Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 18:15
Behavioral task
behavioral1
Sample
2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe
- Size 512KB
- Sample260709-wwdeqagt2s
- SHA256 ac847548a45e19720159f16958edc8d6111572074f703023597affc7b37756e3
- MD5 029c6e23292f1358403f52b3de3d55d0
- SHA1 4533e5c3266cca741a767efdf5f06d0a254ef737
- SHA512 462b67b46bce30c5ecf35172b3ac36eb26ffd1d3263412a8b3ca1e0ae0a98163b8ae33eed5f4a5b3778fe8ca7c815dac9466fb3966cb974da791a5ed414d863a
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6K:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm57
- TLSH T1E7B4AE2276E1B0B2E96325F00F76D728A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 8 IoCs
resource yara_rule behavioral2/files/0x000d00000001c4af-5.dat family_sohanad behavioral2/files/0x000e00000001c4ab-11.dat family_sohanad behavioral2/files/0x000e00000001c4ae-17.dat family_sohanad behavioral2/files/0x000d00000001c4b0-27.dat family_sohanad behavioral2/files/0x000d00000001c4c1-58.dat family_sohanad behavioral2/files/0x000d00000001c4c5-67.dat family_sohanad behavioral2/files/0x000d00000001c4c6-70.dat family_sohanad behavioral2/files/0x000d00000001c4da-86.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" pprctiqkxn.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pprctiqkxn.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" pprctiqkxn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" pprctiqkxn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" pprctiqkxn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" pprctiqkxn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" pprctiqkxn.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" pprctiqkxn.exe - Executes dropped EXE 5 IoCs
pid Process 4312 pprctiqkxn.exe 3932 dxkttckinpfbmog.exe 4112 xeyvhmpp.exe 468 kcxgxxoivdclv.exe 2640 xeyvhmpp.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" pprctiqkxn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" pprctiqkxn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" pprctiqkxn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" pprctiqkxn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" pprctiqkxn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" pprctiqkxn.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\seulclne = "dxkttckinpfbmog.exe" dxkttckinpfbmog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "kcxgxxoivdclv.exe" dxkttckinpfbmog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wfbwenjf = "pprctiqkxn.exe" dxkttckinpfbmog.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\j: xeyvhmpp.exe File opened (read-only) \??\l: xeyvhmpp.exe File opened (read-only) \??\t: pprctiqkxn.exe File opened (read-only) \??\a: xeyvhmpp.exe File opened (read-only) \??\i: xeyvhmpp.exe File opened (read-only) \??\x: xeyvhmpp.exe File opened (read-only) \??\q: pprctiqkxn.exe File opened (read-only) \??\q: xeyvhmpp.exe File opened (read-only) \??\r: xeyvhmpp.exe File opened (read-only) \??\p: xeyvhmpp.exe File opened (read-only) \??\h: pprctiqkxn.exe File opened (read-only) \??\n: pprctiqkxn.exe File opened (read-only) \??\r: pprctiqkxn.exe File opened (read-only) \??\d: pprctiqkxn.exe File opened (read-only) \??\w: xeyvhmpp.exe File opened (read-only) \??\x: xeyvhmpp.exe File opened (read-only) \??\m: pprctiqkxn.exe File opened (read-only) \??\y: xeyvhmpp.exe File opened (read-only) \??\h: xeyvhmpp.exe File opened (read-only) \??\r: xeyvhmpp.exe File opened (read-only) \??\i: pprctiqkxn.exe File opened (read-only) \??\v: pprctiqkxn.exe File opened (read-only) \??\k: xeyvhmpp.exe File opened (read-only) \??\y: xeyvhmpp.exe File opened (read-only) \??\u: pprctiqkxn.exe File opened (read-only) \??\x: pprctiqkxn.exe File opened (read-only) \??\b: xeyvhmpp.exe File opened (read-only) \??\s: xeyvhmpp.exe File opened (read-only) \??\v: xeyvhmpp.exe File opened (read-only) \??\a: pprctiqkxn.exe File opened (read-only) \??\o: pprctiqkxn.exe File opened (read-only) \??\g: xeyvhmpp.exe File opened (read-only) \??\z: xeyvhmpp.exe File opened (read-only) \??\n: xeyvhmpp.exe File opened (read-only) \??\o: xeyvhmpp.exe File opened (read-only) \??\u: xeyvhmpp.exe File opened (read-only) \??\v: xeyvhmpp.exe File opened (read-only) \??\w: pprctiqkxn.exe File opened (read-only) \??\t: xeyvhmpp.exe File opened (read-only) \??\i: xeyvhmpp.exe File opened (read-only) \??\j: xeyvhmpp.exe File opened (read-only) \??\t: xeyvhmpp.exe File opened (read-only) \??\l: pprctiqkxn.exe File opened (read-only) \??\y: pprctiqkxn.exe File opened (read-only) \??\z: pprctiqkxn.exe File opened (read-only) \??\d: xeyvhmpp.exe File opened (read-only) \??\m: xeyvhmpp.exe File opened (read-only) \??\b: xeyvhmpp.exe File opened (read-only) \??\d: xeyvhmpp.exe File opened (read-only) \??\s: pprctiqkxn.exe File opened (read-only) \??\l: xeyvhmpp.exe File opened (read-only) \??\n: xeyvhmpp.exe File opened (read-only) \??\o: xeyvhmpp.exe File opened (read-only) \??\p: xeyvhmpp.exe File opened (read-only) \??\k: xeyvhmpp.exe File opened (read-only) \??\b: pprctiqkxn.exe File opened (read-only) \??\g: pprctiqkxn.exe File opened (read-only) \??\s: xeyvhmpp.exe File opened (read-only) \??\j: pprctiqkxn.exe File opened (read-only) \??\m: xeyvhmpp.exe File opened (read-only) \??\q: xeyvhmpp.exe File opened (read-only) \??\u: xeyvhmpp.exe File opened (read-only) \??\g: xeyvhmpp.exe File opened (read-only) \??\p: pprctiqkxn.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" pprctiqkxn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" pprctiqkxn.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4136-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000d00000001c4af-5.dat autoit_exe behavioral2/files/0x000e00000001c4ab-11.dat autoit_exe behavioral2/files/0x000e00000001c4ae-17.dat autoit_exe behavioral2/files/0x000d00000001c4b0-27.dat autoit_exe behavioral2/files/0x000d00000001c4c1-58.dat autoit_exe behavioral2/files/0x000d00000001c4c5-67.dat autoit_exe behavioral2/files/0x000d00000001c4c6-70.dat autoit_exe behavioral2/files/0x000d00000001c4da-86.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\pprctiqkxn.exe 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\pprctiqkxn.exe 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe File created C:\Windows\SysWOW64\dxkttckinpfbmog.exe 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\kcxgxxoivdclv.exe 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe xeyvhmpp.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe xeyvhmpp.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe xeyvhmpp.exe File opened for modification C:\Windows\SysWOW64\dxkttckinpfbmog.exe 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe File created C:\Windows\SysWOW64\xeyvhmpp.exe 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\xeyvhmpp.exe 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe File created C:\Windows\SysWOW64\kcxgxxoivdclv.exe 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll pprctiqkxn.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe xeyvhmpp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal xeyvhmpp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal xeyvhmpp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe xeyvhmpp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal xeyvhmpp.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe xeyvhmpp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe xeyvhmpp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe xeyvhmpp.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe xeyvhmpp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe xeyvhmpp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe xeyvhmpp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe xeyvhmpp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal xeyvhmpp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe xeyvhmpp.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe xeyvhmpp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe xeyvhmpp.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe xeyvhmpp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe xeyvhmpp.exe File opened for modification C:\Windows\mydoc.rtf 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe xeyvhmpp.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe xeyvhmpp.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe xeyvhmpp.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe xeyvhmpp.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeyvhmpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kcxgxxoivdclv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeyvhmpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pprctiqkxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxkttckinpfbmog.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" pprctiqkxn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AC8F9BCF966F2E284743B4286E93998B081038D4315033BE1BA42EF08D4" 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193AC67414E7DAB7B8BE7CE8ED9034CC" 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat pprctiqkxn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh pprctiqkxn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs pprctiqkxn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" pprctiqkxn.exe Key created \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32432D789D5283256D4176A077272CAE7C8664D7" 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EC3B12F44E7389D53BDBAA633EED4BF" 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" pprctiqkxn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf pprctiqkxn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg pprctiqkxn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" pprctiqkxn.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFAFFFF4F28856F9030D62F7DE1BDE4E634594367446332D6E9" 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F66BB3FE6622DFD20CD0A08A089117" 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" pprctiqkxn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc pprctiqkxn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" pprctiqkxn.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4420 WINWORD.EXE 4420 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4312 pprctiqkxn.exe 4312 pprctiqkxn.exe 4312 pprctiqkxn.exe 4312 pprctiqkxn.exe 4312 pprctiqkxn.exe 4312 pprctiqkxn.exe 4312 pprctiqkxn.exe 4312 pprctiqkxn.exe 4312 pprctiqkxn.exe 4312 pprctiqkxn.exe 3932 dxkttckinpfbmog.exe 3932 dxkttckinpfbmog.exe 3932 dxkttckinpfbmog.exe 3932 dxkttckinpfbmog.exe 3932 dxkttckinpfbmog.exe 3932 dxkttckinpfbmog.exe 3932 dxkttckinpfbmog.exe 3932 dxkttckinpfbmog.exe 3932 dxkttckinpfbmog.exe 3932 dxkttckinpfbmog.exe 4112 xeyvhmpp.exe 4112 xeyvhmpp.exe 4112 xeyvhmpp.exe 4112 xeyvhmpp.exe 4112 xeyvhmpp.exe 4112 xeyvhmpp.exe 4112 xeyvhmpp.exe 4112 xeyvhmpp.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 3932 dxkttckinpfbmog.exe 3932 dxkttckinpfbmog.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 3932 dxkttckinpfbmog.exe 3932 dxkttckinpfbmog.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4312 pprctiqkxn.exe 4312 pprctiqkxn.exe 4312 pprctiqkxn.exe 3932 dxkttckinpfbmog.exe 3932 dxkttckinpfbmog.exe 3932 dxkttckinpfbmog.exe 4112 xeyvhmpp.exe 4112 xeyvhmpp.exe 4112 xeyvhmpp.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 2640 xeyvhmpp.exe 2640 xeyvhmpp.exe 2640 xeyvhmpp.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 4312 pprctiqkxn.exe 4312 pprctiqkxn.exe 4312 pprctiqkxn.exe 3932 dxkttckinpfbmog.exe 3932 dxkttckinpfbmog.exe 3932 dxkttckinpfbmog.exe 4112 xeyvhmpp.exe 4112 xeyvhmpp.exe 4112 xeyvhmpp.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 468 kcxgxxoivdclv.exe 2640 xeyvhmpp.exe 2640 xeyvhmpp.exe 2640 xeyvhmpp.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4136 wrote to memory of 4312 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 87 PID 4136 wrote to memory of 3932 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 88 PID 4136 wrote to memory of 4112 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 89 PID 4136 wrote to memory of 468 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 90 PID 4312 wrote to memory of 2640 4312 pprctiqkxn.exe 91 PID 4136 wrote to memory of 4420 4136 2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_029c6e23292f1358403f52b3de3d55d0_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\pprctiqkxn.exepprctiqkxn.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\xeyvhmpp.exeC:\Windows\system32\xeyvhmpp.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2640
-
-
-
C:\Windows\SysWOW64\dxkttckinpfbmog.exedxkttckinpfbmog.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3932
-
-
C:\Windows\SysWOW64\xeyvhmpp.exexeyvhmpp.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4112
-
-
C:\Windows\SysWOW64\kcxgxxoivdclv.exekcxgxxoivdclv.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:468
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4420
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\TCD1DDB.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- TLSH T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 326B
- SHA256 6f41f0c12b3ed8b2fdabe04a7d2e175bed2c866be2b61981de8bb764cb632b08
- MD5 0e1ce2c007233d5ade342b24966f9f96
- SHA1 733e2c7331164b49a28e5fc2deb782566e41bde1
- SHA512 0ea98ebe59ddb85820b890003fc848883a4c770eb62ec808f75b9023bdc33bc77a35c87912e5463228c4f320899619f85d6b963dcd5e2bae57bc25d4d97970d1
- TLSH T11BE04F279B25D3F4437C61F87DB47EE857F188D8D26D401001CD4CC51D2019361B7984
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 19a98cbd66e32b6819434b9c3ef6c80a9f676384b17a049dc1d08a84cbf98106
- MD5 2919aae550328bfe6c2138b677bbbd3f
- SHA1 762436a4cd7a74b3d37f9be72bd63a562612d943
- SHA512 eaba145e93002313b49f6dba2358548d777f8e8f08712f68a5e6a7eddd4c8b032d0355f34d0397f8cebc52b16c1e6e30eb4cff96da41929dcb92b91941e2de53
- TLSH T109411607159B5B87D1A2437B262E5375EF70FC05A700961D5B45B03BAE34A505E2CB3E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 58a84d45f64e42cbcc3fb2dc74c325dfb86e0b675c27e40fe28d0cfec2c856c7
- MD5 9b47987742f2b8ac3de71bbfbf46c041
- SHA1 595600e4ff4cc4c9ae96d1c5f733ee2f7fc25750
- SHA512 303184b0d99bfce0b36dc17b955ca1e2f4358262ea73d4ca28a3c8ad9f234b5670ec31aa9548f6ffb01eb35e70a70d38a563ff5d515895724ec5a95fb1e568bc
- TLSH T19E21F003569F1B8BD59243BB273E9399EA70FC45A200551D9B80B43BAE34E109E2CF39
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\OutShow.doc.exe
- Size 512KB
- SHA256 8a817349a11f1c262c5f1aac9aa966dc20f086ef28ea77fe54ca2c99822065fe
- MD5 d4aeb45ce6fe0db34cc6d02e4e3a1ed4
- SHA1 07926ed840e2b98e20c8d6bee1d1171caed7bad9
- SHA512 d6ee23d19f20fa4a46e6946b31ab56a125037974079e401f27a5fbab9d43784e7324eeb34447ee8c5e51696cb4313b661da73f5d31aa4ac7a38dfc562aecd7d0
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6D:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5s
- TLSH T15AB4AE2276E1B0B2E96325F00F76D728A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\ResumeMeasure.doc.exe
- Size 512KB
- SHA256 eaeda2bedbe4f65051bd1db75a1e93301deadac1de82f9b498433217928c47a3
- MD5 717b75f560085b26251be89911f39af0
- SHA1 68f99adecf59ba714cf06067d0a84bd5aee7b466
- SHA512 43b20c8774db4b6a45a9b1313ea62ac4d955fd5d255b938be27682c618763572cc792225ebab286a8167c7626f05956f88945b0acca6bc4916ab8329104f9234
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6M:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5X
- TLSH T170B4AE2276E1B0B2E96325F00F76D728A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dxkttckinpfbmog.exe
- Size 512KB
- SHA256 1ea320c827149ab9e3bdd6e73d41a6e0bc24f251770a38d7e35151466fbfaf9f
- MD5 d7fabaf79c08c187f72b370e7a61e12d
- SHA1 5f0780b24939645ff7ab9e78f62c4e10f714dd28
- SHA512 bbdd9278c955bb1dca9f4bcac0d8f87a3e9a806c05cf16905e278794f30240c28a26a97c4050c9cbd8d6386d70bed60918ad7c5b3610277db0f5264b41f8ef0f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm57
- TLSH T127B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\kcxgxxoivdclv.exe
- Size 512KB
- SHA256 69f7db1e90b0934a7b3fc873e99d89bf1334f71cad6b4362f8be3ad17eb5b04d
- MD5 23b513770caa19857a3af8b87bbb70d0
- SHA1 8eabfc473686b399f788da90b6755012e1ff1bdd
- SHA512 283a89777710ced45b222072dbe72aceaf314749779f1ff24f7f6d5d408f4745bcf18832b689e3d915dfb20b3640e16308750eff2dce70d06c8ecb818cafbaa7
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5y
- TLSH T11BB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\pprctiqkxn.exe
- Size 512KB
- SHA256 50ba686d85b3290635e9a34425d9b50c5e340318230efb24b1b75a11b36482c9
- MD5 4984606128f37d57f38c2399b68cbe11
- SHA1 23e44446827bb0696efce70735ed5e4e903de3f6
- SHA512 c25af2493fbdcb93682d154cffb715d24f891826ef2a4add744028c9e5355900431b615c09b46ad2bd57bac597104afd462fee4e1029b4f4ac0fe748ea89e6f9
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6o:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5L
- TLSH T157B4AE2276E1B0B2E96325F00F76D728A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\xeyvhmpp.exe
- Size 512KB
- SHA256 2f716edd573c6a948aaa11f227c18da2025e177508c453d8c1d5e5ad25dc9ea0
- MD5 5a824ab45855af04249362a16c95e207
- SHA1 bb035ff15d9594cfab868f09476ef31522813d4d
- SHA512 aee728db2eb420e02d84ef85c48f7647a6f6088a10be61c48634906826bb738f7de3d36844992d1302114aac9742ed442688eca12bb7f10be23861cc20d67a0c
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6W:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm59
- TLSH T18AB4AE2276E1B0B2E96325F00F76D728A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 3539f2cf8ed533b37e5fcf801aec19500cfcca9997cb28cbcfc5e9ed6b5adba2
- MD5 e4afeeea6ebb133ec7d73675c43d0b8a
- SHA1 dab7b558c6bbe0c7c3bf1c2adaf304795bbb678f
- SHA512 d73b0e8bf7783a37ee08bea9d986be0456cac77af681794b2209b15ffc51024946fb11ff15b95b39558b97251fd6109e910b58dfa6b6044c2e3f3a13f9047e27
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6h:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5a
- TLSH T186B4AE2276E1B0B2E96325F00F76D728A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 ae239dfa65d790e7bad3552db858d41f92f153a072daad57c87e690d5895ae5b
- MD5 ef3e0b672aa6aed980469f00997e1051
- SHA1 9d47eaf0af0d71bbf2d68f3bb9ffa39f96f8bc7a
- SHA512 6476406c3bc2c9204311270d7bfbf72446e1ef86a6d9ef1d8f7e27ce967f4df97d71728dd45a45ef1eaea87ce6b70bcc513744c024efb4cde47789d59346ae9f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6U:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm59
- TLSH T143B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH