Analysis
- max time kernel
149s - max time network
145s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 04:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-04_7625b2c038a2ff419167d1462af5523c_bkransomware_elex_maze.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_7625b2c038a2ff419167d1462af5523c_bkransomware_elex_maze.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-06-04_7625b2c038a2ff419167d1462af5523c_bkransomware_elex_maze.exe
- Size 559KB
- Sample260604-emm45aay2l
- SHA256 b4e31a24cb5a6bdfdd1721c0379689a24e2cfd8eca53272f0c7714bc82afd59a
- MD5 7625b2c038a2ff419167d1462af5523c
- SHA1 917b1e8cdd0c0b3915fc61a56ca20a2bcb92aa68
- SHA512 27299a3ed67ae8b5e3f4b004a731d442c8a18659ca553640886d4fa2be671f06d359fc722a7e139e0bedbfa4778446e466417bdadee77f0176dd2b2602dc2a7d
- SSDEEP 12288:3sA4m//Ty6FIdS2Nj6CVaueOQ5n9ix2VmgtR6:3s/m//TyMIdP60axOiAxEm
- TLSH T1C3C48E11B583A2B3D42215F3426DE63A2A357D760F2DCBE3E7C70E2658F35C09632656
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 3820 giqv3za9typt9whqyqcwgkf.exe 4496 bxmctllqoau.exe 1760 hfqmxtt.exe 1532 bxmctllqoau.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\atademtftlcwq\xmouune 2026-06-04_7625b2c038a2ff419167d1462af5523c_bkransomware_elex_maze.exe File created C:\Windows\atademtftlcwq\xmouune giqv3za9typt9whqyqcwgkf.exe File created C:\Windows\atademtftlcwq\xmouune bxmctllqoau.exe File created C:\Windows\atademtftlcwq\xmouune hfqmxtt.exe File created C:\Windows\atademtftlcwq\xmouune bxmctllqoau.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_7625b2c038a2ff419167d1462af5523c_bkransomware_elex_maze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language giqv3za9typt9whqyqcwgkf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxmctllqoau.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4496 bxmctllqoau.exe 4496 bxmctllqoau.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe 1760 hfqmxtt.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3180 wrote to memory of 3820 3180 2026-06-04_7625b2c038a2ff419167d1462af5523c_bkransomware_elex_maze.exe 81 PID 4496 wrote to memory of 1760 4496 bxmctllqoau.exe 83 PID 3820 wrote to memory of 1532 3820 giqv3za9typt9whqyqcwgkf.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_7625b2c038a2ff419167d1462af5523c_bkransomware_elex_maze.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_7625b2c038a2ff419167d1462af5523c_bkransomware_elex_maze.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\atademtftlcwq\giqv3za9typt9whqyqcwgkf.exe"C:\atademtftlcwq\giqv3za9typt9whqyqcwgkf.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\atademtftlcwq\bxmctllqoau.exe"C:\atademtftlcwq\bxmctllqoau.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1532
-
-
-
C:\atademtftlcwq\bxmctllqoau.exeC:\atademtftlcwq\bxmctllqoau.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\atademtftlcwq\hfqmxtt.execvguosxdnmnm "c:\atademtftlcwq\bxmctllqoau.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1760
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\atademtftlcwq\giqv3za9typt9whqyqcwgkf.exe
- Size 559KB
- SHA256 b4e31a24cb5a6bdfdd1721c0379689a24e2cfd8eca53272f0c7714bc82afd59a
- MD5 7625b2c038a2ff419167d1462af5523c
- SHA1 917b1e8cdd0c0b3915fc61a56ca20a2bcb92aa68
- SHA512 27299a3ed67ae8b5e3f4b004a731d442c8a18659ca553640886d4fa2be671f06d359fc722a7e139e0bedbfa4778446e466417bdadee77f0176dd2b2602dc2a7d
- SSDEEP 12288:3sA4m//Ty6FIdS2Nj6CVaueOQ5n9ix2VmgtR6:3s/m//TyMIdP60axOiAxEm
- TLSH T1C3C48E11B583A2B3D42215F3426DE63A2A357D760F2DCBE3E7C70E2658F35C09632656
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\atademtftlcwq\xmouune
- Size 11B
- SHA256 11a7de7d417add4d049f7fa2200aa831794cea121bd4f76b1e3e205dea0b6051
- MD5 2de460cf56a3b3bae7113c4665bc8fcd
- SHA1 6e59e6b2bb49cadddb525cc705182d56e6a10c03
- SHA512 00ec02d7c91aa7b22ae834d7f2f9957df105b56069a4a11a1792e06eaa5407612d6b5e296eb31da428dd2554dd03d560a892e313fc1a180df5391c5a4803d21e
- MD5 SHA1 SHA512