Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 16:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-05_b535ff4c20ad43a427ccd9c33570b3fe_bkransomware_elex_maze.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-05_b535ff4c20ad43a427ccd9c33570b3fe_bkransomware_elex_maze.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-10-05_b535ff4c20ad43a427ccd9c33570b3fe_bkransomware_elex_maze.exe
- Size 572KB
- Sample261006-t5kt2sff25
- SHA256 df7ab8e4c36d77770b450eda28f37f3986c71bf6018de18145bf3d273284ee53
- MD5 b535ff4c20ad43a427ccd9c33570b3fe
- SHA1 fab70b431e971637dd82d1ba61e654b14fd92422
- SHA512 98cddd6628babc0f8ce41cc27523a0da5c318bdc26a905a78081643179a84b1b3634973a53dea989aef7fbbbeb290d2f46fa542e3d5efbefa98797b34f9da124
- SSDEEP 12288:dGb3xx6oqVzJxR4cWeVjVXKPCAur477PuuHRj6:dEWLNJxR4cWG/Hk/WwR
- TLSH T1C3C48D11B583A1B3D82264F38169E6372A35BD760F298AE3E7C70F2569F35C0D633652
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 568 sy3zbgg9bwommmbsxxw.exe 1136 fomjdaldxol.exe 1784 zcomwvtifags.exe 4508 fomjdaldxol.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\bcswhgdkolt\zie6gd 2026-10-05_b535ff4c20ad43a427ccd9c33570b3fe_bkransomware_elex_maze.exe File created C:\Windows\bcswhgdkolt\zie6gd sy3zbgg9bwommmbsxxw.exe File created C:\Windows\bcswhgdkolt\zie6gd fomjdaldxol.exe File created C:\Windows\bcswhgdkolt\zie6gd zcomwvtifags.exe File created C:\Windows\bcswhgdkolt\zie6gd fomjdaldxol.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-05_b535ff4c20ad43a427ccd9c33570b3fe_bkransomware_elex_maze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sy3zbgg9bwommmbsxxw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fomjdaldxol.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1136 fomjdaldxol.exe 1136 fomjdaldxol.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe 1784 zcomwvtifags.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1028 wrote to memory of 568 1028 2026-10-05_b535ff4c20ad43a427ccd9c33570b3fe_bkransomware_elex_maze.exe 89 PID 1136 wrote to memory of 1784 1136 fomjdaldxol.exe 91 PID 568 wrote to memory of 4508 568 sy3zbgg9bwommmbsxxw.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_b535ff4c20ad43a427ccd9c33570b3fe_bkransomware_elex_maze.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_b535ff4c20ad43a427ccd9c33570b3fe_bkransomware_elex_maze.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\bcswhgdkolt\sy3zbgg9bwommmbsxxw.exe"C:\bcswhgdkolt\sy3zbgg9bwommmbsxxw.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:568 -
C:\bcswhgdkolt\fomjdaldxol.exe"C:\bcswhgdkolt\fomjdaldxol.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4508
-
-
-
C:\bcswhgdkolt\fomjdaldxol.exeC:\bcswhgdkolt\fomjdaldxol.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\bcswhgdkolt\zcomwvtifags.exedrmt71zzitsf "c:\bcswhgdkolt\fomjdaldxol.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1784
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\bcswhgdkolt\sy3zbgg9bwommmbsxxw.exe
- Size 572KB
- SHA256 df7ab8e4c36d77770b450eda28f37f3986c71bf6018de18145bf3d273284ee53
- MD5 b535ff4c20ad43a427ccd9c33570b3fe
- SHA1 fab70b431e971637dd82d1ba61e654b14fd92422
- SHA512 98cddd6628babc0f8ce41cc27523a0da5c318bdc26a905a78081643179a84b1b3634973a53dea989aef7fbbbeb290d2f46fa542e3d5efbefa98797b34f9da124
- SSDEEP 12288:dGb3xx6oqVzJxR4cWeVjVXKPCAur477PuuHRj6:dEWLNJxR4cWG/Hk/WwR
- TLSH T1C3C48D11B583A1B3D82264F38169E6372A35BD760F298AE3E7C70F2569F35C0D633652
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\bcswhgdkolt\zie6gd
- Size 12B
- SHA256 b0915f0a1b4758a129cac30daa64fc0211cb88e9fba0d83f09122718b0f1b39f
- MD5 6da3aa570b47e37768a352b2759354ce
- SHA1 c59d76ab4254046d27bd9aa9cb2c0ef8ed9648c1
- SHA512 e7151bb8e67f2d65d629ce386ee4833761b5d93bb4a8210ae3becb20306a8c841e16bbf69bda803649e6c3c680323e7332930fca62a97590d4d95da33fd9f877
- MD5 SHA1 SHA512