Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_5514a691b74484cdd977afce0643feaa_bkransomware_elex_maze_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_5514a691b74484cdd977afce0643feaa_bkransomware_elex_maze_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-12_5514a691b74484cdd977afce0643feaa_bkransomware_elex_maze_stealc.exe
- Size 504KB
- Sample260812-e8kacsam4v
- SHA256 53091341cefb4d5049fbe5717acc99653f126c441b0a6176e5fb664113b19662
- MD5 5514a691b74484cdd977afce0643feaa
- SHA1 8796a774375fc4fe20af1fb48de1ef1cc3d35f90
- SHA512 dfd80e2977f6676372db81654e393ab564a5cd88e0773799c098e940510fb2c2201753ac339958198f2ea4b2bb408c9111b28a21df8898f3f66d6dd6a663c5ab
- SSDEEP 6144:ksl6hewUQD8P+NVKF5FAIJDDDi1R7bTGJ4K9w7Ss8tAGaMzII93a0Z4Zp0AxLMiJ:v4jUQoPkVKfF7XDZgOvHdq0Zs09iiy
- TLSH T100B47E21B483A1B3D41601F2726BE13666317D760F3A9AE3F7C70E25A9F31B19632653
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 4428 rksq3zbcrvhrjbnrlike.exe 3816 kffnwlbpsn.exe 960 dkslanhyipig.exe 4424 kffnwlbpsn.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\gpjrzaxsk\smfy9ezo9 kffnwlbpsn.exe File created C:\Windows\gpjrzaxsk\smfy9ezo9 dkslanhyipig.exe File created C:\Windows\gpjrzaxsk\smfy9ezo9 kffnwlbpsn.exe File created C:\Windows\gpjrzaxsk\smfy9ezo9 2026-08-12_5514a691b74484cdd977afce0643feaa_bkransomware_elex_maze_stealc.exe File created C:\Windows\gpjrzaxsk\smfy9ezo9 rksq3zbcrvhrjbnrlike.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rksq3zbcrvhrjbnrlike.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kffnwlbpsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_5514a691b74484cdd977afce0643feaa_bkransomware_elex_maze_stealc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3816 kffnwlbpsn.exe 3816 kffnwlbpsn.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe 960 dkslanhyipig.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4296 wrote to memory of 4428 4296 2026-08-12_5514a691b74484cdd977afce0643feaa_bkransomware_elex_maze_stealc.exe 89 PID 3816 wrote to memory of 960 3816 kffnwlbpsn.exe 91 PID 4428 wrote to memory of 4424 4428 rksq3zbcrvhrjbnrlike.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_5514a691b74484cdd977afce0643feaa_bkransomware_elex_maze_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_5514a691b74484cdd977afce0643feaa_bkransomware_elex_maze_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\gpjrzaxsk\rksq3zbcrvhrjbnrlike.exe"C:\gpjrzaxsk\rksq3zbcrvhrjbnrlike.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\gpjrzaxsk\kffnwlbpsn.exe"C:\gpjrzaxsk\kffnwlbpsn.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4424
-
-
-
C:\gpjrzaxsk\kffnwlbpsn.exeC:\gpjrzaxsk\kffnwlbpsn.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\gpjrzaxsk\dkslanhyipig.exexkfdysvsni9l "c:\gpjrzaxsk\kffnwlbpsn.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:960
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\gpjrzaxsk\rksq3zbcrvhrjbnrlike.exe
- Size 504KB
- SHA256 53091341cefb4d5049fbe5717acc99653f126c441b0a6176e5fb664113b19662
- MD5 5514a691b74484cdd977afce0643feaa
- SHA1 8796a774375fc4fe20af1fb48de1ef1cc3d35f90
- SHA512 dfd80e2977f6676372db81654e393ab564a5cd88e0773799c098e940510fb2c2201753ac339958198f2ea4b2bb408c9111b28a21df8898f3f66d6dd6a663c5ab
- SSDEEP 6144:ksl6hewUQD8P+NVKF5FAIJDDDi1R7bTGJ4K9w7Ss8tAGaMzII93a0Z4Zp0AxLMiJ:v4jUQoPkVKfF7XDZgOvHdq0Zs09iiy
- TLSH T100B47E21B483A1B3D41601F2726BE13666317D760F3A9AE3F7C70E25A9F31B19632653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\gpjrzaxsk\smfy9ezo9
- Size 12B
- SHA256 6769235d11c9dc9a0ac4e328b6cb3cac8cc192417f6942d7b154d350d8a53f80
- MD5 36df18c981ffa4aa0f18d57a96ebab2f
- SHA1 7ba7f8ea39291015ddad89e37523eb87be4c041a
- SHA512 7d5158be2c004fb4abadefe210113bdd60b358f4862a7274a71d4f2f1a131ded52c18258c1b65f595417752fc6755d51fec3dad789c5f957c667db8c5bd181f1
- MD5 SHA1 SHA512