Analysis
- max time kernel
149s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 04:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_0222ed0ce036903c6bed5b3b9774335d_elex_maze_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_0222ed0ce036903c6bed5b3b9774335d_elex_maze_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-12_0222ed0ce036903c6bed5b3b9774335d_elex_maze_stealc.exe
- Size 603KB
- Sample260812-feey8aam9y
- SHA256 a612de57600c12f90e58aaecb706f1cf3f51e93b6623a251c486a995927cf7e7
- MD5 0222ed0ce036903c6bed5b3b9774335d
- SHA1 df26b1bfd29b8950716bb26b976af4b9d7093770
- SHA512 40a7aaa396849e21fab5ad462df29321cb93735ebc55d31453af534869ee01839ec1769fd0641eb657c46be6cefd395a62db85ef9693a3c0d6ced6d844194abd
- SSDEEP 12288:Kv4PWKqlQcZF0GbaptGbN3ieANhn8ta8KC8bUa:Jkx1bGGp3Wh8B
- TLSH T154D4F9393440E05BD5B266B5127F7213669D6458D3738ADBEF8448AC8ACD0A03FF726B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 5544 uhsgi3zb2pwmyjqggmjujp.exe 4132 iekscgherv.exe 4168 disvaax.exe 3760 iekscgherv.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\rncrjmq\cf8pjc uhsgi3zb2pwmyjqggmjujp.exe File created C:\Windows\rncrjmq\cf8pjc iekscgherv.exe File created C:\Windows\rncrjmq\cf8pjc disvaax.exe File created C:\Windows\rncrjmq\cf8pjc iekscgherv.exe File created C:\Windows\rncrjmq\cf8pjc 2026-08-12_0222ed0ce036903c6bed5b3b9774335d_elex_maze_stealc.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_0222ed0ce036903c6bed5b3b9774335d_elex_maze_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uhsgi3zb2pwmyjqggmjujp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iekscgherv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4132 iekscgherv.exe 4132 iekscgherv.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe 4168 disvaax.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 752 wrote to memory of 5544 752 2026-08-12_0222ed0ce036903c6bed5b3b9774335d_elex_maze_stealc.exe 88 PID 4132 wrote to memory of 4168 4132 iekscgherv.exe 91 PID 5544 wrote to memory of 3760 5544 uhsgi3zb2pwmyjqggmjujp.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_0222ed0ce036903c6bed5b3b9774335d_elex_maze_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_0222ed0ce036903c6bed5b3b9774335d_elex_maze_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:752 -
C:\rncrjmq\uhsgi3zb2pwmyjqggmjujp.exe"C:\rncrjmq\uhsgi3zb2pwmyjqggmjujp.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\rncrjmq\iekscgherv.exe"C:\rncrjmq\iekscgherv.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3760
-
-
-
C:\rncrjmq\iekscgherv.exeC:\rncrjmq\iekscgherv.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\rncrjmq\disvaax.exeifztz4iaevfs "c:\rncrjmq\iekscgherv.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4168
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\rncrjmq\cf8pjc
- Size 12B
- SHA256 23cc9993f47bef78b969854979ce69b269de427d8d194be24687e25073eea153
- MD5 5a83260575b2ffd47d8296cb4532612c
- SHA1 70fac0722481d0ea92bc0fd32a00146c78385d5c
- SHA512 5a101903f0d66e3980a45ce06e3aef598fda4f1a32d70516032d657643180522d1b0a962b467558866b5444a4a722554041aaa17b175b1de96fb159cae0da610
- MD5 SHA1 SHA512
- Path C:\rncrjmq\uhsgi3zb2pwmyjqggmjujp.exe
- Size 603KB
- SHA256 a612de57600c12f90e58aaecb706f1cf3f51e93b6623a251c486a995927cf7e7
- MD5 0222ed0ce036903c6bed5b3b9774335d
- SHA1 df26b1bfd29b8950716bb26b976af4b9d7093770
- SHA512 40a7aaa396849e21fab5ad462df29321cb93735ebc55d31453af534869ee01839ec1769fd0641eb657c46be6cefd395a62db85ef9693a3c0d6ced6d844194abd
- SSDEEP 12288:Kv4PWKqlQcZF0GbaptGbN3ieANhn8ta8KC8bUa:Jkx1bGGp3Wh8B
- TLSH T154D4F9393440E05BD5B266B5127F7213669D6458D3738ADBEF8448AC8ACD0A03FF726B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\rncrjmq\vuwgav4kj
- Size 4B
- SHA256 35e1d464dfd127bd47e39c55f9c1dc58c9856f504eb3940177f67ea33d844b3b
- MD5 d97c55d067a736ad4625caac7f723c8e
- SHA1 e2e17bc6dbf958db7109ccd47a2b458886e133ff
- SHA512 b9f3c0a2a103423a593343893c6d1bfc25ebcc50a88fd74ad851faabda475f38658d4c2efa4d1fed23b54d6bebf94f4fa1be81aa4a8e53bf06cbfcb128774136
- MD5 SHA1 SHA512