Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 22:25
Behavioral task
behavioral1
Sample
2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe
- Size 512KB
- Sample260825-2cfcvswyet
- SHA256 dbec86dffb865453204a06517c5432e60a0af0aee912681e9959eba7c3507dc2
- MD5 b819e64fac95775374945246e99ec56c
- SHA1 f61f7bbd7e0618164a1dfeff3422ad36073e31ca
- SHA512 96e028aea7cef589470e72f36f27bf035196e1acd01fb5f96dd71620484615b1263fa6c7425c00d903de4c4fdf5908cfabd5ae9d686bf153387f7b8db7ea725a
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6F:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5e
- TLSH T11FB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 8 IoCs
resource yara_rule behavioral2/files/0x000d00000001c51e-2.dat family_sohanad behavioral2/files/0x000c00000001c522-18.dat family_sohanad behavioral2/files/0x000c00000001c523-23.dat family_sohanad behavioral2/files/0x000c00000001c524-27.dat family_sohanad behavioral2/files/0x000600000000bb41-66.dat family_sohanad behavioral2/files/0x000c00000001c535-70.dat family_sohanad behavioral2/files/0x000d00000001c536-87.dat family_sohanad behavioral2/files/0x000d00000001c536-92.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ygedwwazwb.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ygedwwazwb.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ygedwwazwb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ygedwwazwb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ygedwwazwb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ygedwwazwb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ygedwwazwb.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ygedwwazwb.exe - Executes dropped EXE 5 IoCs
pid Process 3440 ygedwwazwb.exe 2916 xcubpumfrywaykx.exe 3516 wsflcohz.exe 2608 bvempnvpiuacp.exe 4896 wsflcohz.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" ygedwwazwb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ygedwwazwb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ygedwwazwb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ygedwwazwb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ygedwwazwb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ygedwwazwb.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wnnkmobw = "xcubpumfrywaykx.exe" xcubpumfrywaykx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "bvempnvpiuacp.exe" xcubpumfrywaykx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wvourhzq = "ygedwwazwb.exe" xcubpumfrywaykx.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: wsflcohz.exe File opened (read-only) \??\l: wsflcohz.exe File opened (read-only) \??\m: wsflcohz.exe File opened (read-only) \??\r: wsflcohz.exe File opened (read-only) \??\h: ygedwwazwb.exe File opened (read-only) \??\y: wsflcohz.exe File opened (read-only) \??\z: wsflcohz.exe File opened (read-only) \??\g: wsflcohz.exe File opened (read-only) \??\d: ygedwwazwb.exe File opened (read-only) \??\g: ygedwwazwb.exe File opened (read-only) \??\h: wsflcohz.exe File opened (read-only) \??\o: wsflcohz.exe File opened (read-only) \??\u: wsflcohz.exe File opened (read-only) \??\a: wsflcohz.exe File opened (read-only) \??\u: wsflcohz.exe File opened (read-only) \??\w: wsflcohz.exe File opened (read-only) \??\o: ygedwwazwb.exe File opened (read-only) \??\w: ygedwwazwb.exe File opened (read-only) \??\g: wsflcohz.exe File opened (read-only) \??\k: wsflcohz.exe File opened (read-only) \??\j: wsflcohz.exe File opened (read-only) \??\t: wsflcohz.exe File opened (read-only) \??\b: wsflcohz.exe File opened (read-only) \??\v: wsflcohz.exe File opened (read-only) \??\k: ygedwwazwb.exe File opened (read-only) \??\s: ygedwwazwb.exe File opened (read-only) \??\h: wsflcohz.exe File opened (read-only) \??\n: wsflcohz.exe File opened (read-only) \??\j: wsflcohz.exe File opened (read-only) \??\n: wsflcohz.exe File opened (read-only) \??\t: wsflcohz.exe File opened (read-only) \??\p: ygedwwazwb.exe File opened (read-only) \??\t: ygedwwazwb.exe File opened (read-only) \??\x: wsflcohz.exe File opened (read-only) \??\x: wsflcohz.exe File opened (read-only) \??\z: wsflcohz.exe File opened (read-only) \??\z: ygedwwazwb.exe File opened (read-only) \??\b: wsflcohz.exe File opened (read-only) \??\q: wsflcohz.exe File opened (read-only) \??\k: wsflcohz.exe File opened (read-only) \??\p: wsflcohz.exe File opened (read-only) \??\m: wsflcohz.exe File opened (read-only) \??\a: ygedwwazwb.exe File opened (read-only) \??\i: ygedwwazwb.exe File opened (read-only) \??\l: ygedwwazwb.exe File opened (read-only) \??\n: ygedwwazwb.exe File opened (read-only) \??\q: ygedwwazwb.exe File opened (read-only) \??\v: ygedwwazwb.exe File opened (read-only) \??\a: wsflcohz.exe File opened (read-only) \??\j: ygedwwazwb.exe File opened (read-only) \??\m: ygedwwazwb.exe File opened (read-only) \??\d: wsflcohz.exe File opened (read-only) \??\l: wsflcohz.exe File opened (read-only) \??\v: wsflcohz.exe File opened (read-only) \??\b: ygedwwazwb.exe File opened (read-only) \??\x: ygedwwazwb.exe File opened (read-only) \??\y: ygedwwazwb.exe File opened (read-only) \??\r: wsflcohz.exe File opened (read-only) \??\d: wsflcohz.exe File opened (read-only) \??\q: wsflcohz.exe File opened (read-only) \??\y: wsflcohz.exe File opened (read-only) \??\r: ygedwwazwb.exe File opened (read-only) \??\o: wsflcohz.exe File opened (read-only) \??\p: wsflcohz.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" ygedwwazwb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" ygedwwazwb.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2868-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000d00000001c51e-2.dat autoit_exe behavioral2/files/0x000c00000001c522-18.dat autoit_exe behavioral2/files/0x000c00000001c523-23.dat autoit_exe behavioral2/files/0x000c00000001c524-27.dat autoit_exe behavioral2/files/0x000600000000bb41-66.dat autoit_exe behavioral2/files/0x000c00000001c535-70.dat autoit_exe behavioral2/files/0x000d00000001c536-87.dat autoit_exe behavioral2/files/0x000d00000001c536-92.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\bvempnvpiuacp.exe 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ygedwwazwb.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe wsflcohz.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe wsflcohz.exe File opened for modification C:\Windows\SysWOW64\ygedwwazwb.exe 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe File created C:\Windows\SysWOW64\wsflcohz.exe 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\wsflcohz.exe 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe wsflcohz.exe File created C:\Windows\SysWOW64\ygedwwazwb.exe 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe File created C:\Windows\SysWOW64\xcubpumfrywaykx.exe 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\xcubpumfrywaykx.exe 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe File created C:\Windows\SysWOW64\bvempnvpiuacp.exe 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe wsflcohz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal wsflcohz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal wsflcohz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal wsflcohz.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe wsflcohz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal wsflcohz.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe wsflcohz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe wsflcohz.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe wsflcohz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe wsflcohz.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe wsflcohz.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe wsflcohz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe wsflcohz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe wsflcohz.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe wsflcohz.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe wsflcohz.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe wsflcohz.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe wsflcohz.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe wsflcohz.exe File opened for modification C:\Windows\mydoc.rtf 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe wsflcohz.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe wsflcohz.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe wsflcohz.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wsflcohz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ygedwwazwb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xcubpumfrywaykx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wsflcohz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvempnvpiuacp.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F668B3FE6B22DDD172D0A68B08906B" 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193EC67F15ECDAB0B8C97C90EDE737CE" 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" ygedwwazwb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg ygedwwazwb.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat ygedwwazwb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" ygedwwazwb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh ygedwwazwb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" ygedwwazwb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" ygedwwazwb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32352C7F9C2C83206D4477D770272DAD7CF264DB" 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBDFACEFE13F1E084093A4486963997B38D03FD42160338E2BE42EB09A2" 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB5B029479339EE53CDBADD329DD4CC" 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E88FCF8485C851C9047D7297E93BC94E140584267466346D6EB" 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf ygedwwazwb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc ygedwwazwb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" ygedwwazwb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs ygedwwazwb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" ygedwwazwb.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3764 WINWORD.EXE 3764 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 3440 ygedwwazwb.exe 3440 ygedwwazwb.exe 3440 ygedwwazwb.exe 3440 ygedwwazwb.exe 3440 ygedwwazwb.exe 3440 ygedwwazwb.exe 3440 ygedwwazwb.exe 3440 ygedwwazwb.exe 3440 ygedwwazwb.exe 3440 ygedwwazwb.exe 2916 xcubpumfrywaykx.exe 2916 xcubpumfrywaykx.exe 2916 xcubpumfrywaykx.exe 2916 xcubpumfrywaykx.exe 2916 xcubpumfrywaykx.exe 2916 xcubpumfrywaykx.exe 2916 xcubpumfrywaykx.exe 2916 xcubpumfrywaykx.exe 2916 xcubpumfrywaykx.exe 2916 xcubpumfrywaykx.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 3516 wsflcohz.exe 3516 wsflcohz.exe 3516 wsflcohz.exe 3516 wsflcohz.exe 3516 wsflcohz.exe 3516 wsflcohz.exe 3516 wsflcohz.exe 3516 wsflcohz.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 2916 xcubpumfrywaykx.exe 2916 xcubpumfrywaykx.exe 2916 xcubpumfrywaykx.exe 2916 xcubpumfrywaykx.exe - Suspicious use of FindShellTrayWindow 20 IoCs
pid Process 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 3440 ygedwwazwb.exe 3440 ygedwwazwb.exe 3440 ygedwwazwb.exe 2916 xcubpumfrywaykx.exe 2916 xcubpumfrywaykx.exe 2916 xcubpumfrywaykx.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 3516 wsflcohz.exe 3516 wsflcohz.exe 3516 wsflcohz.exe 4896 wsflcohz.exe 4896 wsflcohz.exe 4896 wsflcohz.exe 3764 WINWORD.EXE 3764 WINWORD.EXE - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 3440 ygedwwazwb.exe 3440 ygedwwazwb.exe 3440 ygedwwazwb.exe 2916 xcubpumfrywaykx.exe 2916 xcubpumfrywaykx.exe 2916 xcubpumfrywaykx.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 2608 bvempnvpiuacp.exe 3516 wsflcohz.exe 3516 wsflcohz.exe 3516 wsflcohz.exe 4896 wsflcohz.exe 4896 wsflcohz.exe 4896 wsflcohz.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3764 WINWORD.EXE 3764 WINWORD.EXE 3764 WINWORD.EXE 3764 WINWORD.EXE 3764 WINWORD.EXE 3764 WINWORD.EXE 3764 WINWORD.EXE 3764 WINWORD.EXE 3764 WINWORD.EXE 3764 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2868 wrote to memory of 3440 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 88 PID 2868 wrote to memory of 2916 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 89 PID 2868 wrote to memory of 3516 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 90 PID 2868 wrote to memory of 2608 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 91 PID 2868 wrote to memory of 3764 2868 2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe 92 PID 3440 wrote to memory of 4896 3440 ygedwwazwb.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_b819e64fac95775374945246e99ec56c_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\ygedwwazwb.exeygedwwazwb.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\wsflcohz.exeC:\Windows\system32\wsflcohz.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4896
-
-
-
C:\Windows\SysWOW64\xcubpumfrywaykx.exexcubpumfrywaykx.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2916
-
-
C:\Windows\SysWOW64\wsflcohz.exewsflcohz.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3516
-
-
C:\Windows\SysWOW64\bvempnvpiuacp.exebvempnvpiuacp.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2608
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3764
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\TCD67F6.tmp\sist02.xsl
- Size 245KB
- SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
- MD5 f883b260a8d67082ea895c14bf56dd56
- SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
- SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
- SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
- TLSH T15B346895A6DACF144B71F23FD8B53492EA1DC87B29342D41F1DC733717AE948822B622
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\LimitCopy\RegisterUnpublish.doc.exe
- Size 513KB
- SHA256 86ff291397c0df2158b0d750a992368b8ae0be0d4bff9269ad955f74ac959a2d
- MD5 210445204bfd5e338c408704b6fc06bd
- SHA1 2f9fadc7eb76cbb84fd53df77fdb8de6766b8428
- SHA512 07f385919ddab9758fd44fb92d98f38c80cc88cd7d7fb7d2937f03f6258cb36641ce00364fd90088cbc460a26cc4b4b3ef476e2c627ee2ae521b400d486373f1
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6B:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5o
- TLSH T1D3B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 360B
- SHA256 7e197a8a6b4743b74f4b632f18684fb4d13aef4b0ae7072b4740cfd29496707e
- MD5 e727e698bab23c72c8e5063bba289582
- SHA1 7a79be1167f54bb0b56bbe7be9edc02526d6a8a9
- SHA512 db50f87e0e9757f02a0be868a77125e82d80cd04c3fdb98abeae1958562c35220a0c401fab1a2f3544bca2666bd23e7f2a3fd10e8e0a0906f806d70702862193
- TLSH T197E0866F53A4DBF0C3BC81E178785DE877F1480DD6E6112119DC0CC10E6105361B7904
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 a57c0dd9ecbf7f9cd992d7097b4d1fe2d38554a4aa506484fe6e3346125b3073
- MD5 b060f72ea9b9a17dc3577a65e182de3b
- SHA1 a2019eee0415a08abb872d683318a1386852b154
- SHA512 36aae6381ff0bce93eb17c33d687386f2aba505457d15a4120d1c722848b228a66d6f39cd6e770e356c9656fde48ebe0ac749b61a51f337ef7116da471bfb843
- TLSH T16B41DC025B9F2B26E0D182729B3A439BC2307915E5112B4DBB8C606BBD71D508B9DB1B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 2KB
- SHA256 db0ab432d00c6fe038f4274a3c13999acfa3adfede05e20edde061829373bd25
- MD5 7d22c4fbf1425039a52df03bb53af9c3
- SHA1 cb27269bd9abc443c4307ab4b2353efc0e51c2b0
- SHA512 3a5b99e2a584ff34844bd7735c40801f9e71cdb799d07828de334205a93c727749ed78e69230e536a39262e0d3f324076ede1b41c894b28a656ad8a94a328e11
- TLSH T1995134025B9F2B66E0D18233963A43ABC2307902D6111B4EBB8C613BBD70D508FDDB1B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\UnblockProtect.doc.exe
- Size 513KB
- SHA256 ea96126dcf81d9df206cc9392601861f3674fadccbb279dc1772ece118cd2a77
- MD5 4ad017f8119ff4f985b6f5c7900bb8be
- SHA1 b6fb967d2591dc1de9de96c97b553464863bbf1c
- SHA512 21fd0fb132cd13cd59681bcdde4c9d48c532a09c5d4145490b18a23c2689689f0049ca7be7ea8a342558faaa12d907a5261efbab753137143428799321620a2c
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj65:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5I
- TLSH T166B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\bvempnvpiuacp.exe
- Size 512KB
- SHA256 8141c42ae7ecf40cb4b9dad8f6e4ed1ed519c8f2d1049e3748fe6e0af6acc487
- MD5 a3a692e9cb00942b505481ccaf7acb08
- SHA1 a1df576702f80edc78149f84a296b6388f78c947
- SHA512 08a21ce22c06a6a37e74ded2ed072aa1b2551d71b0eb2a4612f38a9769577038c38d01bee5e395c22b9f0f4fd55194cb90f4c29eaba5851220befde0afd3e696
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj65:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5w
- TLSH T191B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\wsflcohz.exe
- Size 512KB
- SHA256 599a2a70d2f9a95744d51735d6a8e2a628fa5304130e90853185e1eb0acef3f3
- MD5 9aad0e6963feb35d00233a465287cb07
- SHA1 7e24a6c4b21707f6d3a9ad786de45e252f2a7eeb
- SHA512 64b8d130fb18aaf0a4defb3e0c5aa077373ecf380064b352d7a2fe7f5a1c49d987b274435f7806ee2ee96b1f608f1849fbdb860c6aa1dd0e03f16b0dab3d37e2
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6c:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5B
- TLSH T11DB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\xcubpumfrywaykx.exe
- Size 512KB
- SHA256 1c08212d29bcafe0ab32f3fd53d4c99e56bcd1ffb089a707ab64033f42bc365c
- MD5 64a76aa06c98ab446d3508b217566df5
- SHA1 99e7d24659e785327a393db7f8a0fb0da96bd3dd
- SHA512 39b97e29b9ee9243963c54a8aefd430e5f1a2a8bc0a09d01781fe62d845917bc37e6f985080ee78d6a546d826741f9a1784f55fb6218bfda52866f52ed939dc0
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6w:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm59
- TLSH T1EEB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\ygedwwazwb.exe
- Size 512KB
- SHA256 0d241967608b1a02fd1d885c392a1ebf613978db82ad83a19456944577fea0ff
- MD5 34b29ef2bfc40d33dcc20fb4bf4de219
- SHA1 27ca1480c28512444a6d1c88e6e5a1e3c9d7b050
- SHA512 07f70187f57b80ea59905f837c3b189e4e4d6ea903ceeb4faec1e87e5613e50f81ea67c274b4be5d0dc513730b39e2b72e2b2c4757c38d5e1ad881cd6cbe1303
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6f:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5+
- TLSH T101B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 513KB
- SHA256 1e81e6bd1d62838b3e76ff3802cb19c7a0f7e65a544c31afd28a5eca408cfa95
- MD5 799eacaf4583a7a03a20686f54053cce
- SHA1 741b6ad3939937f528affab56420fdf995e153c6
- SHA512 0b37306fbc26ce388a320bcbe2076f9cb90374449d24a938114ae9ee01ecb3ac3fda670cee41a8c6419807113da7659c728069a6bdbed5fceff2c2c7d6d64db8
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6W:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5L
- TLSH T13BB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 513KB
- SHA256 1ee9c15a8b3adc02f733da8f0b52a2e9b1e5cbc479f6a90f1ef8da5f1d66ccde
- MD5 2ab88bef0fdbdba4c9fd1a2a4946547d
- SHA1 75ffc7029ae8188a357d71f8baabc73644f4da7b
- SHA512 fbe727cb40a0e09d8a86589faba714e41796e35de44b9f21be0612199e626403c1eefedc03778e9014f860ec26144d94a7392177298d3ad02ad1151a5decbed3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6t:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5c
- TLSH T1F9B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH