ddc79520b684260c386899a2af3d45f398b16f5784634d4e7e4f4173e54bea68

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-21_b701668f200b722b75c17c8543bfee37_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
Size 5.8MB
Sample260421-ry481abw8w
SHA256 ddc79520b684260c386899a2af3d45f398b16f5784634d4e7e4f4173e54bea68
MD5 b701668f200b722b75c17c8543bfee37
SHA1 b8725daa4b426c154b1a0271afc0c594405db29e
SHA512 5b310b538dfe31481ebdbd8327c7bd8e245babbe8b691d36c091db6aa14b4e2e157f607884a681397b68d2538912b5a0a5cfd77c54b094df997c697f5bc70466
SSDEEP 98304:SHwW2ITuKjnJonK/1NIyfs66AqTEz+jPEDrseCNPnjJwP21zrNHWuRNSCbEViNww:SQ3xwOK/0yfJ6An0P4g7Hwe1rwuRNSm9
TLSH
T13A56334577D09225FC2720F68413BA6043267B1CF617F5ABE9CD876B06EE7E11A93283
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3012	AxialisLiveUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-21_b701668f200b722b75c17c8543bfee37_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AxialisLiveUpdate.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 3012	892	2026-04-21_b701668f200b722b75c17c8543bfee37_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-21_b701668f200b722b75c17c8543bfee37_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-21_b701668f200b722b75c17c8543bfee37_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:892
- C:\Users\Admin\AppData\Local\Temp\AxialisLiveUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\AxialisLiveUpdate.exe" 2026-04-21_b701668f200b722b75c17c8543bfee37_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe \
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AxialisLiveUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\AxialisLiveUpdate.exe
Size 6.0MB
SHA256 52156fd576fac44a8f13058fc07c15dde92adcd4e5b78fa03c3487fab196bed1
MD5 bf4ace4cb053dc0b083ea32c2dad4a29
SHA1 a0afc5cf2bd5ae7b89be83fbd12a9830dc1e9814
SHA512 750e10fe9cc98c78eb984f9f6892c130ee452a0ddfd59f56889531f18169db4e0ed4fb7ba68d0f16d9b6cdb2800a116b9a878c7a77da84cd0417195d6414bfef
SSDEEP 98304:e3TkfLQwJaTwcP9lKVMtpuILPMOuoTGrEwVp2Pf1UdqOSo8mB1jJwrj9c6IGRpOO:5LlJfYKmtxLUOuVwgp2nCsJo9w92GRpx
TLSH
T108563304B490C032FA3234724A21EBB0CAAD75346A06A6DF5BDD4EBB6FB47C1561725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download