e4431e0b95165aeebd3fe58005dbe157e6d08cf38fdd05eda6927a75771785c5

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_4c03a04d91866f0a3d89fa4d1172f2ed_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260603-rlwfbsh19k
SHA256 e4431e0b95165aeebd3fe58005dbe157e6d08cf38fdd05eda6927a75771785c5
MD5 4c03a04d91866f0a3d89fa4d1172f2ed
SHA1 86f5db3e2b30cfe8329714a13f9704676d1c92b1
SHA512 439941d1acf6e766300d58d8e4dc6663a88688859b12bce5aa0ec100dd9d379bfda19e8b4a03cf030b3cc6021d1bcf73a355a6b08049efbd1dc6edeff7203458
SSDEEP 12288:AnbcDwuG+jTX+Ml1fIkXIbaNrSbj+MwrRpdUhsxDBmqQc3UGjKJLZmX1:AnDdaaL+rSbqdpdUhsrmGUGWLZmX1
TLSH
T1AFE40142FAC040B0D4E56E318CB859120ABABE9785E5E95762C47B053933C51DB3ABFF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
544	4486.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_4c03a04d91866f0a3d89fa4d1172f2ed_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4486.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 544	3680	2026-06-03_4c03a04d91866f0a3d89fa4d1172f2ed_elex_karagany_manuscrypt_rhadamanthys_stop.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-06-03_4c03a04d91866f0a3d89fa4d1172f2ed_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_4c03a04d91866f0a3d89fa4d1172f2ed_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Users\Admin\AppData\Local\Temp\4486.tmp
  "C:\Users\Admin\AppData\Local\Temp\4486.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4486.tmp

Path C:\Users\Admin\AppData\Local\Temp\4486.tmp
Size 702KB
SHA256 58c9791f4e16de471e1d91b263f45d0803f5d8a53ef2f350e2a80cd2ac85b0fa
MD5 787d329af794346b95ce50619f40a9cc
SHA1 8d5c4face1c3cad0a3b6372421cb1ca6d7a9202b
SHA512 77fd250a2df27d603a54af04e3a64ce57c81dc0e2a560e70d32bf0e47013fbd7475359163834892eec7b9778c3304ce98b5103ad87b4c0cbe84ec2d114b54799
SSDEEP 12288:AnbcDwTT7uffauL3n7tDDRHx0X2sZO+GKJLZmX1:AnDT07tRqX2eb7LZmX1
TLSH
T12DE4F102F9C040B4D4E66D315CB99A410ABBEE5794E5EE5762C83B013833D51E72AAFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download