Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/08/2026, 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_62a6875a99e87e145bc791a362989bb6_bkransomware_elex_maze.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_62a6875a99e87e145bc791a362989bb6_bkransomware_elex_maze.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 2026-08-12_62a6875a99e87e145bc791a362989bb6_bkransomware_elex_maze.exe
- Size 504KB
- Sample260812-e7kvhaae38
- SHA256 8d2108a2e8a42acdaf26c4c1a4fa39ec206966cd036acf7e8f116d75a0f4af5f
- MD5 62a6875a99e87e145bc791a362989bb6
- SHA1 2bce49c303b8bc48107cfd7651b6dc2a6a00d176
- SHA512 5898ea743b2dcb35735c1c61facf69dd9c4ffd953c51cff3dea8437b88415097ba1127ed9f041a126db95db6e79f34d79dc8a39fb54edd3f42a4aa5bdcacbc56
- SSDEEP 6144:OuSHyYLz6ICQrspzBvpaIsdxDadbO49Uy2ItmySRH5/ijHfMzXfOKYK:OPbF/s9BvpaR8bOb7ItmyAZyfaOK
- TLSH T185B4AD009741B272E85918F92A6FD07568A7A9720F3B0DDBF7C5C92D492F0F237267A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 5912 z3nip3za7zzcjufgxrmzfl.exe 5460 gevguomrfiah.exe 4888 tzmnldf.exe 2868 gevguomrfiah.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\sqwklziksbcfxt\r0r29j 2026-08-12_62a6875a99e87e145bc791a362989bb6_bkransomware_elex_maze.exe File created C:\Windows\sqwklziksbcfxt\r0r29j z3nip3za7zzcjufgxrmzfl.exe File created C:\Windows\sqwklziksbcfxt\r0r29j gevguomrfiah.exe File created C:\Windows\sqwklziksbcfxt\r0r29j tzmnldf.exe File created C:\Windows\sqwklziksbcfxt\r0r29j gevguomrfiah.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gevguomrfiah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_62a6875a99e87e145bc791a362989bb6_bkransomware_elex_maze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language z3nip3za7zzcjufgxrmzfl.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5460 gevguomrfiah.exe 5460 gevguomrfiah.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe 4888 tzmnldf.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4596 wrote to memory of 5912 4596 2026-08-12_62a6875a99e87e145bc791a362989bb6_bkransomware_elex_maze.exe 85 PID 5460 wrote to memory of 4888 5460 gevguomrfiah.exe 87 PID 5912 wrote to memory of 2868 5912 z3nip3za7zzcjufgxrmzfl.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_62a6875a99e87e145bc791a362989bb6_bkransomware_elex_maze.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_62a6875a99e87e145bc791a362989bb6_bkransomware_elex_maze.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\sqwklziksbcfxt\z3nip3za7zzcjufgxrmzfl.exe"C:\sqwklziksbcfxt\z3nip3za7zzcjufgxrmzfl.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\sqwklziksbcfxt\gevguomrfiah.exe"C:\sqwklziksbcfxt\gevguomrfiah.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2868
-
-
-
C:\sqwklziksbcfxt\gevguomrfiah.exeC:\sqwklziksbcfxt\gevguomrfiah.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\sqwklziksbcfxt\tzmnldf.exeoelzrbqbwkgj "c:\sqwklziksbcfxt\gevguomrfiah.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4888
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\sqwklziksbcfxt\r0r29j
- Size 11B
- SHA256 4d11c66f6a4790231e624806db5be44370245d64f4811bf3733eccd674c1a463
- MD5 51640ad65af58d7fc46d4db1b40a78c1
- SHA1 5a4ff7284425d9d8e23fb58ad6fb3f4ffbeb6044
- SHA512 f83db257bc32cf3488760ffb8f575d98cda4510f731fabf700e83ca5e371e93d209c9ef20273892808d85d5dd04ef908d5aa0508b26a1935f4b441cdf2d2ca16
- MD5 SHA1 SHA512
- Path C:\sqwklziksbcfxt\z3nip3za7zzcjufgxrmzfl.exe
- Size 504KB
- SHA256 8d2108a2e8a42acdaf26c4c1a4fa39ec206966cd036acf7e8f116d75a0f4af5f
- MD5 62a6875a99e87e145bc791a362989bb6
- SHA1 2bce49c303b8bc48107cfd7651b6dc2a6a00d176
- SHA512 5898ea743b2dcb35735c1c61facf69dd9c4ffd953c51cff3dea8437b88415097ba1127ed9f041a126db95db6e79f34d79dc8a39fb54edd3f42a4aa5bdcacbc56
- SSDEEP 6144:OuSHyYLz6ICQrspzBvpaIsdxDadbO49Uy2ItmySRH5/ijHfMzXfOKYK:OPbF/s9BvpaR8bOb7ItmyAZyfaOK
- TLSH T185B4AD009741B272E85918F92A6FD07568A7A9720F3B0DDBF7C5C92D492F0F237267A1
- MD5 SHA1 SHA512 SSDEEP TLSH