Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 03:35
Behavioral task
behavioral1
Sample
2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe
- Size 513KB
- Sample260705-d5e1ssg161
- SHA256 03ec3fe5b6426bc1b0bd19f90cb34e822cdad00f71d157e22b9775c3fb50084b
- MD5 a7fd175a3ed06c8eb978e4fa98cb2dc1
- SHA1 7ca80c278ac8f0880db6ea253dea8e999fb7d995
- SHA512 ec96e5b6f0bac179b83827fb3cd93de0322bd69a653dcaa68675f6a9ee05d0b48a801216b328ecdb05e502fcbea7e71b59cc07deed556a9752151cb7c94dd602
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6X:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5u
- TLSH T1C0B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 8 IoCs
resource yara_rule behavioral2/files/0x000b000000019cb7-5.dat family_sohanad behavioral2/files/0x00170000000115bf-12.dat family_sohanad behavioral2/files/0x0005000000016b47-17.dat family_sohanad behavioral2/files/0x000400000001b30b-27.dat family_sohanad behavioral2/files/0x000d00000001c4ec-61.dat family_sohanad behavioral2/files/0x000d00000001c4ed-64.dat family_sohanad behavioral2/files/0x000d00000001c4f0-67.dat family_sohanad behavioral2/files/0x000f00000001c4fd-177.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ebibfqnkgy.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ebibfqnkgy.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ebibfqnkgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ebibfqnkgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ebibfqnkgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ebibfqnkgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ebibfqnkgy.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ebibfqnkgy.exe - Executes dropped EXE 5 IoCs
pid Process 4760 ebibfqnkgy.exe 8 kynfuuqrgmsbano.exe 1900 jhgnwtvw.exe 3716 kpnlpkltbmuyj.exe 3432 jhgnwtvw.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ebibfqnkgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ebibfqnkgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ebibfqnkgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ebibfqnkgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ebibfqnkgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" ebibfqnkgy.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jgvakzxl = "kynfuuqrgmsbano.exe" kynfuuqrgmsbano.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "kpnlpkltbmuyj.exe" kynfuuqrgmsbano.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\olcsiaba = "ebibfqnkgy.exe" kynfuuqrgmsbano.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: ebibfqnkgy.exe File opened (read-only) \??\s: ebibfqnkgy.exe File opened (read-only) \??\w: ebibfqnkgy.exe File opened (read-only) \??\i: jhgnwtvw.exe File opened (read-only) \??\t: jhgnwtvw.exe File opened (read-only) \??\b: ebibfqnkgy.exe File opened (read-only) \??\o: jhgnwtvw.exe File opened (read-only) \??\w: jhgnwtvw.exe File opened (read-only) \??\a: ebibfqnkgy.exe File opened (read-only) \??\h: ebibfqnkgy.exe File opened (read-only) \??\o: ebibfqnkgy.exe File opened (read-only) \??\k: jhgnwtvw.exe File opened (read-only) \??\x: jhgnwtvw.exe File opened (read-only) \??\m: jhgnwtvw.exe File opened (read-only) \??\z: jhgnwtvw.exe File opened (read-only) \??\p: ebibfqnkgy.exe File opened (read-only) \??\q: jhgnwtvw.exe File opened (read-only) \??\s: jhgnwtvw.exe File opened (read-only) \??\y: jhgnwtvw.exe File opened (read-only) \??\m: ebibfqnkgy.exe File opened (read-only) \??\q: jhgnwtvw.exe File opened (read-only) \??\s: jhgnwtvw.exe File opened (read-only) \??\d: jhgnwtvw.exe File opened (read-only) \??\v: jhgnwtvw.exe File opened (read-only) \??\l: ebibfqnkgy.exe File opened (read-only) \??\d: jhgnwtvw.exe File opened (read-only) \??\g: jhgnwtvw.exe File opened (read-only) \??\j: jhgnwtvw.exe File opened (read-only) \??\z: jhgnwtvw.exe File opened (read-only) \??\w: jhgnwtvw.exe File opened (read-only) \??\x: jhgnwtvw.exe File opened (read-only) \??\n: ebibfqnkgy.exe File opened (read-only) \??\p: jhgnwtvw.exe File opened (read-only) \??\p: jhgnwtvw.exe File opened (read-only) \??\d: ebibfqnkgy.exe File opened (read-only) \??\a: jhgnwtvw.exe File opened (read-only) \??\b: jhgnwtvw.exe File opened (read-only) \??\j: jhgnwtvw.exe File opened (read-only) \??\n: jhgnwtvw.exe File opened (read-only) \??\t: jhgnwtvw.exe File opened (read-only) \??\j: ebibfqnkgy.exe File opened (read-only) \??\z: ebibfqnkgy.exe File opened (read-only) \??\r: jhgnwtvw.exe File opened (read-only) \??\v: jhgnwtvw.exe File opened (read-only) \??\h: jhgnwtvw.exe File opened (read-only) \??\k: jhgnwtvw.exe File opened (read-only) \??\g: ebibfqnkgy.exe File opened (read-only) \??\g: jhgnwtvw.exe File opened (read-only) \??\l: jhgnwtvw.exe File opened (read-only) \??\u: ebibfqnkgy.exe File opened (read-only) \??\b: jhgnwtvw.exe File opened (read-only) \??\l: jhgnwtvw.exe File opened (read-only) \??\h: jhgnwtvw.exe File opened (read-only) \??\m: jhgnwtvw.exe File opened (read-only) \??\u: jhgnwtvw.exe File opened (read-only) \??\q: ebibfqnkgy.exe File opened (read-only) \??\t: ebibfqnkgy.exe File opened (read-only) \??\v: ebibfqnkgy.exe File opened (read-only) \??\u: jhgnwtvw.exe File opened (read-only) \??\a: jhgnwtvw.exe File opened (read-only) \??\i: jhgnwtvw.exe File opened (read-only) \??\r: jhgnwtvw.exe File opened (read-only) \??\y: jhgnwtvw.exe File opened (read-only) \??\k: ebibfqnkgy.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" ebibfqnkgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" ebibfqnkgy.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1476-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000b000000019cb7-5.dat autoit_exe behavioral2/files/0x00170000000115bf-12.dat autoit_exe behavioral2/files/0x0005000000016b47-17.dat autoit_exe behavioral2/files/0x000400000001b30b-27.dat autoit_exe behavioral2/files/0x000d00000001c4ec-61.dat autoit_exe behavioral2/files/0x000d00000001c4ed-64.dat autoit_exe behavioral2/files/0x000d00000001c4f0-67.dat autoit_exe behavioral2/files/0x000f00000001c4fd-177.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\ebibfqnkgy.exe 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\ebibfqnkgy.exe 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe File created C:\Windows\SysWOW64\jhgnwtvw.exe 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\jhgnwtvw.exe 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe File created C:\Windows\SysWOW64\kpnlpkltbmuyj.exe 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ebibfqnkgy.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe jhgnwtvw.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe jhgnwtvw.exe File created C:\Windows\SysWOW64\kynfuuqrgmsbano.exe 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\kynfuuqrgmsbano.exe 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\kpnlpkltbmuyj.exe 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe jhgnwtvw.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe jhgnwtvw.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jhgnwtvw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jhgnwtvw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal jhgnwtvw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jhgnwtvw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jhgnwtvw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal jhgnwtvw.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jhgnwtvw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jhgnwtvw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jhgnwtvw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jhgnwtvw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal jhgnwtvw.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jhgnwtvw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal jhgnwtvw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jhgnwtvw.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe jhgnwtvw.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe jhgnwtvw.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe jhgnwtvw.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe jhgnwtvw.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe jhgnwtvw.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe jhgnwtvw.exe File opened for modification C:\Windows\mydoc.rtf 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe jhgnwtvw.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe jhgnwtvw.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ebibfqnkgy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kynfuuqrgmsbano.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhgnwtvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kpnlpkltbmuyj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhgnwtvw.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" ebibfqnkgy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg ebibfqnkgy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" ebibfqnkgy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" ebibfqnkgy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABEF9BDF963F1E484753A44819A3E93B08802F94212033BE1CF42EE08A5" 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC1B15B479039EC52C9B9D63393D4BE" 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf ebibfqnkgy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" ebibfqnkgy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFAFCFE482E851D9047D72C7DE0BC90E130594A66426237D79E" 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh ebibfqnkgy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" ebibfqnkgy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs ebibfqnkgy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" ebibfqnkgy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc ebibfqnkgy.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33462C7A9C2083226A4377D170512CAE7DF265AB" 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7876BB9FE6722DBD279D0D68A7B916B" 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184AC60F14E4DAC5B8CF7F97EC9634BE" 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat ebibfqnkgy.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4316 WINWORD.EXE 4316 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 4760 ebibfqnkgy.exe 4760 ebibfqnkgy.exe 4760 ebibfqnkgy.exe 4760 ebibfqnkgy.exe 4760 ebibfqnkgy.exe 4760 ebibfqnkgy.exe 4760 ebibfqnkgy.exe 4760 ebibfqnkgy.exe 4760 ebibfqnkgy.exe 4760 ebibfqnkgy.exe 8 kynfuuqrgmsbano.exe 8 kynfuuqrgmsbano.exe 8 kynfuuqrgmsbano.exe 8 kynfuuqrgmsbano.exe 8 kynfuuqrgmsbano.exe 8 kynfuuqrgmsbano.exe 8 kynfuuqrgmsbano.exe 8 kynfuuqrgmsbano.exe 8 kynfuuqrgmsbano.exe 8 kynfuuqrgmsbano.exe 1900 jhgnwtvw.exe 1900 jhgnwtvw.exe 1900 jhgnwtvw.exe 1900 jhgnwtvw.exe 1900 jhgnwtvw.exe 1900 jhgnwtvw.exe 1900 jhgnwtvw.exe 1900 jhgnwtvw.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 8 kynfuuqrgmsbano.exe 8 kynfuuqrgmsbano.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 8 kynfuuqrgmsbano.exe 8 kynfuuqrgmsbano.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 4760 ebibfqnkgy.exe 4760 ebibfqnkgy.exe 4760 ebibfqnkgy.exe 8 kynfuuqrgmsbano.exe 8 kynfuuqrgmsbano.exe 8 kynfuuqrgmsbano.exe 1900 jhgnwtvw.exe 1900 jhgnwtvw.exe 1900 jhgnwtvw.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 3432 jhgnwtvw.exe 3432 jhgnwtvw.exe 3432 jhgnwtvw.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 4760 ebibfqnkgy.exe 4760 ebibfqnkgy.exe 4760 ebibfqnkgy.exe 8 kynfuuqrgmsbano.exe 8 kynfuuqrgmsbano.exe 8 kynfuuqrgmsbano.exe 1900 jhgnwtvw.exe 1900 jhgnwtvw.exe 1900 jhgnwtvw.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 3716 kpnlpkltbmuyj.exe 3432 jhgnwtvw.exe 3432 jhgnwtvw.exe 3432 jhgnwtvw.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4316 WINWORD.EXE 4316 WINWORD.EXE 4316 WINWORD.EXE 4316 WINWORD.EXE 4316 WINWORD.EXE 4316 WINWORD.EXE 4316 WINWORD.EXE 4316 WINWORD.EXE 4316 WINWORD.EXE 4316 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1476 wrote to memory of 4760 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 88 PID 1476 wrote to memory of 8 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 89 PID 1476 wrote to memory of 1900 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 90 PID 1476 wrote to memory of 3716 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 91 PID 1476 wrote to memory of 4316 1476 2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe 92 PID 4760 wrote to memory of 3432 4760 ebibfqnkgy.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_a7fd175a3ed06c8eb978e4fa98cb2dc1_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\ebibfqnkgy.exeebibfqnkgy.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\jhgnwtvw.exeC:\Windows\system32\jhgnwtvw.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3432
-
-
-
C:\Windows\SysWOW64\kynfuuqrgmsbano.exekynfuuqrgmsbano.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:8
-
-
C:\Windows\SysWOW64\jhgnwtvw.exejhgnwtvw.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1900
-
-
C:\Windows\SysWOW64\kpnlpkltbmuyj.exekpnlpkltbmuyj.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3716
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4316
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 513KB
- SHA256 792849fe1c7aa26782a0be19cfc517f2782cdcde033f70ca5797090c1bdafe10
- MD5 349f209f4a0d55ba6d84b1572611f646
- SHA1 0cbf55d45d270d48949cdab9361af522504f8f8a
- SHA512 419eb9ac3e766745d4f218918dbdc38299040823dff7f7a5fa43585aba71824db95ad345e92ab21e2ccdefeadbda303afb174474e82351b09a424b5b0814eb07
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6R:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5K
- TLSH T125B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 513KB
- SHA256 9b47c9be3b0d7d89b291105e4ae8a51863dc0a1db5166fae0c7ee5a66950563a
- MD5 ac9a5a6f85412db35d55f8b882c17b3b
- SHA1 500cf613c0ed60f5028006d9742d8e1709fa7aee
- SHA512 a5554a6a458ba5ddc23bc3c4b562cd28228819bf3a4d948308413526204801d89567fb257e3e7b61829b0f76f2692bbc09bfce832fc85c2894a7bec1269e29ba
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6s:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D
- TLSH T1D6B4AF2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCDE109.tmp\sist02.xsl
- Size 245KB
- SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
- MD5 f883b260a8d67082ea895c14bf56dd56
- SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
- SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
- SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
- TLSH T15B346895A6DACF144B71F23FD8B53492EA1DC87B29342D41F1DC733717AE948822B622
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\MergeConvertFrom\CopyUpdate.doc.exe
- Size 513KB
- SHA256 14cbf6d98f00cfa90967cc5e6f05454411bc29197b9061f353c95670c60946e2
- MD5 48720f7ebd31dd976ffe5ee01e2b8651
- SHA1 859465d0358bd35ab01c7e70afc2cf930e30e385
- SHA512 e23928f1b7ad64ea478ba53cb3686b73f0f10056cf0545a33e389b271c61c258373cf8a8d22beec1e7ab1c68c46f7a0f0d5a19a319384b2cdf2b68dc1d0fe363
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6+:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5t
- TLSH T112B4AF2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 413B
- SHA256 961f14807abf3e4d0a8409553f0b21e890c677e8a8aff430ef3e1a390a2b987d
- MD5 f12b86e5107daffff4a394178dad44e4
- SHA1 b7fd8b4ee4ed00162c26fc71da85decbfa63e090
- SHA512 1d752cea422ad64080ac42b03d8d3b779e8aa3b5a717b2d7c9964784e8ef5c4121bdbefb20637a56d9b2e91f4a4ab6ca9d38623dd7fe77421c3a725c6daab454
- TLSH T1F4E0920B2721E3F0837D85F439B9AEF467F2986CEA7E406181CC2CC61C6158714C710D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 2KB
- SHA256 8057c25f02aed76ad2808d12eab1d7d6fef7d9e826caa78390a9c5d45c3b0d46
- MD5 4dc4a611192f065114ae708036d1d736
- SHA1 770349a8d98eab3e442d76eddba1ff357274c614
- SHA512 5b71101be57a3805e30d1444434418475af30679570efa52233162672847a0896113da93d24f400a807273740d14d1b2b3c186105adbc44a19b1dd84637c7d17
- TLSH T13B51228266DB2F57D1D4433296267395CB30FD43E7089A1EE288303B6D61B409E9CF6D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 e9e02dde224a75d3cb5c5af0173579eb5020a246842348149542fa4a8f4c31b8
- MD5 484f577a9aa21ffed2abe9c6ed906c75
- SHA1 5e162ee86b09142651bab8d0f306d8213a2aa4b6
- SHA512 15ee3682ae634336f39abb04db6a15e7ee9a5f730a93ade948c8f18c1a759633ed5f0afc5b1920d261735c87a34d9d8c7735d62b06b8fd7c2885f16cda32cb90
- TLSH T1E341ED8266CB2F1BD1D4037296256399C670FD83E708962EE284303B6D65F408E9CF5D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\ebibfqnkgy.exe
- Size 513KB
- SHA256 ae1e146148b5784d1f33f8176cea728577175b28c2016de0809e207f5dfacc27
- MD5 8cdfe460b9aa7f9ca67510f007a4ae92
- SHA1 e164d367f1d7f227e1d58871e899ffec80367bae
- SHA512 95384a1bb0f8a6b7ac9860fab65b510ccb016cf2d3f027daa1df5d7355b98a048b236da76a757cff9a5e002f94f9d491df258446283c7c7cc705314f2ac115a2
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj68:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5b
- TLSH T18CB4AF2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\jhgnwtvw.exe
- Size 513KB
- SHA256 d976291477341477d67c6b0a6958506614c24757c8300f9cfc998f4b80ccfe8f
- MD5 4ac5d2f21bfca22bfb149c910ae6033a
- SHA1 4e18caea56e12504e6731153c66634bc0e706a85
- SHA512 21980b19fabe974b1b5912a384c68ee19f05cc2af653affac6ab7108f41cc112c86a0fa16d37e204d9e047554f24b41a8101a11376919323e9ea28f650fcd4b9
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6e:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5N
- TLSH T1E0B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\kpnlpkltbmuyj.exe
- Size 513KB
- SHA256 a150e7f8bbd3b1ce0d397bbaf37ebb402a29bc8c4afef573352e915f485224f6
- MD5 b80d577c239f14b9815c6ed75c1cadc3
- SHA1 1baab6b73c418890996fa1ee7701afb1be4fac9b
- SHA512 cd7c28b05b27d678617c81335e974f0a98bd7b73932ffd94fe8bf3c357f260bc3634d443b57fd05d804b3b2dfd38228cdf2de733fb8d0b2e7e8b071f215e5cdc
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6V:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5i
- TLSH T1F3B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\kynfuuqrgmsbano.exe
- Size 513KB
- SHA256 a40b6b3abae8a212ed85d516438b4afc693797bc18433fd874895fcf4fc52cd2
- MD5 9ba4f26cc83013668df4d30e2dc28e9c
- SHA1 fa084c54ba2cfae80d44e9c5f2ea1c2829f6a7f6
- SHA512 ec18fb0127aed407b4a1f5a6a6710f1ee4a103152afa0825afefd30a715faa0753406b4f2a95c40ad6b9a7b8efcb7f57a5d785d921921bc5b877b17568c6067a
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6J:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5S
- TLSH T1A2B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 513KB
- SHA256 eda879d2ed6395a090dbc1433473906cb59c7ac193372941868468f9d1f6f33f
- MD5 dc84856f58616fcd968f95d46dd1bdff
- SHA1 b4a57c675621384c894058efcbc7cf23af03efc0
- SHA512 c7157c0fc849a39ee760eededa4dd495572734bf6ebe47e98acd6a7d718e924f1505ebde8fdd0825c8f4577f47237b83511b9e718c1f65901d6e5ad211364478
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6S:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5b
- TLSH T151B4AF2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH