1194995c79eb2e3eb5015d627891e05d5ece75aa7d5e689594e0305c34c6484f

General

Target
2026-05-28_57d03f7517fd9b99f9330a3d8b256e01_bkransomware_elex_maze_rhadamanthys.exe
Size 332KB
Sample260528-s8ea1ady6n
SHA256 1194995c79eb2e3eb5015d627891e05d5ece75aa7d5e689594e0305c34c6484f
MD5 57d03f7517fd9b99f9330a3d8b256e01
SHA1 818c308f1baedd75a9c877eb545fb0f2badeb170
SHA512 cfda64a00c03dd89f6e6b8aa02a7c91498f4c1101f14707546a258317d020761167e3d7f1502acd1d011e037db8b5ff60870e891262d806f64fd2c8b8153b792
SSDEEP 6144:hZMazVFrqQox3I5W+cizrs4GKKFvxHL1EoJ4QRtmoYplNurHa1IEY:hS0ReIKoNGxxr6mJLmoclNAHaWEY
TLSH
T1C8740113B2C1A1B2F0B7423215A58EA507AFBC754E758C073B98718D0E766D14F3ABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3824	KzaD2Rn2M9jIuXK.exe
3296	CTS.exe
4880	CTS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2026-05-28_57d03f7517fd9b99f9330a3d8b256e01_bkransomware_elex_maze_rhadamanthys.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	2026-05-28_57d03f7517fd9b99f9330a3d8b256e01_bkransomware_elex_maze_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_57d03f7517fd9b99f9330a3d8b256e01_bkransomware_elex_maze_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	2026-05-28_57d03f7517fd9b99f9330a3d8b256e01_bkransomware_elex_maze_rhadamanthys.exe
Token: SeDebugPrivilege	3296	CTS.exe
Token: SeDebugPrivilege	4880	CTS.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3824	2168	2026-05-28_57d03f7517fd9b99f9330a3d8b256e01_bkransomware_elex_maze_rhadamanthys.exe	81
PID 2168 wrote to memory of 3296	2168	2026-05-28_57d03f7517fd9b99f9330a3d8b256e01_bkransomware_elex_maze_rhadamanthys.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-05-28_57d03f7517fd9b99f9330a3d8b256e01_bkransomware_elex_maze_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_57d03f7517fd9b99f9330a3d8b256e01_bkransomware_elex_maze_rhadamanthys.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\KzaD2Rn2M9jIuXK.exe
  C:\Users\Admin\AppData\Local\Temp\KzaD2Rn2M9jIuXK.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3296

C:\Windows\CTS.exe
C:\Windows\CTS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 393KB
SHA256 d9958f1268e004a53731b6c78b9e11ed60459183d7bd0629012e474e9d1219bd
MD5 9822bc709afbd2e6bee3fb0b4e7bb50c
SHA1 6c8dd1addf242453b22e3593607fd573b4663596
SHA512 dca186e4f4b8d3e6442a8d325778da626ff232338ca721ad0d358e5647ba380d8b62fae5afdd4229bbf0187ccd39a8e76133a4ee08d7ba373f02b919895791ef
SSDEEP 6144:hZMazzKnEiWLfjKqShBj1cOP65GJRW4sc48xPgH6nP2VLDT4rI9M0tlsaO:hS0zfPEj1cOP6P4t485Q6Y9Ztly
TLSH
T16B8412037AD6C674E8F24672856CDE804BAF7EB14EB1CD573388A45D89750C05E3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KzaD2Rn2M9jIuXK.exe

Path C:\Users\Admin\AppData\Local\Temp\KzaD2Rn2M9jIuXK.exe
Size 261KB
SHA256 3052784f3683c2bbe95f59560eb311e75f1eac7aa5476a91bbd9fe4d2aef880a
MD5 9dce6a120d094e5c925b967c4bb36277
SHA1 1ab60840e8d8ed14619fab2d1559f989f01f01a9
SHA512 20a7a4b8ecb1262ed730c8299ad0ada2ad93327f0886e5fdefc89564ff7510595ec53ac5aa88747e0548315c3037125d83756e3ae4d9a813cc553c12991c94df
SSDEEP 6144:sZJsPeFfFKPNrOYZ63KuH9q08IrL5vYle:GJsPeFfFKPNpZykpI59
TLSH
T14E445A46379900E4D0B28134877747E2AB3D7D255792D68E13D47B66EE3F280FD2AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 71KB
SHA256 075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163
MD5 66df4ffab62e674af2e75b163563fc0b
SHA1 dec8a197312e41eeb3cfef01cb2a443f0205cd6e
SHA512 1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25
SSDEEP 1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazT:ZhpAyazIlyazT
TLSH
T119636B03B6D2C171E4B70A7649B8CE51067FBE765EB18D5B33C4218E49752C08E3ABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads