Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-24_ad42e164a01c5fb3078ce9129fed44d6_elex_maze_remcos_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_ad42e164a01c5fb3078ce9129fed44d6_elex_maze_remcos_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-24_ad42e164a01c5fb3078ce9129fed44d6_elex_maze_remcos_stealc.exe
- Size 407KB
- Sample260825-e2jegsfh49
- SHA256 141502e1ad44c9fc9d0d7e1d96435ba65638ac1a92731a4b866089d5b10ebe1c
- MD5 ad42e164a01c5fb3078ce9129fed44d6
- SHA1 54d8a1cf654b44519e81fed586615d693c8863a5
- SHA512 1ac2f2ff532d69d69f844d5493dd9d766d725c963d9564f2eec6ad0eef7da687fb77a22d0a5ce527c1e061403cc28f8e09ec5306b7ee48f41b4639a64b1bdd50
- SSDEEP 6144:Vx0YiAV+1M9eUrg0eXlK/UAhnvaaTt7ffQjX39Cj2Qe80WU/E:VCYtV+6Brg5K/ndaOt7fm3oj2Qez/E
- TLSH T1F1949D21F7C0D930E07A86B51C78EB3101ED7AB21F79A9CBBBC445898AB45E16735B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 7672 e0s3zbo0todzbuevnffe.exe 11388 afufhaq.exe 15108 jihwcalcxjsd.exe 18840 afufhaq.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\pnnacraqadrgxwn\iscelengfd7 afufhaq.exe File created C:\Windows\pnnacraqadrgxwn\iscelengfd7 jihwcalcxjsd.exe File created C:\Windows\pnnacraqadrgxwn\iscelengfd7 afufhaq.exe File created C:\Windows\pnnacraqadrgxwn\iscelengfd7 2026-08-24_ad42e164a01c5fb3078ce9129fed44d6_elex_maze_remcos_stealc.exe File created C:\Windows\pnnacraqadrgxwn\iscelengfd7 e0s3zbo0todzbuevnffe.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_ad42e164a01c5fb3078ce9129fed44d6_elex_maze_remcos_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e0s3zbo0todzbuevnffe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language afufhaq.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 11388 afufhaq.exe 11388 afufhaq.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe 15108 jihwcalcxjsd.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3208 wrote to memory of 7672 3208 2026-08-24_ad42e164a01c5fb3078ce9129fed44d6_elex_maze_remcos_stealc.exe 89 PID 11388 wrote to memory of 15108 11388 afufhaq.exe 91 PID 7672 wrote to memory of 18840 7672 e0s3zbo0todzbuevnffe.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_ad42e164a01c5fb3078ce9129fed44d6_elex_maze_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_ad42e164a01c5fb3078ce9129fed44d6_elex_maze_remcos_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\pnnacraqadrgxwn\e0s3zbo0todzbuevnffe.exe"C:\pnnacraqadrgxwn\e0s3zbo0todzbuevnffe.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7672 -
C:\pnnacraqadrgxwn\afufhaq.exe"C:\pnnacraqadrgxwn\afufhaq.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:18840
-
-
-
C:\pnnacraqadrgxwn\afufhaq.exeC:\pnnacraqadrgxwn\afufhaq.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:11388 -
C:\pnnacraqadrgxwn\jihwcalcxjsd.exeajjawiwhqqnp "c:\pnnacraqadrgxwn\afufhaq.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:15108
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\pnnacraqadrgxwn\e0s3zbo0todzbuevnffe.exe
- Size 407KB
- SHA256 141502e1ad44c9fc9d0d7e1d96435ba65638ac1a92731a4b866089d5b10ebe1c
- MD5 ad42e164a01c5fb3078ce9129fed44d6
- SHA1 54d8a1cf654b44519e81fed586615d693c8863a5
- SHA512 1ac2f2ff532d69d69f844d5493dd9d766d725c963d9564f2eec6ad0eef7da687fb77a22d0a5ce527c1e061403cc28f8e09ec5306b7ee48f41b4639a64b1bdd50
- SSDEEP 6144:Vx0YiAV+1M9eUrg0eXlK/UAhnvaaTt7ffQjX39Cj2Qe80WU/E:VCYtV+6Brg5K/ndaOt7fm3oj2Qez/E
- TLSH T1F1949D21F7C0D930E07A86B51C78EB3101ED7AB21F79A9CBBBC445898AB45E16735B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\pnnacraqadrgxwn\iscelengfd7
- Size 7B
- SHA256 f4b04c16a2a697c94e27826a253d826aab537559d14cbf6ea81f64c318ea3e47
- MD5 23037310edb5dda90c5a04be7915dc6c
- SHA1 8fc78c478d7274260d11c447dfff4d818dfeb877
- SHA512 c48b50c33db5134c5a03fccff462bae5dd42be2004801790f4f84a994d9b5b1e4ffcd5938dee01f7dec9248d98a8094c2d19ccc5afc461d7b37b2edb91af1505
- MD5 SHA1 SHA512
- Path C:\pnnacraqadrgxwn\savmny1
- Size 4B
- SHA256 3480b21f83e2916ba14bf0fd8928f9df3229ddde173230e9c06a44a220e8c61b
- MD5 7802b5be639b0062876068a5be4de97b
- SHA1 5f15f01b8383661531465e4320957c0a635e4e05
- SHA512 b3ffddede1410d947674f963b61baa7ef2ab298ff668b96a2f7f4705fdd1ac52e3bdb10f78d4e574aa66a5e2249c75fe6db032c64c9ec6d7b5e5f76cd16996cb
- MD5 SHA1 SHA512