f1b8b52417f8a807566a60ca552fcbca88d307395e67853f003bfe1bb9479e1f

General

Target
2026-07-04_3a46a29c2522e2099f99a35271af04aa_bkransomware_elex_maze_rhadamanthys.exe
Size 95KB
Sample260704-e1qr6sa14x
SHA256 f1b8b52417f8a807566a60ca552fcbca88d307395e67853f003bfe1bb9479e1f
MD5 3a46a29c2522e2099f99a35271af04aa
SHA1 2a568a3b32193d522a938ab70e19b80f9854112c
SHA512 945e467e30d02f06eb6c66d00a466f88d286b6a5be893ed109161841eb9554c5e788b5561bdff132d1b4639a934b95cdf818cf44a0429376df18f0905fe8da78
SSDEEP 1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazTVgq23+85ZsP8yGtyy:ZhpAyazIlyazTVwJgE7J
TLSH
T18A93AD03BAD2C170F0B7063649B4CE6106AFBD765FB28D573384219D49766C09E39BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1412	CTS.exe
3284	CTS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2026-07-04_3a46a29c2522e2099f99a35271af04aa_bkransomware_elex_maze_rhadamanthys.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2026-07-04_3a46a29c2522e2099f99a35271af04aa_bkransomware_elex_maze_rhadamanthys.exe
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_3a46a29c2522e2099f99a35271af04aa_bkransomware_elex_maze_rhadamanthys.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6044	2026-07-04_3a46a29c2522e2099f99a35271af04aa_bkransomware_elex_maze_rhadamanthys.exe
Token: SeDebugPrivilege	1412	CTS.exe
Token: SeDebugPrivilege	3284	CTS.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6044 wrote to memory of 1412	6044	2026-07-04_3a46a29c2522e2099f99a35271af04aa_bkransomware_elex_maze_rhadamanthys.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-04_3a46a29c2522e2099f99a35271af04aa_bkransomware_elex_maze_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_3a46a29c2522e2099f99a35271af04aa_bkransomware_elex_maze_rhadamanthys.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1412

C:\Windows\CTS.exe
C:\Windows\CTS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

officeclicktorun.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml
Size 557KB
SHA256 7a2a21b0d8d49c27d168a101ea09ff630331f9ca2cb1979b20d0039ba6f97c07
MD5 18ee4c2de797468d1dbfaae0529b3a7d
SHA1 f8acb699fbe767f38523ac14a53c76354567b0f6
SHA512 7b0709b0cba6c4b6fb0e6ca52849d1b8a7a949efba3602dda12daf988b4cc817914838a02020786b24ad06805d2163e4617d854465e63167c54be30f7762bfc8
SSDEEP 12288:hS06QYMK140qErCRVCKg/hjXOyyNgxP+aU2ocbGIu+jtSLf:D6zFMCKg/hjSqHU3czuq8f
TLSH
T1C4C4220B32D6E171E07B86F10869D66043BFBF764DF6C813675816CD4AB12806E19FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37hbEdyfecejNEv.exe

Path C:\Users\Admin\AppData\Local\Temp\37hbEdyfecejNEv.exe
Size 95KB
SHA256 9cae29373baca8072869f67375d5d9bcdbe5ec10c938b65e8e4189b16a0501aa
MD5 602cd8f6ce9297e09ea7656dfcbc1125
SHA1 adee8b7bef202eff9c3f8b8f2f5b8b3592ece26f
SHA512 1efe94fa0872c127ce7eebffdcceb059dfa0c24a028374dd7022f57843ece9674b091adf924f12a26e34a31b937705b633f327e4571f6418e9159c31cd0d3e4a
SSDEEP 1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazTEm2q5ea5KCNSH:ZhpAyazIlyazTEzMeT5H
TLSH
T17A93AE0376D2C070E4B7067209B8CE514ABFBE765EB68E5737C4218D4AB52D04E39BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 71KB
SHA256 075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163
MD5 66df4ffab62e674af2e75b163563fc0b
SHA1 dec8a197312e41eeb3cfef01cb2a443f0205cd6e
SHA512 1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25
SSDEEP 1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazT:ZhpAyazIlyazT
TLSH
T119636B03B6D2C171E4B70A7649B8CE51067FBE765EB18D5B33C4218E49752C08E3ABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads