Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_641ab2b8e167148d2ad8771d7f8bc5b5_bkransomware_elex_maze.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_641ab2b8e167148d2ad8771d7f8bc5b5_bkransomware_elex_maze.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-12_641ab2b8e167148d2ad8771d7f8bc5b5_bkransomware_elex_maze.exe
- Size 493KB
- Sample260812-e7gsvaal9w
- SHA256 f45eb53416ab9d021af005ba2280ae4832d1e6a3ae0f1eb66f3c077822645115
- MD5 641ab2b8e167148d2ad8771d7f8bc5b5
- SHA1 0a1254b906f492a59263f43f24fff9f4d22bc144
- SHA512 cf8f84bd0314d1a70ebc3a1cfcbaff2b00c6259ee79ade5bd0a4ec09b3bdf9f7a21d90bfbe4d8e9b5c5db1d562a5d7bebfb478dd406191f033128c381cca40f9
- SSDEEP 6144:1D9+izec3EZbGzW7gJdfAZKSUoAj82VgZrvZFBwjlts:KiSZnidYZKDoAj82CrvCPs
- TLSH T1FDB49E11AAA7F734D92918F6169FE13516DAB2B20F358EC3F7909E4D892A4F03721713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 3944 lp73zbc6lwu2pkzvllv.exe 4692 szvngoilaz.exe 1184 vqyvgymhdtba.exe 4520 szvngoilaz.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\unapxfii\zrqyalsdpb 2026-08-12_641ab2b8e167148d2ad8771d7f8bc5b5_bkransomware_elex_maze.exe File created C:\Windows\unapxfii\zrqyalsdpb lp73zbc6lwu2pkzvllv.exe File created C:\Windows\unapxfii\zrqyalsdpb szvngoilaz.exe File created C:\Windows\unapxfii\zrqyalsdpb vqyvgymhdtba.exe File created C:\Windows\unapxfii\zrqyalsdpb szvngoilaz.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_641ab2b8e167148d2ad8771d7f8bc5b5_bkransomware_elex_maze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lp73zbc6lwu2pkzvllv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language szvngoilaz.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4692 szvngoilaz.exe 4692 szvngoilaz.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe 1184 vqyvgymhdtba.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1680 wrote to memory of 3944 1680 2026-08-12_641ab2b8e167148d2ad8771d7f8bc5b5_bkransomware_elex_maze.exe 89 PID 4692 wrote to memory of 1184 4692 szvngoilaz.exe 91 PID 3944 wrote to memory of 4520 3944 lp73zbc6lwu2pkzvllv.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_641ab2b8e167148d2ad8771d7f8bc5b5_bkransomware_elex_maze.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_641ab2b8e167148d2ad8771d7f8bc5b5_bkransomware_elex_maze.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\unapxfii\lp73zbc6lwu2pkzvllv.exe"C:\unapxfii\lp73zbc6lwu2pkzvllv.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\unapxfii\szvngoilaz.exe"C:\unapxfii\szvngoilaz.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4520
-
-
-
C:\unapxfii\szvngoilaz.exeC:\unapxfii\szvngoilaz.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\unapxfii\vqyvgymhdtba.exetvalbcmvkzon "c:\unapxfii\szvngoilaz.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1184
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\unapxfii\lp73zbc6lwu2pkzvllv.exe
- Size 493KB
- SHA256 f45eb53416ab9d021af005ba2280ae4832d1e6a3ae0f1eb66f3c077822645115
- MD5 641ab2b8e167148d2ad8771d7f8bc5b5
- SHA1 0a1254b906f492a59263f43f24fff9f4d22bc144
- SHA512 cf8f84bd0314d1a70ebc3a1cfcbaff2b00c6259ee79ade5bd0a4ec09b3bdf9f7a21d90bfbe4d8e9b5c5db1d562a5d7bebfb478dd406191f033128c381cca40f9
- SSDEEP 6144:1D9+izec3EZbGzW7gJdfAZKSUoAj82VgZrvZFBwjlts:KiSZnidYZKDoAj82CrvCPs
- TLSH T1FDB49E11AAA7F734D92918F6169FE13516DAB2B20F358EC3F7909E4D892A4F03721713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\unapxfii\zrqyalsdpb
- Size 9B
- SHA256 ae21d1895a23bd95d37ab065069e278c5f6f679afea6b7abd6d7766c61b2a4f3
- MD5 c16903ef45bc1dda377a2ded8a27dbfa
- SHA1 2c95a4acff1a6011e7bce5b980b8988530264d21
- SHA512 96f270802c3d31de8d05830c3d117a4da856335c6998f12b832a95411b3d5e5315aa3e9c84340a880f7e8d4382ea3451e6f2aba5effcd9640a95c2d019dc8230
- MD5 SHA1 SHA512