Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/04/2026, 15:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc.exe
- Size 416KB
- Sample260423-sn6jragz21
- SHA256 9d4f674a30bf7a70de95fd25e86cfbafd31e132e430028c86c277f0790f732a9
- MD5 907996a80f9390c26cd161802591976c
- SHA1 445b8e7e3cd9cbb99d83cea6de1c223de0115951
- SHA512 4905d39ea36d78ddf332551b7d26d19829ee31d9834591e321876e8027e7aa2ed9f9e456660691d3848db7dcda397491f1633abed64607e228309456e83c0438
- SSDEEP 6144:HJSidiqUYMmKwvG7gkDGTXQ3M3QdGmnnhWSI/IjK0Dsml7CyRF:HJ3di6MmKlqTXQc3nEhWSIiKol+2F
- TLSH T10C945B007493C035D5B395F5CDB9A36245BCAA622BB499C3BFD8484D4AB84E1EB7231F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 6080 ic3za724pjjexnm1sv.exe 8904 lgkyjcoaoetg.exe 11776 mthilmp.exe 14632 lgkyjcoaoetg.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\buuzurzwa\sqj1yyizskxh 2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc.exe File created C:\Windows\buuzurzwa\sqj1yyizskxh ic3za724pjjexnm1sv.exe File created C:\Windows\buuzurzwa\sqj1yyizskxh lgkyjcoaoetg.exe File created C:\Windows\buuzurzwa\sqj1yyizskxh mthilmp.exe File created C:\Windows\buuzurzwa\sqj1yyizskxh lgkyjcoaoetg.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ic3za724pjjexnm1sv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lgkyjcoaoetg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 8904 lgkyjcoaoetg.exe 8904 lgkyjcoaoetg.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe 11776 mthilmp.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2844 wrote to memory of 6080 2844 2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc.exe 83 PID 8904 wrote to memory of 11776 8904 lgkyjcoaoetg.exe 85 PID 6080 wrote to memory of 14632 6080 ic3za724pjjexnm1sv.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\buuzurzwa\ic3za724pjjexnm1sv.exe"C:\buuzurzwa\ic3za724pjjexnm1sv.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\buuzurzwa\lgkyjcoaoetg.exe"C:\buuzurzwa\lgkyjcoaoetg.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:14632
-
-
-
C:\buuzurzwa\lgkyjcoaoetg.exeC:\buuzurzwa\lgkyjcoaoetg.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:8904 -
C:\buuzurzwa\mthilmp.exemgkmxiladbda "c:\buuzurzwa\lgkyjcoaoetg.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:11776
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\buuzurzwa\ic3za724pjjexnm1sv.exe
- Size 416KB
- SHA256 9d4f674a30bf7a70de95fd25e86cfbafd31e132e430028c86c277f0790f732a9
- MD5 907996a80f9390c26cd161802591976c
- SHA1 445b8e7e3cd9cbb99d83cea6de1c223de0115951
- SHA512 4905d39ea36d78ddf332551b7d26d19829ee31d9834591e321876e8027e7aa2ed9f9e456660691d3848db7dcda397491f1633abed64607e228309456e83c0438
- SSDEEP 6144:HJSidiqUYMmKwvG7gkDGTXQ3M3QdGmnnhWSI/IjK0Dsml7CyRF:HJ3di6MmKlqTXQc3nEhWSIiKol+2F
- TLSH T10C945B007493C035D5B395F5CDB9A36245BCAA622BB499C3BFD8484D4AB84E1EB7231F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\buuzurzwa\sqj1yyizskxh
- Size 10B
- SHA256 4c93c842a8488484052903e1f383e69ee55805d8186781b5f5b6f17150d9cc8f
- MD5 6bf0b92284b37bcd48f636d74fd06378
- SHA1 011b218bd135fce95a9fb395ebc63d1229217e76
- SHA512 f4b57d6e50530d95d3bc2f25fba17b431f6ee9e129ca455da3cd66d481c11374e77fa7e53baba3cd30dd4d35c25556696f9cd31d7ad7d0fe517c6ab2dd0e10ce
- MD5 SHA1 SHA512
- Path C:\buuzurzwa\vixajf
- Size 4B
- SHA256 53069811046e01419566ef1e0235294df6df71096f85651009af606acdc2b36f
- MD5 65ba4e6da11c9617bf566a2eb3bda727
- SHA1 642a1941c9d8b3ea349e0726e871c64f37700ba4
- SHA512 44a8c3f36bc2a626af90ba791421cfcdaf8866caa588af1f9d66f23adba342dfb029ba16a7ba552f890cc95c2bdd668c0a39cf5801f8d87e2f433424a21dd442
- MD5 SHA1 SHA512