Analysis
- max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/05/2026, 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-23_1c327f29f08fe8ff1e792d2a81fbdc16_bkransomware_elex_maze.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-23_1c327f29f08fe8ff1e792d2a81fbdc16_bkransomware_elex_maze.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-05-23_1c327f29f08fe8ff1e792d2a81fbdc16_bkransomware_elex_maze.exe
- Size 503KB
- Sample260523-ecl43sez31
- SHA256 b2b72e54e23a4d2a0a85e8dcebd5d471fce2e4a5c3b990f8dc270253f702458d
- MD5 1c327f29f08fe8ff1e792d2a81fbdc16
- SHA1 1d5215a19882332080fe364c7de719c7f7ed8a51
- SHA512 a78412dfed4dd1e8c34243cf79a67dded34b4f349b4cf8045660b67d4216d68684aec4ca4c82a7b6d8ae96ea47a3d852aa732130840eea4151e41b42b14422e5
- SSDEEP 12288:wz+Zlv6G6T8YmOATlDs2MlYd1E/aFrXi:wzKvmFmOATl42Mad+yFrS
- TLSH T14CB47D11A483E2B3D41601F672BFF23A2A317D790B2689E3F7871E1589F15B19932673
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 3332 tral3z9ybwtltavxdm9.exe 2180 hjtxnifcxe.exe 2496 zbvdinth.exe 3692 hjtxnifcxe.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\cvnhluxhami\ks5fgsdhv 2026-05-23_1c327f29f08fe8ff1e792d2a81fbdc16_bkransomware_elex_maze.exe File created C:\Windows\cvnhluxhami\ks5fgsdhv tral3z9ybwtltavxdm9.exe File created C:\Windows\cvnhluxhami\ks5fgsdhv hjtxnifcxe.exe File created C:\Windows\cvnhluxhami\ks5fgsdhv zbvdinth.exe File created C:\Windows\cvnhluxhami\ks5fgsdhv hjtxnifcxe.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-23_1c327f29f08fe8ff1e792d2a81fbdc16_bkransomware_elex_maze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tral3z9ybwtltavxdm9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjtxnifcxe.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2180 hjtxnifcxe.exe 2180 hjtxnifcxe.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe 2496 zbvdinth.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4444 wrote to memory of 3332 4444 2026-05-23_1c327f29f08fe8ff1e792d2a81fbdc16_bkransomware_elex_maze.exe 80 PID 2180 wrote to memory of 2496 2180 hjtxnifcxe.exe 82 PID 3332 wrote to memory of 3692 3332 tral3z9ybwtltavxdm9.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_1c327f29f08fe8ff1e792d2a81fbdc16_bkransomware_elex_maze.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_1c327f29f08fe8ff1e792d2a81fbdc16_bkransomware_elex_maze.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\cvnhluxhami\tral3z9ybwtltavxdm9.exe"C:\cvnhluxhami\tral3z9ybwtltavxdm9.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\cvnhluxhami\hjtxnifcxe.exe"C:\cvnhluxhami\hjtxnifcxe.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3692
-
-
-
C:\cvnhluxhami\hjtxnifcxe.exeC:\cvnhluxhami\hjtxnifcxe.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\cvnhluxhami\zbvdinth.exeootqupuxrake "c:\cvnhluxhami\hjtxnifcxe.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2496
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\cvnhluxhami\ks5fgsdhv
- Size 9B
- SHA256 12db029bf63076f08b2a6b2759c32724b6865f679809285d818b3d7abe46f806
- MD5 cec542c6b8407fd30692112a2c57f03f
- SHA1 5c90ecc62cb14551937884b093de1e57e7496ad8
- SHA512 55df4fcfbd6b47f25bf9307f59e967b4394f46a9832a6987e60094de43712843d35615833a6411f42a5ad1a825e8d86272fa3164bd259e4d8fc1915d905ce681
- MD5 SHA1 SHA512
- Path C:\cvnhluxhami\tral3z9ybwtltavxdm9.exe
- Size 503KB
- SHA256 b2b72e54e23a4d2a0a85e8dcebd5d471fce2e4a5c3b990f8dc270253f702458d
- MD5 1c327f29f08fe8ff1e792d2a81fbdc16
- SHA1 1d5215a19882332080fe364c7de719c7f7ed8a51
- SHA512 a78412dfed4dd1e8c34243cf79a67dded34b4f349b4cf8045660b67d4216d68684aec4ca4c82a7b6d8ae96ea47a3d852aa732130840eea4151e41b42b14422e5
- SSDEEP 12288:wz+Zlv6G6T8YmOATlDs2MlYd1E/aFrXi:wzKvmFmOATl42Mad+yFrS
- TLSH T14CB47D11A483E2B3D41601F672BFF23A2A317D790B2689E3F7871E1589F15B19932673
- MD5 SHA1 SHA512 SSDEEP TLSH