f77910cefb9fce6843d0fba735bc1b129275b0446df769464cdd4bdd34233741

General

Target
2026-08-02_518c22db28d340ce6a1338e7cf4d1d1a_bkransomware_elex_maze_rhadamanthys.exe
Size 557KB
Sample260802-w9vk6aeb75
SHA256 f77910cefb9fce6843d0fba735bc1b129275b0446df769464cdd4bdd34233741
MD5 518c22db28d340ce6a1338e7cf4d1d1a
SHA1 b5afe9effb1c7278b7d7a51f02a8e6d0f72d1f52
SHA512 7e5ab4e7e3837c9926508cc49c437762620ee42412f2d42896e46191fc07a0ecbab3972dc3805998bf9f74af6ba7b6915b55aa32f51fc7684bd1634e5cc0ea43
SSDEEP 12288:xC0qZQY3HRvhhW5IZSYpghXPzMTecRElorDK6wC:DqZ5HR5hbghXPzLcRCorDtwC
TLSH
T165C41213B6C58232F07B5A3259695D702E6F7D791FA2DD5733C4008E82395C08B7ABAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4304	CTS.exe
2936	CTS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2026-08-02_518c22db28d340ce6a1338e7cf4d1d1a_bkransomware_elex_maze_rhadamanthys.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2026-08-02_518c22db28d340ce6a1338e7cf4d1d1a_bkransomware_elex_maze_rhadamanthys.exe
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_518c22db28d340ce6a1338e7cf4d1d1a_bkransomware_elex_maze_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	2026-08-02_518c22db28d340ce6a1338e7cf4d1d1a_bkransomware_elex_maze_rhadamanthys.exe
Token: SeDebugPrivilege	4304	CTS.exe
Token: SeDebugPrivilege	2936	CTS.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 4304	2776	2026-08-02_518c22db28d340ce6a1338e7cf4d1d1a_bkransomware_elex_maze_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_518c22db28d340ce6a1338e7cf4d1d1a_bkransomware_elex_maze_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_518c22db28d340ce6a1338e7cf4d1d1a_bkransomware_elex_maze_rhadamanthys.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4304

C:\Windows\CTS.exe
C:\Windows\CTS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

officeclicktorun.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml
Size 557KB
SHA256 c8ae4b814a2663751ee6e1f5e8d349be0ad85713abd301f798c8db807131126d
MD5 94b3df0beff415e309a64d34227adf2d
SHA1 dfe282635041fa3c9ff088da416a16c7b4eabf7c
SHA512 f40f679c8293f6d29fd8def65eb7d292e2f449cbb329f6a79f3da950214d5ccc4de9183c799d15b8498526d2d0b93215f5ff5a2b7a6d98cac7382a5d89a27850
SSDEEP 12288:xC0LWPe1BY4xvMCgs1GCu8Rmx7brzWQ2FaC2XKybJSr+:DaPejYU0l8Ex7/vUa76ybJSq
TLSH
T157C42213B9C2C1B1D5F3673408E8CF50566FBA769EB38D0773A4219E4A616C05E36BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

y786chxJHbn6Z83.exe

Path C:\Users\Admin\AppData\Local\Temp\y786chxJHbn6Z83.exe
Size 557KB
SHA256 608fd4c3a92e02195095f7efdcd59c54c0bf331e2f1bb1ea96518c5f4213ac72
MD5 7f3cccc92f999ccdf508561cc6e10ad1
SHA1 90020b535c9602438571eff2d2e0bfc09621f0b9
SHA512 50123f49fc5bc7db46d7cb3a0c57644f7d8a54bf2e8b4ff98e9fff51ee89365d93b68f09d5bbee1e8d29be1c9e8fd6029affb885a9aaab38d5bf31d6a6283c5e
SSDEEP 12288:xC0zwduj7DLSjusomIpMiAfaNquCmhlnPPKyBUTmaqvHBq:D+k3LAIXyFmhPKyqKk
TLSH
T15DC42313B6C6C0F5F07A457345A68E18866FBDBA8FA54E03A3E0606C06361D18D7BF97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 71KB
SHA256 b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc
MD5 f9d4ab0a726adc9b5e4b7d7b724912f1
SHA1 3d42ca2098475924f70ee4a831c4f003b4682328
SHA512 22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432
SSDEEP 1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazT:ZRpAyazIliazT
TLSH
T176636B03B6D2C171E4B70A7649B8CE51067FBE765EB18D5B33C4218E49752C08E3ABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads