Analysis
- max time kernel
150s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/06/2026, 01:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-01_a346cde0e4ed718fc2d456a0228fc52e_elex_maze_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-01_a346cde0e4ed718fc2d456a0228fc52e_elex_maze_stealc.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-06-01_a346cde0e4ed718fc2d456a0228fc52e_elex_maze_stealc.exe
- Size 509KB
- Sample260601-b8fqdsbt2s
- SHA256 dec31693fa28a8fef18a086012290ddc0f11ed8316b0e603e6b9be47f380d2d6
- MD5 a346cde0e4ed718fc2d456a0228fc52e
- SHA1 771c0f18f988cf3838f82ebb86b655a046cb1465
- SHA512 c0a76794fccf4cee1ff908b4f012027469e15429e5b254a49657169142e487e6d59b1e08a3a70c137c950e10b37a967e6a3b72056fe1794a7a0470f695e86163
- SSDEEP 6144:/URyeNotL2eiBICWDNgGuCFdb22gib92XFleGzVzw0DQyi2:cw2otSVICwSGJnb22gib9MFlFzG0Dq2
- TLSH T185B40988B4A6E0E5D59791701AAD328726281EB013B4C7EB2F8018DC87DD5D12DF7EB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 2564 uff3za4o7hdxnlcuwm2.exe 5500 teyycrhenlr.exe 6612 zoypdpzhcqh.exe 7756 teyycrhenlr.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\ogrmuxgnb\dlouwplnd6 zoypdpzhcqh.exe File created C:\Windows\ogrmuxgnb\dlouwplnd6 2026-06-01_a346cde0e4ed718fc2d456a0228fc52e_elex_maze_stealc.exe File created C:\Windows\ogrmuxgnb\dlouwplnd6 uff3za4o7hdxnlcuwm2.exe File created C:\Windows\ogrmuxgnb\dlouwplnd6 teyycrhenlr.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2620 7756 WerFault.exe 83 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-01_a346cde0e4ed718fc2d456a0228fc52e_elex_maze_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uff3za4o7hdxnlcuwm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language teyycrhenlr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5500 teyycrhenlr.exe 5500 teyycrhenlr.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe 6612 zoypdpzhcqh.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4580 wrote to memory of 2564 4580 2026-06-01_a346cde0e4ed718fc2d456a0228fc52e_elex_maze_stealc.exe 80 PID 5500 wrote to memory of 6612 5500 teyycrhenlr.exe 82 PID 2564 wrote to memory of 7756 2564 uff3za4o7hdxnlcuwm2.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-01_a346cde0e4ed718fc2d456a0228fc52e_elex_maze_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-01_a346cde0e4ed718fc2d456a0228fc52e_elex_maze_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\ogrmuxgnb\uff3za4o7hdxnlcuwm2.exe"C:\ogrmuxgnb\uff3za4o7hdxnlcuwm2.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\ogrmuxgnb\teyycrhenlr.exe"C:\ogrmuxgnb\teyycrhenlr.exe"3⤵
- Executes dropped EXE
PID:7756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7756 -s 3404⤵
- Program crash
PID:2620
-
-
-
-
C:\ogrmuxgnb\teyycrhenlr.exeC:\ogrmuxgnb\teyycrhenlr.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\ogrmuxgnb\zoypdpzhcqh.exedjetbjeqitxr "c:\ogrmuxgnb\teyycrhenlr.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:6612
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7756 -ip 77561⤵PID:2148
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ogrmuxgnb\dlouwplnd6
- Size 9B
- SHA256 9abcbbffa816fe466831d876c98a6e28e8ee2eb0239bfaad54d19e7cb5c4a09c
- MD5 8bc9b00dd8561f2eab2acac40dcfd691
- SHA1 153ed293bbdf7d6f9c2ab7d84cd5c6de1a86c9e1
- SHA512 1086808644451b9bed6f3a06849290c550e1b1a3f9432fe6a6a00e3a6d96c0358bcd7291d31c0e6145b08bce807a1d5b9f57406b5599b3120cb6936170b5ec34
- MD5 SHA1 SHA512
- Path C:\ogrmuxgnb\hslhmhigaq
- Size 4B
- SHA256 469135bf16a7010aea37702c875a9f1c756a6f6c0ac0bcbc9e7b9a807eb682fd
- MD5 e2fba9fcf43dbdf0798ef6d0774aab5e
- SHA1 66a10ea1653f0ea6560cdcda83ee98534b306ec0
- SHA512 30d54ad3de91664d04748f9b36dfbe1051192fe09a3106bae2577494a058b8de92d1274f9e07d6b746221626009b5c88eca98ef5bee3ee098e373544d69c7603
- MD5 SHA1 SHA512
- Path C:\ogrmuxgnb\uff3za4o7hdxnlcuwm2.exe
- Size 509KB
- SHA256 dec31693fa28a8fef18a086012290ddc0f11ed8316b0e603e6b9be47f380d2d6
- MD5 a346cde0e4ed718fc2d456a0228fc52e
- SHA1 771c0f18f988cf3838f82ebb86b655a046cb1465
- SHA512 c0a76794fccf4cee1ff908b4f012027469e15429e5b254a49657169142e487e6d59b1e08a3a70c137c950e10b37a967e6a3b72056fe1794a7a0470f695e86163
- SSDEEP 6144:/URyeNotL2eiBICWDNgGuCFdb22gib92XFleGzVzw0DQyi2:cw2otSVICwSGJnb22gib9MFlFzG0Dq2
- TLSH T185B40988B4A6E0E5D59791701AAD328726281EB013B4C7EB2F8018DC87DD5D12DF7EB7
- MD5 SHA1 SHA512 SSDEEP TLSH