Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 19:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-05_90d6bf52490e97603fc4f4e643d9326f_bkransomware_elex_maze_stealc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-05_90d6bf52490e97603fc4f4e643d9326f_bkransomware_elex_maze_stealc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-05_90d6bf52490e97603fc4f4e643d9326f_bkransomware_elex_maze_stealc.exe
- Size 595KB
- Sample261006-yckqssty5q
- SHA256 2f4a2aafbf33ed6af5fd41bd61d54b432cb53b5df75724d5eb69f4f23690306f
- MD5 90d6bf52490e97603fc4f4e643d9326f
- SHA1 a90c83baac5871b2e60024085ca6f81c6741ccda
- SHA512 aa8775c5759a4b679218d5ed8c85ad0390a3c8da5c678ddc18f6ed1e60a77d923393d710b17a4eaa43d0260beb66030da6dab4a868f3229ebd11a5021f832ab3
- SSDEEP 6144:4p5UKePM8HuDvVECGT/A2zLceTulT3S0if1y8BjKaItax+52lIaNM5oU2InULnwo:IMsacuU2InCwvbQ0KldNI56V
- TLSH T14FD4A4237988C266DCED3AB6431DB2E2F3351DD8A7609177F2D8267C72142AC8F91725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 1620 sgpbe3zcpeqjecuncktr.exe 2348 xxtxxcsyve.exe 3344 lzwwvkzdzqqy.exe 5904 xxtxxcsyve.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\ezobpfdbvykq\cqcen61z xxtxxcsyve.exe File created C:\Windows\ezobpfdbvykq\cqcen61z 2026-10-05_90d6bf52490e97603fc4f4e643d9326f_bkransomware_elex_maze_stealc.exe File created C:\Windows\ezobpfdbvykq\cqcen61z sgpbe3zcpeqjecuncktr.exe File created C:\Windows\ezobpfdbvykq\cqcen61z xxtxxcsyve.exe File created C:\Windows\ezobpfdbvykq\cqcen61z lzwwvkzdzqqy.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname xxtxxcsyve.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain xxtxxcsyve.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxtxxcsyve.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-05_90d6bf52490e97603fc4f4e643d9326f_bkransomware_elex_maze_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sgpbe3zcpeqjecuncktr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2348 xxtxxcsyve.exe 2348 xxtxxcsyve.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 2348 xxtxxcsyve.exe 2348 xxtxxcsyve.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 2348 xxtxxcsyve.exe 2348 xxtxxcsyve.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 2348 xxtxxcsyve.exe 2348 xxtxxcsyve.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe 3344 lzwwvkzdzqqy.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4280 wrote to memory of 1620 4280 2026-10-05_90d6bf52490e97603fc4f4e643d9326f_bkransomware_elex_maze_stealc.exe 88 PID 2348 wrote to memory of 3344 2348 xxtxxcsyve.exe 90 PID 1620 wrote to memory of 5904 1620 sgpbe3zcpeqjecuncktr.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_90d6bf52490e97603fc4f4e643d9326f_bkransomware_elex_maze_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_90d6bf52490e97603fc4f4e643d9326f_bkransomware_elex_maze_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\ezobpfdbvykq\sgpbe3zcpeqjecuncktr.exe"C:\ezobpfdbvykq\sgpbe3zcpeqjecuncktr.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\ezobpfdbvykq\xxtxxcsyve.exe"C:\ezobpfdbvykq\xxtxxcsyve.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5904
-
-
-
C:\ezobpfdbvykq\xxtxxcsyve.exeC:\ezobpfdbvykq\xxtxxcsyve.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\ezobpfdbvykq\lzwwvkzdzqqy.exeyumqufzyftc4 "c:\ezobpfdbvykq\xxtxxcsyve.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3344
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ezobpfdbvykq\cbidjnogzhe
- Size 4B
- SHA256 89afda29189be77c52f49246ce29e9219ed9066bccf96bf38e745ddb77bfc503
- MD5 f1f9da9d52742e7c43936ec5ffa63069
- SHA1 57ee287f1c79a6507254b38796b390ea35d639d8
- SHA512 93a9b06be14d0b7c3f26293fe2287af7a6ff91299c5e322a4460b6ab963d2416bb442a7f91192c6bde0756465a8081b88cf6dcbcb615d62f92d964544735f5b5
- MD5 SHA1 SHA512
- Path C:\ezobpfdbvykq\cqcen61z
- Size 12B
- SHA256 462841f0fec372c68d43a2925a5acd0591b16abff7b5c1fc8d5af83a89b925c8
- MD5 91b3cdec886913b3804806c39a16d6cb
- SHA1 9a7033cdbb4ce5353af87e4f0bc4f7ad48d85178
- SHA512 ffdce71638b4eb9982e562b86da1e0f1253ccb217b065462e66d6baa2d3bcc73b089fa0aa0543d85d1724a513a27a74d1b34b17820f367068b770a215ca5cfd7
- MD5 SHA1 SHA512
- Path C:\ezobpfdbvykq\sgpbe3zcpeqjecuncktr.exe
- Size 595KB
- SHA256 2f4a2aafbf33ed6af5fd41bd61d54b432cb53b5df75724d5eb69f4f23690306f
- MD5 90d6bf52490e97603fc4f4e643d9326f
- SHA1 a90c83baac5871b2e60024085ca6f81c6741ccda
- SHA512 aa8775c5759a4b679218d5ed8c85ad0390a3c8da5c678ddc18f6ed1e60a77d923393d710b17a4eaa43d0260beb66030da6dab4a868f3229ebd11a5021f832ab3
- SSDEEP 6144:4p5UKePM8HuDvVECGT/A2zLceTulT3S0if1y8BjKaItax+52lIaNM5oU2InULnwo:IMsacuU2InCwvbQ0KldNI56V
- TLSH T14FD4A4237988C266DCED3AB6431DB2E2F3351DD8A7609177F2D8267C72142AC8F91725
- MD5 SHA1 SHA512 SSDEEP TLSH