0145d728958c92d12983421311cf5c258ebcd113b9b56373f68c81b6c8ff4020

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 01:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_0bfc5395c7fb2ef05228e453c0ae1c83_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
Size 224KB
Sample260425-bsyahagy3n
SHA256 0145d728958c92d12983421311cf5c258ebcd113b9b56373f68c81b6c8ff4020
MD5 0bfc5395c7fb2ef05228e453c0ae1c83
SHA1 4bc2acb30763ae0e141da43ace55aaba60f84b75
SHA512 73f5d32706da9cc35e26313fed9054055ef0d128b81ce55792fb093b191427b02128a577b7c393a6ee4b8eed462883519ed705d96a2516ec5497299f09b747e5
SSDEEP 3072:nZfnxegcbEz1sWn+4dmpYexanmX7+kcWQyZwE5GJUUfHY:pYbbnW+9ieomLBfZdIJUcH
TLSH
T12B245910B981C072D6B3027106F8CBB2597DBD724B66A9CFB7D40B9D0A345D2AB31B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3700	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_0bfc5395c7fb2ef05228e453c0ae1c83_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3372	2026-04-25_0bfc5395c7fb2ef05228e453c0ae1c83_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
3372	2026-04-25_0bfc5395c7fb2ef05228e453c0ae1c83_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
3700	WMIC.exe
3700	WMIC.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 3700	3372	2026-04-25_0bfc5395c7fb2ef05228e453c0ae1c83_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-25_0bfc5395c7fb2ef05228e453c0ae1c83_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_0bfc5395c7fb2ef05228e453c0ae1c83_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Intel\WMIC.exe
  C:\Intel\WMIC.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WMIC.exe

Path C:\Intel\WMIC.exe
Size 224KB
SHA256 84af30720637ce5046428333ad9f45c5327d3f9e4d6c5c774a681d0d00380425
MD5 25afce63b2adabae8adf9896d9e81614
SHA1 35f5c6e2d0bea47176425fb648e4471d519a28a4
SHA512 ee605f9f23c5d0cdfce23f39222f75c345f8a322ad643e9b7204bdca384ffcc7261edd4145e2ca52f9135897bb2957ab1db230fbc4babd7ba20a0bf05dbf61ed
SSDEEP 3072:nZfnxegcbEz1sWn+4dmpYexanmX7+kcWQyZwE5GJ4UfHY:pYbbnW+9ieomLBfZdIJ4cH
TLSH
T11B245910B981C072D6B3027106F8CBB2597DBD724B76A9CFA7D40B9D0A745D2AB31B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp-0.bin

Path C:\Intel\tmp-0.bin
Size 8KB
SHA256 d1d1eebbf8cebfe88c5fce3e878bf31b567efbbf003187c1b3c4da2d1f37635d
MD5 52fe4232bda48a60278960fa801a6586
SHA1 b169df7820aa3be52a4626a4e9ad9229f12faa58
SHA512 14a034d7d9bbf907cb5de9eaf55bd4eab03fd0f66364518174ba698e91255a0867371c068d44b2c9dbb705ce9f8d3d456b7651f1d96b83cccbfe5251e624bef9
SSDEEP 3:Xtlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll/:v
MD5 SHA1 SHA512 SSDEEP

Submit Download