Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 15:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_72cb1da69f47535a37a5b82a284c2add_elex_maze.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_72cb1da69f47535a37a5b82a284c2add_elex_maze.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-22_72cb1da69f47535a37a5b82a284c2add_elex_maze.exe
- Size 647KB
- Sample260722-s51ptsvsds
- SHA256 4554c7c91d8b873ca73dd0161d838cd28269906f20acb0a0e46540a91fe0b7a6
- MD5 72cb1da69f47535a37a5b82a284c2add
- SHA1 c3af36dea0151400d94221b7bfd820a3f1fb2451
- SHA512 a9b45c3a8be87dba541c1e0a77904d80ac3d30316acea49c40b403c8f883e2d6d0d21d3c6c0a9b09aa39fcd09ee23ed1f61b0c1007923959eeb223b7c0d46694
- SSDEEP 12288:x7nHUAtiC7Fk6+5S0kyB2SX9R9Ts86L/Wh5qQTHqNfQcOLS1:x7nHUA0Chk6+5JkoRRpsD7WqjD
- TLSH T1B3E48C10B543A2B3C87208B6455CF7261A39BD751F1D8BE3EBEB4A4A69F71C08233657
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 4568 gnshq3zbusqam6vgnp8qnsl.exe 5904 ctigpym.exe 4072 qdbrctjtf.exe 4640 ctigpym.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\fujofupgyoazs\dxigba2 qdbrctjtf.exe File created C:\Windows\fujofupgyoazs\dxigba2 ctigpym.exe File created C:\Windows\fujofupgyoazs\dxigba2 2026-07-22_72cb1da69f47535a37a5b82a284c2add_elex_maze.exe File created C:\Windows\fujofupgyoazs\dxigba2 gnshq3zbusqam6vgnp8qnsl.exe File created C:\Windows\fujofupgyoazs\dxigba2 ctigpym.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_72cb1da69f47535a37a5b82a284c2add_elex_maze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gnshq3zbusqam6vgnp8qnsl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctigpym.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5904 ctigpym.exe 5904 ctigpym.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe 4072 qdbrctjtf.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4208 wrote to memory of 4568 4208 2026-07-22_72cb1da69f47535a37a5b82a284c2add_elex_maze.exe 89 PID 5904 wrote to memory of 4072 5904 ctigpym.exe 91 PID 4568 wrote to memory of 4640 4568 gnshq3zbusqam6vgnp8qnsl.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_72cb1da69f47535a37a5b82a284c2add_elex_maze.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_72cb1da69f47535a37a5b82a284c2add_elex_maze.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\fujofupgyoazs\gnshq3zbusqam6vgnp8qnsl.exe"C:\fujofupgyoazs\gnshq3zbusqam6vgnp8qnsl.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\fujofupgyoazs\ctigpym.exe"C:\fujofupgyoazs\ctigpym.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4640
-
-
-
C:\fujofupgyoazs\ctigpym.exeC:\fujofupgyoazs\ctigpym.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\fujofupgyoazs\qdbrctjtf.exebblalgbjm4ic "c:\fujofupgyoazs\ctigpym.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4072
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\fujofupgyoazs\dxigba2
- Size 9B
- SHA256 efd061af39732c611c4a39dad064f84ad76eefcf66ad10e97572557a5ae49945
- MD5 7393ef240c182ac5d10a7e8cdc62b91f
- SHA1 4145c3c8f18111a31c66ff194772053de9df5366
- SHA512 877a2023679799e73c1c6cd071197dd3a0ba45c584c124c146cc2be509e76b71d554d80b5eba9ec8fe78fb353e0d4523daa1a7d66b73b2be53c05b5fcd31783c
- MD5 SHA1 SHA512
- Path C:\fujofupgyoazs\gnshq3zbusqam6vgnp8qnsl.exe
- Size 647KB
- SHA256 4554c7c91d8b873ca73dd0161d838cd28269906f20acb0a0e46540a91fe0b7a6
- MD5 72cb1da69f47535a37a5b82a284c2add
- SHA1 c3af36dea0151400d94221b7bfd820a3f1fb2451
- SHA512 a9b45c3a8be87dba541c1e0a77904d80ac3d30316acea49c40b403c8f883e2d6d0d21d3c6c0a9b09aa39fcd09ee23ed1f61b0c1007923959eeb223b7c0d46694
- SSDEEP 12288:x7nHUAtiC7Fk6+5S0kyB2SX9R9Ts86L/Wh5qQTHqNfQcOLS1:x7nHUA0Chk6+5JkoRRpsD7WqjD
- TLSH T1B3E48C10B543A2B3C87208B6455CF7261A39BD751F1D8BE3EBEB4A4A69F71C08233657
- MD5 SHA1 SHA512 SSDEEP TLSH