Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/08/2026, 04:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_66c4081af5422558be47343652a522da_bkransomware_elex_maze_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_66c4081af5422558be47343652a522da_bkransomware_elex_maze_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 2026-08-12_66c4081af5422558be47343652a522da_bkransomware_elex_maze_stealc.exe
- Size 636KB
- Sample260812-e6v9vayeqf
- SHA256 cf036ef6fe7cf3244ab98c4005487ec8df1c32ad5f8b53280e2341985af0160d
- MD5 66c4081af5422558be47343652a522da
- SHA1 761f7a68d35377cedbfad4fe2d14dc545043bfc0
- SHA512 6eaf058ee39ad1b9075a04d9493dc93fda7fee112c3dc89a6115c09bf81c42d45a04cc95c2147a34821f2b3fa3b9ca0348544f4818d462aea5aca719e91906df
- SSDEEP 12288:NEf8oiewXeTqmwJd0SdgX2bTuFop+UToITvLd42je:6fOdXuqmwX0yuE0o/bv5
- TLSH T14BD48C11B563A2B3D46225F6416DFB3A1A297E720F2D8BD3EBC70E5649F21C09633253
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 960 rx3zac8cgv4ruekvvc.exe 2564 lgqwtawk.exe 1456 dzbgkypay.exe 2240 lgqwtawk.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\pwcklbmemr\mlwdgtdu lgqwtawk.exe File created C:\Windows\pwcklbmemr\mlwdgtdu 2026-08-12_66c4081af5422558be47343652a522da_bkransomware_elex_maze_stealc.exe File created C:\Windows\pwcklbmemr\mlwdgtdu rx3zac8cgv4ruekvvc.exe File created C:\Windows\pwcklbmemr\mlwdgtdu lgqwtawk.exe File created C:\Windows\pwcklbmemr\mlwdgtdu dzbgkypay.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lgqwtawk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_66c4081af5422558be47343652a522da_bkransomware_elex_maze_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rx3zac8cgv4ruekvvc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2564 lgqwtawk.exe 2564 lgqwtawk.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe 1456 dzbgkypay.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2076 wrote to memory of 960 2076 2026-08-12_66c4081af5422558be47343652a522da_bkransomware_elex_maze_stealc.exe 86 PID 2564 wrote to memory of 1456 2564 lgqwtawk.exe 88 PID 960 wrote to memory of 2240 960 rx3zac8cgv4ruekvvc.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_66c4081af5422558be47343652a522da_bkransomware_elex_maze_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_66c4081af5422558be47343652a522da_bkransomware_elex_maze_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\pwcklbmemr\rx3zac8cgv4ruekvvc.exe"C:\pwcklbmemr\rx3zac8cgv4ruekvvc.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:960 -
C:\pwcklbmemr\lgqwtawk.exe"C:\pwcklbmemr\lgqwtawk.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2240
-
-
-
C:\pwcklbmemr\lgqwtawk.exeC:\pwcklbmemr\lgqwtawk.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\pwcklbmemr\dzbgkypay.exeiorzc9kz0buu "c:\pwcklbmemr\lgqwtawk.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1456
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\pwcklbmemr\mlwdgtdu
- Size 10B
- SHA256 9e93b62f29159495a7b82815ace2da494dc023bc5eb2d78e0a638373e0053923
- MD5 e3105071549ca7db78bb1fab2334a749
- SHA1 077537e32455fc9b31ce69f2aec6c5b7aa76907e
- SHA512 eab337f1e81f6191ca0aecda471cd1949a80c7cdfeac803bacfca42c45dadf823b9249aadb60ae5bb87f414823a174535d3ee5b4d64457aaeaedde86a6d64427
- MD5 SHA1 SHA512
- Path C:\pwcklbmemr\rx3zac8cgv4ruekvvc.exe
- Size 636KB
- SHA256 cf036ef6fe7cf3244ab98c4005487ec8df1c32ad5f8b53280e2341985af0160d
- MD5 66c4081af5422558be47343652a522da
- SHA1 761f7a68d35377cedbfad4fe2d14dc545043bfc0
- SHA512 6eaf058ee39ad1b9075a04d9493dc93fda7fee112c3dc89a6115c09bf81c42d45a04cc95c2147a34821f2b3fa3b9ca0348544f4818d462aea5aca719e91906df
- SSDEEP 12288:NEf8oiewXeTqmwJd0SdgX2bTuFop+UToITvLd42je:6fOdXuqmwX0yuE0o/bv5
- TLSH T14BD48C11B563A2B3D46225F6416DFB3A1A297E720F2D8BD3EBC70E5649F21C09633253
- MD5 SHA1 SHA512 SSDEEP TLSH