296da4ebb3c7e6e7104549cc0486fe91b50745224411ba1eae4fb65230e00b53

General

Target
2026-07-03_1d866e629a918b123c49f4b7dd64bc54_bkransomware_elex_maze_rhadamanthys.exe
Size 557KB
Sample260703-x436sae191
SHA256 296da4ebb3c7e6e7104549cc0486fe91b50745224411ba1eae4fb65230e00b53
MD5 1d866e629a918b123c49f4b7dd64bc54
SHA1 d4149ea8b612536258eaefc3daedde9ac549ae13
SHA512 ef0f887b52d22602725b8bbc7bdc3bf7cb9c033e23018aed266f865a6454480d83d71a442c4ba01ad28d59ba8fd0b1aa8df5866d5cfee1384c2ffbae3abcd951
SSDEEP 6144:xZ8azqAR27ON1uzdH8M2ufwtTRgol/PUo6HBeZI6FezHLd7+8oBxafa2En5xfXX:xC0z27C89NQJhln4eKJLLg8WxafRexv
TLSH
T16CC4231375E5E3B0F86617B008A0CA100E7FFD75AEB2CD9B7744169E05719E04E29BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2304	CTS.exe
3316	CTS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2026-07-03_1d866e629a918b123c49f4b7dd64bc54_bkransomware_elex_maze_rhadamanthys.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2026-07-03_1d866e629a918b123c49f4b7dd64bc54_bkransomware_elex_maze_rhadamanthys.exe
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_1d866e629a918b123c49f4b7dd64bc54_bkransomware_elex_maze_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4424	2026-07-03_1d866e629a918b123c49f4b7dd64bc54_bkransomware_elex_maze_rhadamanthys.exe
Token: SeDebugPrivilege	2304	CTS.exe
Token: SeDebugPrivilege	3316	CTS.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 2304	4424	2026-07-03_1d866e629a918b123c49f4b7dd64bc54_bkransomware_elex_maze_rhadamanthys.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-03_1d866e629a918b123c49f4b7dd64bc54_bkransomware_elex_maze_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_1d866e629a918b123c49f4b7dd64bc54_bkransomware_elex_maze_rhadamanthys.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2304

C:\Windows\CTS.exe
C:\Windows\CTS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

officeclicktorun.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml
Size 557KB
SHA256 815250cd5230fe691b045ede545b63a570baa15283978f1415ac4137c9934425
MD5 05b099104faf90dde21c52621c0eaf65
SHA1 91ccd20b39612c5ece69d60708ba27602b44da02
SHA512 f7d046f50976dbbe101449b9eacc8b0362c7f775e9898b568f82a91df3573e6fb1d1a2cb368885500416f1f3bdf78be6905897dec51dc42d8094d73b32871f85
SSDEEP 12288:xC09u433dUHwYHdm7J9ZgX2FiNKE1fMSR/0CGOXBZbGlo:Dv3U1dmXuZZfD//CC
TLSH
T1BFC4121373C5C536E4B21B7501E5DE608ABF7D345FA5DD872B582ACE0631AC01E2ABA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

l29Uuz7r8pz3qRA.exe

Path C:\Users\Admin\AppData\Local\Temp\l29Uuz7r8pz3qRA.exe
Size 557KB
SHA256 6cf73628de28c1c1f10af8c736dd6f18f8606fcb79ca33ac0b34491aad5572c5
MD5 02101368ebf37d4954faf95af745e68b
SHA1 a45f3ed5a70618f72f615a536130f5109ffbf0d1
SHA512 bc6176b5239eb1606d30ae0a797987b2f678de40887514a16be632262edea85aa119e80beb904b49ff5ec8242adcffa5b54507c2272258e53e66f7deec203789
SSDEEP 12288:xC0YnpIMbiheqIPcjH6EFL5+CIaqJx/GD3C+:DYnpIwd8sCnqJNGD3C+
TLSH
T130C423233BD24130D4FE0A3624A85D208ABF7D7B5A795F563380B19E26325D05E397BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 71KB
SHA256 b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc
MD5 f9d4ab0a726adc9b5e4b7d7b724912f1
SHA1 3d42ca2098475924f70ee4a831c4f003b4682328
SHA512 22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432
SSDEEP 1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazT:ZRpAyazIliazT
TLSH
T176636B03B6D2C171E4B70A7649B8CE51067FBE765EB18D5B33C4218E49752C08E3ABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads