Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/10/2026, 17:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-11_82b1d961ad4aa74cc80783261de10934_bkransomware_elex_maze_stealc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-11_82b1d961ad4aa74cc80783261de10934_bkransomware_elex_maze_stealc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-10-11_82b1d961ad4aa74cc80783261de10934_bkransomware_elex_maze_stealc.exe
- Size 622KB
- Sample261012-vx4smaytht
- SHA256 61618f46c865cae9e373996f7d98f81595464dd3cec71bd67367cc381d2ca02f
- MD5 82b1d961ad4aa74cc80783261de10934
- SHA1 d6fda9be7c73b5cc507db01f43c7a7c4fcf934cb
- SHA512 6f3c92be907a87037f069ea1d9e4d1ccf0f927422d9f98eea00336f5fea1c70e263c0c50fda138cd609de8d4c866c73345c306ed7f6eabcf6238b8fc082da2a7
- SSDEEP 12288:gXc2sXxvYMY2BPIONYfk6TCF2vrOGt5tq5RzWMSt5gXg:gXcdZYM/lTYf8KrJq5e/gw
- TLSH T147D49D11B643A1B3D42325B74159F73A1A2DBE7A0F298AE3EBC30E6559F31C09633653
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 2264 furo3zaybwviilwcm8.exe 2212 xbfjchldo.exe 2944 vzrcqplygr.exe 1424 xbfjchldo.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\aijizevmn\wuxess0tgr vzrcqplygr.exe File created C:\Windows\aijizevmn\wuxess0tgr xbfjchldo.exe File created C:\Windows\aijizevmn\wuxess0tgr 2026-10-11_82b1d961ad4aa74cc80783261de10934_bkransomware_elex_maze_stealc.exe File created C:\Windows\aijizevmn\wuxess0tgr furo3zaybwviilwcm8.exe File created C:\Windows\aijizevmn\wuxess0tgr xbfjchldo.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbfjchldo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-11_82b1d961ad4aa74cc80783261de10934_bkransomware_elex_maze_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language furo3zaybwviilwcm8.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2212 xbfjchldo.exe 2212 xbfjchldo.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe 2944 vzrcqplygr.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2264 2508 2026-10-11_82b1d961ad4aa74cc80783261de10934_bkransomware_elex_maze_stealc.exe 85 PID 2212 wrote to memory of 2944 2212 xbfjchldo.exe 87 PID 2264 wrote to memory of 1424 2264 furo3zaybwviilwcm8.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-11_82b1d961ad4aa74cc80783261de10934_bkransomware_elex_maze_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-11_82b1d961ad4aa74cc80783261de10934_bkransomware_elex_maze_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\aijizevmn\furo3zaybwviilwcm8.exe"C:\aijizevmn\furo3zaybwviilwcm8.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\aijizevmn\xbfjchldo.exe"C:\aijizevmn\xbfjchldo.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1424
-
-
-
C:\aijizevmn\xbfjchldo.exeC:\aijizevmn\xbfjchldo.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\aijizevmn\vzrcqplygr.exekaaz3gbywumo "c:\aijizevmn\xbfjchldo.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2944
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\aijizevmn\furo3zaybwviilwcm8.exe
- Size 622KB
- SHA256 61618f46c865cae9e373996f7d98f81595464dd3cec71bd67367cc381d2ca02f
- MD5 82b1d961ad4aa74cc80783261de10934
- SHA1 d6fda9be7c73b5cc507db01f43c7a7c4fcf934cb
- SHA512 6f3c92be907a87037f069ea1d9e4d1ccf0f927422d9f98eea00336f5fea1c70e263c0c50fda138cd609de8d4c866c73345c306ed7f6eabcf6238b8fc082da2a7
- SSDEEP 12288:gXc2sXxvYMY2BPIONYfk6TCF2vrOGt5tq5RzWMSt5gXg:gXcdZYM/lTYf8KrJq5e/gw
- TLSH T147D49D11B643A1B3D42325B74159F73A1A2DBE7A0F298AE3EBC30E6559F31C09633653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\aijizevmn\wuxess0tgr
- Size 8B
- SHA256 723306ba99a42ae59d8d220de7f31095f0e2a51679de70117bad385a23c7242d
- MD5 447258ce2bb8b08ff00f4097099cf6ad
- SHA1 7bec7e322e377e25abf75798f11cdc37698e50e9
- SHA512 8edea53711cce562c16f92a972e272c009ddd171dff14985877a2087ca3a5d74cd60e4d6a7840af20c20a9d5f20eff7e578997506b6490f977f35525846e9ed3
- MD5 SHA1 SHA512