Analysis
- max time kernel
150s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 09:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_7c450d80b8ae98e0364f79d7494b2dfc_bkransomware_elex_maze_remcos_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_7c450d80b8ae98e0364f79d7494b2dfc_bkransomware_elex_maze_remcos_stealc.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-01_7c450d80b8ae98e0364f79d7494b2dfc_bkransomware_elex_maze_remcos_stealc.exe
- Size 373KB
- Sample260701-lax7wsav3m
- SHA256 156557add741a02ba36d97a6e3476b030311eaef3caa5773a9befe8c3f1ccf7d
- MD5 7c450d80b8ae98e0364f79d7494b2dfc
- SHA1 636fff95c850c83533ad0e258af5a2b2d39df572
- SHA512 8a0a69440be98d60130b117882dabd322b0520078226ff51840437c5cdd9b63e6369a713deef4abed4a02c83a411f1d95c966c8b79f001ca1e8b16d281059a83
- SSDEEP 6144:Hiun7Hh8KpO3rgjm0Kf6HzTsCcd1ND50TBn9CmgxVt:ZNpO3roKSkCcdrDuTDC/xVt
- TLSH T1E584AE21B6C69032C06282FE6264F77164FEB8F27F656ADB67D84ACE45702C06237753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 5860 jqbpt3zajmtt2kobvhwcrmt.exe 5932 pvuwltojmsmx.exe 5616 nlgbxvvcnwgl.exe 2740 pvuwltojmsmx.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\ncreiwyfsbrvxpk\rn8snze nlgbxvvcnwgl.exe File created C:\Windows\ncreiwyfsbrvxpk\rn8snze pvuwltojmsmx.exe File created C:\Windows\ncreiwyfsbrvxpk\rn8snze 2026-07-01_7c450d80b8ae98e0364f79d7494b2dfc_bkransomware_elex_maze_remcos_stealc.exe File created C:\Windows\ncreiwyfsbrvxpk\rn8snze jqbpt3zajmtt2kobvhwcrmt.exe File created C:\Windows\ncreiwyfsbrvxpk\rn8snze pvuwltojmsmx.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-01_7c450d80b8ae98e0364f79d7494b2dfc_bkransomware_elex_maze_remcos_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jqbpt3zajmtt2kobvhwcrmt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvuwltojmsmx.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5932 pvuwltojmsmx.exe 5932 pvuwltojmsmx.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5932 pvuwltojmsmx.exe 5932 pvuwltojmsmx.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5932 pvuwltojmsmx.exe 5932 pvuwltojmsmx.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5932 pvuwltojmsmx.exe 5932 pvuwltojmsmx.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5616 nlgbxvvcnwgl.exe 5932 pvuwltojmsmx.exe 5932 pvuwltojmsmx.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 7144 wrote to memory of 5860 7144 2026-07-01_7c450d80b8ae98e0364f79d7494b2dfc_bkransomware_elex_maze_remcos_stealc.exe 89 PID 5932 wrote to memory of 5616 5932 pvuwltojmsmx.exe 91 PID 5860 wrote to memory of 2740 5860 jqbpt3zajmtt2kobvhwcrmt.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_7c450d80b8ae98e0364f79d7494b2dfc_bkransomware_elex_maze_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_7c450d80b8ae98e0364f79d7494b2dfc_bkransomware_elex_maze_remcos_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7144 -
C:\ncreiwyfsbrvxpk\jqbpt3zajmtt2kobvhwcrmt.exe"C:\ncreiwyfsbrvxpk\jqbpt3zajmtt2kobvhwcrmt.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\ncreiwyfsbrvxpk\pvuwltojmsmx.exe"C:\ncreiwyfsbrvxpk\pvuwltojmsmx.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2740
-
-
-
C:\ncreiwyfsbrvxpk\pvuwltojmsmx.exeC:\ncreiwyfsbrvxpk\pvuwltojmsmx.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\ncreiwyfsbrvxpk\nlgbxvvcnwgl.exeexnxaqsevyoi "c:\ncreiwyfsbrvxpk\pvuwltojmsmx.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:5616
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ncreiwyfsbrvxpk\jqbpt3zajmtt2kobvhwcrmt.exe
- Size 373KB
- SHA256 156557add741a02ba36d97a6e3476b030311eaef3caa5773a9befe8c3f1ccf7d
- MD5 7c450d80b8ae98e0364f79d7494b2dfc
- SHA1 636fff95c850c83533ad0e258af5a2b2d39df572
- SHA512 8a0a69440be98d60130b117882dabd322b0520078226ff51840437c5cdd9b63e6369a713deef4abed4a02c83a411f1d95c966c8b79f001ca1e8b16d281059a83
- SSDEEP 6144:Hiun7Hh8KpO3rgjm0Kf6HzTsCcd1ND50TBn9CmgxVt:ZNpO3roKSkCcdrDuTDC/xVt
- TLSH T1E584AE21B6C69032C06282FE6264F77164FEB8F27F656ADB67D84ACE45702C06237753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ncreiwyfsbrvxpk\mwitfc
- Size 4B
- SHA256 08d179c5a68945243ed67ad8b478fbd4837e96a01e32bd2945db4b4d3848150e
- MD5 11186b1ba17536cc48ea1a86c602d075
- SHA1 10ec29877d192ddf548a39cc764e7e80b550631f
- SHA512 b7c4d4683bd6dda8d6721c9228a8bacd9b0b318384511480e7bcc320ce5844532663946bcbe907218a8aa3c69b82f29e259d5f8ee97058caa60edcd7a214d819
- MD5 SHA1 SHA512
- Path C:\ncreiwyfsbrvxpk\rn8snze
- Size 11B
- SHA256 fba1368b9f5ce35fcfc03b049c69746e08bd543eef57a3f6f8f7eb8d20683490
- MD5 4ed86728979c60ebb42fa9685494ee90
- SHA1 a367b8bdfd268bcc6152019f5dc49bdf313b286d
- SHA512 c6001ed6f015dd282d28dd6dc31fa1aa1c346fb4d6722d9fd2c77eafdbb401ae705b02b561226d03525bea284644b620b347696430f0c00ce24031dab49fdbe6
- MD5 SHA1 SHA512