Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/05/2026, 03:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-16_a22c214661c6c2ba19c611f88b964ce4_bkransomware_elex_maze.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-16_a22c214661c6c2ba19c611f88b964ce4_bkransomware_elex_maze.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-05-16_a22c214661c6c2ba19c611f88b964ce4_bkransomware_elex_maze.exe
- Size 579KB
- Sample260516-ebhehady3m
- SHA256 59bd5366b3184c197e7bc565e8d866472fbe7a5546f3af6296429a95d0473e66
- MD5 a22c214661c6c2ba19c611f88b964ce4
- SHA1 1022e964861a58502b71c25cd2a28daef232f9e6
- SHA512 e77ff58e2d99de3c84f1f659958061cae37e451bc35329d0cc245570f1ba7cd783688e39e4fd51446e0a9fdbb39f2024081c3676b02188b61ee8a53388a6f3cd
- SSDEEP 12288:69oxnltt3HeZeghW6s+DCf16iD99jrBAbr9p7Zc7S:6e1cZPA16iD/jNA/L7ZW
- TLSH T119C48D10B563A1F3D8A269B3416DE63B1A357D720F298BE3EBCB4F1549F25C09633246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 4192 hy03z9xe1aiubkwyxncm.exe 3468 bljsangeqjf.exe 4232 vyzzzexfvxqg.exe 4344 bljsangeqjf.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\dhercixmepurqeh\qgssdvxhu bljsangeqjf.exe File created C:\Windows\dhercixmepurqeh\qgssdvxhu 2026-05-16_a22c214661c6c2ba19c611f88b964ce4_bkransomware_elex_maze.exe File created C:\Windows\dhercixmepurqeh\qgssdvxhu hy03z9xe1aiubkwyxncm.exe File created C:\Windows\dhercixmepurqeh\qgssdvxhu bljsangeqjf.exe File created C:\Windows\dhercixmepurqeh\qgssdvxhu vyzzzexfvxqg.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-16_a22c214661c6c2ba19c611f88b964ce4_bkransomware_elex_maze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hy03z9xe1aiubkwyxncm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bljsangeqjf.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3468 bljsangeqjf.exe 3468 bljsangeqjf.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe 4232 vyzzzexfvxqg.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 824 wrote to memory of 4192 824 2026-05-16_a22c214661c6c2ba19c611f88b964ce4_bkransomware_elex_maze.exe 88 PID 3468 wrote to memory of 4232 3468 bljsangeqjf.exe 90 PID 4192 wrote to memory of 4344 4192 hy03z9xe1aiubkwyxncm.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_a22c214661c6c2ba19c611f88b964ce4_bkransomware_elex_maze.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_a22c214661c6c2ba19c611f88b964ce4_bkransomware_elex_maze.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:824 -
C:\dhercixmepurqeh\hy03z9xe1aiubkwyxncm.exe"C:\dhercixmepurqeh\hy03z9xe1aiubkwyxncm.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\dhercixmepurqeh\bljsangeqjf.exe"C:\dhercixmepurqeh\bljsangeqjf.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4344
-
-
-
C:\dhercixmepurqeh\bljsangeqjf.exeC:\dhercixmepurqeh\bljsangeqjf.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\dhercixmepurqeh\vyzzzexfvxqg.exeefs0fkyassge "c:\dhercixmepurqeh\bljsangeqjf.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4232
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\dhercixmepurqeh\hy03z9xe1aiubkwyxncm.exe
- Size 579KB
- SHA256 59bd5366b3184c197e7bc565e8d866472fbe7a5546f3af6296429a95d0473e66
- MD5 a22c214661c6c2ba19c611f88b964ce4
- SHA1 1022e964861a58502b71c25cd2a28daef232f9e6
- SHA512 e77ff58e2d99de3c84f1f659958061cae37e451bc35329d0cc245570f1ba7cd783688e39e4fd51446e0a9fdbb39f2024081c3676b02188b61ee8a53388a6f3cd
- SSDEEP 12288:69oxnltt3HeZeghW6s+DCf16iD99jrBAbr9p7Zc7S:6e1cZPA16iD/jNA/L7ZW
- TLSH T119C48D10B563A1F3D8A269B3416DE63B1A357D720F298BE3EBCB4F1549F25C09633246
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\dhercixmepurqeh\qgssdvxhu
- Size 9B
- SHA256 06e563429869bffc1d9e5e43923b2f73453ee42a5410f4a83ba08bc42ddf0c07
- MD5 2d301d3891e1d9649c8dfbc380357f7a
- SHA1 4bd8cfc05cc81ce18ab24acb98220a3593451fd6
- SHA512 db90375853fb4c19a7e06bfb6e26e16d60075163bfc41a7bd5c97506d86b0c41e2a80310e97c99d94ed27c4e66e3b827c1ff73c5d8dedd46aafd8cb851a5d86f
- MD5 SHA1 SHA512