Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 04:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_e171f2b963397c542121a504a6e6dde4_elex_maze.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_e171f2b963397c542121a504a6e6dde4_elex_maze.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-30_e171f2b963397c542121a504a6e6dde4_elex_maze.exe
- Size 589KB
- Sample260730-ffw9wstsdz
- SHA256 085ac7c95b35f74bd8aa2ebf7ca54ebb723a3716e32f5ab9c8a252deda859d4c
- MD5 e171f2b963397c542121a504a6e6dde4
- SHA1 b773854cdfb382177f6f7040711bd3f81f63a72c
- SHA512 59d92949d9e67ae52bf996cec962efd035b9c7683d2f686912cc86a2a323927c02bdf13e98e5f02b534c39831f5baff119c7b63d2ec55274dd4a9852da161912
- SSDEEP 12288:a+kr1s7TlPvDaQYYQwi7BcxqmNtKlUvJ9mf/hPIMvk:a+q1UTlPv/Qn7yxqAKlOJ9mVK
- TLSH T1ACD49D01B5A3A1F3D46224F34169E63A1A367D360F398BE3EBCB5E2549F65C0D633642
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 5156 flxp3zbehxwozkxlnyis.exe 4996 tjkpvftdbzb.exe 1776 ekmyiwdjj.exe 2420 tjkpvftdbzb.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\gsljnrbxokef\ztxkgdht 2026-07-30_e171f2b963397c542121a504a6e6dde4_elex_maze.exe File created C:\Windows\gsljnrbxokef\ztxkgdht flxp3zbehxwozkxlnyis.exe File created C:\Windows\gsljnrbxokef\ztxkgdht tjkpvftdbzb.exe File created C:\Windows\gsljnrbxokef\ztxkgdht ekmyiwdjj.exe File created C:\Windows\gsljnrbxokef\ztxkgdht tjkpvftdbzb.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_e171f2b963397c542121a504a6e6dde4_elex_maze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxp3zbehxwozkxlnyis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjkpvftdbzb.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4996 tjkpvftdbzb.exe 4996 tjkpvftdbzb.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe 1776 ekmyiwdjj.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1192 wrote to memory of 5156 1192 2026-07-30_e171f2b963397c542121a504a6e6dde4_elex_maze.exe 88 PID 4996 wrote to memory of 1776 4996 tjkpvftdbzb.exe 91 PID 5156 wrote to memory of 2420 5156 flxp3zbehxwozkxlnyis.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_e171f2b963397c542121a504a6e6dde4_elex_maze.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_e171f2b963397c542121a504a6e6dde4_elex_maze.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\gsljnrbxokef\flxp3zbehxwozkxlnyis.exe"C:\gsljnrbxokef\flxp3zbehxwozkxlnyis.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\gsljnrbxokef\tjkpvftdbzb.exe"C:\gsljnrbxokef\tjkpvftdbzb.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2420
-
-
-
C:\gsljnrbxokef\tjkpvftdbzb.exeC:\gsljnrbxokef\tjkpvftdbzb.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\gsljnrbxokef\ekmyiwdjj.exeupt1avnetbef "c:\gsljnrbxokef\tjkpvftdbzb.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1776
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\gsljnrbxokef\flxp3zbehxwozkxlnyis.exe
- Size 589KB
- SHA256 085ac7c95b35f74bd8aa2ebf7ca54ebb723a3716e32f5ab9c8a252deda859d4c
- MD5 e171f2b963397c542121a504a6e6dde4
- SHA1 b773854cdfb382177f6f7040711bd3f81f63a72c
- SHA512 59d92949d9e67ae52bf996cec962efd035b9c7683d2f686912cc86a2a323927c02bdf13e98e5f02b534c39831f5baff119c7b63d2ec55274dd4a9852da161912
- SSDEEP 12288:a+kr1s7TlPvDaQYYQwi7BcxqmNtKlUvJ9mf/hPIMvk:a+q1UTlPv/Qn7yxqAKlOJ9mVK
- TLSH T1ACD49D01B5A3A1F3D46224F34169E63A1A367D360F398BE3EBCB5E2549F65C0D633642
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\gsljnrbxokef\ztxkgdht
- Size 11B
- SHA256 bdd4a9f562e535f3985e0b3940fc828270074b58c1d34fa627be4c236bcde01b
- MD5 d6586c0b41e06c83d8e5a90fd80c9361
- SHA1 d4c2b4557fd295f61cfd15a358531836144566a0
- SHA512 b5068828c166b2c4237b045ba5c40bd53e5513a8ca7e8926fe7e102d01c5b19af4d5754a47f4379d2e23862c4d100907a7f11d30e11af967a59dc072d0195aac
- MD5 SHA1 SHA512