Analysis
- max time kernel
149s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 03:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_b2df86a8ebc29c44f186eaa0cd853dcb_bkransomware_elex_maze_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_b2df86a8ebc29c44f186eaa0cd853dcb_bkransomware_elex_maze_stealc.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-06-27_b2df86a8ebc29c44f186eaa0cd853dcb_bkransomware_elex_maze_stealc.exe
- Size 598KB
- Sample260629-ebjmkacv4y
- SHA256 8b0e0aaa5f9d46afcb9b6a460b75d957d92c5e973c45760079b3240d4fdfe5ac
- MD5 b2df86a8ebc29c44f186eaa0cd853dcb
- SHA1 b33be761ac7074e188990f21d982fb0aa6646394
- SHA512 d7a43991777045c2ff1c494a65e5e80ed4944788b0c4996a45c7cf578ecfbd1aaa3594abc9c91eb0b0d76aa7ee74d86db6dfb366b381c0fb8af7fac18a679dc3
- SSDEEP 12288:wEQbUL2F4WPlCSSsBjebq68ygW7RgHdDZ9XcMJEE09RNSA:wEwKg4WPlCSp0bD5xVgb9b/omA
- TLSH T151D4A1815A0A45AADCE67674002136E7F1346CE85F9017B6F2CCA1FC3B193AC1BD97E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 1316 w9dub3zaymbeutxjztuk.exe 3808 xiqqmjx.exe 4956 lpvmxoc.exe 1628 xiqqmjx.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\huuzfcogawgqztg\dqadjx8htl 2026-06-27_b2df86a8ebc29c44f186eaa0cd853dcb_bkransomware_elex_maze_stealc.exe File created C:\Windows\huuzfcogawgqztg\dqadjx8htl w9dub3zaymbeutxjztuk.exe File created C:\Windows\huuzfcogawgqztg\dqadjx8htl xiqqmjx.exe File created C:\Windows\huuzfcogawgqztg\dqadjx8htl lpvmxoc.exe File created C:\Windows\huuzfcogawgqztg\dqadjx8htl xiqqmjx.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xiqqmjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_b2df86a8ebc29c44f186eaa0cd853dcb_bkransomware_elex_maze_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w9dub3zaymbeutxjztuk.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3808 xiqqmjx.exe 3808 xiqqmjx.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe 4956 lpvmxoc.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3104 wrote to memory of 1316 3104 2026-06-27_b2df86a8ebc29c44f186eaa0cd853dcb_bkransomware_elex_maze_stealc.exe 89 PID 3808 wrote to memory of 4956 3808 xiqqmjx.exe 91 PID 1316 wrote to memory of 1628 1316 w9dub3zaymbeutxjztuk.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_b2df86a8ebc29c44f186eaa0cd853dcb_bkransomware_elex_maze_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_b2df86a8ebc29c44f186eaa0cd853dcb_bkransomware_elex_maze_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\huuzfcogawgqztg\w9dub3zaymbeutxjztuk.exe"C:\huuzfcogawgqztg\w9dub3zaymbeutxjztuk.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\huuzfcogawgqztg\xiqqmjx.exe"C:\huuzfcogawgqztg\xiqqmjx.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1628
-
-
-
C:\huuzfcogawgqztg\xiqqmjx.exeC:\huuzfcogawgqztg\xiqqmjx.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\huuzfcogawgqztg\lpvmxoc.exezswblalloj7v "c:\huuzfcogawgqztg\xiqqmjx.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4956
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\huuzfcogawgqztg\dqadjx8htl
- Size 11B
- SHA256 553d54b2ee2889bcb09a1a4d35e0b9ec644ef4754f808c39d027f84c1c09cabd
- MD5 38c601ec3286ac71b9441b73b7bc83ff
- SHA1 2d55ccc67b38c8d4236e7c8b232c9da0b2486d6a
- SHA512 ac0c2b31d3c79efa8da63a532151a82b34ff7df5b61f40cca8c4bb55e982420ab7e7ff184679277458873d51e87705357db98159f02109a9bec4d7346b28095e
- MD5 SHA1 SHA512
- Path C:\huuzfcogawgqztg\fujergqqz
- Size 4B
- SHA256 75e4f9ef94531faa9f94adee8231a1f463e770fc48b69f7d5ef9b94cadf8942e
- MD5 de7af11cabc0afde740d32d12b0ec6c6
- SHA1 51975af28d3d8c2d9234bc541981f2dcb9b7b909
- SHA512 8b1054f579116cfebb751333185505d9d35ab0f22cdb8d43ade5503434be8e99837d9a53d6dfdef46e9c56354342e802fb8696ab4755cdc84686920cfd509139
- MD5 SHA1 SHA512
- Path C:\huuzfcogawgqztg\w9dub3zaymbeutxjztuk.exe
- Size 598KB
- SHA256 8b0e0aaa5f9d46afcb9b6a460b75d957d92c5e973c45760079b3240d4fdfe5ac
- MD5 b2df86a8ebc29c44f186eaa0cd853dcb
- SHA1 b33be761ac7074e188990f21d982fb0aa6646394
- SHA512 d7a43991777045c2ff1c494a65e5e80ed4944788b0c4996a45c7cf578ecfbd1aaa3594abc9c91eb0b0d76aa7ee74d86db6dfb366b381c0fb8af7fac18a679dc3
- SSDEEP 12288:wEQbUL2F4WPlCSSsBjebq68ygW7RgHdDZ9XcMJEE09RNSA:wEwKg4WPlCSp0bD5xVgb9b/omA
- TLSH T151D4A1815A0A45AADCE67674002136E7F1346CE85F9017B6F2CCA1FC3B193AC1BD97E6
- MD5 SHA1 SHA512 SSDEEP TLSH