10fd416c68f191091278155e087ac4aa1818bbbb0af23484490c2cac3b1cc0e5

General

Target
2026-08-10_1d08c4746888343e2a37a96affc4c6d3_bkransomware_elex_maze_rhadamanthys.exe
Size 422KB
Sample260810-xmervswblc
SHA256 10fd416c68f191091278155e087ac4aa1818bbbb0af23484490c2cac3b1cc0e5
MD5 1d08c4746888343e2a37a96affc4c6d3
SHA1 7f41921b8118c2519eafb87e8192cddc1a0c366f
SHA512 bd94f874f4a5533d1ef5ffa6fae5df5caadc4dce1b17154e5347feaf22bde811e97bb71a5550528f832d5e357f8c3263c718786986564d8dbf15e0aa18f60ed9
SSDEEP 12288:cS0QvrJovqyb0JCCRpXd4cUCw5Oio0pJRTqpzh:qCN2qw0JCCLXd4cUCwgNpzh
TLSH
T1B49412037BD2C070D5B60AB188B5CD514A7FBE7167A18E4777C8208A49B16D09D3EF6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2828	CTS.exe
4720	CTS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2026-08-10_1d08c4746888343e2a37a96affc4c6d3_bkransomware_elex_maze_rhadamanthys.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2026-08-10_1d08c4746888343e2a37a96affc4c6d3_bkransomware_elex_maze_rhadamanthys.exe
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_1d08c4746888343e2a37a96affc4c6d3_bkransomware_elex_maze_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	476	2026-08-10_1d08c4746888343e2a37a96affc4c6d3_bkransomware_elex_maze_rhadamanthys.exe
Token: SeDebugPrivilege	2828	CTS.exe
Token: SeDebugPrivilege	4720	CTS.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 2828	476	2026-08-10_1d08c4746888343e2a37a96affc4c6d3_bkransomware_elex_maze_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-10_1d08c4746888343e2a37a96affc4c6d3_bkransomware_elex_maze_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_1d08c4746888343e2a37a96affc4c6d3_bkransomware_elex_maze_rhadamanthys.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:476
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2828

C:\Windows\CTS.exe
C:\Windows\CTS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

officeclicktorun.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml
Size 557KB
SHA256 8e2bf306fdb289fbc36233ee4fcae50c2a599f2edd99262ce0f17af5ca169819
MD5 651beb97690674553bb409532d78c793
SHA1 af6d1d81e2a4a0e9c3c2f61ca4080ff4a11bc279
SHA512 53769113c3fd4bb2db92013752fed590c493c5e0a02aef04f5fa280ec69e5c527d8b47e784da44bda179ce23e628daf2da87f2efb35301deb5e0e69377f67c8c
SSDEEP 12288:cS0BLo6y5QBdpz/2iDOu6RoiGd6MtzVr4U8JA6ins3Vr:qB3dp/w2fHKJA6Jx
TLSH
T1F8C4221339C1D4B6F4A60A725A99CD114A9F3D2B8BB49FABB7C4547D0A702C05F28B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lipku09Cq8VgyWb.exe

Path C:\Users\Admin\AppData\Local\Temp\Lipku09Cq8VgyWb.exe
Size 422KB
SHA256 c96046869842a65f229afcf2154dd7d8e5a17fb352e428e83348446a3f098757
MD5 5c9f68b3a3d2b68e0b667d1238f4bd0e
SHA1 66c60ea3a24d6227d5901cf4ecb354dbe68c8e92
SHA512 f9b6113c35f60adc1dd35a93ef6fbbd3086788f40c8cfc982a561553fc3d92eba69355f5c83f6cf451ec20783a189718a86fcedfdcc0ea1c79603b404786c7fa
SSDEEP 12288:cS0sosGbup7+D8hg6Vxb0PPNZtcv5aYDs:qso+JzhNVxb0PPPtA5bs
TLSH
T1D394120772DA80B0D5BB0A3114E90E200B6F7E764AF1CE9B77D029EC96356C19E6D363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 71KB
SHA256 7a1c6cd3173222859a0d776c4949134e09b12c30ce4260e2d689e43202b1ca4b
MD5 ea7997ed926da609b4008fbee72e07e6
SHA1 c2e75d2d8e1619cdea76bb3dac6cd8bf2f7842b6
SHA512 07ee1b1eb94ff6a6e73daf4b6794b253c7517da655a71782ca5d71c93df8694ce0e4a6f987db1b7af34821b68e20f85c4e19e0981bef89fb3d00bc6ae610d2a3
SSDEEP 1536:Sc8N7UsWjcd9w+AyabjDbxE+MwmvlDuazT:MRpAyazIlyazT
TLSH
T1D1636B03B6D2C171E4B70A7649B8CE51077FBE765EB18D5B3384218D4A752C08E3ABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads