Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 17:29
Behavioral task
behavioral1
Sample
2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe
- Size 512KB
- Sample260818-v2zdpsxamd
- SHA256 b42ce615a1847ee83ae1602e3fd0377dac73eed0ee8f5fe26d2fe6a502d9ea03
- MD5 83f503f3446b256c5e78006beb8bd207
- SHA1 20324b9189c0b8fdf1f3cb4f6e0fc844e079a34b
- SHA512 c936c73b9eb7264f28a4e6ce3e69b92deaea3825fda333ac90227aa76feed89fe7c8a3608e4f8dc3b04f0f6a1613d6acf75313541d566de58cea57e68bb19133
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6W:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5N
- TLSH T194B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 9 IoCs
resource yara_rule behavioral2/files/0x000d00000001c555-7.dat family_sohanad behavioral2/files/0x001300000001b1d0-11.dat family_sohanad behavioral2/files/0x000e00000001c550-16.dat family_sohanad behavioral2/files/0x000d00000001c554-21.dat family_sohanad behavioral2/files/0x000d00000001c560-67.dat family_sohanad behavioral2/files/0x000d00000001c565-80.dat family_sohanad behavioral2/files/0x000d00000001c566-83.dat family_sohanad behavioral2/files/0x000d00000001c57e-103.dat family_sohanad behavioral2/files/0x000d00000001c57e-105.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" fxtmeuslsm.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fxtmeuslsm.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fxtmeuslsm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fxtmeuslsm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fxtmeuslsm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fxtmeuslsm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" fxtmeuslsm.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fxtmeuslsm.exe - Executes dropped EXE 5 IoCs
pid Process 5056 fxtmeuslsm.exe 1544 pkixjstpxwadsdn.exe 1812 jbojznns.exe 4768 wevdbrqokdcif.exe 1260 jbojznns.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fxtmeuslsm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fxtmeuslsm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fxtmeuslsm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" fxtmeuslsm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fxtmeuslsm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" fxtmeuslsm.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qmxjlkuk = "fxtmeuslsm.exe" pkixjstpxwadsdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hfmadvqq = "pkixjstpxwadsdn.exe" pkixjstpxwadsdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "wevdbrqokdcif.exe" pkixjstpxwadsdn.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\q: jbojznns.exe File opened (read-only) \??\x: jbojznns.exe File opened (read-only) \??\k: fxtmeuslsm.exe File opened (read-only) \??\p: fxtmeuslsm.exe File opened (read-only) \??\u: jbojznns.exe File opened (read-only) \??\m: fxtmeuslsm.exe File opened (read-only) \??\t: jbojznns.exe File opened (read-only) \??\m: jbojznns.exe File opened (read-only) \??\y: jbojznns.exe File opened (read-only) \??\d: fxtmeuslsm.exe File opened (read-only) \??\q: fxtmeuslsm.exe File opened (read-only) \??\s: fxtmeuslsm.exe File opened (read-only) \??\x: fxtmeuslsm.exe File opened (read-only) \??\a: jbojznns.exe File opened (read-only) \??\b: jbojznns.exe File opened (read-only) \??\l: jbojznns.exe File opened (read-only) \??\g: jbojznns.exe File opened (read-only) \??\h: jbojznns.exe File opened (read-only) \??\i: jbojznns.exe File opened (read-only) \??\s: jbojznns.exe File opened (read-only) \??\o: jbojznns.exe File opened (read-only) \??\p: jbojznns.exe File opened (read-only) \??\n: jbojznns.exe File opened (read-only) \??\o: fxtmeuslsm.exe File opened (read-only) \??\z: fxtmeuslsm.exe File opened (read-only) \??\g: jbojznns.exe File opened (read-only) \??\h: jbojznns.exe File opened (read-only) \??\k: jbojznns.exe File opened (read-only) \??\p: jbojznns.exe File opened (read-only) \??\z: jbojznns.exe File opened (read-only) \??\t: fxtmeuslsm.exe File opened (read-only) \??\z: jbojznns.exe File opened (read-only) \??\d: jbojznns.exe File opened (read-only) \??\o: jbojznns.exe File opened (read-only) \??\t: jbojznns.exe File opened (read-only) \??\b: fxtmeuslsm.exe File opened (read-only) \??\d: jbojznns.exe File opened (read-only) \??\j: jbojznns.exe File opened (read-only) \??\r: jbojznns.exe File opened (read-only) \??\g: fxtmeuslsm.exe File opened (read-only) \??\i: fxtmeuslsm.exe File opened (read-only) \??\j: fxtmeuslsm.exe File opened (read-only) \??\l: jbojznns.exe File opened (read-only) \??\v: jbojznns.exe File opened (read-only) \??\k: jbojznns.exe File opened (read-only) \??\b: jbojznns.exe File opened (read-only) \??\l: fxtmeuslsm.exe File opened (read-only) \??\w: fxtmeuslsm.exe File opened (read-only) \??\r: jbojznns.exe File opened (read-only) \??\m: jbojznns.exe File opened (read-only) \??\a: fxtmeuslsm.exe File opened (read-only) \??\h: fxtmeuslsm.exe File opened (read-only) \??\u: fxtmeuslsm.exe File opened (read-only) \??\q: jbojznns.exe File opened (read-only) \??\s: jbojznns.exe File opened (read-only) \??\v: jbojznns.exe File opened (read-only) \??\v: fxtmeuslsm.exe File opened (read-only) \??\y: fxtmeuslsm.exe File opened (read-only) \??\j: jbojznns.exe File opened (read-only) \??\n: jbojznns.exe File opened (read-only) \??\a: jbojznns.exe File opened (read-only) \??\n: fxtmeuslsm.exe File opened (read-only) \??\i: jbojznns.exe File opened (read-only) \??\x: jbojznns.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" fxtmeuslsm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" fxtmeuslsm.exe - AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4340-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000d00000001c555-7.dat autoit_exe behavioral2/files/0x001300000001b1d0-11.dat autoit_exe behavioral2/files/0x000e00000001c550-16.dat autoit_exe behavioral2/files/0x000d00000001c554-21.dat autoit_exe behavioral2/files/0x000d00000001c560-67.dat autoit_exe behavioral2/files/0x000d00000001c565-80.dat autoit_exe behavioral2/files/0x000d00000001c566-83.dat autoit_exe behavioral2/files/0x000d00000001c57e-103.dat autoit_exe behavioral2/files/0x000d00000001c57e-105.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msvbvm60.dll fxtmeuslsm.exe File opened for modification C:\Windows\SysWOW64\fxtmeuslsm.exe 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\wevdbrqokdcif.exe 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe jbojznns.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe jbojznns.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe jbojznns.exe File created C:\Windows\SysWOW64\fxtmeuslsm.exe 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe File created C:\Windows\SysWOW64\pkixjstpxwadsdn.exe 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\pkixjstpxwadsdn.exe 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe File created C:\Windows\SysWOW64\jbojznns.exe 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\jbojznns.exe 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe File created C:\Windows\SysWOW64\wevdbrqokdcif.exe 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal jbojznns.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jbojznns.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jbojznns.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal jbojznns.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jbojznns.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jbojznns.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal jbojznns.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jbojznns.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jbojznns.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal jbojznns.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jbojznns.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jbojznns.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jbojznns.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jbojznns.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe jbojznns.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe jbojznns.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe jbojznns.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe jbojznns.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe jbojznns.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe jbojznns.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe jbojznns.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe jbojznns.exe File opened for modification C:\Windows\mydoc.rtf 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxtmeuslsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pkixjstpxwadsdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbojznns.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevdbrqokdcif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbojznns.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC1B12847E139E852C4BADC329BD4C5" 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8FFF824F26856E9141D65A7E94BDE2E146594367446337D7E9" 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F06BB8FF6C21A9D27CD0A58B7C9161" 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc fxtmeuslsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf fxtmeuslsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg fxtmeuslsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" fxtmeuslsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33452D0B9D2D83526A4277D577252CAB7CF664AF" 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1848C60C1594DAC5B8C07FE2EC9F37C8" 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" fxtmeuslsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" fxtmeuslsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BB5FABFF964F291837A3A42819F3E91B3FE03884369033DE2CD429D08A4" 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat fxtmeuslsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" fxtmeuslsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh fxtmeuslsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" fxtmeuslsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs fxtmeuslsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" fxtmeuslsm.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4296 WINWORD.EXE 4296 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 5056 fxtmeuslsm.exe 5056 fxtmeuslsm.exe 5056 fxtmeuslsm.exe 5056 fxtmeuslsm.exe 5056 fxtmeuslsm.exe 5056 fxtmeuslsm.exe 5056 fxtmeuslsm.exe 5056 fxtmeuslsm.exe 5056 fxtmeuslsm.exe 5056 fxtmeuslsm.exe 1812 jbojznns.exe 1812 jbojznns.exe 1812 jbojznns.exe 1812 jbojznns.exe 1812 jbojznns.exe 1812 jbojznns.exe 1812 jbojznns.exe 1812 jbojznns.exe 1544 pkixjstpxwadsdn.exe 1544 pkixjstpxwadsdn.exe 1544 pkixjstpxwadsdn.exe 1544 pkixjstpxwadsdn.exe 1544 pkixjstpxwadsdn.exe 1544 pkixjstpxwadsdn.exe 1544 pkixjstpxwadsdn.exe 1544 pkixjstpxwadsdn.exe 1544 pkixjstpxwadsdn.exe 1544 pkixjstpxwadsdn.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 1544 pkixjstpxwadsdn.exe 1544 pkixjstpxwadsdn.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 5056 fxtmeuslsm.exe 5056 fxtmeuslsm.exe 5056 fxtmeuslsm.exe 1812 jbojznns.exe 1812 jbojznns.exe 1812 jbojznns.exe 1544 pkixjstpxwadsdn.exe 1544 pkixjstpxwadsdn.exe 1544 pkixjstpxwadsdn.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 1260 jbojznns.exe 1260 jbojznns.exe 1260 jbojznns.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 5056 fxtmeuslsm.exe 5056 fxtmeuslsm.exe 5056 fxtmeuslsm.exe 1812 jbojznns.exe 1812 jbojznns.exe 1812 jbojznns.exe 1544 pkixjstpxwadsdn.exe 1544 pkixjstpxwadsdn.exe 1544 pkixjstpxwadsdn.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 4768 wevdbrqokdcif.exe 1260 jbojznns.exe 1260 jbojznns.exe 1260 jbojznns.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 4296 WINWORD.EXE 4296 WINWORD.EXE 4296 WINWORD.EXE 4296 WINWORD.EXE 4296 WINWORD.EXE 4296 WINWORD.EXE 4296 WINWORD.EXE 4296 WINWORD.EXE 4296 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4340 wrote to memory of 5056 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 88 PID 4340 wrote to memory of 1544 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 89 PID 4340 wrote to memory of 1812 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 90 PID 4340 wrote to memory of 4768 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 91 PID 4340 wrote to memory of 4296 4340 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 92 PID 5056 wrote to memory of 1260 5056 fxtmeuslsm.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\fxtmeuslsm.exefxtmeuslsm.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\jbojznns.exeC:\Windows\system32\jbojznns.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1260
-
-
-
C:\Windows\SysWOW64\pkixjstpxwadsdn.exepkixjstpxwadsdn.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1544
-
-
C:\Windows\SysWOW64\jbojznns.exejbojznns.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1812
-
-
C:\Windows\SysWOW64\wevdbrqokdcif.exewevdbrqokdcif.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4768
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4296
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 771dfcf9f35b7c074028374674ac998715437dd0fe26b98a7384f634b6f1e043
- MD5 47f33d0656d636bc983b1ce834ab8189
- SHA1 5e5ee2617997aaa4ba64e55517dd709c54aaf6d3
- SHA512 d5c94160ffe98716aab507dec510483313d7f13ba475035732666caa1e345012b2a7e32fc41f15501849fb9eefa79f56cafe78dc382b60398fea6d1b832081d4
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6U:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5N
- TLSH T191B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCD7FFD.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- TLSH T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 285B
- SHA256 8a62496f41978c8b12a77cacc263a652fb9c87219062e3adc93e2c81c6d1f740
- MD5 857570689f8f2481bbb59d774d2f24a1
- SHA1 78bd68392a993be8b39470e9dbd67def3ec077fb
- SHA512 cc25cd73154ef2b11911075add8531854ec800685026877bde28a388f4a537d199e109faf858b03a1c9b854fea25829a8c18199a5b29138cbc08357cfb88c372
- TLSH T13FD017279B21D3E4977C01A574358CF47BF36CACD9A8417100CC5CD21D20163609B685
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 655B
- SHA256 d72797ae6e8fd28ebfe2d8ad5f02ba5598aecedc9626631a402bfbce5de7e5a1
- MD5 1493bdf926a388aacf208de09cb66c73
- SHA1 c53d819e0c6eda3c90b4ecbff482cf9be3b62778
- SHA512 fb0d34b91b130dce6803d98c94c19d4e8e67433b9344482b4a07645ab13af393178c4e3cd7655d174954238b7e78c27f7df969c40a27fc37de7b8e11247ce8ab
- TLSH T157F0EB03A7DB460AE04082B30D2BC30ADA71BC139A41830E86C8D63BBC609509FC82AA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 a4ca82b638f53787f03435b462f8553a1c2cd76ff7cf6fdc74e348a26707e062
- MD5 36d3700b6d286a3801b59b4c4e1f4e6a
- SHA1 add49a8d9de0debf0613e7df55e1ee8d1b42b098
- SHA512 6d4b9c92c23bc8af38659c6314e581dbef0e1dafbdf28a45f3257c46b196f4630de4694c486c84650783b2d549de79fa4df893e66ff5e7ccd5533780b3213a77
- TLSH T13A21420357978656D04442730C1FD3169F31FC03AB49875FA288EA33BDA03809E8C27A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SuspendUnprotect\OutUnlock.doc.exe
- Size 512KB
- SHA256 0d1ec676628d73c201d3024b89a506da2ebc66bcc6306ad0d61ba35f71f71859
- MD5 ce7587402de19556d05eea3d4a55b8bf
- SHA1 5aea461181f093e7c1a063bfd5cfff7f3b616b75
- SHA512 499ec6d73e9ca5b15ce3de772d68cee1ad1133522c25b0a0d0192c528988804dd518c1cd48d43108ad94b3248add67bdcc1fbc2a71357152eb190ab8882f1cb1
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6v:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5G
- TLSH T166B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\TestRepair\ResumeSearch.doc.exe
- Size 512KB
- SHA256 3ab1fdd3d870c6eb97426a2b5af607fad0f99005ab6eac10b3ac6b4607ee6a3b
- MD5 591fab0193b6ca7db418e9d3f2e2e2dd
- SHA1 5af4ec883962ce43ec2a34999c67cfc368c3d0b5
- SHA512 9b18f8206b19a82f78019910de10b816c90b01e37fea9e1075b81436096a0dbfc0c49de6812923ac9aea86d456475d496f2755a4af09632a969188b11935eeb4
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
- TLSH T17BB4AE2276E1B0B2E96325F00F76D728A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\fxtmeuslsm.exe
- Size 512KB
- SHA256 8cad7e72f181c710cf95d0e888da3952d43e5f87c3e8a0ac94cec90588e752d3
- MD5 11c3b61fe7cfe0bce79d7740c0d647b6
- SHA1 48198342162c315eda16fae68a4ca51a0bc7e83a
- SHA512 b3fc2e49242d5f682edc132511b4c9339d1c62272b47d13b214db0bb83e67dd6e3088f46ff1a1a96cda9e955abdb747d9d8a46f97135195567e6b779e1e26f6b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6a:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5X
- TLSH T1ABB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\jbojznns.exe
- Size 512KB
- SHA256 767ab750dd5a5617ab759dfb2d63374be5f1144280a15a20f3c9de26d957ed4e
- MD5 171146b06c8bf7e35806f0e2df0e4656
- SHA1 98644d3e9f7ee904b2287f4f2eba395fe593ce83
- SHA512 d4853273610bc274e32487e1929dfdd48e70a772b7b332fc4b0f0d97fe3e53de96e0525b960b7cd70164f7a0303de6d0db7fe701fca9fec1e2ac0db771c98a3a
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Q:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5N
- TLSH T176B4AE2276E1B0B2E96325F00F76D728A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\pkixjstpxwadsdn.exe
- Size 512KB
- SHA256 510935ff22887b7e442532ed621eb2255ec1e39e868613890182dafc84189dd7
- MD5 d7fce7625131e20928dd36f39c1ba065
- SHA1 5f68ebe94af91c631498d228afcd51dd4bff3441
- SHA512 89956c48f2e259547be903fc76dede84a8a5628127426f0ca55deff3a4ddb20c0542b8e92beaac07a4141912afd5096d7f703d976fbf04a6787e6ff326bb48eb
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj62:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5F
- TLSH T1BCB4AE2276E1B0B2E96325F00F76D728A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\wevdbrqokdcif.exe
- Size 512KB
- SHA256 f5373e177f1e2228dab8d7e355ad52c12ce627e7df2ff3d37aee40f1b26babc1
- MD5 298b3ea9103cde3516df5b5675d7d0fb
- SHA1 6cade4e1a7c09333590bc4b0be25036cf9b12725
- SHA512 3f344fd97af51b8eaa9f9d84be7e3f82d80ae98e83c42f351481cf49f36564b86dadebba4b9e8fc6b12da422fbf7cd4809453acd2c67c5c9b2576470e395f272
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5t
- TLSH T134B4AE2276E1B0B2E96325F00F76D728A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 fcb60d3db543c98c74519daf736925b46ef824864edf44e94ccfab1c730e6003
- MD5 7ef9fa5f27316ac6be6122aa9e9991d6
- SHA1 721eba2a0b95d00e0d7515a56931b52d3f485f94
- SHA512 59035b7f2cb26727e8ec286291fc4a565fea24ea1d0e5a1d39e5f9b97cd4b7653c17e1cad51106f82c2a8bcdecd919e9ace4046ea6b147a9e4b3476acfcbe41e
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj65:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5I
- TLSH T1FBB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 1d6ad959c5f52cee7ebe1246d89fe5d838dc9739f5bbd6bf530e09d32b5726cf
- MD5 78831ae53cbff7f71048f920a6165528
- SHA1 c61077c68d25b364da18de0b0b0c74fa36ffa06b
- SHA512 3544c8022031f9e0e14bb54a79d514e14075303378f48806abb27211131a02a692fe1d5b7c72f486b85af781ea3132012b7f099214248a7e1d847c96a62ce92d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm58
- TLSH T1CCB4AE2276E1B0B2E96325F00F76D728A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH