Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 18:11
Behavioral task
behavioral1
Sample
2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe
- Size 512KB
- Sample260724-wsmh8aaj21
- SHA256 ac33610f2aff337262bcec18aad2694e8c90337c6c2e0bf60dc1746822498427
- MD5 66db8a671fa8aef57ccd62bb57d98bab
- SHA1 1b0f09489ff558c3c2a6d12edd2ef0f43629c81b
- SHA512 fcdca0b7cb20d12e21b1200f9a9889a1e8109d865a70c40f22ed9f949867f894e4d7ea1f1477ddb8e1aadca64fe753f4047ffd5e3984efbc9e9b900258641760
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6A:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55
- TLSH T13BB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 9 IoCs
resource yara_rule behavioral2/files/0x000d00000001b1d0-1.dat family_sohanad behavioral2/files/0x000e00000001c553-17.dat family_sohanad behavioral2/files/0x000d00000001c557-22.dat family_sohanad behavioral2/files/0x000d00000001c558-27.dat family_sohanad behavioral2/files/0x000e00000001c567-62.dat family_sohanad behavioral2/files/0x000d00000001c56c-65.dat family_sohanad behavioral2/files/0x000d00000001c579-68.dat family_sohanad behavioral2/files/0x000c00000001c5e9-429.dat family_sohanad behavioral2/files/0x000c00000001c5e9-431.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" dyykvexpou.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dyykvexpou.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dyykvexpou.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dyykvexpou.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dyykvexpou.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dyykvexpou.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" dyykvexpou.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dyykvexpou.exe - Executes dropped EXE 5 IoCs
pid Process 4948 dyykvexpou.exe 1256 pwugiqpombnkujq.exe 3212 zvedlawo.exe 716 txxkxtwyfozms.exe 2004 zvedlawo.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" dyykvexpou.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dyykvexpou.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dyykvexpou.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dyykvexpou.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" dyykvexpou.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dyykvexpou.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "txxkxtwyfozms.exe" pwugiqpombnkujq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aeopbgzi = "dyykvexpou.exe" pwugiqpombnkujq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rmtwknol = "pwugiqpombnkujq.exe" pwugiqpombnkujq.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\l: zvedlawo.exe File opened (read-only) \??\s: zvedlawo.exe File opened (read-only) \??\w: zvedlawo.exe File opened (read-only) \??\n: dyykvexpou.exe File opened (read-only) \??\q: dyykvexpou.exe File opened (read-only) \??\y: dyykvexpou.exe File opened (read-only) \??\d: zvedlawo.exe File opened (read-only) \??\j: zvedlawo.exe File opened (read-only) \??\m: zvedlawo.exe File opened (read-only) \??\n: zvedlawo.exe File opened (read-only) \??\t: zvedlawo.exe File opened (read-only) \??\k: dyykvexpou.exe File opened (read-only) \??\v: dyykvexpou.exe File opened (read-only) \??\y: zvedlawo.exe File opened (read-only) \??\z: zvedlawo.exe File opened (read-only) \??\b: dyykvexpou.exe File opened (read-only) \??\g: dyykvexpou.exe File opened (read-only) \??\i: dyykvexpou.exe File opened (read-only) \??\u: dyykvexpou.exe File opened (read-only) \??\x: dyykvexpou.exe File opened (read-only) \??\m: zvedlawo.exe File opened (read-only) \??\i: zvedlawo.exe File opened (read-only) \??\j: zvedlawo.exe File opened (read-only) \??\n: zvedlawo.exe File opened (read-only) \??\t: zvedlawo.exe File opened (read-only) \??\x: zvedlawo.exe File opened (read-only) \??\d: zvedlawo.exe File opened (read-only) \??\q: zvedlawo.exe File opened (read-only) \??\v: zvedlawo.exe File opened (read-only) \??\s: dyykvexpou.exe File opened (read-only) \??\p: zvedlawo.exe File opened (read-only) \??\v: zvedlawo.exe File opened (read-only) \??\b: zvedlawo.exe File opened (read-only) \??\h: zvedlawo.exe File opened (read-only) \??\x: zvedlawo.exe File opened (read-only) \??\a: dyykvexpou.exe File opened (read-only) \??\h: dyykvexpou.exe File opened (read-only) \??\a: zvedlawo.exe File opened (read-only) \??\p: zvedlawo.exe File opened (read-only) \??\m: dyykvexpou.exe File opened (read-only) \??\j: dyykvexpou.exe File opened (read-only) \??\o: dyykvexpou.exe File opened (read-only) \??\l: zvedlawo.exe File opened (read-only) \??\t: dyykvexpou.exe File opened (read-only) \??\r: zvedlawo.exe File opened (read-only) \??\s: zvedlawo.exe File opened (read-only) \??\z: zvedlawo.exe File opened (read-only) \??\l: dyykvexpou.exe File opened (read-only) \??\w: dyykvexpou.exe File opened (read-only) \??\u: zvedlawo.exe File opened (read-only) \??\w: zvedlawo.exe File opened (read-only) \??\b: zvedlawo.exe File opened (read-only) \??\h: zvedlawo.exe File opened (read-only) \??\r: dyykvexpou.exe File opened (read-only) \??\z: dyykvexpou.exe File opened (read-only) \??\d: dyykvexpou.exe File opened (read-only) \??\i: zvedlawo.exe File opened (read-only) \??\k: zvedlawo.exe File opened (read-only) \??\u: zvedlawo.exe File opened (read-only) \??\a: zvedlawo.exe File opened (read-only) \??\g: zvedlawo.exe File opened (read-only) \??\k: zvedlawo.exe File opened (read-only) \??\o: zvedlawo.exe File opened (read-only) \??\r: zvedlawo.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" dyykvexpou.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" dyykvexpou.exe - AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/6084-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000d00000001b1d0-1.dat autoit_exe behavioral2/files/0x000e00000001c553-17.dat autoit_exe behavioral2/files/0x000d00000001c557-22.dat autoit_exe behavioral2/files/0x000d00000001c558-27.dat autoit_exe behavioral2/files/0x000e00000001c567-62.dat autoit_exe behavioral2/files/0x000d00000001c56c-65.dat autoit_exe behavioral2/files/0x000d00000001c579-68.dat autoit_exe behavioral2/files/0x000c00000001c5e9-429.dat autoit_exe behavioral2/files/0x000c00000001c5e9-431.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dyykvexpou.exe 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe File created C:\Windows\SysWOW64\pwugiqpombnkujq.exe 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\pwugiqpombnkujq.exe 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe File created C:\Windows\SysWOW64\zvedlawo.exe 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe File created C:\Windows\SysWOW64\txxkxtwyfozms.exe 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe zvedlawo.exe File created C:\Windows\SysWOW64\dyykvexpou.exe 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\zvedlawo.exe 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\txxkxtwyfozms.exe 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll dyykvexpou.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe zvedlawo.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe zvedlawo.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal zvedlawo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zvedlawo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal zvedlawo.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zvedlawo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zvedlawo.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zvedlawo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal zvedlawo.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zvedlawo.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zvedlawo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal zvedlawo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zvedlawo.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zvedlawo.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zvedlawo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zvedlawo.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe zvedlawo.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe zvedlawo.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe zvedlawo.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe zvedlawo.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe zvedlawo.exe File opened for modification C:\Windows\mydoc.rtf 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe zvedlawo.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe zvedlawo.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe zvedlawo.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zvedlawo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txxkxtwyfozms.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zvedlawo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dyykvexpou.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pwugiqpombnkujq.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33472D089D2083546D4376D5772E2DDE7D8165DC" 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF5FC8F4F28851A9030D6587E92BCE4E134593166366333D6EE" 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat dyykvexpou.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc dyykvexpou.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" dyykvexpou.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf dyykvexpou.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F06BB0FE6B22D8D272D0A98B089163" 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh dyykvexpou.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" dyykvexpou.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EC1B02C4792399F53B9BAD33392D7C9" 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1939C67C14E6DBC7B8CF7C93ED9134BE" 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" dyykvexpou.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" dyykvexpou.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs dyykvexpou.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" dyykvexpou.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BB5F9CAFE13F1E783793A40819B39E5B0F9028F43660332E2CB42EA09D2" 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" dyykvexpou.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg dyykvexpou.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 5744 WINWORD.EXE 5744 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 4948 dyykvexpou.exe 4948 dyykvexpou.exe 4948 dyykvexpou.exe 4948 dyykvexpou.exe 4948 dyykvexpou.exe 4948 dyykvexpou.exe 4948 dyykvexpou.exe 4948 dyykvexpou.exe 4948 dyykvexpou.exe 4948 dyykvexpou.exe 1256 pwugiqpombnkujq.exe 1256 pwugiqpombnkujq.exe 1256 pwugiqpombnkujq.exe 1256 pwugiqpombnkujq.exe 1256 pwugiqpombnkujq.exe 1256 pwugiqpombnkujq.exe 1256 pwugiqpombnkujq.exe 1256 pwugiqpombnkujq.exe 1256 pwugiqpombnkujq.exe 1256 pwugiqpombnkujq.exe 3212 zvedlawo.exe 3212 zvedlawo.exe 3212 zvedlawo.exe 3212 zvedlawo.exe 3212 zvedlawo.exe 3212 zvedlawo.exe 3212 zvedlawo.exe 3212 zvedlawo.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 1256 pwugiqpombnkujq.exe 1256 pwugiqpombnkujq.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 1256 pwugiqpombnkujq.exe 1256 pwugiqpombnkujq.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 4948 dyykvexpou.exe 4948 dyykvexpou.exe 4948 dyykvexpou.exe 1256 pwugiqpombnkujq.exe 1256 pwugiqpombnkujq.exe 1256 pwugiqpombnkujq.exe 3212 zvedlawo.exe 3212 zvedlawo.exe 3212 zvedlawo.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 2004 zvedlawo.exe 2004 zvedlawo.exe 2004 zvedlawo.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 4948 dyykvexpou.exe 4948 dyykvexpou.exe 4948 dyykvexpou.exe 1256 pwugiqpombnkujq.exe 1256 pwugiqpombnkujq.exe 1256 pwugiqpombnkujq.exe 3212 zvedlawo.exe 3212 zvedlawo.exe 3212 zvedlawo.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 716 txxkxtwyfozms.exe 2004 zvedlawo.exe 2004 zvedlawo.exe 2004 zvedlawo.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 5744 WINWORD.EXE 5744 WINWORD.EXE 5744 WINWORD.EXE 5744 WINWORD.EXE 5744 WINWORD.EXE 5744 WINWORD.EXE 5744 WINWORD.EXE 5744 WINWORD.EXE 5744 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 6084 wrote to memory of 4948 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 89 PID 6084 wrote to memory of 1256 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 90 PID 6084 wrote to memory of 3212 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 91 PID 6084 wrote to memory of 716 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 92 PID 6084 wrote to memory of 5744 6084 2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe 93 PID 4948 wrote to memory of 2004 4948 dyykvexpou.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_66db8a671fa8aef57ccd62bb57d98bab_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\dyykvexpou.exedyykvexpou.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\zvedlawo.exeC:\Windows\system32\zvedlawo.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2004
-
-
-
C:\Windows\SysWOW64\pwugiqpombnkujq.exepwugiqpombnkujq.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1256
-
-
C:\Windows\SysWOW64\zvedlawo.exezvedlawo.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3212
-
-
C:\Windows\SysWOW64\txxkxtwyfozms.exetxxkxtwyfozms.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:716
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5744
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 636da1fae6f96ef2fbb3a780aa6bd70e5b1abae9f1ceb1df083867d285cb78e2
- MD5 eba778d168d3698fa3f89c32016bd1c2
- SHA1 904bec6aaed7ad0af14e094bd90475f7bfb4dd0e
- SHA512 67df6e61d8f340d908a994d9098bee26c05bf7b4c7afb7be07daf365f9db4b8fb97b84c378c524fb7a1397b3bd9504b449d1871a837cba309b3df53c018178b3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj62:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5T
- TLSH T15BB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 7861b6c135fe88c6972ea4867445b64e63163132d15d0219c5a6092791ce11de
- MD5 e76716b0aa7516ecd24b20fa21b8ce07
- SHA1 35440cfb0742a899a6d48479981123367de066d4
- SHA512 c6ed5a75508060d9f79a333fb746cb535f35573c374d7aaa04c2a06bdaf384af584d099ce20bab2334107066504a46861d6dfc68c5f1e4c4a42c70c78c0db757
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6i:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5v
- TLSH T124B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCDFFB0.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- TLSH T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 396B
- SHA256 7d80228194e1b1b28c2afc5a325b8a0ad2a13a5c77c6d582330b47775d172878
- MD5 98d25ec958248588276b64a121b8a0f2
- SHA1 bf48663e2063d353dd21ac102ec1cd9459ec9150
- SHA512 8ea6f0967f31e3d38c7b91f1429f9059b2798fc666c24845b68573ef7fd2cc0c4abe1572d7083f8cf012859c2469a82a90f17074620c4d4ba157ac4006ca54bc
- TLSH T155E01A5BABA9EFF9C33D91E57D78DEF166F28859E6A5113420CC0CC31CD8253219B509
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 6616e1f50b2bd02ce2f66150fe11ab7743ab97b733627cb5bbe903af304a43e7
- MD5 58fc3258dff89b507e36bc597685a2b5
- SHA1 1b7723f10c3d0e5302b437c76765012ca43a5005
- SHA512 e5e447ce9c1e8451181a8dbcc4cc84eb5ceb5649b01802fcfb90fa58c9f3452bdf3348ce98d50bfe200bbc6d007d7179db2df551781191603984f4efc3f62bee
- TLSH T19021C3035A9F1B5EF89442B5262E838DDB713D12EA14B72E578085377C70620CF8C76A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 677a5d202290a3b431f5dc4c813670bd715734553486c11c11538c79b947912d
- MD5 0054d08453f84aa3bcadae38b4df4bdb
- SHA1 81da470240fa5237e83a5440bc08985f167ca7bc
- SHA512 ae8011cfc3a4c5062c37c811a855568f3b71b5665922548ed741fd3704a6f4333d026a0c39db4cd7f24bf1dff37f7cdd1482d19b5c289962c95f0fc75cd48186
- TLSH T16D4111034A5F5B6AE8984276252E9389DF717D13EE14AB2E16809177BCA0710CF8C66A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\OptimizeExport.doc.exe
- Size 512KB
- SHA256 0e4ce00c0e393e3c94256a343b65d03379809f87b43234d7ecdd8d7f7e76ae24
- MD5 d00f4604ed7d73142f7baefd0da0829e
- SHA1 33437a2afc20a100f147915d0e3c155a12fd43a7
- SHA512 5f5e2a4959cc0452804ad8705dfe1f40fd237bbdd63ec252e46900b5e6bd3d9f522328685cbc800266a90aed2bd41c39f04fed366ae0e2be59f16be28e24c273
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6N:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm50
- TLSH T1D7B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dyykvexpou.exe
- Size 512KB
- SHA256 a593da2b8691ae60c11988bf5e680d57f9b3390982214150ad1313ebd9c62737
- MD5 96957a19d7957ddbda75231a6ce7b04b
- SHA1 4f0bfbc03f28b4a61cdd9eccbe11e61a08902b55
- SHA512 0c74a3a95a31c7f9d92eb05041f0065d12cc34c4db1accc06be89f72fdfcd93604349feab41b5909d5d0bf446390a575e20f1d7f9df0b7a0cce64c1a87abd768
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6D:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5W
- TLSH T149B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\pwugiqpombnkujq.exe
- Size 512KB
- SHA256 73ecc724531e1cbd4398631b92356f90101eb464513fa27833005e2ea4dc560b
- MD5 645620910b37b93afa35a4d2052aa033
- SHA1 9e14304390eca368e486462b9cbe1910214f0ab7
- SHA512 94afe25e3ab013f8613752d09e5c01497d27d7672c88eb1e81451ffe740924375ede6fab6acecb80ac5e054234e2b8764d8097ece301d808a6822fa5340a4492
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Y
- TLSH T10CB4AE2276E1B0B2E96325F00F76D728A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\txxkxtwyfozms.exe
- Size 512KB
- SHA256 c6fde4b5f58d255d5983b33e8beb595df2d9367d6b46a8238865dbdcb85af784
- MD5 289b83de5e78e883620973d6c3b822b6
- SHA1 34f3ed09dfd3e6b414fdaa06506809e0f16b704b
- SHA512 0dd16ca1fd8b25d7b9eca5cb634d4341e0633f6b12cc8b93203e53d93d07fe253688540519eac68757c42a2fee78c853003850a77a506dc5072b0a448d1db9b7
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Y:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5z
- TLSH T1DEB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\zvedlawo.exe
- Size 512KB
- SHA256 57f645d6795ae17a5d9e158ca9257e5dc95b047f3bc46e0896be91b5cece5264
- MD5 fa3c1136310b0ec5f36aa957d688245b
- SHA1 9e4d674413ec420d1f6f443564c3e96ecfd49c3d
- SHA512 a6489b1da616118a4d518a206002404483bd6510c9745ccb67914cf7ae8a7f8942fce2c3b7ae0b04afecea72ebbc11c678e3bbb8bc759f2744f595d58f730fdd
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Y:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5j
- TLSH T1E2B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 3c4f1d999489b331e5fe8028c229b317a06db31f6a1301eb2f61a4cc469b21ed
- MD5 52031a5b09b6451761e912bf867e9c36
- SHA1 805b0ea8c56b2d4b697a4fe72be63374f50c0110
- SHA512 3b9ceafbfc4065f9bd1432706d4389014bf803e5cb1c593345f4aed0ee6dabcf8f823b6090406adfbb291fc16574d1334da51e8fa1ff4ef4900d21f88bca9ad9
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6S:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5L
- TLSH T178B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 e39b6f276c91331bddf00d7b9828705823e7dabc6cad24a3c06ae22222813fed
- MD5 0049d36372fb2e674f38954c9dd073a9
- SHA1 88c5ce01e8432471a9e031e48ee2184d6f9b3879
- SHA512 8e6f139fdf946e30714eb459499f6740f79fa937104faa95f65560ccbce9911f67e61ad7b856ceeb833404f64289220baf66a51e0fe9d4f1c258a71c5e6c6cc8
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6v:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
- TLSH T1D9B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH