Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 00:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_c8ef9759d59beb2b8143457a23f0d3e3_bkransomware_elex_maze_remcos_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_c8ef9759d59beb2b8143457a23f0d3e3_bkransomware_elex_maze_remcos_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-22_c8ef9759d59beb2b8143457a23f0d3e3_bkransomware_elex_maze_remcos_stealc.exe
- Size 376KB
- Sample260823-atbx8a1emd
- SHA256 ceecc8e74e967a08981dc652a809317a328ac2f82218baec1499cee89c87abb6
- MD5 c8ef9759d59beb2b8143457a23f0d3e3
- SHA1 16968bf74623c1ea2aded8df8963f50414b137c1
- SHA512 b761b8339109e976ae766deaef3f9fa2625d419d3a23ad0c1a53b9f1925765c64e2027f039d5fb64bfd2017fcc6bba4150d4dbd63589b51454f86e6512207953
- SSDEEP 6144:9FFdaFyHkKnMui5qUjFIM0cVAfwhSPz9Jp85uJa0:9REyEu3jUjFIM0cVAf+S5Jp8ka0
- TLSH T1FA84AD14B284D032C56292BE1165FBB225BEB9F63F217ADB67D90ACE44742C07233797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 2996 ppg3zbf3nyehbnfkl9q.exe 4212 homoseedy.exe 5636 btyteolmwj.exe 4088 homoseedy.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\gotiqqx\fzcbjwthm btyteolmwj.exe File created C:\Windows\gotiqqx\fzcbjwthm homoseedy.exe File created C:\Windows\gotiqqx\fzcbjwthm 2026-08-22_c8ef9759d59beb2b8143457a23f0d3e3_bkransomware_elex_maze_remcos_stealc.exe File created C:\Windows\gotiqqx\fzcbjwthm ppg3zbf3nyehbnfkl9q.exe File created C:\Windows\gotiqqx\fzcbjwthm homoseedy.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-22_c8ef9759d59beb2b8143457a23f0d3e3_bkransomware_elex_maze_remcos_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppg3zbf3nyehbnfkl9q.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language homoseedy.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4212 homoseedy.exe 4212 homoseedy.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe 5636 btyteolmwj.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4708 wrote to memory of 2996 4708 2026-08-22_c8ef9759d59beb2b8143457a23f0d3e3_bkransomware_elex_maze_remcos_stealc.exe 88 PID 4212 wrote to memory of 5636 4212 homoseedy.exe 91 PID 2996 wrote to memory of 4088 2996 ppg3zbf3nyehbnfkl9q.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_c8ef9759d59beb2b8143457a23f0d3e3_bkransomware_elex_maze_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_c8ef9759d59beb2b8143457a23f0d3e3_bkransomware_elex_maze_remcos_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\gotiqqx\ppg3zbf3nyehbnfkl9q.exe"C:\gotiqqx\ppg3zbf3nyehbnfkl9q.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\gotiqqx\homoseedy.exe"C:\gotiqqx\homoseedy.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4088
-
-
-
C:\gotiqqx\homoseedy.exeC:\gotiqqx\homoseedy.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\gotiqqx\btyteolmwj.exeeqtshvwgvmyx "c:\gotiqqx\homoseedy.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:5636
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\gotiqqx\fzcbjwthm
- Size 6B
- SHA256 10c71de3a5e8e93888413158615b29d6863a5f646c866668d9cb1b82c7cac5bb
- MD5 4b665e72d5f3908c82a16a01031f2d23
- SHA1 e746e8d18737b14b3efbbcffafb2cd967de61599
- SHA512 f61c84816fdc9b9afbf86c60d41ee63ad6f7c0d4056712f55f49aeef534d3869d4ac790b5939e8020afd8a477963eb64ebdbb41f47370b541ff64b5e0b92be1c
- MD5 SHA1 SHA512
- Path C:\gotiqqx\ppg3zbf3nyehbnfkl9q.exe
- Size 376KB
- SHA256 ceecc8e74e967a08981dc652a809317a328ac2f82218baec1499cee89c87abb6
- MD5 c8ef9759d59beb2b8143457a23f0d3e3
- SHA1 16968bf74623c1ea2aded8df8963f50414b137c1
- SHA512 b761b8339109e976ae766deaef3f9fa2625d419d3a23ad0c1a53b9f1925765c64e2027f039d5fb64bfd2017fcc6bba4150d4dbd63589b51454f86e6512207953
- SSDEEP 6144:9FFdaFyHkKnMui5qUjFIM0cVAfwhSPz9Jp85uJa0:9REyEu3jUjFIM0cVAf+S5Jp8ka0
- TLSH T1FA84AD14B284D032C56292BE1165FBB225BEB9F63F217ADB67D90ACE44742C07233797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\gotiqqx\sktksqimmu
- Size 4B
- SHA256 508ec44c2a54df4a5422694b0b11e7178fbe1226c1a27feaee420949a2eb5007
- MD5 cc98f852a8be491d55771d469c71dd48
- SHA1 7ae130db5f747832ae8e935f97999233269b0374
- SHA512 8ce593d8dbedfb7f3c01725c665e856973a51325269dce9bd9f57bd65933dae58ab02b69f096d0519da04837dfd54de60ee3f19fbf6afee52489efaccf646da8
- MD5 SHA1 SHA512