Analysis
- max time kernel
149s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 04:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_e3f539a1b48ffc8d333299746e487bb7_elex_hawkeye_maze_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_e3f539a1b48ffc8d333299746e487bb7_elex_hawkeye_maze_stealc.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-08_e3f539a1b48ffc8d333299746e487bb7_elex_hawkeye_maze_stealc.exe
- Size 421KB
- Sample260708-envklaav2y
- SHA256 9a1a1919b361d46c0d4fb8967ae9674816c62dad8d0f1cbeec3583beff8056ad
- MD5 e3f539a1b48ffc8d333299746e487bb7
- SHA1 db2da9968d5f69840e9acf84d3283ed70f06d79c
- SHA512 86d947e1fea3d602e605c0a7ce3929004a6508f9fc1a3c6d58dae4c210943b57b1c2cc06a62af0c43ba20839ec40b45a69849368af474574a2c38c4b14a5d776
- SSDEEP 6144:c3fQ59EJKeS8F7gWWwkCv1CpVoYA1RKhX9FBrQR/NSYDnSJfZ:i/7gWFkCv1Cpe3RKhNnVYDSJfZ
- TLSH T1C1944A0274D3D03AD4B341F6C5ADA32206B8BE60337559D7BFD80A8D5BA84D0BA7625F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 4744 pahur3zbqs7vej56tsxtggw.exe 5736 vryawcv.exe 3596 ovhbmfeuni.exe 3196 vryawcv.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\hdskewzprv\b8mujp vryawcv.exe File created C:\Windows\hdskewzprv\b8mujp 2026-07-08_e3f539a1b48ffc8d333299746e487bb7_elex_hawkeye_maze_stealc.exe File created C:\Windows\hdskewzprv\b8mujp pahur3zbqs7vej56tsxtggw.exe File created C:\Windows\hdskewzprv\b8mujp vryawcv.exe File created C:\Windows\hdskewzprv\b8mujp ovhbmfeuni.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_e3f539a1b48ffc8d333299746e487bb7_elex_hawkeye_maze_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pahur3zbqs7vej56tsxtggw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vryawcv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5736 vryawcv.exe 5736 vryawcv.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 5736 vryawcv.exe 5736 vryawcv.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 5736 vryawcv.exe 5736 vryawcv.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 5736 vryawcv.exe 5736 vryawcv.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 5736 vryawcv.exe 5736 vryawcv.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 5736 vryawcv.exe 5736 vryawcv.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 5736 vryawcv.exe 5736 vryawcv.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe 5736 vryawcv.exe 5736 vryawcv.exe 3596 ovhbmfeuni.exe 3596 ovhbmfeuni.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2976 wrote to memory of 4744 2976 2026-07-08_e3f539a1b48ffc8d333299746e487bb7_elex_hawkeye_maze_stealc.exe 88 PID 5736 wrote to memory of 3596 5736 vryawcv.exe 90 PID 4744 wrote to memory of 3196 4744 pahur3zbqs7vej56tsxtggw.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_e3f539a1b48ffc8d333299746e487bb7_elex_hawkeye_maze_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_e3f539a1b48ffc8d333299746e487bb7_elex_hawkeye_maze_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\hdskewzprv\pahur3zbqs7vej56tsxtggw.exe"C:\hdskewzprv\pahur3zbqs7vej56tsxtggw.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\hdskewzprv\vryawcv.exe"C:\hdskewzprv\vryawcv.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3196
-
-
-
C:\hdskewzprv\vryawcv.exeC:\hdskewzprv\vryawcv.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\hdskewzprv\ovhbmfeuni.exexuhlyugjquzi "c:\hdskewzprv\vryawcv.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3596
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\hdskewzprv\b8mujp
- Size 7B
- SHA256 ba56b161a4ce1a57668948be4d6c049ec3fe411ec9d6a72365772aa98d914f29
- MD5 4c06f6e745956466bdd624197176e883
- SHA1 b82805f680805bb52777212a92a6bc7ff6a10a99
- SHA512 a32c0af538837a14ecaa40772afbaa1a9074ed6adca106527299baf78239c2cf9193ebe47f6871f900d6355ecbf1857b2606bb26e36388d17a205e1be27d66d0
- MD5 SHA1 SHA512
- Path C:\hdskewzprv\mzfasjfk
- Size 4B
- SHA256 31b3b2b03d5e740eb1294f37b4d4b75d6477779a8d37c5b3f04cdda596f42f9b
- MD5 0c0b8dae5d769edbaeed0f917d6a3cee
- SHA1 6f566ae4a9aa3f40b08ed2185ae1a5c08c36662f
- SHA512 edd404dffa0e6ada434ad3e5e3328bf92032f7f20f2977bbcf8b62a9d13735fd1a33e9707e51d6b4fdd22387c0913dcaf0d81b1edcb2791dfb35da825b9a0283
- MD5 SHA1 SHA512
- Path C:\hdskewzprv\pahur3zbqs7vej56tsxtggw.exe
- Size 421KB
- SHA256 9a1a1919b361d46c0d4fb8967ae9674816c62dad8d0f1cbeec3583beff8056ad
- MD5 e3f539a1b48ffc8d333299746e487bb7
- SHA1 db2da9968d5f69840e9acf84d3283ed70f06d79c
- SHA512 86d947e1fea3d602e605c0a7ce3929004a6508f9fc1a3c6d58dae4c210943b57b1c2cc06a62af0c43ba20839ec40b45a69849368af474574a2c38c4b14a5d776
- SSDEEP 6144:c3fQ59EJKeS8F7gWWwkCv1CpVoYA1RKhX9FBrQR/NSYDnSJfZ:i/7gWFkCv1Cpe3RKhNnVYDSJfZ
- TLSH T1C1944A0274D3D03AD4B341F6C5ADA32206B8BE60337559D7BFD80A8D5BA84D0BA7625F
- MD5 SHA1 SHA512 SSDEEP TLSH