Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/10/2026, 16:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-18_2dcd1a9508d5263895ed3e26fe0f6781_bkransomware_elex_maze_stealc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-18_2dcd1a9508d5263895ed3e26fe0f6781_bkransomware_elex_maze_stealc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-18_2dcd1a9508d5263895ed3e26fe0f6781_bkransomware_elex_maze_stealc.exe
- Size 604KB
- Sample261018-tv14aaex9p
- SHA256 375f40d05435397a5758488680200c569094a595bcc338f1b5509e1a06b3351b
- MD5 2dcd1a9508d5263895ed3e26fe0f6781
- SHA1 1bfff7accc2b4d138664e26a339798dfd0077047
- SHA512 c2351544ef7a90d4a35af25b52af20f6cf35431010d7106a60ace26768f029a6cfcf1063bb3e9b6ecd337f275e29b7e3e0cdeeaee99b7b32d78d020399d7f309
- SSDEEP 6144:9nc9iVjU5d9UuPxfwR9NjKJq4p3MrcsfT4qbYarH5eqz+Wu15jrSfBknjcgr/JqR:a4joPiDAduXx+DjrS5Oj1JDpM
- TLSH T178D4A302474C4A28DCED39B80255B2F3F2765C9A635286BAF28D05BC36D93ADDF91317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 5372 ylho63zaqmztccqfvwjj.exe 2452 ogpellxvp.exe 3416 esbcfck.exe 4904 ogpellxvp.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\hpoiwlvjynvntzi\ughmt9uce ogpellxvp.exe File created C:\Windows\hpoiwlvjynvntzi\ughmt9uce 2026-10-18_2dcd1a9508d5263895ed3e26fe0f6781_bkransomware_elex_maze_stealc.exe File created C:\Windows\hpoiwlvjynvntzi\ughmt9uce ylho63zaqmztccqfvwjj.exe File created C:\Windows\hpoiwlvjynvntzi\ughmt9uce ogpellxvp.exe File created C:\Windows\hpoiwlvjynvntzi\ughmt9uce esbcfck.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ogpellxvp.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ogpellxvp.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-18_2dcd1a9508d5263895ed3e26fe0f6781_bkransomware_elex_maze_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ylho63zaqmztccqfvwjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ogpellxvp.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2452 ogpellxvp.exe 2452 ogpellxvp.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe 3416 esbcfck.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3176 wrote to memory of 5372 3176 2026-10-18_2dcd1a9508d5263895ed3e26fe0f6781_bkransomware_elex_maze_stealc.exe 89 PID 2452 wrote to memory of 3416 2452 ogpellxvp.exe 91 PID 5372 wrote to memory of 4904 5372 ylho63zaqmztccqfvwjj.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-18_2dcd1a9508d5263895ed3e26fe0f6781_bkransomware_elex_maze_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-18_2dcd1a9508d5263895ed3e26fe0f6781_bkransomware_elex_maze_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\hpoiwlvjynvntzi\ylho63zaqmztccqfvwjj.exe"C:\hpoiwlvjynvntzi\ylho63zaqmztccqfvwjj.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\hpoiwlvjynvntzi\ogpellxvp.exe"C:\hpoiwlvjynvntzi\ogpellxvp.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4904
-
-
-
C:\hpoiwlvjynvntzi\ogpellxvp.exeC:\hpoiwlvjynvntzi\ogpellxvp.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\hpoiwlvjynvntzi\esbcfck.exeats7hq1pywrm "c:\hpoiwlvjynvntzi\ogpellxvp.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3416
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\hpoiwlvjynvntzi\oltwpwnu
- Size 4B
- SHA256 859c535e0066a94d1e60cbcd86c6bc43cb7de5b5a0ca18229beaa19b378129e7
- MD5 3e5b859fd572b50aa8a3941050bd6c00
- SHA1 1cce3d7bf802f010cb1d6d840805768b14b655e1
- SHA512 56e5bcb02d32a0c0c173a8709e88ce8c4a8bfb372acb4c698c5213aecda694f4e6fa37ac5889b0ffc92099384b6618acb10bbc720660128f9d573c24ec9171c5
- MD5 SHA1 SHA512
- Path C:\hpoiwlvjynvntzi\ughmt9uce
- Size 8B
- SHA256 3f9f0f67261b16b2a079b988ee9b8b8048960225558507bc7ddc336b8ab25b66
- MD5 9956faa46b173460c99f32da8ba18ee7
- SHA1 0b0b76b44b45642459bdb7fac4c67b499dac9d03
- SHA512 12ddb45740d8af755fb89a7c753b090ea4fd97ac1eb6100db4d03732a86a36ce57182ff4770d61499d63ee0243a4737bde103993170744db5ec220344eedba2c
- MD5 SHA1 SHA512
- Path C:\hpoiwlvjynvntzi\ylho63zaqmztccqfvwjj.exe
- Size 604KB
- SHA256 375f40d05435397a5758488680200c569094a595bcc338f1b5509e1a06b3351b
- MD5 2dcd1a9508d5263895ed3e26fe0f6781
- SHA1 1bfff7accc2b4d138664e26a339798dfd0077047
- SHA512 c2351544ef7a90d4a35af25b52af20f6cf35431010d7106a60ace26768f029a6cfcf1063bb3e9b6ecd337f275e29b7e3e0cdeeaee99b7b32d78d020399d7f309
- SSDEEP 6144:9nc9iVjU5d9UuPxfwR9NjKJq4p3MrcsfT4qbYarH5eqz+Wu15jrSfBknjcgr/JqR:a4joPiDAduXx+DjrS5Oj1JDpM
- TLSH T178D4A302474C4A28DCED39B80255B2F3F2765C9A635286BAF28D05BC36D93ADDF91317
- MD5 SHA1 SHA512 SSDEEP TLSH