/files/0x001900000002b63d-84.dat autoit_exe behavioral2/files/0x002400000002b640-297.dat autoit_exe behavioral2/files/0x002400000002b640-299.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\rmuvhjmogdrzpxe.exe 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe File created C:\Windows\SysWOW64\baxqbqcb.exe 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe File created C:\Windows\SysWOW64\oljotqirmxjof.exe 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\oljotqirmxjof.exe 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe baxqbqcb.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe baxqbqcb.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe baxqbqcb.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe baxqbqcb.exe File created C:\Windows\SysWOW64\uhxxnloulb.exe 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\uhxxnloulb.exe 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\rmuvhjmogdrzpxe.exe 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\baxqbqcb.exe 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll uhxxnloulb.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe baxqbqcb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe baxqbqcb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal baxqbqcb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe baxqbqcb.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe baxqbqcb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal baxqbqcb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal baxqbqcb.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe baxqbqcb.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe baxqbqcb.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe baxqbqcb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal baxqbqcb.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe baxqbqcb.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe baxqbqcb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe baxqbqcb.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe baxqbqcb.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe baxqbqcb.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe baxqbqcb.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe baxqbqcb.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe baxqbqcb.exe File opened for modification C:\Windows\mydoc.rtf 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe baxqbqcb.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe baxqbqcb.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe baxqbqcb.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uhxxnloulb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rmuvhjmogdrzpxe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language baxqbqcb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oljotqirmxjof.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language baxqbqcb.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32462C0B9D2182576A3276DC70522DDB7D8264DB" 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB2B12B44E638E353CCB9D332EFD7C4" 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFEFF8B482A851E903CD65F7D9CBCEFE144583067366331D7E9" 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1845C77914E2DBB3B8C17F97ECE534CE" 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" uhxxnloulb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf uhxxnloulb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" uhxxnloulb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" uhxxnloulb.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F06BB1FF6C22D8D273D1D38B7B9160" 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat uhxxnloulb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" uhxxnloulb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc uhxxnloulb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs uhxxnloulb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh uhxxnloulb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" uhxxnloulb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" uhxxnloulb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCEFAB9FE13F2E483783B4B869639E5B08802F042110233E2CE45E808D6" 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg uhxxnloulb.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3672 WINWORD.EXE 3672 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 6092 uhxxnloulb.exe 6092 uhxxnloulb.exe 6092 uhxxnloulb.exe 6092 uhxxnloulb.exe 6092 uhxxnloulb.exe 6092 uhxxnloulb.exe 6092 uhxxnloulb.exe 6092 uhxxnloulb.exe 1392 rmuvhjmogdrzpxe.exe 1392 rmuvhjmogdrzpxe.exe 1392 rmuvhjmogdrzpxe.exe 1392 rmuvhjmogdrzpxe.exe 1392 rmuvhjmogdrzpxe.exe 1392 rmuvhjmogdrzpxe.exe 1392 rmuvhjmogdrzpxe.exe 1392 rmuvhjmogdrzpxe.exe 6092 uhxxnloulb.exe 6092 uhxxnloulb.exe 792 baxqbqcb.exe 792 baxqbqcb.exe 792 baxqbqcb.exe 792 baxqbqcb.exe 792 baxqbqcb.exe 792 baxqbqcb.exe 792 baxqbqcb.exe 792 baxqbqcb.exe 6104 oljotqirmxjof.exe 6104 oljotqirmxjof.exe 1392 rmuvhjmogdrzpxe.exe 1392 rmuvhjmogdrzpxe.exe 6104 oljotqirmxjof.exe 6104 oljotqirmxjof.exe 6104 oljotqirmxjof.exe 6104 oljotqirmxjof.exe 6104 oljotqirmxjof.exe 6104 oljotqirmxjof.exe 6104 oljotqirmxjof.exe 6104 oljotqirmxjof.exe 6104 oljotqirmxjof.exe 6104 oljotqirmxjof.exe 1392 rmuvhjmogdrzpxe.exe 1392 rmuvhjmogdrzpxe.exe 1592 baxqbqcb.exe 1592 baxqbqcb.exe 1592 baxqbqcb.exe 1592 baxqbqcb.exe 1592 baxqbqcb.exe 1592 baxqbqcb.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 1392 rmuvhjmogdrzpxe.exe 1392 rmuvhjmogdrzpxe.exe 1392 rmuvhjmogdrzpxe.exe 6092 uhxxnloulb.exe 792 baxqbqcb.exe 6092 uhxxnloulb.exe 792 baxqbqcb.exe 6092 uhxxnloulb.exe 792 baxqbqcb.exe 6104 oljotqirmxjof.exe 6104 oljotqirmxjof.exe 6104 oljotqirmxjof.exe 1592 baxqbqcb.exe 1592 baxqbqcb.exe 1592 baxqbqcb.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 1392 rmuvhjmogdrzpxe.exe 1392 rmuvhjmogdrzpxe.exe 1392 rmuvhjmogdrzpxe.exe 6092 uhxxnloulb.exe 792 baxqbqcb.exe 6092 uhxxnloulb.exe 792 baxqbqcb.exe 6092 uhxxnloulb.exe 792 baxqbqcb.exe 6104 oljotqirmxjof.exe 6104 oljotqirmxjof.exe 6104 oljotqirmxjof.exe 1592 baxqbqcb.exe 1592 baxqbqcb.exe 1592 baxqbqcb.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 3672 WINWORD.EXE 3672 WINWORD.EXE 3672 WINWORD.EXE 3672 WINWORD.EXE 3672 WINWORD.EXE 3672 WINWORD.EXE 3672 WINWORD.EXE 3672 WINWORD.EXE 3672 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5004 wrote to memory of 6092 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 81 PID 5004 wrote to memory of 1392 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 82 PID 5004 wrote to memory of 792 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 83 PID 5004 wrote to memory of 6104 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 84 PID 5004 wrote to memory of 3672 5004 2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe 85 PID 6092 wrote to memory of 1592 6092 uhxxnloulb.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_9840d01a032eea67e8a64906499cb35b_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\uhxxnloulb.exeuhxxnloulb.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\baxqbqcb.exeC:\Windows\system32\baxqbqcb.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1592
-
-
-
C:\Windows\SysWOW64\rmuvhjmogdrzpxe.exermuvhjmogdrzpxe.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1392
-
-
C:\Windows\SysWOW64\baxqbqcb.exebaxqbqcb.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:792
-
-
C:\Windows\SysWOW64\oljotqirmxjof.exeoljotqirmxjof.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6104
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3672
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 372cb5d38811339f00c26789b6dedef858330fd2bfbdfba14a741f6c179fea12
- MD5 41a6f21984c6fba1af3a468a6526e143
- SHA1 adfb8e044792402263417ea0c9324222a9ac72d8
- SHA512 84ce61ad9d1eaf94cc2e01ee28afa24204fee6a518eb2498ff012147ec36146b500809272444a18c48bff2d633775d5b1770a3c90bb1649aeb46d982705568c2
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6t:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5w
- TLSH T1F6B4AF2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 1e8bc28031a611118501719b8cd13345b30ee4277b79602a472713b1248120ca
- MD5 dbb5428701f3654d1e6edb4613d00f4d
- SHA1 869d5e25082b32c757e1625e48f8a17921c1ae9c
- SHA512 09fb5f191c45d17014d1f3510952fea6a26bdeb5d7b464a4ddb7d120630d2079856a6ed66dec6111b647e91bda7073412808dab35a11e157dc6a62989a75deb8
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6R:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5w
- TLSH T181B4AF2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCDB350.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- TLSH T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\AddOptimize\SkipGrant.doc.exe
- Size 512KB
- SHA256 1226daf1a49fd1d188cdcb8e4e033646ce101dff197d524d050bf17eae4121a2
- MD5 6bdaa523883aa9b93d967e2d8a697148
- SHA1 c380341fb98f74606377e559512649e13a6e2d1d
- SHA512 d4f318dcbad4ea1e0cffbe41ec6c6285b0e1b98d39ff43c4b54d32c4f21e97fd27b5685f293bfc45367a6dc6c859dc0fb68795f23a8cb16eae22c63cc4215994
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6a:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P
- TLSH T158B4AF2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 374B
- SHA256 3ed9635ffef57d3dfd1c2a08895ae4ab7bb08e1f76c41843a8465163e9b77932
- MD5 9cd42e4e0f890b74dd7d114aef00eab6
- SHA1 5832de28f27bb39bb60656a6a998b3ae9e4b639e
- SHA512 1ed998d47bc99e5d5fdea070f37d42a30c830f6af04854ad6ee79e740133104e7722ce9688cb70c0771d5f7e8bfe958a73758d2ebe831353106552ab1f1eaea5
- TLSH T11CE04F176365F7F083BC93F53A7A9CE067F248BDD7A8503805EC5D890D64583109754A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 2KB
- SHA256 3752d4c97fa9f58729899ab27fcabf5624ab36e7936e403d00fcaefd7258699c
- MD5 17bee7a109ca8483ed83f5863a9dec7f
- SHA1 be69447559cea86b23546bfe81ea733a670421bb
- SHA512 9c70d816a86fd394ffa72d491028fa33029d67c85f69e03881702f4d22cdbd97111bc52c3c50d72c9d4ea0efb2359ca0ffe9c89c65202ef5c019868eb0ea3fa6
- TLSH T1E951FD1382DF2B93E186077503398389DB707D83E700615DE584792A9D76D118F9DBAB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 ceebaf0ef3854f709fee128a526e85224b53151f1d2ff4f0a5352b898ab7c95d
- MD5 190944d7bf066b0459d80ee601b5fc1c
- SHA1 b09972f05bdb2da6144634ee49538dc39d429f3e
- SHA512 94bbf49f25d28d6310eadd3cba98cce8aadeb977a1ce244b59cb01591195646adb899446e6754f8bd90c1938e7fa8baa4b0a24e6c4977712a16bea9be83a8536
- TLSH T18D614113429F5BE3E2C60775027A8345CB30BD83E700625DE584392A9D76D028F9DB6F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\baxqbqcb.exe
- Size 512KB
- SHA256 b0c9f02b802c7aafe78940ac983a7beea46336d84ca83a3b5b001f47629831c0
- MD5 1ed52921ea854e45f6c99b5c1bc97f36
- SHA1 8c91b6d7bcb3e47a4a689e7b100276f8e1f616f6
- SHA512 aad371dee58211c74af753f42151df5717687b5e819e1c84653840e44ec8e64cb27d8b88a2ee5d219c631dc18ef1ad4c9985ec6c18ab569b25bbc48e7fce23bc
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6d:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm54
- TLSH T1E7B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\oljotqirmxjof.exe
- Size 512KB
- SHA256 ed4385577d9669f412668e978376b8cd5af637e1bf99a5d51b804da8146797b3
- MD5 aa92823aa3c0b50c0bf870cdba78d43b
- SHA1 eeb8428cc7e52d0b0f32542a30a56051ca3f07c5
- SHA512 53101bcf76113531bed742dc71f792b7921656004a9a2b6f32f96b20efd8c904b587bd91ea97c734d8a2e6e2421aea47278e49fc728ad765b55a8f5063c7847d
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6a:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5j
- TLSH T114B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\rmuvhjmogdrzpxe.exe
- Size 512KB
- SHA256 00fbf74dc9eb0e8d8f6e87dd0a3f2eefe1218da7ac76537035fb664837dbf0bd
- MD5 aa958c4ea1134257d35aef74a8bb19cb
- SHA1 02ec6187b2bf9c53affb97765cb44bc2caa865a6
- SHA512 d7df08977be4ef5dbc3f6858b97cfed15ae7f14879f87a45ecbf764c6e7e28e273c957f2eaf833a37aba1d029ae46133537d36b58d5bdbdd11ba730fe1bc3fd0
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6c:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5R
- TLSH T16CB4AF2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\uhxxnloulb.exe
- Size 512KB
- SHA256 556d09f82f45ed3186446868ac9804158f60155de364b3e095ae59ae79afe03b
- MD5 316b898970c41ea77dfaf4748e954778
- SHA1 4ac9a06f4546c7d1f251532fb512fce215031d97
- SHA512 808abef6ec2396ab8bf59aff91161e00820db8b49b61e1794e018a270d903bc0195668d39f1d5a98843c3ab3e686edb202bd26932808106ebc077f0c15fe7060
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6S:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm53
- TLSH T181B4AF2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 3eaba03484c5cef74f7f5e6625fc02ff1c302d863a3ee6e8b6d5d9917c50aacb
- MD5 152fc3923c5d30da87171d6be857928d
- SHA1 06917ed661186c923cb57e6e534ed17479f6b268
- SHA512 6b9662b4c6886d568afb363a6485adeaa9d2bf8e643c1e08ae323960f6b1f34262821b7486ae3fd6710ca7ee5a356dd3dc6d2a8f663287210b9983e97cf9bde8
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5e
- TLSH T129B4AF2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 63464c5e525448700fdcbd6a9bad479fa8a1229aeda22ed125a6225559d40dbe
- MD5 bf1b7e7ac61cdf66ad914c543e149667
- SHA1 ed5381cd427195180301f8e80c8122751d6da14b
- SHA512 36a60d8532f9aa9e0e284eac0e2f3e4bf52fd9c014352b03bcf234971ec2ade79a755e0e6bd05a2aef43cb6c2e66bac2e9f184a6067a7800e2759bbdb8e1a17e
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6i:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5R
- TLSH T154B4AF2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH