c0884fcaadc0b8a59299f43ec725cc53fa9583fad4a1d1111d1262fa172e19c8

General

Target
2026-08-08_78691d48627ddf95b79bda99f4c7e488_bkransomware_elex_maze_rhadamanthys.exe
Size 557KB
Sample260808-wa4psawsd1
SHA256 c0884fcaadc0b8a59299f43ec725cc53fa9583fad4a1d1111d1262fa172e19c8
MD5 78691d48627ddf95b79bda99f4c7e488
SHA1 89d2c8c128ca09a80eb91c743a853bc7858433bf
SHA512 63227ebda2c148f33587be3e75a0f850fb31ffe3f0b6da030460b081354aa7e8bf729ad68110f76a73021d21d28a78d31213e0807555fdbfc3a25fb59752ea4b
SSDEEP 12288:RS05wNmEH4F+fdznjEsiaVQo5Za1KVbzg5i2w0:TyNm9FGysE1Obzg5s0
TLSH
T1F8C41213B2D18534E9BB0937CEBA9E5485AFBC31AA618D5B63D8188C1D611C04F3BB77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3604	CTS.exe
3684	CTS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2026-08-08_78691d48627ddf95b79bda99f4c7e488_bkransomware_elex_maze_rhadamanthys.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2026-08-08_78691d48627ddf95b79bda99f4c7e488_bkransomware_elex_maze_rhadamanthys.exe
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_78691d48627ddf95b79bda99f4c7e488_bkransomware_elex_maze_rhadamanthys.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	312	2026-08-08_78691d48627ddf95b79bda99f4c7e488_bkransomware_elex_maze_rhadamanthys.exe
Token: SeDebugPrivilege	3604	CTS.exe
Token: SeDebugPrivilege	3684	CTS.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 3604	312	2026-08-08_78691d48627ddf95b79bda99f4c7e488_bkransomware_elex_maze_rhadamanthys.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-08_78691d48627ddf95b79bda99f4c7e488_bkransomware_elex_maze_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_78691d48627ddf95b79bda99f4c7e488_bkransomware_elex_maze_rhadamanthys.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:312
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3604

C:\Windows\CTS.exe
C:\Windows\CTS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 73KB
SHA256 c1970f0b9c8cdae585c1ecca16d5efdf38dae286838bb9d1b6c1ff2faf2bc8bc
MD5 cf92f5e622488d8a6ac2754b944bebdf
SHA1 c0df54fad15176178aef0f7be52eae9ee44985e0
SHA512 e73a3e048ddbec5dfc8a03b87a08f71cc1f17b919ba2721782372c4b554381e149ed21560376a83bee7ebcc7dacdf8605e5d0a85779151c94950a315c43f959a
SSDEEP 1536:Fc897EsWjcd9w+AyabjDbxE+MwmvlDuazTg:ZxpAyazIlyazTg
TLSH
T121736B03B6D2C171E4B70A7649A9CE51067FBE765FB18D5B33C4218D09752C08E3ABAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nQEvWdMKliIP4Kg.exe

Path C:\Users\Admin\AppData\Local\Temp\nQEvWdMKliIP4Kg.exe
Size 557KB
SHA256 594284ce0cc5e0f5cd6f9520903acb281eab9cedfdf27e6524d93242b64f6555
MD5 8da56b7946784c54eaefc5ac2ad77abf
SHA1 07f0be4c256067b20fabe2c792a18600f6100a31
SHA512 4e6781defe8fc38433756ae1ef98a3b327c96eceee0e5cd5762d7e25211d2717ae20b2f114ffa2b035a09ed2853736b221fe7a236cf683748842fd1e2b64f6e2
SSDEEP 12288:RS0SiEmQLeDXhIJo0EV1UTPc02BVDPJOo91EQGPecYeCQ+qV:TSiEDqV1gPc02nd1NqCPqV
TLSH
T139C412137AC5A431EE76273180E58E42476FBDB30AB18E0BA7D0559D4AB13C05F39B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 71KB
SHA256 479450abbbb7bded1c00cceb20497fc90f6156325b86401505b50739075a63ba
MD5 f53a5c9ca2e3837485afaba90a4cd7e2
SHA1 5b02231c979d9af0990294094113aca1de3fb8b4
SHA512 4c0c8ec807e458f5fe9407796307d43ae109047a133d08ef3ce86b726646749dcce6802a85a9a3186c9837afd1e8b0d040f74d6034865a1e2a62f28c4e8e3c78
SSDEEP 1536:Fc897EsWjcd9w+AyabjDbxE+MwmvlDuazT:ZxpAyazIlyazT
TLSH
T141636B03B6D2C171E4B70A7649B8CE51067FBE765EB18D5B33C4218E49752C08E3ABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads