75b932e190962372efe6ea7c60ad171874fcb9d908e75da1e67fe79c2af5f036

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_6f40d1a26fd8918ff3008bdbc2a02885_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
Size 94KB
Sample260701-e227laes8p
SHA256 75b932e190962372efe6ea7c60ad171874fcb9d908e75da1e67fe79c2af5f036
MD5 6f40d1a26fd8918ff3008bdbc2a02885
SHA1 e80f59569304d794d000dd8efd21d1cb06b306e7
SHA512 7d3e1c6038b010d224fb15e2065332bac0021a736df8123c95dd2aebc0a87a15a3f0e0ad744e357b9cf66d6de2e7bc1f0bcec1e6e61eb340330091554ec038ba
SSDEEP 1536:Sdyql1M7wIIEuti7rEYivykYkpaWj0OocG7mJAm/lGb3Cls:SdV1Z1i3QKqjGCJr/lK
TLSH
T1EF939E127AE180F2C48541BC1A9C8F54AB7BBD1445B9D903EB544A8BEFF22D2D73E316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1672	sppsrv.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sppsrv.exe	2026-06-30_6f40d1a26fd8918ff3008bdbc2a02885_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
File created	C:\Windows\SysWOW64\xpwunp.dat	2026-06-30_6f40d1a26fd8918ff3008bdbc2a02885_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sppsrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_6f40d1a26fd8918ff3008bdbc2a02885_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 6024	3584	2026-06-30_6f40d1a26fd8918ff3008bdbc2a02885_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-30_6f40d1a26fd8918ff3008bdbc2a02885_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_6f40d1a26fd8918ff3008bdbc2a02885_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_del.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6024

C:\Windows\SysWOW64\sppsrv.exe
C:\Windows\SysWOW64\sppsrv.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_del.bat

Path C:\Users\Admin\AppData\Local\Temp\_del.bat
Size 350B
SHA256 1355788e3419e42f7e5510c26f1cf4a29c55f037aae6691f3152f5cb174136b3
MD5 3e09b881823d3c7458b55436d2f1dac3
SHA1 d41f3171ffc062f5289047a913cd764ac7054b0f
SHA512 9b3d4a2da0e042978d22089f43de12b68e658dba9058e61ee7b34b53614c2baff5e7aa30786118f3ca0aefce331c921cee2b177d0dd9ee0480a1ae864a3bbd33
TLSH
T171E0D808437F9D290101A14A45F2F58D81A265542E4F2350313182CD43E5D9BF2B7656
MD5 SHA1 SHA512 TLSH

Submit Download

sppsrv.exe

Path C:\Windows\SysWOW64\sppsrv.exe
Size 94KB
SHA256 690b0025a4d21f7518164d7610396edbfad5e6d9f23ee3a11667402b05f077f7
MD5 b5d042dc8c5766c76daeaab54fa713f0
SHA1 91610f8105cd83b2d7c47b6ed1eadeb38f39f4a0
SHA512 28ccd52d031c0c4eea45e9094cd17667e7d7baedbe8c27241da81a652ce9f66ffcb4b7d01b9277798d8736cfb7ec075434c54d3c8429265a9b07cb5efa267b71
SSDEEP 1536:Sdyql1M7wIIEuti7rEYivykYkpaWj0OocG7mJAm/lGb3Nls:SdV1Z1i3QKqjGCJr/lJ
TLSH
T11C939E127AE180F2C48541BC1A9C8F54AB7BBD1445B9D903EB544A8BEFF22D2D73E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xpwunp.dat

Path C:\Windows\SysWOW64\xpwunp.dat
Size 740B
SHA256 ebbb09f0ec9882baeff72c74b35fd8317affb769fb06db504db3e677da1e19e4
MD5 432d11afaae8e571af35363f34d78901
SHA1 c3a33d47bf9976d939bd0913c4003d2c09605ff6
SHA512 44867aa12913fa71078768eee75cb202d73f186e27eb13867f11f8f59516ad96e248d2ebe1e0ac698a81a916117593517fe7aeeabe2a5e9a0b147a43e66f9ff9
TLSH
T11101B5B1C0673CCA26942D2490CF34C1E48AF70A128A06AEB84A39E628CC4754688C05
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads