Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/09/2026, 11:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-08_d9687b9604b2bf917a3c522cb5914040_bkransomware_elex_hawkeye_maze_remcos_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-08_d9687b9604b2bf917a3c522cb5914040_bkransomware_elex_hawkeye_maze_remcos_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-09-08_d9687b9604b2bf917a3c522cb5914040_bkransomware_elex_hawkeye_maze_remcos_stealc.exe
- Size 375KB
- Sample260908-nnl3wsysdy
- SHA256 ed1ea1692d5946f7ae194b49c7c7a8c818bd5f7238c5fe81ca90b8cd2535c0f2
- MD5 d9687b9604b2bf917a3c522cb5914040
- SHA1 dd6855d27dfde39a503e30551df6e17645d48f9d
- SHA512 aaf2e3a28f982e3beee7df210bb43a3e3817917c1f2a29649661fa5d655273a533e72f283da01a6122c23f36bcfe6b1ac55902a29130c0b8d593672010d69235
- SSDEEP 6144:OdWf3SBsLIUSi+Pq0dt08PPJLfc3lY3mh9BCiFgjIxtVbDBIivP6q:OdWf3SBW3SpP1dt04ylY3mh/CzjIxtdR
- TLSH T12E849E11B5C7E032D4A283BD53A8FB7155FE79B16B246ADB67C888CC4A302C1B236757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 2452 smyj3zbtetsfulmoofucwk.exe 6108 xzgyxhijzie.exe 2660 nbwqiihq.exe 2648 xzgyxhijzie.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\yaafymohwnpwebo\cr7nlji 2026-09-08_d9687b9604b2bf917a3c522cb5914040_bkransomware_elex_hawkeye_maze_remcos_stealc.exe File created C:\Windows\yaafymohwnpwebo\cr7nlji smyj3zbtetsfulmoofucwk.exe File created C:\Windows\yaafymohwnpwebo\cr7nlji xzgyxhijzie.exe File created C:\Windows\yaafymohwnpwebo\cr7nlji nbwqiihq.exe File created C:\Windows\yaafymohwnpwebo\cr7nlji xzgyxhijzie.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-08_d9687b9604b2bf917a3c522cb5914040_bkransomware_elex_hawkeye_maze_remcos_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smyj3zbtetsfulmoofucwk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xzgyxhijzie.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6108 xzgyxhijzie.exe 6108 xzgyxhijzie.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe 2660 nbwqiihq.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4696 wrote to memory of 2452 4696 2026-09-08_d9687b9604b2bf917a3c522cb5914040_bkransomware_elex_hawkeye_maze_remcos_stealc.exe 88 PID 6108 wrote to memory of 2660 6108 xzgyxhijzie.exe 91 PID 2452 wrote to memory of 2648 2452 smyj3zbtetsfulmoofucwk.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_d9687b9604b2bf917a3c522cb5914040_bkransomware_elex_hawkeye_maze_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_d9687b9604b2bf917a3c522cb5914040_bkransomware_elex_hawkeye_maze_remcos_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\yaafymohwnpwebo\smyj3zbtetsfulmoofucwk.exe"C:\yaafymohwnpwebo\smyj3zbtetsfulmoofucwk.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\yaafymohwnpwebo\xzgyxhijzie.exe"C:\yaafymohwnpwebo\xzgyxhijzie.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2648
-
-
-
C:\yaafymohwnpwebo\xzgyxhijzie.exeC:\yaafymohwnpwebo\xzgyxhijzie.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\yaafymohwnpwebo\nbwqiihq.exedv8ehzqzkdgx "c:\yaafymohwnpwebo\xzgyxhijzie.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2660
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\yaafymohwnpwebo\cr7nlji
- Size 12B
- SHA256 452a95fee1b907e7c689b9639b8a48e19398ff0524dff15095e8e6476e5c590a
- MD5 aec867c9b1b0339201762c1f8cc4acb7
- SHA1 cf253d453c6bd7b081d433d6185d0f934906e4bb
- SHA512 4f2c6da3058f6bfe38e76ddeee557bff6fdfc60af21628af4613f5a2369ab428d9a9d2d8fad43e4d147d96a72f4622634a9fe0b3bae0aa92417b7de037c1f638
- MD5 SHA1 SHA512
- Path C:\yaafymohwnpwebo\ogzbqe
- Size 4B
- SHA256 8428bb2215ca7cea99c8336e448bf806b2162312d3205b63af904a55e726c906
- MD5 3520acb20b4b6cfd03570fba57aaca01
- SHA1 f3e3f537fff9d520dae4174aeb1d523154de7acf
- SHA512 7add254a1c65ca3b82d5b14e87b80ba8ca229202339562d133085ff2e20af86dd0b0794b7afd4172dfd516031e35c53b7be0e36e5df506e6266b39bb80c51f5c
- MD5 SHA1 SHA512
- Path C:\yaafymohwnpwebo\smyj3zbtetsfulmoofucwk.exe
- Size 375KB
- SHA256 ed1ea1692d5946f7ae194b49c7c7a8c818bd5f7238c5fe81ca90b8cd2535c0f2
- MD5 d9687b9604b2bf917a3c522cb5914040
- SHA1 dd6855d27dfde39a503e30551df6e17645d48f9d
- SHA512 aaf2e3a28f982e3beee7df210bb43a3e3817917c1f2a29649661fa5d655273a533e72f283da01a6122c23f36bcfe6b1ac55902a29130c0b8d593672010d69235
- SSDEEP 6144:OdWf3SBsLIUSi+Pq0dt08PPJLfc3lY3mh9BCiFgjIxtVbDBIivP6q:OdWf3SBW3SpP1dt04ylY3mh/CzjIxtdR
- TLSH T12E849E11B5C7E032D4A283BD53A8FB7155FE79B16B246ADB67C888CC4A302C1B236757
- MD5 SHA1 SHA512 SSDEEP TLSH