Analysis
- max time kernel
150s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 15:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc.exe
- Size 416KB
- Sample260423-sn6jragz21
- SHA256 9d4f674a30bf7a70de95fd25e86cfbafd31e132e430028c86c277f0790f732a9
- MD5 907996a80f9390c26cd161802591976c
- SHA1 445b8e7e3cd9cbb99d83cea6de1c223de0115951
- SHA512 4905d39ea36d78ddf332551b7d26d19829ee31d9834591e321876e8027e7aa2ed9f9e456660691d3848db7dcda397491f1633abed64607e228309456e83c0438
- SSDEEP 6144:HJSidiqUYMmKwvG7gkDGTXQ3M3QdGmnnhWSI/IjK0Dsml7CyRF:HJ3di6MmKlqTXQc3nEhWSIiKol+2F
- TLSH T10C945B007493C035D5B395F5CDB9A36245BCAA622BB499C3BFD8484D4AB84E1EB7231F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 932 ic3z9zu5pjjexnm1sv.exe 8988 lgkyjcoaoetg.exe 11872 mthilmp.exe 14736 lgkyjcoaoetg.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\buuzurzwa\sqj1yyizskxh lgkyjcoaoetg.exe File created C:\Windows\buuzurzwa\sqj1yyizskxh 2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc.exe File created C:\Windows\buuzurzwa\sqj1yyizskxh ic3z9zu5pjjexnm1sv.exe File created C:\Windows\buuzurzwa\sqj1yyizskxh lgkyjcoaoetg.exe File created C:\Windows\buuzurzwa\sqj1yyizskxh mthilmp.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ic3z9zu5pjjexnm1sv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lgkyjcoaoetg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 8988 lgkyjcoaoetg.exe 8988 lgkyjcoaoetg.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 8988 lgkyjcoaoetg.exe 8988 lgkyjcoaoetg.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 8988 lgkyjcoaoetg.exe 8988 lgkyjcoaoetg.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 8988 lgkyjcoaoetg.exe 8988 lgkyjcoaoetg.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 8988 lgkyjcoaoetg.exe 8988 lgkyjcoaoetg.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 8988 lgkyjcoaoetg.exe 8988 lgkyjcoaoetg.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 8988 lgkyjcoaoetg.exe 8988 lgkyjcoaoetg.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 8988 lgkyjcoaoetg.exe 8988 lgkyjcoaoetg.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe 11872 mthilmp.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4940 wrote to memory of 932 4940 2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc.exe 79 PID 8988 wrote to memory of 11872 8988 lgkyjcoaoetg.exe 81 PID 932 wrote to memory of 14736 932 ic3z9zu5pjjexnm1sv.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\buuzurzwa\ic3z9zu5pjjexnm1sv.exe"C:\buuzurzwa\ic3z9zu5pjjexnm1sv.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:932 -
C:\buuzurzwa\lgkyjcoaoetg.exe"C:\buuzurzwa\lgkyjcoaoetg.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:14736
-
-
-
C:\buuzurzwa\lgkyjcoaoetg.exeC:\buuzurzwa\lgkyjcoaoetg.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:8988 -
C:\buuzurzwa\mthilmp.exemgkmxiladbda "c:\buuzurzwa\lgkyjcoaoetg.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:11872
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\buuzurzwa\ic3z9zu5pjjexnm1sv.exe
- Size 416KB
- SHA256 9d4f674a30bf7a70de95fd25e86cfbafd31e132e430028c86c277f0790f732a9
- MD5 907996a80f9390c26cd161802591976c
- SHA1 445b8e7e3cd9cbb99d83cea6de1c223de0115951
- SHA512 4905d39ea36d78ddf332551b7d26d19829ee31d9834591e321876e8027e7aa2ed9f9e456660691d3848db7dcda397491f1633abed64607e228309456e83c0438
- SSDEEP 6144:HJSidiqUYMmKwvG7gkDGTXQ3M3QdGmnnhWSI/IjK0Dsml7CyRF:HJ3di6MmKlqTXQc3nEhWSIiKol+2F
- TLSH T10C945B007493C035D5B395F5CDB9A36245BCAA622BB499C3BFD8484D4AB84E1EB7231F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\buuzurzwa\sqj1yyizskxh
- Size 10B
- SHA256 4c93c842a8488484052903e1f383e69ee55805d8186781b5f5b6f17150d9cc8f
- MD5 6bf0b92284b37bcd48f636d74fd06378
- SHA1 011b218bd135fce95a9fb395ebc63d1229217e76
- SHA512 f4b57d6e50530d95d3bc2f25fba17b431f6ee9e129ca455da3cd66d481c11374e77fa7e53baba3cd30dd4d35c25556696f9cd31d7ad7d0fe517c6ab2dd0e10ce
- MD5 SHA1 SHA512
- Path C:\buuzurzwa\vixajf
- Size 4B
- SHA256 60b675f0dc785826f2003cb2063a6a3ab28a19d517d4ff8dd53e5d142a263d69
- MD5 7b7e3893c424b5f06bf84fec2ebabe37
- SHA1 32b9af2a25265475f5bdae763c521b5b1e09c325
- SHA512 24f9f1fb417ea94478a78f5ab13347e11ea1ff670908f5d05f9178a40e15a1eec6a042419e3acb80d8b9674b92c1244d3d9e362b8425da22e4d22eea64330ea3
- MD5 SHA1 SHA512