Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 03:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_7b56655b41745689784229ddc83f8a67_bkransomware_elex_maze_remcos_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_7b56655b41745689784229ddc83f8a67_bkransomware_elex_maze_remcos_stealc.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-02_7b56655b41745689784229ddc83f8a67_bkransomware_elex_maze_remcos_stealc.exe
- Size 660KB
- Sample260702-d95f9abw2z
- SHA256 8682192c7fdfb66e8db76e37f07985d3a15affdb7ec5d85f1af44c55f6bc9f61
- MD5 7b56655b41745689784229ddc83f8a67
- SHA1 6d6cf65c806d5faca85752ab0a52f38be0d864b4
- SHA512 060501a8b3029e58533f5ff9bf046ad88a63c19915b1af66b9087c0f1e0e85067b14e75275c3c159af0eacec162bd65b4bc01672b82fc66badda3e67321bf5a4
- SSDEEP 12288:ZKH11tQxjpjbMPjmyCU29kxczDmDytDDXTY6CMyQ19X:ZKH11sNjbyjtCU2QcW6DzwQ
- TLSH T17FE4AD11B563A1F3D42224B74159F73A2A397D764F698BE3EBC75E2648F21C09A33213
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 5332 sr3zas4tdknnfjp70.exe 2416 ahjtiwz.exe 2480 xxslypurgh.exe 2724 ahjtiwz.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\mtczpbinopm\gspvofwt xxslypurgh.exe File created C:\Windows\mtczpbinopm\gspvofwt ahjtiwz.exe File created C:\Windows\mtczpbinopm\gspvofwt 2026-07-02_7b56655b41745689784229ddc83f8a67_bkransomware_elex_maze_remcos_stealc.exe File created C:\Windows\mtczpbinopm\gspvofwt sr3zas4tdknnfjp70.exe File created C:\Windows\mtczpbinopm\gspvofwt ahjtiwz.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_7b56655b41745689784229ddc83f8a67_bkransomware_elex_maze_remcos_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sr3zas4tdknnfjp70.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ahjtiwz.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2416 ahjtiwz.exe 2416 ahjtiwz.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe 2480 xxslypurgh.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5804 wrote to memory of 5332 5804 2026-07-02_7b56655b41745689784229ddc83f8a67_bkransomware_elex_maze_remcos_stealc.exe 88 PID 2416 wrote to memory of 2480 2416 ahjtiwz.exe 90 PID 5332 wrote to memory of 2724 5332 sr3zas4tdknnfjp70.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_7b56655b41745689784229ddc83f8a67_bkransomware_elex_maze_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_7b56655b41745689784229ddc83f8a67_bkransomware_elex_maze_remcos_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\mtczpbinopm\sr3zas4tdknnfjp70.exe"C:\mtczpbinopm\sr3zas4tdknnfjp70.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\mtczpbinopm\ahjtiwz.exe"C:\mtczpbinopm\ahjtiwz.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2724
-
-
-
C:\mtczpbinopm\ahjtiwz.exeC:\mtczpbinopm\ahjtiwz.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\mtczpbinopm\xxslypurgh.exexbyqtpdxyyeu "c:\mtczpbinopm\ahjtiwz.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2480
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\mtczpbinopm\gspvofwt
- Size 12B
- SHA256 5600a433a2c9a4cb4113aec47331d0d4dbd7d1b4ada30c3907890e10e26408ec
- MD5 c3e1dbcf13e3d6d711b6ea5904858349
- SHA1 321495f6e1202dea00d053fc64a836ec7c1b8eb0
- SHA512 9819eaa0d812cc5738ce149d72d76ce8811143cc88706138f74930d93011f51970ab2ee0fd742c97ed050b8241d9df1519f25d2336f07a01f7d62793e384d393
- MD5 SHA1 SHA512
- Path C:\mtczpbinopm\sr3zas4tdknnfjp70.exe
- Size 660KB
- SHA256 8682192c7fdfb66e8db76e37f07985d3a15affdb7ec5d85f1af44c55f6bc9f61
- MD5 7b56655b41745689784229ddc83f8a67
- SHA1 6d6cf65c806d5faca85752ab0a52f38be0d864b4
- SHA512 060501a8b3029e58533f5ff9bf046ad88a63c19915b1af66b9087c0f1e0e85067b14e75275c3c159af0eacec162bd65b4bc01672b82fc66badda3e67321bf5a4
- SSDEEP 12288:ZKH11tQxjpjbMPjmyCU29kxczDmDytDDXTY6CMyQ19X:ZKH11sNjbyjtCU2QcW6DzwQ
- TLSH T17FE4AD11B563A1F3D42224B74159F73A2A397D764F698BE3EBC75E2648F21C09A33213
- MD5 SHA1 SHA512 SSDEEP TLSH