4ff064c858a356a8e8a8d3fceca218d3ee9c93f0e92cc3d11a13daf58b22dd9c

General

Target
2026-07-15_acd42a57d0eecbbd1a1253a07b48c780_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader_stealc.exe
Size 123KB
Sample260715-splkzaft2l
SHA256 4ff064c858a356a8e8a8d3fceca218d3ee9c93f0e92cc3d11a13daf58b22dd9c
MD5 acd42a57d0eecbbd1a1253a07b48c780
SHA1 f171782905af128f2135fb1214df9905f0cdafb8
SHA512 dca9a8bc9e991ecae7165a226eb90ede4013940d9bcceaa5e6ae9dbb9b17be331bd6cefd64780b2a113c2f85daec7ab7f22b2ad61b33b8d54cb80eda4029e002
SSDEEP 1536:i0DotuWGl9OO9GjTQl5bm/ynWcp6CsWjcdNuEtA06ln+8+2eQotxrdTcxJL:vDoYp3ObQ+/y6oEtA0BQo/pTcxJL
TLSH
T1B2C35B0172D1A071D4A6753109A4BA71062EFEF67E61DF07A3E8534AC9771A01E3BB3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2112	PowerMapStarter.exe
3564	PowerMapRestarter.exe
3296	PowerMapStarter.exe
5532	PowerMap.exe

Loads dropped DLL 10 IoCs

pid	Process
2112	PowerMapStarter.exe
2112	PowerMapStarter.exe
2112	PowerMapStarter.exe
3564	PowerMapRestarter.exe
3564	PowerMapRestarter.exe
3296	PowerMapStarter.exe
3296	PowerMapStarter.exe
3296	PowerMapStarter.exe
5532	PowerMap.exe
5532	PowerMap.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_acd42a57d0eecbbd1a1253a07b48c780_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowerMapStarter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowerMapRestarter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowerMapStarter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowerMap.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2112	PowerMapStarter.exe
2112	PowerMapStarter.exe
3564	PowerMapRestarter.exe
3564	PowerMapRestarter.exe
3296	PowerMapStarter.exe
3296	PowerMapStarter.exe
5532	PowerMap.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 2112	5004	2026-07-15_acd42a57d0eecbbd1a1253a07b48c780_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader_stealc.exe	87
PID 2112 wrote to memory of 3564	2112	PowerMapStarter.exe	89
PID 3564 wrote to memory of 3296	3564	PowerMapRestarter.exe	90
PID 3296 wrote to memory of 5532	3296	PowerMapStarter.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-15_acd42a57d0eecbbd1a1253a07b48c780_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_acd42a57d0eecbbd1a1253a07b48c780_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\AppData\Local\Temp\PowerMapStarter.exe
  C:\Users\Admin\AppData\Local\Temp\PowerMapStarter.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Users\Admin\AppData\Local\Temp\PowerMapRestarter.exe
    C:\Users\Admin\AppData\Local\Temp\PowerMapRestarter.exe PowerMapStarter.exe PowerMap.exe SkinDialog.dll #
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\PowerMapStarter.exe
      C:\Users\Admin\AppData\Local\Temp\PowerMapStarter.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\PowerMap.exe
        
        C:\Users\Admin\AppData\Local\Temp\PowerMap.exe server port
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IPowerMap.dll

Path C:\Users\Admin\AppData\Local\Temp\IPowerMap.dll
Size 158KB
SHA256 c6d572b9cf531ce770d57cfb01f5ba508ba374f8bcdecdb64672a83473e0f07b
MD5 745953b91f3cc60139febd2bfd107030
SHA1 b8658d5a97558ed26ae7a66f196589b376acd591
SHA512 5da195b42a6284f403e034d5335ef64a014373fbc0d010f51ff2e00f7de6a809069054b234e59e357f24a2bda10dc46f353a90b599ede47b6e0beae37f4dbf56
SSDEEP 3072:VgSSQ1UlpsiLRCmLt2ExSOCRRPYSoWGDjT:wpoEt2VNRZYSo
TLSH
T1AEF37C657A01B4F2CA98063CAC3587192678B453B7FC12D71ED9A76E1C722E6C63270F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR120.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCR120.dll
Size 948KB
SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
MD5 034ccadc1c073e4216e9466b720f9849
SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
TLSH
T10F25BE12B982C0B2C57202B1152DE772197FBA71443598B7BBD98F0E1DB46C0FB67A63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PowerMap.exe.new

Path C:\Users\Admin\AppData\Local\Temp\PowerMap.exe.new
Size 950KB
SHA256 a5e6babfe2a6d2129203a18b0d90c9f4bf8f215a584033b9a2d33c8ee3a61012
MD5 6e0bb3e98efc75d2ed41661d7514844b
SHA1 17e61b2c8751956df6baf7e3ef0ad76f010fb653
SHA512 3e0e84d430194374ef12f59eb916d92e9c05023eb8cbe1bd50b53e5c1fab61fa7f5dad0df05d34590c1992db84a6754677f78330d8f90b6677ca7cbc6b6210dc
SSDEEP 6144:gNZKzviQBQo/926pZWRuFof2ZAQITLfJ:iKzRBQo126pZBFof2KJf
TLSH
T1A32543C069428432CCB3D3B4B86EA83367627D2A47DB744E57D83EF12F35B3159A14A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PowerMapRestarter.exe

Path C:\Users\Admin\AppData\Local\Temp\PowerMapRestarter.exe
Size 36KB
SHA256 f69e6daa01c38b629352034b5fd0eb9103d1b648d2d8fb017e3803aedfe3de8a
MD5 4ad2813e0985f1dc14cee8d3deb3859f
SHA1 ce2892acaae4dd65695173bdf75b6e9865d8d329
SHA512 e2df754f007d1e67b0da3f867a91c74bfe76a1a89f21299866f73cd4acc2e0507d818041689566bf9e7226b66c6d4c148c83ce93a23daf8df723a1b0fd0e2a38
SSDEEP 768:OVlwDmUg3kD1tpNsFcD1bk3EyT4lVzYpXZ7Zg:OVlpHkDbpNvDxuslCi
TLSH
T187F2C38A6400C021E25DF531E9294AF889F6BD21FB6158DF72807F7E3A351EC9D342DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PowerMapStarter.exe

Path C:\Users\Admin\AppData\Local\Temp\PowerMapStarter.exe
Size 90KB
SHA256 00aa48716470b71a34fe849d2ce113b5488c93a29a1ecbe4496919ccca953305
MD5 cb75dd2522600d9e338ae31d4f81ac41
SHA1 29784e7f20ea0e2716f022d67dc32d654133bd14
SHA512 8c9cfc787a27ab19d4800601fff013c981615244de465f830517b10050786c9c8d6d19338c354c663cd7b1b919ad8b047112ced748ad95a3045cf9a5cf6a3d7b
SSDEEP 1536:n81g1JPZUwlHnVFw5rIKjpgVxisA06ln+8+2eQotxr4CdU4:n8bwlHn7w5r1jp6xisA0BQo/cCdU4
TLSH
T15393F5437A868161DD65B03108397BBA421B68E12F10DFE36AE80B6EDC771E11D7727E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkinDialog.dll

Path C:\Users\Admin\AppData\Local\Temp\SkinDialog.dll
Size 330KB
SHA256 66150451f0cf849dc86ec7d107c350737bf23a9397a943b6ec8690097b244e42
MD5 5c350bfbf990a02d377597df307a29cb
SHA1 d95becc0a4834989f48d68ccab6c9cfec81e538c
SHA512 23b5268c1da3f7ef091aa9effeb9d66de49f980b19eba55110df33f38d7cebff0d39d0754eb03e23a18a13a922723769d6868e4fb365fbb4b1b24eaf633b94c8
SSDEEP 3072:Y0dBI50nA6YsEKOlwi9CEELLCLL8+N+pywBcs033RA0BQo/fK:FhXhOwi9CXLLCLL8+N+useBQo/y
TLSH
T1B0743F5A151476E3C6D9953FEC065AEE300239C91B9C968205F9131DE6F20F3F9AE738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc120.dll

Path C:\Users\Admin\AppData\Local\Temp\mfc120.dll
Size 4.2MB
SHA256 5855b0e1e04f2dbff129c8d9f6954c0bd538e4dc12addf7aa5531ab073e8beee
MD5 df9a5545501a2442ca54c73c6f4de827
SHA1 94e5abde9625c59a140249f52bdcdcfabacd7a0e
SHA512 f2abc119990a9ae19282005f416b714c23a5e48265476317e6e0d7ec8d9e748a8f02c135e904f77a38544c283d9d2a34779f5432eec81dedd4cdab0a462206a5
SSDEEP 98304:rMaXhLgwfbs7C65C92AuYZNJ6jc34/y+fhULFLOAkGkzdnEVomFHKnPN:KYZNJ6jc346+qLFLOyomFHKnPN
TLSH
T13C26BF02BFE980E9C66F13328D59773CA6EEBE94F830064722553F2FF9726026919157
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads