Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 05:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_fb07370dfd6359ae5baf2819d50ee63b_elex_hawkeye_maze_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_fb07370dfd6359ae5baf2819d50ee63b_elex_hawkeye_maze_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-15_fb07370dfd6359ae5baf2819d50ee63b_elex_hawkeye_maze_stealc.exe
- Size 427KB
- Sample260815-fpfcqszvhy
- SHA256 94fb63fe712e033a6162feabbd64d7871e8bd0e5058a1bbed162463c8592d68d
- MD5 fb07370dfd6359ae5baf2819d50ee63b
- SHA1 10a6477cfab5438ca3c6bb9c9d960320eb2881c9
- SHA512 26e932388842a8e7d363ea2963fd101e7eac2b4862a775da04fa8e85a1bd03eba4b8e2d3876e46225fb86253bebefd1f8c99e8dddda8774e162a2031418dfe5d
- SSDEEP 12288:PBS6TcuuqevT5nAFFcxihgbfZniLjjq67:PBvTcuuqevT5AF6xihg7ZnWPq6
- TLSH T1D294590478D3C036D6E341F5C9AAA22301BDAEA467F585C7BFC5089C5BA84D0AB7771E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 5692 ziyz3zbqw4rfmubdambg.exe 5700 fexginjxml.exe 4336 ksnlkzaxqdm.exe 1496 fexginjxml.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\ckebeojrz\oygu3ber9 fexginjxml.exe File created C:\Windows\ckebeojrz\oygu3ber9 2026-08-15_fb07370dfd6359ae5baf2819d50ee63b_elex_hawkeye_maze_stealc.exe File created C:\Windows\ckebeojrz\oygu3ber9 ziyz3zbqw4rfmubdambg.exe File created C:\Windows\ckebeojrz\oygu3ber9 fexginjxml.exe File created C:\Windows\ckebeojrz\oygu3ber9 ksnlkzaxqdm.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-15_fb07370dfd6359ae5baf2819d50ee63b_elex_hawkeye_maze_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ziyz3zbqw4rfmubdambg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fexginjxml.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5700 fexginjxml.exe 5700 fexginjxml.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 5700 fexginjxml.exe 5700 fexginjxml.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 5700 fexginjxml.exe 5700 fexginjxml.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 5700 fexginjxml.exe 5700 fexginjxml.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 5700 fexginjxml.exe 5700 fexginjxml.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 5700 fexginjxml.exe 5700 fexginjxml.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 5700 fexginjxml.exe 5700 fexginjxml.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe 5700 fexginjxml.exe 5700 fexginjxml.exe 4336 ksnlkzaxqdm.exe 4336 ksnlkzaxqdm.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4960 wrote to memory of 5692 4960 2026-08-15_fb07370dfd6359ae5baf2819d50ee63b_elex_hawkeye_maze_stealc.exe 89 PID 5700 wrote to memory of 4336 5700 fexginjxml.exe 91 PID 5692 wrote to memory of 1496 5692 ziyz3zbqw4rfmubdambg.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_fb07370dfd6359ae5baf2819d50ee63b_elex_hawkeye_maze_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_fb07370dfd6359ae5baf2819d50ee63b_elex_hawkeye_maze_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\ckebeojrz\ziyz3zbqw4rfmubdambg.exe"C:\ckebeojrz\ziyz3zbqw4rfmubdambg.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\ckebeojrz\fexginjxml.exe"C:\ckebeojrz\fexginjxml.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1496
-
-
-
C:\ckebeojrz\fexginjxml.exeC:\ckebeojrz\fexginjxml.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\ckebeojrz\ksnlkzaxqdm.exexmkgrvlplcao "c:\ckebeojrz\fexginjxml.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4336
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ckebeojrz\jqwii9a2
- Size 4B
- SHA256 f0bbbd912ecff1755e891ebcdf8ac9104a1d874361b152777636d25ac6d84ef9
- MD5 c22709365c3dc4754c102191a9f84f39
- SHA1 b22580564dd4f130aed99a5e672e6eca4a8d3417
- SHA512 44926cbaa99990162b2c9c270a2fa33aa4bafca0deae596ae75388d381858982a4c0662e1fe7de112e9498061637ce52dddffea4bc2d83d44fcae6149db38cd2
- MD5 SHA1 SHA512
- Path C:\ckebeojrz\oygu3ber9
- Size 8B
- SHA256 96630fb126f504719d1ce15386377b6e37d14bc7e1272b3af0ab2e776b85515b
- MD5 de908ec2128aeeb5cb3d15306c110206
- SHA1 2b1713421ab33352e3fee61bfeb1accd3d49a848
- SHA512 99fce2e6c5aacebf6a720f3ba16deaa250761bebeaf84079d7f8d1026317ce1169e3334a9466a94d6e02dea38a51e9743ada8fba4f3645ba6ec84640d5c00f10
- MD5 SHA1 SHA512
- Path C:\ckebeojrz\ziyz3zbqw4rfmubdambg.exe
- Size 427KB
- SHA256 94fb63fe712e033a6162feabbd64d7871e8bd0e5058a1bbed162463c8592d68d
- MD5 fb07370dfd6359ae5baf2819d50ee63b
- SHA1 10a6477cfab5438ca3c6bb9c9d960320eb2881c9
- SHA512 26e932388842a8e7d363ea2963fd101e7eac2b4862a775da04fa8e85a1bd03eba4b8e2d3876e46225fb86253bebefd1f8c99e8dddda8774e162a2031418dfe5d
- SSDEEP 12288:PBS6TcuuqevT5nAFFcxihgbfZniLjjq67:PBvTcuuqevT5AF6xihg7ZnWPq6
- TLSH T1D294590478D3C036D6E341F5C9AAA22301BDAEA467F585C7BFC5089C5BA84D0AB7771E
- MD5 SHA1 SHA512 SSDEEP TLSH