Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 06:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-05_17edcb33b4633809732184274947a8a6_bkransomware_elex_maze_remcos_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_17edcb33b4633809732184274947a8a6_bkransomware_elex_maze_remcos_stealc.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-05_17edcb33b4633809732184274947a8a6_bkransomware_elex_maze_remcos_stealc.exe
- Size 377KB
- Sample260705-g1eq1set4l
- SHA256 0c159354bd057ef86a98a37bfdc7563cde5be7990176121fc9f2275ecdae6aa5
- MD5 17edcb33b4633809732184274947a8a6
- SHA1 0f30256b0dc0e81a0d0499107806b9be8681c7b0
- SHA512 40fb2d2b6e0adf56515ec00c5f9d21eef9fcd1615f51425965733f8b23045d002452302c019c6dda9cf97b62a997ffd37a248a52c549d14359ceea76d6799919
- SSDEEP 6144:rfbi9QX4w0iEPMCQhSs2L5uf9keTA38igW7H5f9PZrzsB:rfbXXilmsRdufqeTA38igKHzP1zsB
- TLSH T12484AD20B6C3D032C46642FD0769E73265FE38726B255ACBA7D98ADC41703D0A736B97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 5968 y0ueb3zaocjgwpr3gslbui.exe 5524 kwegiastm.exe 4240 jhulcdgpdmjx.exe 5600 kwegiastm.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\nxntxpeqs\rspkpwjlw 2026-07-05_17edcb33b4633809732184274947a8a6_bkransomware_elex_maze_remcos_stealc.exe File created C:\Windows\nxntxpeqs\rspkpwjlw y0ueb3zaocjgwpr3gslbui.exe File created C:\Windows\nxntxpeqs\rspkpwjlw kwegiastm.exe File created C:\Windows\nxntxpeqs\rspkpwjlw jhulcdgpdmjx.exe File created C:\Windows\nxntxpeqs\rspkpwjlw kwegiastm.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-05_17edcb33b4633809732184274947a8a6_bkransomware_elex_maze_remcos_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language y0ueb3zaocjgwpr3gslbui.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kwegiastm.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5524 kwegiastm.exe 5524 kwegiastm.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe 4240 jhulcdgpdmjx.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2788 wrote to memory of 5968 2788 2026-07-05_17edcb33b4633809732184274947a8a6_bkransomware_elex_maze_remcos_stealc.exe 89 PID 5524 wrote to memory of 4240 5524 kwegiastm.exe 91 PID 5968 wrote to memory of 5600 5968 y0ueb3zaocjgwpr3gslbui.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_17edcb33b4633809732184274947a8a6_bkransomware_elex_maze_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_17edcb33b4633809732184274947a8a6_bkransomware_elex_maze_remcos_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\nxntxpeqs\y0ueb3zaocjgwpr3gslbui.exe"C:\nxntxpeqs\y0ueb3zaocjgwpr3gslbui.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\nxntxpeqs\kwegiastm.exe"C:\nxntxpeqs\kwegiastm.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5600
-
-
-
C:\nxntxpeqs\kwegiastm.exeC:\nxntxpeqs\kwegiastm.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\nxntxpeqs\jhulcdgpdmjx.exegyrgrrzdeahi "c:\nxntxpeqs\kwegiastm.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4240
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\nxntxpeqs\e8snux
- Size 4B
- SHA256 0eacbd3e7bba4f1d85cfe8764d24d9a0b95710d593cea7e5a6dbd4365cc96c98
- MD5 aac0cbb82ef4689d1483109429ccb264
- SHA1 d92da8af2b2b3881ebf16ef5c8ab629dc4be0046
- SHA512 65ab3b6a71724503f4ed21f1a13c451cf559f24b35440e37a8c326dec4000b0e80dbba6fb3c75b7c682dee849c3c13cf439a47921a04e09054cc9958947b1ef7
- MD5 SHA1 SHA512
- Path C:\nxntxpeqs\rspkpwjlw
- Size 8B
- SHA256 3ed1469de06742d73bd295516502a4990c8888a5d3389fa07d625db55eb3fdf4
- MD5 6201e7a2043aac8f7f1c910429352db9
- SHA1 625523c2152ab98a8b8b0424368f56c35ecfcc22
- SHA512 f7f089c5eefc171194a15859e4a049321d8d782b1f9f3b51c4b6260c25f93064cc6a14a2b68e62c592891eb5b5074811be66f44279fe89f30156564705a76456
- MD5 SHA1 SHA512
- Path C:\nxntxpeqs\y0ueb3zaocjgwpr3gslbui.exe
- Size 377KB
- SHA256 0c159354bd057ef86a98a37bfdc7563cde5be7990176121fc9f2275ecdae6aa5
- MD5 17edcb33b4633809732184274947a8a6
- SHA1 0f30256b0dc0e81a0d0499107806b9be8681c7b0
- SHA512 40fb2d2b6e0adf56515ec00c5f9d21eef9fcd1615f51425965733f8b23045d002452302c019c6dda9cf97b62a997ffd37a248a52c549d14359ceea76d6799919
- SSDEEP 6144:rfbi9QX4w0iEPMCQhSs2L5uf9keTA38igW7H5f9PZrzsB:rfbXXilmsRdufqeTA38igKHzP1zsB
- TLSH T12484AD20B6C3D032C46642FD0769E73265FE38726B255ACBA7D98ADC41703D0A736B97
- MD5 SHA1 SHA512 SSDEEP TLSH