5a7b35f08d4830017486e2e6a8ad7ca94a9b2aaf1b42d2962e8870cd99b18d77

General

Target
2026-07-04_b98e0643b5a91364ec980c6dd971565c_bkransomware_elex_maze_rhadamanthys.exe
Size 332KB
Sample260704-heedssf19l
SHA256 5a7b35f08d4830017486e2e6a8ad7ca94a9b2aaf1b42d2962e8870cd99b18d77
MD5 b98e0643b5a91364ec980c6dd971565c
SHA1 2fc200d7d6cd42d7cdf39fc7fb51a72ebf4296bf
SHA512 e1d84a7c86b7737c97624b58724eccf94498d433c1619a54e5eb172619dcb6c4c2b9b82962262c745c66ddeb341cba7cebc010ca8e6bdcfd703398aaac320b1b
SSDEEP 6144:xZ8az8ZTajed94zr8jdZPJem+v3kuv6pe9UaEQfinlx:xC08ZTajeE0jdKv3kPpe9UFWinlx
TLSH
T16074021376D2C176F0BB4B7108B88A6A57AF79729BB19D0337D0258E18705C09F79B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2876	D1K2lB8CzZQ7ir9.exe
2576	CTS.exe
1336	CTS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2026-07-04_b98e0643b5a91364ec980c6dd971565c_bkransomware_elex_maze_rhadamanthys.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	2026-07-04_b98e0643b5a91364ec980c6dd971565c_bkransomware_elex_maze_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_b98e0643b5a91364ec980c6dd971565c_bkransomware_elex_maze_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4196	2026-07-04_b98e0643b5a91364ec980c6dd971565c_bkransomware_elex_maze_rhadamanthys.exe
Token: SeDebugPrivilege	2576	CTS.exe
Token: SeDebugPrivilege	1336	CTS.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 2876	4196	2026-07-04_b98e0643b5a91364ec980c6dd971565c_bkransomware_elex_maze_rhadamanthys.exe	89
PID 4196 wrote to memory of 2576	4196	2026-07-04_b98e0643b5a91364ec980c6dd971565c_bkransomware_elex_maze_rhadamanthys.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-04_b98e0643b5a91364ec980c6dd971565c_bkransomware_elex_maze_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_b98e0643b5a91364ec980c6dd971565c_bkransomware_elex_maze_rhadamanthys.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Users\Admin\AppData\Local\Temp\D1K2lB8CzZQ7ir9.exe
  C:\Users\Admin\AppData\Local\Temp\D1K2lB8CzZQ7ir9.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2576

C:\Windows\CTS.exe
C:\Windows\CTS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

officeclicktorun.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml
Size 557KB
SHA256 d01cfda509319012099cd0df5b5f757407de9afc2cf96810861cf9176a6adf07
MD5 8872698ed394c914e740222fc24dc528
SHA1 648b8876510eb4d3aef1679b2dc6ab0b006b0407
SHA512 a58e1662db7198df523fe004b2b2684c28c29d2890406a58302eaf94d09166d41d10e60d350ee1a11531db97c09cf1583f838332516e20a1eab6e789af5aaa38
SSDEEP 12288:xC0qg+GBtb7Y3zHD9Oq9K5S46qzViES69kMMMxg7WFirz:Dq0tb7sHD0qQA468irxJC+z
TLSH
T1C5C42203B2E6D438F4F70E7849F5DC41066FBAB61EB98E9B33D0169B4A791D00A21767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D1K2lB8CzZQ7ir9.exe

Path C:\Users\Admin\AppData\Local\Temp\D1K2lB8CzZQ7ir9.exe
Size 332KB
SHA256 efcf312bf994d3af14d78e372549195839b827d695190fc5558406c475cbb2ae
MD5 3c7eee5f0bc2ce2d7b2546184b06e092
SHA1 09f96b74633ae2540b6b17f266d45b1d71d1c36d
SHA512 79faed079c42d9791515917d7f0bbdcea9fdb1f3754e0b7e7c1539b88d04a3a155792a2844f3efd495d5c2e50a47de87deff560a03d7f467d76451cbee5b85f9
SSDEEP 6144:xZ8azQ3PdrReb21fOiYI4bb1YWSWVItg8zYgXrjUyYk2EriO6lzLPbzy:xC0QfdrUiROI9MItg86RGOdzbbzy
TLSH
T137740213B7D1C230F1A30A3158A59A41473F7E796A76884F33D8318D5A716E04EB9BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D1K2lB8CzZQ7ir9.exe

Path C:\Users\Admin\AppData\Local\Temp\D1K2lB8CzZQ7ir9.exe
Size 261KB
SHA256 3052784f3683c2bbe95f59560eb311e75f1eac7aa5476a91bbd9fe4d2aef880a
MD5 9dce6a120d094e5c925b967c4bb36277
SHA1 1ab60840e8d8ed14619fab2d1559f989f01f01a9
SHA512 20a7a4b8ecb1262ed730c8299ad0ada2ad93327f0886e5fdefc89564ff7510595ec53ac5aa88747e0548315c3037125d83756e3ae4d9a813cc553c12991c94df
SSDEEP 6144:sZJsPeFfFKPNrOYZ63KuH9q08IrL5vYle:GJsPeFfFKPNpZykpI59
TLSH
T14E445A46379900E4D0B28134877747E2AB3D7D255792D68E13D47B66EE3F280FD2AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 71KB
SHA256 b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc
MD5 f9d4ab0a726adc9b5e4b7d7b724912f1
SHA1 3d42ca2098475924f70ee4a831c4f003b4682328
SHA512 22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432
SSDEEP 1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazT:ZRpAyazIliazT
TLSH
T176636B03B6D2C171E4B70A7649B8CE51067FBE765EB18D5B33C4218E49752C08E3ABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads