Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 07:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_1f2f250d4208ec13b8c2c571d74c34dd_elex_maze_remcos_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_1f2f250d4208ec13b8c2c571d74c34dd_elex_maze_remcos_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-05_1f2f250d4208ec13b8c2c571d74c34dd_elex_maze_remcos_stealc.exe
- Size 395KB
- Sample260805-hypnwafe53
- SHA256 a8da236421bed15adedf0de9bd8b1abb92d76d3092ee94b82e12eb39a13006d2
- MD5 1f2f250d4208ec13b8c2c571d74c34dd
- SHA1 679c1e6aa944a2910362a52e31e89a69dc153a4d
- SHA512 ccb49c85b8e06f40f783615add0d38af288d698fcb7be1af128f77999f9b43979d2f8454aba9d1890bf5b2e48c751aebeec65ba21598b3a340db78e0dafcc8d5
- SSDEEP 12288:ga2KiAwmVH4Ke7hVFF9+Ip5zqmjVB4OUg:ilXKkhnj+Ip53TP
- TLSH T1DC849C22F5C0C131D1B2467A9C78FB3152FCB9B01F6569DBB7C80A894AB6DE06632753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 7572 u3cf3zce4xloose2zv5.exe 11016 jxepaauabeup.exe 14480 whipoxyzsgn.exe 17936 jxepaauabeup.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\oyeoubxr\cnbcaupul jxepaauabeup.exe File created C:\Windows\oyeoubxr\cnbcaupul 2026-08-05_1f2f250d4208ec13b8c2c571d74c34dd_elex_maze_remcos_stealc.exe File created C:\Windows\oyeoubxr\cnbcaupul u3cf3zce4xloose2zv5.exe File created C:\Windows\oyeoubxr\cnbcaupul jxepaauabeup.exe File created C:\Windows\oyeoubxr\cnbcaupul whipoxyzsgn.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_1f2f250d4208ec13b8c2c571d74c34dd_elex_maze_remcos_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u3cf3zce4xloose2zv5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxepaauabeup.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 11016 jxepaauabeup.exe 11016 jxepaauabeup.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe 14480 whipoxyzsgn.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4944 wrote to memory of 7572 4944 2026-08-05_1f2f250d4208ec13b8c2c571d74c34dd_elex_maze_remcos_stealc.exe 88 PID 11016 wrote to memory of 14480 11016 jxepaauabeup.exe 90 PID 7572 wrote to memory of 17936 7572 u3cf3zce4xloose2zv5.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_1f2f250d4208ec13b8c2c571d74c34dd_elex_maze_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_1f2f250d4208ec13b8c2c571d74c34dd_elex_maze_remcos_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\oyeoubxr\u3cf3zce4xloose2zv5.exe"C:\oyeoubxr\u3cf3zce4xloose2zv5.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7572 -
C:\oyeoubxr\jxepaauabeup.exe"C:\oyeoubxr\jxepaauabeup.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:17936
-
-
-
C:\oyeoubxr\jxepaauabeup.exeC:\oyeoubxr\jxepaauabeup.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:11016 -
C:\oyeoubxr\whipoxyzsgn.exeopjwmwnewace "c:\oyeoubxr\jxepaauabeup.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:14480
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\oyeoubxr\cnbcaupul
- Size 11B
- SHA256 9f6a147f704a78155944a19239bf6b00b469df06fcbc0a12a9168fee7980e70f
- MD5 b155099c0abffe37e08b0bfae1aef676
- SHA1 944707834fb579990f1dd80067fc5813eb27c840
- SHA512 15113c5f599084c98653ef93138408edce230f4859fd33a2cc6143e6c6e77c37b6e4963680d9e7bc1a0aa3bc4b03e6dda7401b68aba25958b53ed6103517fda5
- MD5 SHA1 SHA512
- Path C:\oyeoubxr\rcxv2fpasqp
- Size 4B
- SHA256 63fa48599d59f973ac0e1493f61102b596591abe5d52a6f848877905e3503ae8
- MD5 0dd0b09d88007666f1e6bc14b780f3d4
- SHA1 7d865d3d09ecd7e752e90f0ad3aacc573f514ab2
- SHA512 3671c15b766d11dcb8c9b6b63e5003cbc09aec9b8c6b580557ccdd4c56993830f7f568f74c560f99cba381f19c7cf9647b4c2a569431bbee89d1e079f217e70f
- MD5 SHA1 SHA512
- Path C:\oyeoubxr\u3cf3zce4xloose2zv5.exe
- Size 395KB
- SHA256 a8da236421bed15adedf0de9bd8b1abb92d76d3092ee94b82e12eb39a13006d2
- MD5 1f2f250d4208ec13b8c2c571d74c34dd
- SHA1 679c1e6aa944a2910362a52e31e89a69dc153a4d
- SHA512 ccb49c85b8e06f40f783615add0d38af288d698fcb7be1af128f77999f9b43979d2f8454aba9d1890bf5b2e48c751aebeec65ba21598b3a340db78e0dafcc8d5
- SSDEEP 12288:ga2KiAwmVH4Ke7hVFF9+Ip5zqmjVB4OUg:ilXKkhnj+Ip53TP
- TLSH T1DC849C22F5C0C131D1B2467A9C78FB3152FCB9B01F6569DBB7C80A894AB6DE06632753
- MD5 SHA1 SHA512 SSDEEP TLSH