a23ebb304a51691c0f0b27d94d225e761d396e6aab818ac3fe0f2c1e0d867aaa

General

Target
2026-08-05_c2a490330432421832bf541b9d70db3b_bkransomware_elex_maze_rhadamanthys.exe
Size 557KB
Sample260805-mwb28azvcx
SHA256 a23ebb304a51691c0f0b27d94d225e761d396e6aab818ac3fe0f2c1e0d867aaa
MD5 c2a490330432421832bf541b9d70db3b
SHA1 41520e15b9684243d36580a3212ddcfc47772da6
SHA512 ac72418b32e4d60224b204f6783e387f515060da97565ea6660d467825197e29bb440bcbae5fa1f06d3e638106de0a7a6245d88f04c2e30b6d05a551a561254a
SSDEEP 12288:xC0+linKo90YsbAotZhwKWbnjmAZDSZJrTD7rVR90mE3iueBUJZN:DQe9ybA8+ZnjyHDJd0z1JZN
TLSH
T1D7C4121376D2C070F07B4AB048A19D14167FBD7A1FA0CD6BB3C8058D197A1E19E69BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
712	CTS.exe
3068	CTS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2026-08-05_c2a490330432421832bf541b9d70db3b_bkransomware_elex_maze_rhadamanthys.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2026-08-05_c2a490330432421832bf541b9d70db3b_bkransomware_elex_maze_rhadamanthys.exe
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_c2a490330432421832bf541b9d70db3b_bkransomware_elex_maze_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	2026-08-05_c2a490330432421832bf541b9d70db3b_bkransomware_elex_maze_rhadamanthys.exe
Token: SeDebugPrivilege	712	CTS.exe
Token: SeDebugPrivilege	3068	CTS.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 712	2728	2026-08-05_c2a490330432421832bf541b9d70db3b_bkransomware_elex_maze_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_c2a490330432421832bf541b9d70db3b_bkransomware_elex_maze_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_c2a490330432421832bf541b9d70db3b_bkransomware_elex_maze_rhadamanthys.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:712

C:\Windows\CTS.exe
C:\Windows\CTS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

onenote.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml
Size 1.1MB
SHA256 f4a0d5bd1749c5b8cbe68bfb47b129dd2beb5f390148e957821c6425b61a6435
MD5 97828ce62a65a5882139ac8bbdf85ac0
SHA1 b51a5527d016ce47fb400f7bff1d935c1645f6f8
SHA512 f364005f8b6ddfe9612c7f4519816db18d8921da00bcbfa3f0de81326a3ce60398f79026fadd6c4a623165014d22d894ba91a889d54cceb303fc50ee6b0c9cd4
SSDEEP 24576:DmP3FiPo39coRHQOGnyKmyDn/dvG7f53Mu3utZluZoPzHJUd7Qk+JbK9:DCsANcWwRyKmyL/dvGDZv3MluolUd7QM
TLSH
T12C45230372DEA571E43602775DD99D25026FF97E79B2CE03B780348C66399C06B39A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GJw8Pf0XCjwBT4H.exe

Path C:\Users\Admin\AppData\Local\Temp\GJw8Pf0XCjwBT4H.exe
Size 557KB
SHA256 83d5db3dc456cfbbdd60bf85cd387713124802336e5ccd96bb8fd46f4c015fb8
MD5 0cf418a35b39face295144f74f41b86c
SHA1 e08eb6abbf1dd7fe203689a4cd19ca293383f618
SHA512 b3c5f7c60110ebf40d955e1c404cd3304cfe39b149dc00062301312e2cbeb5f51c409e05a3dc4e13c9a212edb481364c38d6fac317c3a0294cb1d84f1fa22dd6
SSDEEP 12288:xC0h8Bmd3QWsbasR+qzbFq+7B3tzyMdzUlzV4O4eg/:DhWTzBP7Bdn4zVOeU
TLSH
T163C4120372D69D70F46B0B3245A089601E6F76B92DB48D4BB390249E5E763D0AD39FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 71KB
SHA256 b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc
MD5 f9d4ab0a726adc9b5e4b7d7b724912f1
SHA1 3d42ca2098475924f70ee4a831c4f003b4682328
SHA512 22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432
SSDEEP 1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazT:ZRpAyazIliazT
TLSH
T176636B03B6D2C171E4B70A7649B8CE51067FBE765EB18D5B33C4218E49752C08E3ABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads