67ab85a7fa7ff2126805cdfaccf57501b50bdc2a0a239b969c7ec9daa6933e7b

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_1a9d200226decf138a047ba585c62c0f_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260629-we853aa17t
SHA256 67ab85a7fa7ff2126805cdfaccf57501b50bdc2a0a239b969c7ec9daa6933e7b
MD5 1a9d200226decf138a047ba585c62c0f
SHA1 49aba6abbc55a6f9c475a550ce73414531db5efe
SHA512 4f58c579f4dcf62ce4939621f3d26fb0b9cfda6cb31db5ea8a6773fd5ea1e4a843ee470dfe1a39699119f6f05cb45da4f26974003f3b20f2c7f1b554a5f6dd29
SSDEEP 12288:AnbcDwBC3/nzcZeVTLiVAvd6rFR3NZSfjR3UOKJLZmX1:AnDByzNVTLimdo3NZEjR3UjLZmX1
TLSH
T161E4F142F8C040B4D9E66E314CB996010A7AFE9754F9EA5772C87B063833C51D739AAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4716	1A54.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1A54.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_1a9d200226decf138a047ba585c62c0f_elex_karagany_manuscrypt_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 4716	4276	2026-06-26_1a9d200226decf138a047ba585c62c0f_elex_karagany_manuscrypt_rhadamanthys_stop.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-06-26_1a9d200226decf138a047ba585c62c0f_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_1a9d200226decf138a047ba585c62c0f_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Users\Admin\AppData\Local\Temp\1A54.tmp
  "C:\Users\Admin\AppData\Local\Temp\1A54.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1A54.tmp

Path C:\Users\Admin\AppData\Local\Temp\1A54.tmp
Size 702KB
SHA256 d2ec3c4f5b197ea379bb548864d3c5f34610b21d661ea92fbadc9a4b3b50edef
MD5 2897dcfe1e6e0df6824f5ec3c27fa5ae
SHA1 d5bc5abe320d2262d4c7b46acf3a6df4ff99b79a
SHA512 4d7263a61e5fbfc5532fc699134fa11540d1d5e948ca2943e73667d0037d7131c5731d2cc4d1387939552267dd7fd23c32261d57fd9da5367792e3cd0ffa8eaa
SSDEEP 12288:AnbcDwlVQQI6iFeQo6YdFG18jX7VJGYR/+TN9z5ual0YPeRKJLZmX1:AnDHIBFeQoRdFG6LVh/KzNFbLZmX1
TLSH
T1C2E40102F9C040F5D5E56E715CB846020ABABD6784E5EE5B62C83B423C73D50D729BBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download