aca1163170acad1f941366b3e0d60c9d5db973d798e657caca94a0704a260576

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_5b81159da26ecadfb5249dd3711fe460_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260628-2at38sft6s
SHA256 aca1163170acad1f941366b3e0d60c9d5db973d798e657caca94a0704a260576
MD5 5b81159da26ecadfb5249dd3711fe460
SHA1 0ca74a75f0d967ab558c1a6d9748f62513db4799
SHA512 567816c09fa9283b4f7d0bff87d9fb8f9b4f22286a1746e6234ed6b5fef01032077511c213cb03f2f1e96e69bcdff1c18b8f6f94780cfef129a0328948f27431
SSDEEP 12288:AnbcDwcmiFNoVw5eKssehJ6aMp+jAihjeGAfJANPRHfVPc7sdfiWViftVKJLZmX1:AnDoNpPehJ6rpSjxKJicEfiWV6tILZmF
TLSH
T1FDE4F142F9D080B5D0E56A369CB945010A7BFE5784E5FA5726C83B063833C51A73AFBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2176	F9EB.tmp

Executes dropped EXE 1 IoCs

pid	Process
2176	F9EB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5b81159da26ecadfb5249dd3711fe460_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F9EB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 2176	1296	2026-06-28_5b81159da26ecadfb5249dd3711fe460_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_5b81159da26ecadfb5249dd3711fe460_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_5b81159da26ecadfb5249dd3711fe460_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Users\Admin\AppData\Local\Temp\F9EB.tmp
  "C:\Users\Admin\AppData\Local\Temp\F9EB.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F9EB.tmp

Path C:\Users\Admin\AppData\Local\Temp\F9EB.tmp
Size 702KB
SHA256 e7444ed51fdb6a266b7e2d041ab5075e2eec57490fa25c972301312f7e96d009
MD5 7f0ecdf7b8400c7e8fd406e8a42aa114
SHA1 0f7e2f3c3c2044b83515cc8d62e830cd97fd365d
SHA512 6ccb763c46a52826e6762176cef1d96843cf0dc23a8ac4ce4ba1b518a23e54e573f61c8a830daf3325c0d13655f29cdcce6de86469a9231528d0d19acd88263a
SSDEEP 12288:AnbcDwYM1NW8TqFM41f7uVQtF8OkPoFDiBYhshQ3VEAPjKJLZmX1:AnDtSFzCGkUFDiBY3tOLZmX1
TLSH
T11CE4F102F9C040B0D8E56D764CB6A6010ABBFE5784F4EA5772C877453837C91972AABF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download