c77c05b8fb50b49fb0e760fbb9b58f9dc01f123b672523e273be305af68ed8de

General

Target
2026-07-30_5b470aa31ce12066e7df4d8b0086bf71_bkransomware_elex_maze_rhadamanthys.exe
Size 103KB
Sample260730-2fa8bagf52
SHA256 c77c05b8fb50b49fb0e760fbb9b58f9dc01f123b672523e273be305af68ed8de
MD5 5b470aa31ce12066e7df4d8b0086bf71
SHA1 fcfb82ad06c8e3baeb9fd0b912d7a84326708972
SHA512 91c6dfadf172d453482bfd3461fe946b5e83ddddfb1b853f214faf29db4590262cd273ce2e978dc93d44adba7db51ab6c0379b516f465bddecbf7ce7dc82d354
SSDEEP 1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazTvLbacjJTkqLjlm:ZRpAyazIliazTjbUqHE
TLSH
T11CA3AE03B6D2C171E0B7063648B5DE640A7FBD365EB18EA77384258D09752C09E3ABB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5416	CTS.exe
4320	CTS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2026-07-30_5b470aa31ce12066e7df4d8b0086bf71_bkransomware_elex_maze_rhadamanthys.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	2026-07-30_5b470aa31ce12066e7df4d8b0086bf71_bkransomware_elex_maze_rhadamanthys.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_5b470aa31ce12066e7df4d8b0086bf71_bkransomware_elex_maze_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5500	2026-07-30_5b470aa31ce12066e7df4d8b0086bf71_bkransomware_elex_maze_rhadamanthys.exe
Token: SeDebugPrivilege	5416	CTS.exe
Token: SeDebugPrivilege	4320	CTS.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5500 wrote to memory of 5416	5500	2026-07-30_5b470aa31ce12066e7df4d8b0086bf71_bkransomware_elex_maze_rhadamanthys.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-30_5b470aa31ce12066e7df4d8b0086bf71_bkransomware_elex_maze_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_5b470aa31ce12066e7df4d8b0086bf71_bkransomware_elex_maze_rhadamanthys.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5500
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5416

C:\Windows\CTS.exe
C:\Windows\CTS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

officeclicktorun.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml
Size 557KB
SHA256 2b93d7e923e880a0b56cb44fefc6ce2a50df3441654652d032fe82f02afc8a77
MD5 b2d54b1db5c0db47c4f939df8937b4f3
SHA1 f224c634a8da7ebace95fb79cd83668fccdb5a55
SHA512 cf793285ff0d1a7989f66f5c7707b3ad4a52d975bfb7ad957d901349b05cf8013306c9af7bb193add2f34d1fbe1ae7ea40b766e54aa6ad1f7a8b6bb1cf83b9c9
SSDEEP 12288:xC0H3jYIzBbogoK+vnqDPLV9e645N15wz4grfKghC25whNkTn:DTDhUOPLVY15N1qz4QfKghDwhmn
TLSH
T1D8C4120336E2C174D0F686B544E4CE712AAF7E316BBA0E6776A4348E09745C0DE797A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xY3oyZkAnIOoW0F.exe

Path C:\Users\Admin\AppData\Local\Temp\xY3oyZkAnIOoW0F.exe
Size 103KB
SHA256 8d0b7449ecf4613538ac5af38c9fc874468fcf933c75065b3a8ab84313a26431
MD5 83a4117ac84800e3928fc413334a26fc
SHA1 19ff42ccc03e7ca1d3b20f4f5e3c5de06e59f67b
SHA512 52a4147a53aa810ae8f31192ce6601a6c20aec2c94c0dcaa4ac103012d07fdf8dffcfbc61553634a97f559e3e44ef9a86a4381536710e91e5434d7c3a9859140
SSDEEP 1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazTVpoQIWtxiOR6FRsyjr7omZTIrw1gKI:ZRpAyazIliazTcNnBGyjDZTIugKI
TLSH
T144A39D03B6C2D570E0B70A7248B5CE510A7FBE765FB18E572384118D4A766C09E3AB7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 71KB
SHA256 b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc
MD5 f9d4ab0a726adc9b5e4b7d7b724912f1
SHA1 3d42ca2098475924f70ee4a831c4f003b4682328
SHA512 22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432
SSDEEP 1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazT:ZRpAyazIliazT
TLSH
T176636B03B6D2C171E4B70A7649B8CE51067FBE765EB18D5B33C4218E49752C08E3ABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads