0145d728958c92d12983421311cf5c258ebcd113b9b56373f68c81b6c8ff4020

Analysis

max time kernel
149s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 01:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_0bfc5395c7fb2ef05228e453c0ae1c83_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
Size 224KB
Sample260425-bsyahagy3n
SHA256 0145d728958c92d12983421311cf5c258ebcd113b9b56373f68c81b6c8ff4020
MD5 0bfc5395c7fb2ef05228e453c0ae1c83
SHA1 4bc2acb30763ae0e141da43ace55aaba60f84b75
SHA512 73f5d32706da9cc35e26313fed9054055ef0d128b81ce55792fb093b191427b02128a577b7c393a6ee4b8eed462883519ed705d96a2516ec5497299f09b747e5
SSDEEP 3072:nZfnxegcbEz1sWn+4dmpYexanmX7+kcWQyZwE5GJUUfHY:pYbbnW+9ieomLBfZdIJUcH
TLSH
T12B245910B981C072D6B3027106F8CBB2597DBD724B66A9CFB7D40B9D0A345D2AB31B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2172	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_0bfc5395c7fb2ef05228e453c0ae1c83_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4336	2026-04-25_0bfc5395c7fb2ef05228e453c0ae1c83_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
4336	2026-04-25_0bfc5395c7fb2ef05228e453c0ae1c83_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
2172	WMIC.exe
2172	WMIC.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 2172	4336	2026-04-25_0bfc5395c7fb2ef05228e453c0ae1c83_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-25_0bfc5395c7fb2ef05228e453c0ae1c83_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_0bfc5395c7fb2ef05228e453c0ae1c83_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Intel\WMIC.exe
  C:\Intel\WMIC.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WMIC.exe

Path C:\Intel\WMIC.exe
Size 224KB
SHA256 378bc81f7e8d0c5403fe66544ecc3048185edd7a8a1d10ab5f6c259c98a8fb62
MD5 1acee1467117c17a2bc1d58dde2e9edf
SHA1 9b8700fd319a0f008aa6bc913953a6eeb68aa2d9
SHA512 d01a0293ba703efcc9430c175ed740b9b2649f215559b3a61c5c51411da0069f7a8c52bb2ed761df6ebf8e59f51e5dd48289df3bac6fe43a5d0dc781a8f4f8a1
SSDEEP 3072:nZfnxegcbEz1sWn+4dmpYexanmX7+kcWQyZwE5GJbUfHY:pYbbnW+9ieomLBfZdIJbcH
TLSH
T139245910B981C072D6B3027106F8CBB2597DBD724B66A9CFB7D40B9D0A345D2AB31B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp-0.bin

Path C:\Intel\tmp-0.bin
Size 8KB
SHA256 d1d1eebbf8cebfe88c5fce3e878bf31b567efbbf003187c1b3c4da2d1f37635d
MD5 52fe4232bda48a60278960fa801a6586
SHA1 b169df7820aa3be52a4626a4e9ad9229f12faa58
SHA512 14a034d7d9bbf907cb5de9eaf55bd4eab03fd0f66364518174ba698e91255a0867371c068d44b2c9dbb705ce9f8d3d456b7651f1d96b83cccbfe5251e624bef9
SSDEEP 3:Xtlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll/:v
MD5 SHA1 SHA512 SSDEEP

Submit Download