Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 05:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_ef06f64d3c4fe2dad0211d978822b091_bkransomware_elex_maze.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_ef06f64d3c4fe2dad0211d978822b091_bkransomware_elex_maze.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-15_ef06f64d3c4fe2dad0211d978822b091_bkransomware_elex_maze.exe
- Size 500KB
- Sample260815-fsa77adh74
- SHA256 4d26ebf300ceff6ec57ea1917bb84adef01227d82114e33af4a07d3e08f6350b
- MD5 ef06f64d3c4fe2dad0211d978822b091
- SHA1 08fd26406cca5267d591cd30a744ad01faf1464f
- SHA512 16e052ef7f7d2980069a28f58ef1ab0973297f9945d193d0aabe7d4c9ef65ec2acd0a1dc500d71640d53d311a674cfe9ad06a40b1593818e2e7f8300dc676f2a
- SSDEEP 12288:oinHDmNohc6lWJriGO7azCexsbqlgU/D:oqjFhclYSCY6qlgSD
- TLSH T190B49D01A642A720EC4114F4F5ABF13A6D6534731BBA0EDBF7C285AE48791F033767A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 2104 pev3zb9gye4vqnruqjma.exe 4488 zxgzmyyzkpc.exe 4120 vxocviruq.exe 2364 zxgzmyyzkpc.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\vhmelxqgwpvnphg\znvo74e vxocviruq.exe File created C:\Windows\vhmelxqgwpvnphg\znvo74e zxgzmyyzkpc.exe File created C:\Windows\vhmelxqgwpvnphg\znvo74e 2026-08-15_ef06f64d3c4fe2dad0211d978822b091_bkransomware_elex_maze.exe File created C:\Windows\vhmelxqgwpvnphg\znvo74e pev3zb9gye4vqnruqjma.exe File created C:\Windows\vhmelxqgwpvnphg\znvo74e zxgzmyyzkpc.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-15_ef06f64d3c4fe2dad0211d978822b091_bkransomware_elex_maze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pev3zb9gye4vqnruqjma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zxgzmyyzkpc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4488 zxgzmyyzkpc.exe 4488 zxgzmyyzkpc.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe 4120 vxocviruq.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2600 wrote to memory of 2104 2600 2026-08-15_ef06f64d3c4fe2dad0211d978822b091_bkransomware_elex_maze.exe 89 PID 4488 wrote to memory of 4120 4488 zxgzmyyzkpc.exe 91 PID 2104 wrote to memory of 2364 2104 pev3zb9gye4vqnruqjma.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_ef06f64d3c4fe2dad0211d978822b091_bkransomware_elex_maze.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_ef06f64d3c4fe2dad0211d978822b091_bkransomware_elex_maze.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\vhmelxqgwpvnphg\pev3zb9gye4vqnruqjma.exe"C:\vhmelxqgwpvnphg\pev3zb9gye4vqnruqjma.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\vhmelxqgwpvnphg\zxgzmyyzkpc.exe"C:\vhmelxqgwpvnphg\zxgzmyyzkpc.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2364
-
-
-
C:\vhmelxqgwpvnphg\zxgzmyyzkpc.exeC:\vhmelxqgwpvnphg\zxgzmyyzkpc.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\vhmelxqgwpvnphg\vxocviruq.exev3vxepmll7sb "c:\vhmelxqgwpvnphg\zxgzmyyzkpc.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4120
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\vhmelxqgwpvnphg\pev3zb9gye4vqnruqjma.exe
- Size 500KB
- SHA256 4d26ebf300ceff6ec57ea1917bb84adef01227d82114e33af4a07d3e08f6350b
- MD5 ef06f64d3c4fe2dad0211d978822b091
- SHA1 08fd26406cca5267d591cd30a744ad01faf1464f
- SHA512 16e052ef7f7d2980069a28f58ef1ab0973297f9945d193d0aabe7d4c9ef65ec2acd0a1dc500d71640d53d311a674cfe9ad06a40b1593818e2e7f8300dc676f2a
- SSDEEP 12288:oinHDmNohc6lWJriGO7azCexsbqlgU/D:oqjFhclYSCY6qlgSD
- TLSH T190B49D01A642A720EC4114F4F5ABF13A6D6534731BBA0EDBF7C285AE48791F033767A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\vhmelxqgwpvnphg\znvo74e
- Size 11B
- SHA256 c3f34b0a2371f5c3efafb9614f68e1c3de49b139162d8738dc8cda51c8fb23b9
- MD5 341a258e9560a6413522841ed82467db
- SHA1 e8654fec3dd6748d9a2f1548bace4250c845371d
- SHA512 03edb422ff2da6f9e8f3258420ccee3009953a4213b158235caf17c940cb878c9705d43d372d5aecef8ea201b8e57dd8b23bc0a517cffac181bcdedfb4ac82c5
- MD5 SHA1 SHA512