75b932e190962372efe6ea7c60ad171874fcb9d908e75da1e67fe79c2af5f036

Analysis

max time kernel
149s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_6f40d1a26fd8918ff3008bdbc2a02885_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
Size 94KB
Sample260701-e227laes8p
SHA256 75b932e190962372efe6ea7c60ad171874fcb9d908e75da1e67fe79c2af5f036
MD5 6f40d1a26fd8918ff3008bdbc2a02885
SHA1 e80f59569304d794d000dd8efd21d1cb06b306e7
SHA512 7d3e1c6038b010d224fb15e2065332bac0021a736df8123c95dd2aebc0a87a15a3f0e0ad744e357b9cf66d6de2e7bc1f0bcec1e6e61eb340330091554ec038ba
SSDEEP 1536:Sdyql1M7wIIEuti7rEYivykYkpaWj0OocG7mJAm/lGb3Cls:SdV1Z1i3QKqjGCJr/lK
TLSH
T1EF939E127AE180F2C48541BC1A9C8F54AB7BBD1445B9D903EB544A8BEFF22D2D73E316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2092	sppsrv.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xpwunp.dat	2026-06-30_6f40d1a26fd8918ff3008bdbc2a02885_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
File created	C:\Windows\SysWOW64\sppsrv.exe	2026-06-30_6f40d1a26fd8918ff3008bdbc2a02885_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_6f40d1a26fd8918ff3008bdbc2a02885_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sppsrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5556 wrote to memory of 4304	5556	2026-06-30_6f40d1a26fd8918ff3008bdbc2a02885_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-30_6f40d1a26fd8918ff3008bdbc2a02885_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_6f40d1a26fd8918ff3008bdbc2a02885_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_del.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4304

C:\Windows\SysWOW64\sppsrv.exe
C:\Windows\SysWOW64\sppsrv.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_del.bat

Path C:\Users\Admin\AppData\Local\Temp\_del.bat
Size 350B
SHA256 1355788e3419e42f7e5510c26f1cf4a29c55f037aae6691f3152f5cb174136b3
MD5 3e09b881823d3c7458b55436d2f1dac3
SHA1 d41f3171ffc062f5289047a913cd764ac7054b0f
SHA512 9b3d4a2da0e042978d22089f43de12b68e658dba9058e61ee7b34b53614c2baff5e7aa30786118f3ca0aefce331c921cee2b177d0dd9ee0480a1ae864a3bbd33
TLSH
T171E0D808437F9D290101A14A45F2F58D81A265542E4F2350313182CD43E5D9BF2B7656
MD5 SHA1 SHA512 TLSH

Submit Download

sppsrv.exe

Path C:\Windows\SysWOW64\sppsrv.exe
Size 94KB
SHA256 3bae7be891cdcc4b6d11700107049cff61f9e2703b83c960691dbc703dc92ad7
MD5 4c266fee3358b62626dda2ce66b93734
SHA1 4cde09512918a04c79feb8782ff710efd919022f
SHA512 ef8d15a45f718e70551225f73c8a8ed7a75807a90627c8d7d8c2cd158f95ce70d83ed254b6a791334d0f5aee0a986ec963f70cebbf3863d6303d732fc39d4f98
SSDEEP 1536:Sdyql1M7wIIEuti7rEYivykYkpaWj0OocG7mJAm/lGb3yls:SdV1Z1i3QKqjGCJr/ly
TLSH
T133939E127AE180F2C48541BC1A9C8F54AB7BBC1445B9D903EB544A8BEFF22D2D73E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xpwunp.dat

Path C:\Windows\SysWOW64\xpwunp.dat
Size 740B
SHA256 305b2bcc77952f288ed2ffed4d2cf2239bd8b049e7dabc820eea61158b74d9a8
MD5 48cf70bad71b582513d56b2797765147
SHA1 369356049e05e2dabfc2c9a0a0001da6452fb729
SHA512 0a32ce08b86d5ff824da634063a4717b8c5f2a99f230094acc37ddad1e2d37f5a80ce5d3b61a69bd54a50dfccd96a1ef4d283c180adb7da145b932a59a9447e0
TLSH
T14601994B770A185D3CC75F867E7561923E7E506F656693F1544B23501ECC2043B471F2
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads