7da01b980b699aafbfbfb71387974d1ce70589c68fabf9b10144f7a91826dd4a

General

Target
2026-07-19_9acee8d94eb1ea4694df9c55f565b9c6_bkransomware_elex_maze_rhadamanthys.exe
Size 557KB
Sample260720-a94yyads6x
SHA256 7da01b980b699aafbfbfb71387974d1ce70589c68fabf9b10144f7a91826dd4a
MD5 9acee8d94eb1ea4694df9c55f565b9c6
SHA1 635e4e2ff2c6dcaf2b1b2b8ea63271cc7ad4ef72
SHA512 0661e8ea1a13b4909e96d73ead30c6f1dfc347d8400a01b1b405e8bec808c087d57719e86c067da704500b31921f9a7edfc9ef04722f20e891aefa7e9f42a27f
SSDEEP 12288:hS0+SMtl17ww6GRgfeuISBtfGflRCKvD9GINHgGCjDLwj8:D+PBwSu4SaeKvxhzGIo
TLSH
T178C4225371D1C070E5A64A364A34C9684BBFBA7625B5EC8B7384200E85B87C09F79F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1676	CTS.exe
2848	CTS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2026-07-19_9acee8d94eb1ea4694df9c55f565b9c6_bkransomware_elex_maze_rhadamanthys.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2026-07-19_9acee8d94eb1ea4694df9c55f565b9c6_bkransomware_elex_maze_rhadamanthys.exe
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_9acee8d94eb1ea4694df9c55f565b9c6_bkransomware_elex_maze_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	2026-07-19_9acee8d94eb1ea4694df9c55f565b9c6_bkransomware_elex_maze_rhadamanthys.exe
Token: SeDebugPrivilege	1676	CTS.exe
Token: SeDebugPrivilege	2848	CTS.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1676	4884	2026-07-19_9acee8d94eb1ea4694df9c55f565b9c6_bkransomware_elex_maze_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_9acee8d94eb1ea4694df9c55f565b9c6_bkransomware_elex_maze_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_9acee8d94eb1ea4694df9c55f565b9c6_bkransomware_elex_maze_rhadamanthys.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1676

C:\Windows\CTS.exe
C:\Windows\CTS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

officeclicktorun.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml
Size 557KB
SHA256 450758abfe6737cf60c7ad0c9cb9c057939e7a73f8c9fcb14deb07e02480b787
MD5 60945ecb09db919a5ce671736552cc63
SHA1 78bf0b6de29e9d351afdc1627ebf47452455fd3b
SHA512 06d73a5021ac5af1d3731f36f5ab0c92a3b4bfc0bf181de9c335da8039f8ff520792fe47deccc473479550de08f6ba7ff9c1f65be671d8a6cc77310d8daefebc
SSDEEP 12288:hS0UlimT7KtB9kkt9BsMRMdKNzSI+uE8rz1U1QUzQueXF5UGG:D51kkt9Bp+dK5wuHKQueXF5UL
TLSH
T1DDC412173AD790B1F1A709758194CD20007FBE329BA1ED4F63D8918D4AB52E09E36B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kJDMXOTfctcRwBc.exe

Path C:\Users\Admin\AppData\Local\Temp\kJDMXOTfctcRwBc.exe
Size 557KB
SHA256 f88f3372009fed9329c95366f91df45fa2ef63b3639d7bdf1c82dc8887b380a2
MD5 b7dd798a91440483e0167df8d13fc324
SHA1 33df55f522c2911c5ac95de0d0cf5fd8a036c9a6
SHA512 08e4dd98a6f28385d27fe3ddb7e683f8fb392e215ad8cb18a8db46744f5c6b9485a648d623836992d3137d5714c3a6560f12babafa29d244669c6b97c702be33
SSDEEP 12288:hS0ZgZY4zvYHT5Xgq8hKdJa26CfPd2/0RbLG3znxThy8SyY/b:D2BvYHTpgLhkJ9d20Rb6jnhI8S7
TLSH
T130C41203B5D29079F8B3067A89649E611A6FFCB68FF449C73384314E05751C29CB6B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 71KB
SHA256 075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163
MD5 66df4ffab62e674af2e75b163563fc0b
SHA1 dec8a197312e41eeb3cfef01cb2a443f0205cd6e
SHA512 1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25
SSDEEP 1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazT:ZhpAyazIlyazT
TLSH
T119636B03B6D2C171E4B70A7649B8CE51067FBE765EB18D5B33C4218E49752C08E3ABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads