92ed41222e2c0ea3919c75c2a735b76ea85d5381c37865400c1b67468c1bb7db

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_c42c6fb0087fce11ec8977930795cb0b_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260604-pa79msdy71
SHA256 92ed41222e2c0ea3919c75c2a735b76ea85d5381c37865400c1b67468c1bb7db
MD5 c42c6fb0087fce11ec8977930795cb0b
SHA1 d2e2963ccd679c0ffe20526f3658943594c451ce
SHA512 8c07f9bc37474c05ded2e7302ee6be11404cbb15c86abb920efa3d482ccf7c31437f02b77f38ea6b32418f76d9e953f0322b5c7c77a8784edf539efbe9cee516
SSDEEP 12288:AnbcDwUXC550QvuhrRK/ozUFtE5HMLnxsviCkx5NjXRKJLZmX1:AnDgC55Vvuh1iFKsLxsviTgLZmX1
TLSH
T182E40102F8C040B4C4E95D364CB8A6010ABABE4795E6FE5772C837453877D919B39AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4784	16BF.tmp

Executes dropped EXE 1 IoCs

pid	Process
4784	16BF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_c42c6fb0087fce11ec8977930795cb0b_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16BF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6116 wrote to memory of 4784	6116	2026-06-04_c42c6fb0087fce11ec8977930795cb0b_elex_karagany_manuscrypt_rhadamanthys_stop.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-04_c42c6fb0087fce11ec8977930795cb0b_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_c42c6fb0087fce11ec8977930795cb0b_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Users\Admin\AppData\Local\Temp\16BF.tmp
  "C:\Users\Admin\AppData\Local\Temp\16BF.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

16BF.tmp

Path C:\Users\Admin\AppData\Local\Temp\16BF.tmp
Size 702KB
SHA256 f7d182058bfb737775f381f2792b749291717eaea0b0a069fc4604ce49ec9b5a
MD5 4b1a00abe7ba654fea99690acfb01ab2
SHA1 ffa070a992b3716c2e9e89484f408f84e5d635db
SHA512 8012c2744f936f3d2b96e75dcb0e6e72f24777992fa480a2f3b6252194dcfb4416e491fc536cce1a1fdc6d96383179572a52d36640e054980a521469fe099978
SSDEEP 12288:AnbcDwC9THkrSi7QHxIEd5aZF7bjcJrKNS7Y6Cg1dyKJLZmX1:AnDC9Tkt0LdYFPjc4aY671dHLZmX1
TLSH
T194E4F141F9C040B1D9E92E765CB996010ABAFE9781E5EA8732C837413833C519B35BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download