5c9d275df06ca705fe78a11922974370500e7571eba03849109e21564396ed81

General

Target
2026-07-21_248f87bca10d4faf51c2e5525d1fead8_bkransomware_elex_maze_rhadamanthys.exe
Size 176KB
Sample260722-bfg3rahc73
SHA256 5c9d275df06ca705fe78a11922974370500e7571eba03849109e21564396ed81
MD5 248f87bca10d4faf51c2e5525d1fead8
SHA1 c836c2047766b737b45203655bf3bf9f93951f9a
SHA512 b7d0344632d213426b3ad2456fdea8c6093b2c0d3528c9dece0c2ad7322ee5f76c64219dc66807999d8d8ecbaea017c2e781a2bc482ccd4d04cbf2e4fecd67c2
SSDEEP 3072:ZxpAyazIlyazTtz7Dcykt2xf4s6OmOZoRTIaFiGyA8+:RZMazFqgxH2OZPasNAT
TLSH
T15604E00372E69171E4B70A7209A5CE5547AF7EB66EB1CD8733C0618D0A725C08F39B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1256	QZVepMrxRKRRHpu.exe
4104	CTS.exe
5748	CTS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2026-07-21_248f87bca10d4faf51c2e5525d1fead8_bkransomware_elex_maze_rhadamanthys.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2026-07-21_248f87bca10d4faf51c2e5525d1fead8_bkransomware_elex_maze_rhadamanthys.exe
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_248f87bca10d4faf51c2e5525d1fead8_bkransomware_elex_maze_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	2026-07-21_248f87bca10d4faf51c2e5525d1fead8_bkransomware_elex_maze_rhadamanthys.exe
Token: SeDebugPrivilege	4104	CTS.exe
Token: SeDebugPrivilege	5748	CTS.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1256	2976	2026-07-21_248f87bca10d4faf51c2e5525d1fead8_bkransomware_elex_maze_rhadamanthys.exe	89
PID 2976 wrote to memory of 4104	2976	2026-07-21_248f87bca10d4faf51c2e5525d1fead8_bkransomware_elex_maze_rhadamanthys.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-21_248f87bca10d4faf51c2e5525d1fead8_bkransomware_elex_maze_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_248f87bca10d4faf51c2e5525d1fead8_bkransomware_elex_maze_rhadamanthys.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\QZVepMrxRKRRHpu.exe
  C:\Users\Admin\AppData\Local\Temp\QZVepMrxRKRRHpu.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4104

C:\Windows\CTS.exe
C:\Windows\CTS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

officeclicktorun.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml
Size 557KB
SHA256 97d043b45c9d030205bf6b65f4f6711edcd7a5295086f034fa2678ff2e61e2f3
MD5 c1b66c5753832b878afcf64f0e8716fa
SHA1 bc7a6f3ab994848c53d5a4ffd8da23e2e1e00cf6
SHA512 4354a8118b5f26452275a5cbf9e2e274fa1d2c0a0dd7988ae36f0158e60fe4071294ddf128c0554a02a3c75589aa34bdde3333024d01f69b7e92708f5367a683
SSDEEP 12288:RS0MpiuxOHCSK8JGRQz8QS99A/NsPENUCt:TMAAOdAQz9SsycNft
TLSH
T1A4C41203B6C1C274E877173585B1EAE2017FBC765AB65E937398608E4C204C15EAEBA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QZVepMrxRKRRHpu.exe

Path C:\Users\Admin\AppData\Local\Temp\QZVepMrxRKRRHpu.exe
Size 105KB
SHA256 81a618f21cb87db9076134e70388b6e9cb7c2106739011b6a51772d22cae06b7
MD5 19d621a4b2d26d8fa8002548a1b04a32
SHA1 0d0c5e3b06f56ad12a77da46ab3fdab81acda628
SHA512 78da0a9f19b4eb39db3eb678ac71e170cf279deb37282e9f3069e74c8bb2597c6067eb14810bd67f7a43ddf1395ae19157456163c88554d21a01113be34136a9
SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+G:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+
TLSH
T1AAB36A0A33D420FDD0575274CDB69A15D3B2BC2A4274934F27A47B6A1F733926D2E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 71KB
SHA256 479450abbbb7bded1c00cceb20497fc90f6156325b86401505b50739075a63ba
MD5 f53a5c9ca2e3837485afaba90a4cd7e2
SHA1 5b02231c979d9af0990294094113aca1de3fb8b4
SHA512 4c0c8ec807e458f5fe9407796307d43ae109047a133d08ef3ce86b726646749dcce6802a85a9a3186c9837afd1e8b0d040f74d6034865a1e2a62f28c4e8e3c78
SSDEEP 1536:Fc897EsWjcd9w+AyabjDbxE+MwmvlDuazT:ZxpAyazIlyazT
TLSH
T141636B03B6D2C171E4B70A7649B8CE51067FBE765EB18D5B33C4218E49752C08E3ABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads