Analysis
- max time kernel
150s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 04:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_533958857530268f998e128c53b73251_bkransomware_elex_maze_remcos_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_533958857530268f998e128c53b73251_bkransomware_elex_maze_remcos_stealc.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-08_533958857530268f998e128c53b73251_bkransomware_elex_maze_remcos_stealc.exe
- Size 375KB
- Sample260708-e9k82sbx2k
- SHA256 10c4915cb0c4608dc55a438cc4df1812eb2281ab6af51af97dd8f308894c3dcb
- MD5 533958857530268f998e128c53b73251
- SHA1 0a44bd7a950d7085316418473a3ef34cac040091
- SHA512 737fa1f96b6ff539ac2b6ab6f3269198b37107e3899697998e9d7567f89bbff39c54af2bdfe837c8e367e3bafaa2c61f1e326ef9a0e236f0005df13023a441ce
- SSDEEP 6144:j9GwYOgzK8AypOPPUc65F4TnynD6Siuh1JfoBzTEN/vlmRR+H9lZ5mx6/:j9GTzlHOPcX3sCD6S11NoBzTEN/v2Ror
- TLSH T15584AE21B6C7D032C46282FD1669FB3264FE79B2BB2169DB67C989CD45302C0A637717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 4976 svlf3zb151nibshgcfub2.exe 1392 rcdvcsw.exe 2420 aljhooxppxsl.exe 2316 rcdvcsw.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\ybycyrpbzzqho\vdzqga 2026-07-08_533958857530268f998e128c53b73251_bkransomware_elex_maze_remcos_stealc.exe File created C:\Windows\ybycyrpbzzqho\vdzqga svlf3zb151nibshgcfub2.exe File created C:\Windows\ybycyrpbzzqho\vdzqga rcdvcsw.exe File created C:\Windows\ybycyrpbzzqho\vdzqga aljhooxppxsl.exe File created C:\Windows\ybycyrpbzzqho\vdzqga rcdvcsw.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_533958857530268f998e128c53b73251_bkransomware_elex_maze_remcos_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svlf3zb151nibshgcfub2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rcdvcsw.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1392 rcdvcsw.exe 1392 rcdvcsw.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 1392 rcdvcsw.exe 1392 rcdvcsw.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe 1392 rcdvcsw.exe 1392 rcdvcsw.exe 2420 aljhooxppxsl.exe 2420 aljhooxppxsl.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5060 wrote to memory of 4976 5060 2026-07-08_533958857530268f998e128c53b73251_bkransomware_elex_maze_remcos_stealc.exe 88 PID 1392 wrote to memory of 2420 1392 rcdvcsw.exe 90 PID 4976 wrote to memory of 2316 4976 svlf3zb151nibshgcfub2.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_533958857530268f998e128c53b73251_bkransomware_elex_maze_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_533958857530268f998e128c53b73251_bkransomware_elex_maze_remcos_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\ybycyrpbzzqho\svlf3zb151nibshgcfub2.exe"C:\ybycyrpbzzqho\svlf3zb151nibshgcfub2.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\ybycyrpbzzqho\rcdvcsw.exe"C:\ybycyrpbzzqho\rcdvcsw.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2316
-
-
-
C:\ybycyrpbzzqho\rcdvcsw.exeC:\ybycyrpbzzqho\rcdvcsw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\ybycyrpbzzqho\aljhooxppxsl.exemizuhktl75jh "c:\ybycyrpbzzqho\rcdvcsw.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2420
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ybycyrpbzzqho\svlf3zb151nibshgcfub2.exe
- Size 375KB
- SHA256 10c4915cb0c4608dc55a438cc4df1812eb2281ab6af51af97dd8f308894c3dcb
- MD5 533958857530268f998e128c53b73251
- SHA1 0a44bd7a950d7085316418473a3ef34cac040091
- SHA512 737fa1f96b6ff539ac2b6ab6f3269198b37107e3899697998e9d7567f89bbff39c54af2bdfe837c8e367e3bafaa2c61f1e326ef9a0e236f0005df13023a441ce
- SSDEEP 6144:j9GwYOgzK8AypOPPUc65F4TnynD6Siuh1JfoBzTEN/vlmRR+H9lZ5mx6/:j9GTzlHOPcX3sCD6S11NoBzTEN/v2Ror
- TLSH T15584AE21B6C7D032C46282FD1669FB3264FE79B2BB2169DB67C989CD45302C0A637717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ybycyrpbzzqho\uttsamgnj4um
- Size 4B
- SHA256 ad76f85f90baf60912313bed62dcf73e3aa5100346b6d2c83a49bc64bcf346eb
- MD5 389a8f64a86c06ca7adce07c588b9c67
- SHA1 058aedace5f46ad8a597d7119fcf68ec9ac0d28c
- SHA512 53e67b9a8fa3e8a1acdad76e42a65bee944a0855d48ae22d673e34e8e74d8f0f2cb9ee15bc4f59939635e0704edf046a15c151efd9ebb909cec85ba32723f412
- MD5 SHA1 SHA512
- Path C:\ybycyrpbzzqho\vdzqga
- Size 7B
- SHA256 a96b5367da8bb4ef4002c9bc035d07d7b587a86efc1e1895cc8e209f7d82dbcd
- MD5 f27cab52e51d7c45558ecef24744dcdc
- SHA1 218f065c03edc736a9d99d2b9e8e269deccc1b7e
- SHA512 51b93a9b84a33087ee52f43c59b1d38215c73d473e3ff8f9723e591bc988aaa09c6392bfcc3692bc61c534c6da726b38900ff2e98a5d47b791aaca955f64b5d7
- MD5 SHA1 SHA512