Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/07/2026, 04:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_533958857530268f998e128c53b73251_bkransomware_elex_maze_remcos_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_533958857530268f998e128c53b73251_bkransomware_elex_maze_remcos_stealc.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-08_533958857530268f998e128c53b73251_bkransomware_elex_maze_remcos_stealc.exe
- Size 375KB
- Sample260708-e9k82sbx2k
- SHA256 10c4915cb0c4608dc55a438cc4df1812eb2281ab6af51af97dd8f308894c3dcb
- MD5 533958857530268f998e128c53b73251
- SHA1 0a44bd7a950d7085316418473a3ef34cac040091
- SHA512 737fa1f96b6ff539ac2b6ab6f3269198b37107e3899697998e9d7567f89bbff39c54af2bdfe837c8e367e3bafaa2c61f1e326ef9a0e236f0005df13023a441ce
- SSDEEP 6144:j9GwYOgzK8AypOPPUc65F4TnynD6Siuh1JfoBzTEN/vlmRR+H9lZ5mx6/:j9GTzlHOPcX3sCD6S11NoBzTEN/v2Ror
- TLSH T15584AE21B6C7D032C46282FD1669FB3264FE79B2BB2169DB67C989CD45302C0A637717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 1612 svlf3zavkynibshgcfub2.exe 5004 rcdvcsw.exe 3760 aljhooxppxsl.exe 1808 rcdvcsw.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\ybycyrpbzzqho\vdzqga svlf3zavkynibshgcfub2.exe File created C:\Windows\ybycyrpbzzqho\vdzqga rcdvcsw.exe File created C:\Windows\ybycyrpbzzqho\vdzqga aljhooxppxsl.exe File created C:\Windows\ybycyrpbzzqho\vdzqga rcdvcsw.exe File created C:\Windows\ybycyrpbzzqho\vdzqga 2026-07-08_533958857530268f998e128c53b73251_bkransomware_elex_maze_remcos_stealc.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rcdvcsw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_533958857530268f998e128c53b73251_bkransomware_elex_maze_remcos_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svlf3zavkynibshgcfub2.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5004 rcdvcsw.exe 5004 rcdvcsw.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe 3760 aljhooxppxsl.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2428 wrote to memory of 1612 2428 2026-07-08_533958857530268f998e128c53b73251_bkransomware_elex_maze_remcos_stealc.exe 84 PID 5004 wrote to memory of 3760 5004 rcdvcsw.exe 86 PID 1612 wrote to memory of 1808 1612 svlf3zavkynibshgcfub2.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_533958857530268f998e128c53b73251_bkransomware_elex_maze_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_533958857530268f998e128c53b73251_bkransomware_elex_maze_remcos_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\ybycyrpbzzqho\svlf3zavkynibshgcfub2.exe"C:\ybycyrpbzzqho\svlf3zavkynibshgcfub2.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\ybycyrpbzzqho\rcdvcsw.exe"C:\ybycyrpbzzqho\rcdvcsw.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1808
-
-
-
C:\ybycyrpbzzqho\rcdvcsw.exeC:\ybycyrpbzzqho\rcdvcsw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\ybycyrpbzzqho\aljhooxppxsl.exemizuhktl75jh "c:\ybycyrpbzzqho\rcdvcsw.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3760
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ybycyrpbzzqho\svlf3zavkynibshgcfub2.exe
- Size 375KB
- SHA256 10c4915cb0c4608dc55a438cc4df1812eb2281ab6af51af97dd8f308894c3dcb
- MD5 533958857530268f998e128c53b73251
- SHA1 0a44bd7a950d7085316418473a3ef34cac040091
- SHA512 737fa1f96b6ff539ac2b6ab6f3269198b37107e3899697998e9d7567f89bbff39c54af2bdfe837c8e367e3bafaa2c61f1e326ef9a0e236f0005df13023a441ce
- SSDEEP 6144:j9GwYOgzK8AypOPPUc65F4TnynD6Siuh1JfoBzTEN/vlmRR+H9lZ5mx6/:j9GTzlHOPcX3sCD6S11NoBzTEN/v2Ror
- TLSH T15584AE21B6C7D032C46282FD1669FB3264FE79B2BB2169DB67C989CD45302C0A637717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ybycyrpbzzqho\uttsamgnj4um
- Size 4B
- SHA256 b6a25202981bd9510c06cef67fa57b5b9d6eec27c667cb015bb8c87e6644fdb1
- MD5 8a326762638a02844c24494508517afe
- SHA1 7c1dde58aa420311c3578813c8c7323d5fab8b57
- SHA512 10b644f609de122759cc4746b416c995f5d46c7bc72d35fa353702132352cb4ad0bc5dbd4abc210fe9d6918395686d8f7a2ba916566485b9dcdeea2327fefda6
- MD5 SHA1 SHA512
- Path C:\ybycyrpbzzqho\vdzqga
- Size 7B
- SHA256 a96b5367da8bb4ef4002c9bc035d07d7b587a86efc1e1895cc8e209f7d82dbcd
- MD5 f27cab52e51d7c45558ecef24744dcdc
- SHA1 218f065c03edc736a9d99d2b9e8e269deccc1b7e
- SHA512 51b93a9b84a33087ee52f43c59b1d38215c73d473e3ff8f9723e591bc988aaa09c6392bfcc3692bc61c534c6da726b38900ff2e98a5d47b791aaca955f64b5d7
- MD5 SHA1 SHA512