Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 14:06
Behavioral task
behavioral1
Sample
2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe
- Size 512KB
- Sample260816-rexd2scn4v
- SHA256 c004c1c7a8b8ef53878fc6283a46ef8d9765e9cff6eae2350ab352db91220fba
- MD5 7135bada302c63daa29ef09dda334259
- SHA1 994f2255fcbfd2542cd917181276fd87bf4d999d
- SHA512 44c5ee3da6fbd466a05e671d07499cf3a129a0bd9f26e902f3c82791a04383f1e6cc9f903a4c10f14f11dc6c67009666a96643e7c21e70b2030d4d3b928802d7
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6i:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5j
- TLSH T179B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 8 IoCs
resource yara_rule behavioral2/files/0x000d00000001c3d4-6.dat family_sohanad behavioral2/files/0x0008000000016cfd-11.dat family_sohanad behavioral2/files/0x000e00000001c3d0-17.dat family_sohanad behavioral2/files/0x000d00000001c3d5-28.dat family_sohanad behavioral2/files/0x000d00000001c3f7-63.dat family_sohanad behavioral2/files/0x000d00000001c3f8-66.dat family_sohanad behavioral2/files/0x000d00000001c46e-388.dat family_sohanad behavioral2/files/0x000d00000001c46e-446.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" brdhssjzez.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" brdhssjzez.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" brdhssjzez.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" brdhssjzez.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" brdhssjzez.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" brdhssjzez.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" brdhssjzez.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" brdhssjzez.exe - Executes dropped EXE 5 IoCs
pid Process 4448 brdhssjzez.exe 1736 xjmaiwgzobrzioo.exe 4872 mnhsucoe.exe 5760 lnzytlnctretv.exe 4900 mnhsucoe.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" brdhssjzez.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" brdhssjzez.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" brdhssjzez.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" brdhssjzez.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" brdhssjzez.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" brdhssjzez.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mktzzlwx = "brdhssjzez.exe" xjmaiwgzobrzioo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mrymgwma = "xjmaiwgzobrzioo.exe" xjmaiwgzobrzioo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "lnzytlnctretv.exe" xjmaiwgzobrzioo.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: brdhssjzez.exe File opened (read-only) \??\j: brdhssjzez.exe File opened (read-only) \??\g: mnhsucoe.exe File opened (read-only) \??\a: brdhssjzez.exe File opened (read-only) \??\p: brdhssjzez.exe File opened (read-only) \??\v: brdhssjzez.exe File opened (read-only) \??\u: mnhsucoe.exe File opened (read-only) \??\j: mnhsucoe.exe File opened (read-only) \??\v: mnhsucoe.exe File opened (read-only) \??\m: brdhssjzez.exe File opened (read-only) \??\n: brdhssjzez.exe File opened (read-only) \??\o: brdhssjzez.exe File opened (read-only) \??\o: mnhsucoe.exe File opened (read-only) \??\d: brdhssjzez.exe File opened (read-only) \??\r: mnhsucoe.exe File opened (read-only) \??\r: brdhssjzez.exe File opened (read-only) \??\m: mnhsucoe.exe File opened (read-only) \??\v: mnhsucoe.exe File opened (read-only) \??\o: mnhsucoe.exe File opened (read-only) \??\p: mnhsucoe.exe File opened (read-only) \??\r: mnhsucoe.exe File opened (read-only) \??\t: mnhsucoe.exe File opened (read-only) \??\x: brdhssjzez.exe File opened (read-only) \??\n: mnhsucoe.exe File opened (read-only) \??\x: mnhsucoe.exe File opened (read-only) \??\h: mnhsucoe.exe File opened (read-only) \??\w: brdhssjzez.exe File opened (read-only) \??\a: mnhsucoe.exe File opened (read-only) \??\n: mnhsucoe.exe File opened (read-only) \??\s: mnhsucoe.exe File opened (read-only) \??\b: brdhssjzez.exe File opened (read-only) \??\y: brdhssjzez.exe File opened (read-only) \??\a: mnhsucoe.exe File opened (read-only) \??\k: mnhsucoe.exe File opened (read-only) \??\l: mnhsucoe.exe File opened (read-only) \??\x: mnhsucoe.exe File opened (read-only) \??\z: mnhsucoe.exe File opened (read-only) \??\q: mnhsucoe.exe File opened (read-only) \??\d: mnhsucoe.exe File opened (read-only) \??\d: mnhsucoe.exe File opened (read-only) \??\h: mnhsucoe.exe File opened (read-only) \??\u: mnhsucoe.exe File opened (read-only) \??\h: brdhssjzez.exe File opened (read-only) \??\i: brdhssjzez.exe File opened (read-only) \??\l: brdhssjzez.exe File opened (read-only) \??\t: brdhssjzez.exe File opened (read-only) \??\j: mnhsucoe.exe File opened (read-only) \??\w: mnhsucoe.exe File opened (read-only) \??\s: brdhssjzez.exe File opened (read-only) \??\m: mnhsucoe.exe File opened (read-only) \??\y: mnhsucoe.exe File opened (read-only) \??\k: brdhssjzez.exe File opened (read-only) \??\q: brdhssjzez.exe File opened (read-only) \??\s: mnhsucoe.exe File opened (read-only) \??\z: mnhsucoe.exe File opened (read-only) \??\b: mnhsucoe.exe File opened (read-only) \??\q: mnhsucoe.exe File opened (read-only) \??\k: mnhsucoe.exe File opened (read-only) \??\i: mnhsucoe.exe File opened (read-only) \??\u: brdhssjzez.exe File opened (read-only) \??\g: mnhsucoe.exe File opened (read-only) \??\l: mnhsucoe.exe File opened (read-only) \??\w: mnhsucoe.exe File opened (read-only) \??\z: brdhssjzez.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" brdhssjzez.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" brdhssjzez.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4360-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000d00000001c3d4-6.dat autoit_exe behavioral2/files/0x0008000000016cfd-11.dat autoit_exe behavioral2/files/0x000e00000001c3d0-17.dat autoit_exe behavioral2/files/0x000d00000001c3d5-28.dat autoit_exe behavioral2/files/0x000d00000001c3f7-63.dat autoit_exe behavioral2/files/0x000d00000001c3f8-66.dat autoit_exe behavioral2/files/0x000d00000001c46e-388.dat autoit_exe behavioral2/files/0x000d00000001c46e-446.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\brdhssjzez.exe 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\xjmaiwgzobrzioo.exe 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\mnhsucoe.exe 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\lnzytlnctretv.exe 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe mnhsucoe.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe mnhsucoe.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe mnhsucoe.exe File created C:\Windows\SysWOW64\brdhssjzez.exe 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe File created C:\Windows\SysWOW64\xjmaiwgzobrzioo.exe 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe File created C:\Windows\SysWOW64\mnhsucoe.exe 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe File created C:\Windows\SysWOW64\lnzytlnctretv.exe 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll brdhssjzez.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mnhsucoe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal mnhsucoe.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mnhsucoe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mnhsucoe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mnhsucoe.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mnhsucoe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal mnhsucoe.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mnhsucoe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mnhsucoe.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mnhsucoe.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mnhsucoe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal mnhsucoe.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mnhsucoe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal mnhsucoe.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe mnhsucoe.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe mnhsucoe.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe mnhsucoe.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe mnhsucoe.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe mnhsucoe.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe mnhsucoe.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe mnhsucoe.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe mnhsucoe.exe File opened for modification C:\Windows\mydoc.rtf 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mnhsucoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brdhssjzez.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjmaiwgzobrzioo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mnhsucoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnzytlnctretv.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7FC6BC5FF1B22A9D17AD0A28B7E9062" 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" brdhssjzez.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs brdhssjzez.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBDFABEF960F19883793A46869C3EE2B080028F42110233E1BE42EF08A5" 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184DC7081490DAB6B8BA7FE3ED9334C8" 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" brdhssjzez.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf brdhssjzez.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33412D7A9C2D83576D3F77D370552DAD7DF465AA" 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFDFF894F2A8218903CD72B7DE2BDEEE636584567426243D6E9" 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" brdhssjzez.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc brdhssjzez.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg brdhssjzez.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC6B15D47E6389A52CBBAD1329AD7B8" 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat brdhssjzez.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh brdhssjzez.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" brdhssjzez.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" brdhssjzez.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" brdhssjzez.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2240 WINWORD.EXE 2240 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4448 brdhssjzez.exe 4448 brdhssjzez.exe 4448 brdhssjzez.exe 4448 brdhssjzez.exe 4448 brdhssjzez.exe 4448 brdhssjzez.exe 4448 brdhssjzez.exe 4448 brdhssjzez.exe 4448 brdhssjzez.exe 4448 brdhssjzez.exe 1736 xjmaiwgzobrzioo.exe 1736 xjmaiwgzobrzioo.exe 1736 xjmaiwgzobrzioo.exe 1736 xjmaiwgzobrzioo.exe 1736 xjmaiwgzobrzioo.exe 1736 xjmaiwgzobrzioo.exe 1736 xjmaiwgzobrzioo.exe 1736 xjmaiwgzobrzioo.exe 4872 mnhsucoe.exe 1736 xjmaiwgzobrzioo.exe 4872 mnhsucoe.exe 1736 xjmaiwgzobrzioo.exe 4872 mnhsucoe.exe 4872 mnhsucoe.exe 4872 mnhsucoe.exe 4872 mnhsucoe.exe 4872 mnhsucoe.exe 4872 mnhsucoe.exe 1736 xjmaiwgzobrzioo.exe 1736 xjmaiwgzobrzioo.exe 1736 xjmaiwgzobrzioo.exe 1736 xjmaiwgzobrzioo.exe 5760 lnzytlnctretv.exe 5760 lnzytlnctretv.exe 5760 lnzytlnctretv.exe 5760 lnzytlnctretv.exe 5760 lnzytlnctretv.exe 5760 lnzytlnctretv.exe 5760 lnzytlnctretv.exe 5760 lnzytlnctretv.exe 5760 lnzytlnctretv.exe 5760 lnzytlnctretv.exe 5760 lnzytlnctretv.exe 5760 lnzytlnctretv.exe 1736 xjmaiwgzobrzioo.exe 1736 xjmaiwgzobrzioo.exe 5760 lnzytlnctretv.exe 5760 lnzytlnctretv.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4448 brdhssjzez.exe 4448 brdhssjzez.exe 4448 brdhssjzez.exe 1736 xjmaiwgzobrzioo.exe 1736 xjmaiwgzobrzioo.exe 1736 xjmaiwgzobrzioo.exe 4872 mnhsucoe.exe 4872 mnhsucoe.exe 4872 mnhsucoe.exe 5760 lnzytlnctretv.exe 5760 lnzytlnctretv.exe 5760 lnzytlnctretv.exe 4900 mnhsucoe.exe 4900 mnhsucoe.exe 4900 mnhsucoe.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 4448 brdhssjzez.exe 4448 brdhssjzez.exe 4448 brdhssjzez.exe 1736 xjmaiwgzobrzioo.exe 1736 xjmaiwgzobrzioo.exe 1736 xjmaiwgzobrzioo.exe 4872 mnhsucoe.exe 4872 mnhsucoe.exe 4872 mnhsucoe.exe 5760 lnzytlnctretv.exe 5760 lnzytlnctretv.exe 5760 lnzytlnctretv.exe 4900 mnhsucoe.exe 4900 mnhsucoe.exe 4900 mnhsucoe.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2240 WINWORD.EXE 2240 WINWORD.EXE 2240 WINWORD.EXE 2240 WINWORD.EXE 2240 WINWORD.EXE 2240 WINWORD.EXE 2240 WINWORD.EXE 2240 WINWORD.EXE 2240 WINWORD.EXE 2240 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4360 wrote to memory of 4448 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 89 PID 4360 wrote to memory of 1736 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 90 PID 4360 wrote to memory of 4872 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 91 PID 4360 wrote to memory of 5760 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 92 PID 4360 wrote to memory of 2240 4360 2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe 93 PID 4448 wrote to memory of 4900 4448 brdhssjzez.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_7135bada302c63daa29ef09dda334259_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\brdhssjzez.exebrdhssjzez.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\mnhsucoe.exeC:\Windows\system32\mnhsucoe.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4900
-
-
-
C:\Windows\SysWOW64\xjmaiwgzobrzioo.exexjmaiwgzobrzioo.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1736
-
-
C:\Windows\SysWOW64\mnhsucoe.exemnhsucoe.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4872
-
-
C:\Windows\SysWOW64\lnzytlnctretv.exelnzytlnctretv.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5760
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2240
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 86ac2f672c9457ae4bc0bdf19c3222e2568b447a7777c932b6651de1d04d55eb
- MD5 2834aa88bc50c7f44bc39e4e7bf81185
- SHA1 5ee71511c47079a975b4be740d90f5f2302543b1
- SHA512 d8958ea13696bc4fda426752c937040649acba2175a529b33ca23f5615f3789b81f30ed2a287a726c376fc1ef811bb0357e2a7fab4153dbb9cba4411db902458
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6p:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5W
- TLSH T102B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 4KB
- SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
- MD5 5f036f91e86e30f749961506951d51eb
- SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
- SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
- SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
- TLSH T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 342B
- SHA256 88fbe15dc83bd4fbade435d15c549e841066202eda8ab12a57d00641db9eda7f
- MD5 5aa86490a81bb2be945fb38ef4dd5477
- SHA1 52d2bcfe441d57a8a58e065836cb20795b22c123
- SHA512 7c3f582ce99553c84c77dc1d21a853cd0d4d16f0fc8c0ff219ee8406a1e125ef8f90586e3eaa4878533bc8e54af9ef16002735ee94040bf679276cd6a075bec2
- TLSH T1B3E05E112BE80204F6770A3CA97366499977B76BAA01CADD0275008D1D36FA2CD3271E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 342B
- SHA256 d1b62af04c1c5e648e1058a74ca4bf684d5d6056ccc09008587e69b4c3a7a0d5
- MD5 9c56523b0c317da8bc1f8a13caaf8f99
- SHA1 cfb058bdc45a8ef7658ea5b5b9f1901722601974
- SHA512 09a066da1c693a350deb8ccfe5998c50bb68da929037787fc6813d2ce82161240c37be7a284e128ba386b553fe1d5ed64c6dd5bd05e875fb47df0675d751608e
- TLSH T1E9E05E112BE80204F6770A3CA87366499977B76BAA01CADD0275008D1C35FA2CD3271E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCD86B4.tmp\sist02.xsl
- Size 245KB
- SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
- MD5 f883b260a8d67082ea895c14bf56dd56
- SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
- SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
- SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
- TLSH T15B346895A6DACF144B71F23FD8B53492EA1DC87B29342D41F1DC733717AE948822B622
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 291B
- SHA256 fde05ac9f79af1a1b4e4f846e637ecb3b7b6c2e68dbfb8d12045bf10f501aa22
- MD5 6b6f2cea5558f6d3693c608dd2b41f9b
- SHA1 e4568730373d42bdeb38e24b4597475b1d01bb58
- SHA512 6b209881e6f791e28a3bdb9ecb9958dde28c47e515e5abf697177933ab25381a4dcb0c66cb83c8a664163b87540e47ae5f5006c29843b8e0da86c3319a72a493
- TLSH T176D0E22F0BA8C7E1E37CC6FA30B29CE49AF2089CD67A007100CC1C822C441A32ADB104
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 7465dfdb75ea77ffec2d7e835f1d33ba9d464b23cf4a61e7408b9bae852592d4
- MD5 328beade9aef57916786dd84b9cc6dc5
- SHA1 0d9526ad17cbde09fdcb53dfb9bab45c1d551f69
- SHA512 6cd956ad84318c379c4ef7852ccdd0ccd3951b0cb2f540850d27f723da8c5bd2ad52c4d89d3b772e115c783fc515b0e1a7ce9fcca10ac8d06a4e4efe0eb5bead
- TLSH T16D211F0392964B66D0A543369A9F5313EB34BC02FB9E595E85807237BD706809E1EB3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 658B
- SHA256 ce2674b08f41b25c4dff181d7fc4d570cd720e45e03d64f3dcf244f914e23294
- MD5 f86fecb18f3a30dd24766bcd299c2429
- SHA1 0639ab93a1a8668984c2cb80a8d923b55801a2bc
- SHA512 570372a92a1bf54648efdf7608a0757728228fdabf87d7769213f5d155efa99c34690d0a715656a90b9351c75ca689d08f2db64c8586a0d4684f26124c609a10
- TLSH T122012013A28E0B16D0911376872E4346D734BC02FA89568DC5C0517BAD31E90DE8DB34
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\WatchExport.doc.exe
- Size 512KB
- SHA256 0f7129bf5e855332bcaacd978c061fbb228d1bd86ea1558f6f0926b1e54d9db2
- MD5 3ebf662a30491a4b63a0cac1f37a08ce
- SHA1 a952f2ba0883a22c3c0f7bc5125ac8c42969d230
- SHA512 c12c69f1f6321ba2a302d526e50f38a0b596b0c3707eb6c2d673d2c49d54c93f9d267796c442e8ee3abe83295bdcb645fde7b2a55ebdeb9ccddbc72269209efc
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6N:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
- TLSH T1A2B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\brdhssjzez.exe
- Size 512KB
- SHA256 09b4a9a15c4325c864fae66ef7a31517d0483ea3d870d9330bd00e6032cc6de0
- MD5 88ceff0bb0a169717e9d8f4a6b4cad91
- SHA1 6c1acebd75bb791fb7c489703ff7c6f4e20f39bd
- SHA512 02d474a38d9e902425ec507e08cf8a9e0108dbf31cff705ae6b272626d816d810dd28ab5f472df1cbb4ae1d3f8f346bc1ceb61d399222ff24afd4eeeae4f5bff
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5k
- TLSH T193B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\lnzytlnctretv.exe
- Size 512KB
- SHA256 f163cae25b482775c76bf9102dfde355e6ede1f4eb8c984743eed7148cfe5202
- MD5 fb97c4ef759e574a35c700dad3db298f
- SHA1 f099637fd8161ef37782cc0ccae77e22ed5c2f17
- SHA512 b6c7db2096ef6dba84858ab669da1ff6f7cd8f586c106c50438326794a3a662f978bc281690d9ec7c70b77e389b28b454465c01bd1bd5ec130bf2ba40850d573
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6e:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5l
- TLSH T1ABB4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\mnhsucoe.exe
- Size 512KB
- SHA256 b7756e94d87058b9c8ebf19b73260520f123a2587c024258ed26976ee8f03948
- MD5 4d244813fcb862696856fc8dd9354ba0
- SHA1 5083f7425fe2d8b26ab91e33081a61beea131373
- SHA512 42ce375d0844cd4c3286be0d80baa6e0d3b74dc437729481afaafc81492d4d3c595c2f8807a173432f87ee4d97795447c8e52977642c1cb18e5bed9cf6f9aed3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6d:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5m
- TLSH T1F9B4AE2276E1B0B2E96325F00F76D728A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\xjmaiwgzobrzioo.exe
- Size 512KB
- SHA256 190ef2f14d6c00711bb2e7976b71aa2b9b5dda33d7e0d48dc021a15342d87b36
- MD5 338fffcf261ff823fc17942251505326
- SHA1 981e2c7ef89cf10898a41d796b257ca034ca2bc5
- SHA512 bc0fe26ed51071d9b960bb14433ac5a462e6d1fe12823180890fce178d131c7be94d9940b230c706f282abb770799e00838fcee755ba79a6dc98d376de1c9e48
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6P:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Q
- TLSH T11EB4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 59ad50d8654a5dc29fe865529ab99ee48c930127fcdb05763d6f0768147a6429
- MD5 47c25a0a2a01aa8aaf79e3684638b22f
- SHA1 e81cb187ce2095d7bb0c7b43203ff9200101a339
- SHA512 0e4ac3c69f417cb38d56de09fdc0e965361a28a7d98132cef049cb472377ac8b3fc82c15f922330d5c85185e058f1ca843e4fb9089be318595498feb9d75d670
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6A:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5r
- TLSH T1EAB4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 57a18fb5f9e3d6853f1e2150ed76d0fd2de743eb625c39bf99af3971106ed399
- MD5 186aa626522e53b8818459bf9414095d
- SHA1 7d2280ce70f59ed5f2664fb58f5a032405bf93e8
- SHA512 797483cd9312b962432ad40f166c089afecd1599d6c1fe90a499c92dd690e0073486aa819a383f9edf38536c6cd8ebb4b0824780af28e4bf1fe5addb6da28aa2
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5G
- TLSH T147B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH