Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 07:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_1f2f250d4208ec13b8c2c571d74c34dd_elex_maze_remcos_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_1f2f250d4208ec13b8c2c571d74c34dd_elex_maze_remcos_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-05_1f2f250d4208ec13b8c2c571d74c34dd_elex_maze_remcos_stealc.exe
- Size 395KB
- Sample260805-hypnwafe53
- SHA256 a8da236421bed15adedf0de9bd8b1abb92d76d3092ee94b82e12eb39a13006d2
- MD5 1f2f250d4208ec13b8c2c571d74c34dd
- SHA1 679c1e6aa944a2910362a52e31e89a69dc153a4d
- SHA512 ccb49c85b8e06f40f783615add0d38af288d698fcb7be1af128f77999f9b43979d2f8454aba9d1890bf5b2e48c751aebeec65ba21598b3a340db78e0dafcc8d5
- SSDEEP 12288:ga2KiAwmVH4Ke7hVFF9+Ip5zqmjVB4OUg:ilXKkhnj+Ip53TP
- TLSH T1DC849C22F5C0C131D1B2467A9C78FB3152FCB9B01F6569DBB7C80A894AB6DE06632753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 6956 u3cf3zaen5loose2zv5.exe 10360 jxepaauabeup.exe 13808 whipoxyzsgn.exe 17260 jxepaauabeup.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\oyeoubxr\cnbcaupul jxepaauabeup.exe File created C:\Windows\oyeoubxr\cnbcaupul whipoxyzsgn.exe File created C:\Windows\oyeoubxr\cnbcaupul jxepaauabeup.exe File created C:\Windows\oyeoubxr\cnbcaupul 2026-08-05_1f2f250d4208ec13b8c2c571d74c34dd_elex_maze_remcos_stealc.exe File created C:\Windows\oyeoubxr\cnbcaupul u3cf3zaen5loose2zv5.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_1f2f250d4208ec13b8c2c571d74c34dd_elex_maze_remcos_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u3cf3zaen5loose2zv5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxepaauabeup.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 10360 jxepaauabeup.exe 10360 jxepaauabeup.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe 13808 whipoxyzsgn.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2288 wrote to memory of 6956 2288 2026-08-05_1f2f250d4208ec13b8c2c571d74c34dd_elex_maze_remcos_stealc.exe 88 PID 10360 wrote to memory of 13808 10360 jxepaauabeup.exe 90 PID 6956 wrote to memory of 17260 6956 u3cf3zaen5loose2zv5.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_1f2f250d4208ec13b8c2c571d74c34dd_elex_maze_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_1f2f250d4208ec13b8c2c571d74c34dd_elex_maze_remcos_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\oyeoubxr\u3cf3zaen5loose2zv5.exe"C:\oyeoubxr\u3cf3zaen5loose2zv5.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6956 -
C:\oyeoubxr\jxepaauabeup.exe"C:\oyeoubxr\jxepaauabeup.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:17260
-
-
-
C:\oyeoubxr\jxepaauabeup.exeC:\oyeoubxr\jxepaauabeup.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:10360 -
C:\oyeoubxr\whipoxyzsgn.exeopjwmwnewace "c:\oyeoubxr\jxepaauabeup.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:13808
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\oyeoubxr\cnbcaupul
- Size 11B
- SHA256 9f6a147f704a78155944a19239bf6b00b469df06fcbc0a12a9168fee7980e70f
- MD5 b155099c0abffe37e08b0bfae1aef676
- SHA1 944707834fb579990f1dd80067fc5813eb27c840
- SHA512 15113c5f599084c98653ef93138408edce230f4859fd33a2cc6143e6c6e77c37b6e4963680d9e7bc1a0aa3bc4b03e6dda7401b68aba25958b53ed6103517fda5
- MD5 SHA1 SHA512
- Path C:\oyeoubxr\rcxv2fpasqp
- Size 4B
- SHA256 90e7f8e25cfdb355cd0f3be42089719633ce108811a57c48afb98d52ae0f4d55
- MD5 82349bb35222c09a342c727a4ef35892
- SHA1 3133404ff5e7e1ffc7d2cda85f4d9ff4fdac5848
- SHA512 fd85fa32e64589ceea80fd61307f2d0f6c0263f261343ff2be5ed6a4dd679de4fe00c7863abb397936fb7ceeaffe1c2b4acddc78d715f05d4854fa7621ccac61
- MD5 SHA1 SHA512
- Path C:\oyeoubxr\u3cf3zaen5loose2zv5.exe
- Size 395KB
- SHA256 a8da236421bed15adedf0de9bd8b1abb92d76d3092ee94b82e12eb39a13006d2
- MD5 1f2f250d4208ec13b8c2c571d74c34dd
- SHA1 679c1e6aa944a2910362a52e31e89a69dc153a4d
- SHA512 ccb49c85b8e06f40f783615add0d38af288d698fcb7be1af128f77999f9b43979d2f8454aba9d1890bf5b2e48c751aebeec65ba21598b3a340db78e0dafcc8d5
- SSDEEP 12288:ga2KiAwmVH4Ke7hVFF9+Ip5zqmjVB4OUg:ilXKkhnj+Ip53TP
- TLSH T1DC849C22F5C0C131D1B2467A9C78FB3152FCB9B01F6569DBB7C80A894AB6DE06632753
- MD5 SHA1 SHA512 SSDEEP TLSH