64c9bb4e86508884f9fe61de8506632be494b89247f3362fd13d68ef807cf97b

General

Target
2026-08-17_7c45c6af66a37a7457137e1de479bf70_bkransomware_elex_maze_rhadamanthys.exe
Size 391KB
Sample260817-s33fmscc52
SHA256 64c9bb4e86508884f9fe61de8506632be494b89247f3362fd13d68ef807cf97b
MD5 7c45c6af66a37a7457137e1de479bf70
SHA1 562124ed167871d62cf7595913c4e3a9062d9441
SHA512 e53adb306dbe79c9ff6798f4b1e51bab5dd93e35ef08c93147fc0cc67938f9d91c2a295d56e5165b77593a53806d280a2840b9d5ef7436e42941e29a2d94c16b
SSDEEP 6144:xZ8azbcDJv8luBmBsRwAYXXSYDA3Oy/Zs9mUJ+6i/5u4OHaNgxd:xC0bsvLmKDAOjA6N6d
TLSH
T178841203B6D185B0E2A60E3215699D11836FBE7606368ED7A7C4208E55B42C14F3FFBB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4648	CTS.exe
240	CTS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2026-08-17_7c45c6af66a37a7457137e1de479bf70_bkransomware_elex_maze_rhadamanthys.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2026-08-17_7c45c6af66a37a7457137e1de479bf70_bkransomware_elex_maze_rhadamanthys.exe
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_7c45c6af66a37a7457137e1de479bf70_bkransomware_elex_maze_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4056	2026-08-17_7c45c6af66a37a7457137e1de479bf70_bkransomware_elex_maze_rhadamanthys.exe
Token: SeDebugPrivilege	4648	CTS.exe
Token: SeDebugPrivilege	240	CTS.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 4648	4056	2026-08-17_7c45c6af66a37a7457137e1de479bf70_bkransomware_elex_maze_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_7c45c6af66a37a7457137e1de479bf70_bkransomware_elex_maze_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_7c45c6af66a37a7457137e1de479bf70_bkransomware_elex_maze_rhadamanthys.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4648

C:\Windows\CTS.exe
C:\Windows\CTS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

officeclicktorun.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml
Size 557KB
SHA256 d4ed222c33e396f0333b8933b441365bd4bfa2a12b443820bb278045bc785b83
MD5 e73faa4196e724ac4ab0134b58f2197e
SHA1 9146f4043f9073b0eb92be405d39e1147cc7ad5e
SHA512 18760f4d355794088e2332f2a8c29cc6457472d26fb017ffffe58b85e01cebde3b92211411c0c946e514328324b0d65bfd3a77fd19740b491fe1ffafecd9c447
SSDEEP 12288:xC0d1CBKxFoKLNPmkp/OCoSt6mOOMIhAz/55PNOGcJOlOIHv7blg:DdeKLRxh9omJ3W/55P/c2tPy
TLSH
T17CC41203B6C242B0F0B34BB55565DD2187BF797686709D9677C031A86AB43C08B3EBA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5zAA0RDWqJqIpe1.exe

Path C:\Users\Admin\AppData\Local\Temp\5zAA0RDWqJqIpe1.exe
Size 391KB
SHA256 498cbff668cb334ec4f9ca3e597b010c32a580e614069cfa055dff4972a0480f
MD5 85df2f380b9ac881dbb3ce277a1e4a08
SHA1 a54ed7a9d038be2a30ff0c9d33d92c8661f49b31
SHA512 3910499359cf362972fa3a1db0564dedbffe008973bae6590bdde4bc140e534ee817265f8434232e0da0ef64a74b0e83a6f4ac60e5f733bbaf5f315f94e63425
SSDEEP 6144:Vm8azsHQjnS6xPK5UhJue8sSAsrwjnGdzm50x3/shOUFoJRihqb:j0sHQjScS5De0bwjGtFx3kEUFaI0b
TLSH
T16B84BF8BF01265A3EF9E613D92B081F60DF4912757C74C42741427F9EC66CEA1CA6BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 71KB
SHA256 b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc
MD5 f9d4ab0a726adc9b5e4b7d7b724912f1
SHA1 3d42ca2098475924f70ee4a831c4f003b4682328
SHA512 22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432
SSDEEP 1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazT:ZRpAyazIliazT
TLSH
T176636B03B6D2C171E4B70A7649B8CE51067FBE765EB18D5B33C4218E49752C08E3ABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads