Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/08/2026, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_5514a691b74484cdd977afce0643feaa_bkransomware_elex_maze_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_5514a691b74484cdd977afce0643feaa_bkransomware_elex_maze_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-12_5514a691b74484cdd977afce0643feaa_bkransomware_elex_maze_stealc.exe
- Size 504KB
- Sample260812-e8kacsam4v
- SHA256 53091341cefb4d5049fbe5717acc99653f126c441b0a6176e5fb664113b19662
- MD5 5514a691b74484cdd977afce0643feaa
- SHA1 8796a774375fc4fe20af1fb48de1ef1cc3d35f90
- SHA512 dfd80e2977f6676372db81654e393ab564a5cd88e0773799c098e940510fb2c2201753ac339958198f2ea4b2bb408c9111b28a21df8898f3f66d6dd6a663c5ab
- SSDEEP 6144:ksl6hewUQD8P+NVKF5FAIJDDDi1R7bTGJ4K9w7Ss8tAGaMzII93a0Z4Zp0AxLMiJ:v4jUQoPkVKfF7XDZgOvHdq0Zs09iiy
- TLSH T100B47E21B483A1B3D41601F2726BE13666317D760F3A9AE3F7C70E25A9F31B19632653
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 2468 rksq3zahyhhrjbnrlike.exe 2100 kffnwlbpsn.exe 3220 dkslanhyipig.exe 3308 kffnwlbpsn.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\gpjrzaxsk\smfy9ezo9 2026-08-12_5514a691b74484cdd977afce0643feaa_bkransomware_elex_maze_stealc.exe File created C:\Windows\gpjrzaxsk\smfy9ezo9 rksq3zahyhhrjbnrlike.exe File created C:\Windows\gpjrzaxsk\smfy9ezo9 kffnwlbpsn.exe File created C:\Windows\gpjrzaxsk\smfy9ezo9 dkslanhyipig.exe File created C:\Windows\gpjrzaxsk\smfy9ezo9 kffnwlbpsn.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rksq3zahyhhrjbnrlike.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kffnwlbpsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_5514a691b74484cdd977afce0643feaa_bkransomware_elex_maze_stealc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2100 kffnwlbpsn.exe 2100 kffnwlbpsn.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe 3220 dkslanhyipig.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1528 wrote to memory of 2468 1528 2026-08-12_5514a691b74484cdd977afce0643feaa_bkransomware_elex_maze_stealc.exe 86 PID 2100 wrote to memory of 3220 2100 kffnwlbpsn.exe 88 PID 2468 wrote to memory of 3308 2468 rksq3zahyhhrjbnrlike.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_5514a691b74484cdd977afce0643feaa_bkransomware_elex_maze_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_5514a691b74484cdd977afce0643feaa_bkransomware_elex_maze_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\gpjrzaxsk\rksq3zahyhhrjbnrlike.exe"C:\gpjrzaxsk\rksq3zahyhhrjbnrlike.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\gpjrzaxsk\kffnwlbpsn.exe"C:\gpjrzaxsk\kffnwlbpsn.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3308
-
-
-
C:\gpjrzaxsk\kffnwlbpsn.exeC:\gpjrzaxsk\kffnwlbpsn.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\gpjrzaxsk\dkslanhyipig.exexkfdysvsni9l "c:\gpjrzaxsk\kffnwlbpsn.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3220
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\gpjrzaxsk\rksq3zahyhhrjbnrlike.exe
- Size 504KB
- SHA256 53091341cefb4d5049fbe5717acc99653f126c441b0a6176e5fb664113b19662
- MD5 5514a691b74484cdd977afce0643feaa
- SHA1 8796a774375fc4fe20af1fb48de1ef1cc3d35f90
- SHA512 dfd80e2977f6676372db81654e393ab564a5cd88e0773799c098e940510fb2c2201753ac339958198f2ea4b2bb408c9111b28a21df8898f3f66d6dd6a663c5ab
- SSDEEP 6144:ksl6hewUQD8P+NVKF5FAIJDDDi1R7bTGJ4K9w7Ss8tAGaMzII93a0Z4Zp0AxLMiJ:v4jUQoPkVKfF7XDZgOvHdq0Zs09iiy
- TLSH T100B47E21B483A1B3D41601F2726BE13666317D760F3A9AE3F7C70E25A9F31B19632653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\gpjrzaxsk\smfy9ezo9
- Size 12B
- SHA256 6769235d11c9dc9a0ac4e328b6cb3cac8cc192417f6942d7b154d350d8a53f80
- MD5 36df18c981ffa4aa0f18d57a96ebab2f
- SHA1 7ba7f8ea39291015ddad89e37523eb87be4c041a
- SHA512 7d5158be2c004fb4abadefe210113bdd60b358f4862a7274a71d4f2f1a131ded52c18258c1b65f595417752fc6755d51fec3dad789c5f957c667db8c5bd181f1
- MD5 SHA1 SHA512