Analysis
- max time kernel
150s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system - submitted
11/05/2026, 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_e7c9ba34d7198c64396d49d747796024_bkransomware_elex_maze_remcos_stealc.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_e7c9ba34d7198c64396d49d747796024_bkransomware_elex_maze_remcos_stealc.exe
Resource
win11-20250502-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-05-11_e7c9ba34d7198c64396d49d747796024_bkransomware_elex_maze_remcos_stealc.exe
- Size 379KB
- Sample260511-e7h1xabt6y
- SHA256 0e6af804d018f468e179f14b218122e985a816773a63fbceea3e14f189565de1
- MD5 e7c9ba34d7198c64396d49d747796024
- SHA1 e3d931f5dbfaade5c73c42434c5eb62905120052
- SHA512 62427668608ec56dfd961fa8cb5c6f009d6598f9d46e2c5cb60eff41b6548e12c785414fdb745e652f548d89b33dbc411ac2814bacaf85d5220284e4b00c8a39
- SSDEEP 6144:H+HfuKeUahdhZgdd7kx4Yuc3llWzuaXzu2P4w8mAOHgQ90F3n7Avke:SG7XdhZGQyzc3lQpzu2P4V0H70d0r
- TLSH T1AA84AE20B6CB9032C46282FE0269F73265FE78B62B216DCB67D889CD46743D06637757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
pid Process 2624 rvr3z90u6nxyobzqck.exe 2324 gjpbeurnk.exe 1068 liarpgr.exe 3428 gjpbeurnk.exe 4060 liarpgr.exe - Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\qoxxljurs\rit3ygdpc gjpbeurnk.exe File created C:\Windows\qoxxljurs\rit3ygdpc liarpgr.exe File created C:\Windows\qoxxljurs\rit3ygdpc gjpbeurnk.exe File created C:\Windows\qoxxljurs\rit3ygdpc liarpgr.exe File created C:\Windows\qoxxljurs\rit3ygdpc 2026-05-11_e7c9ba34d7198c64396d49d747796024_bkransomware_elex_maze_remcos_stealc.exe File created C:\Windows\qoxxljurs\rit3ygdpc rvr3z90u6nxyobzqck.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvr3z90u6nxyobzqck.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gjpbeurnk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_e7c9ba34d7198c64396d49d747796024_bkransomware_elex_maze_remcos_stealc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2324 gjpbeurnk.exe 2324 gjpbeurnk.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 2324 gjpbeurnk.exe 1068 liarpgr.exe 2324 gjpbeurnk.exe 4060 liarpgr.exe 4060 liarpgr.exe 1068 liarpgr.exe 1068 liarpgr.exe 4060 liarpgr.exe 4060 liarpgr.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4088 wrote to memory of 2624 4088 2026-05-11_e7c9ba34d7198c64396d49d747796024_bkransomware_elex_maze_remcos_stealc.exe 78 PID 2324 wrote to memory of 1068 2324 gjpbeurnk.exe 80 PID 2624 wrote to memory of 3428 2624 rvr3z90u6nxyobzqck.exe 81 PID 2324 wrote to memory of 4060 2324 gjpbeurnk.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_e7c9ba34d7198c64396d49d747796024_bkransomware_elex_maze_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_e7c9ba34d7198c64396d49d747796024_bkransomware_elex_maze_remcos_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\qoxxljurs\rvr3z90u6nxyobzqck.exe"C:\qoxxljurs\rvr3z90u6nxyobzqck.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\qoxxljurs\gjpbeurnk.exe"C:\qoxxljurs\gjpbeurnk.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3428
-
-
-
C:\qoxxljurs\gjpbeurnk.exeC:\qoxxljurs\gjpbeurnk.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\qoxxljurs\liarpgr.exede8decyv6i7i "c:\qoxxljurs\gjpbeurnk.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1068
-
-
C:\qoxxljurs\liarpgr.exede8decyv6i7i "c:\qoxxljurs\gjpbeurnk.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4060
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\qoxxljurs\c9teempynu
- Size 4B
- SHA256 1c37743cb2c3b067b933e3b4b644187a8c5899e90d0d6dce78e026c4f5cdbd6d
- MD5 3d8c53676698ceb9d2372cd40e913b72
- SHA1 5531f28b51fe2a4b111db00f1121a9e43b64dc73
- SHA512 e297d0d1dc0ad08af9a6a2e7f838e7dd4d65e3d065eca025d7110e2e5282116af69c86fe1f27fe62126868bf7fa0d899535590a454bf5c0e8080171651f98563
- MD5 SHA1 SHA512
- Path C:\qoxxljurs\rit3ygdpc
- Size 11B
- SHA256 0492a5427b7ad6844532fffbce07a9c3e9a7d87ae8371ab33c9a75a732cd69f3
- MD5 d17f5af7696bb113c2366d61d704675b
- SHA1 1f49e947f6dd2e58e9c92342a979c93a0341cd3e
- SHA512 91dd3337c13ced2b788bb22b7f9342d00d1e7b33fde1add4f2e85ee26e85c9d53eb94ef630fd0c9626aa4ba2d58c5816b26011f2cf90a95e5c9fa00d1733ad10
- MD5 SHA1 SHA512
- Path C:\qoxxljurs\rvr3z90u6nxyobzqck.exe
- Size 379KB
- SHA256 0e6af804d018f468e179f14b218122e985a816773a63fbceea3e14f189565de1
- MD5 e7c9ba34d7198c64396d49d747796024
- SHA1 e3d931f5dbfaade5c73c42434c5eb62905120052
- SHA512 62427668608ec56dfd961fa8cb5c6f009d6598f9d46e2c5cb60eff41b6548e12c785414fdb745e652f548d89b33dbc411ac2814bacaf85d5220284e4b00c8a39
- SSDEEP 6144:H+HfuKeUahdhZgdd7kx4Yuc3llWzuaXzu2P4w8mAOHgQ90F3n7Avke:SG7XdhZGQyzc3lQpzu2P4V0H70d0r
- TLSH T1AA84AE20B6CB9032C46282FE0269F73265FE78B62B216DCB67D889CD46743D06637757
- MD5 SHA1 SHA512 SSDEEP TLSH