2be59eb161373ee4055aca0c1a140a023537e2b0c3f10e99b432387d53525b25

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 19:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_c7b3ea8207527127dd4f88dae3a54967_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260702-x9eelsh12k
SHA256 2be59eb161373ee4055aca0c1a140a023537e2b0c3f10e99b432387d53525b25
MD5 c7b3ea8207527127dd4f88dae3a54967
SHA1 47d6efe37e5b05a38bda129dd54fc55312c58a90
SHA512 104d448484401eaf4ae3a7e1d2569fddca4b164658a9deeb8e78d8eb21368a0fc80c049b3d258501966f429a58ae336b895fc57d977b81ac8940f318fda22341
SSDEEP 12288:AnbcDwhxH4qOlsXL3w5My/KQ4rFWm5ntndx0niLvsntf+jXaoKJLZmX1:AnDzH4nGrsnO51tnH0QstmULZmX1
TLSH
T174E40242F4C080B0D4E66D328CBA96010A7BFD5795E5ED8B66C83B417833D519B29EBF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1444	31C9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31C9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_c7b3ea8207527127dd4f88dae3a54967_elex_karagany_manuscrypt_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1444	904	2026-07-02_c7b3ea8207527127dd4f88dae3a54967_elex_karagany_manuscrypt_rhadamanthys_stop.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-02_c7b3ea8207527127dd4f88dae3a54967_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_c7b3ea8207527127dd4f88dae3a54967_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:904
- C:\Users\Admin\AppData\Local\Temp\31C9.tmp
  "C:\Users\Admin\AppData\Local\Temp\31C9.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

31C9.tmp

Path C:\Users\Admin\AppData\Local\Temp\31C9.tmp
Size 702KB
SHA256 023852fd1c6ad3f3880c5ba210f77e77720a39b6ad955e3ac8dcccbf77b4e14a
MD5 00533437c7b7c6cbc13e6a4b97226b2b
SHA1 6578360a9567c14e51fefd46ec74cf026e4a95d2
SHA512 b2e282093a215e13761caddb135069b9fac4630c65e0eae729278aae279f074d57456f476faf4f0c30c0c76ee3331ed3f8211890adda722ff9f2d858e043ae67
SSDEEP 12288:AnbcDwLO36rtQeBFkH7CdX1Zf8RYqCjwtVKiIKz/IMxLe6jkVKJLZmX1:AnDLO0KZqZURYqqmVKiIWgMxLegkILZe
TLSH
T1FAE4F141B9C080B0D4E56D358CB956120ABAFE9784E5FE5736C83B027933C519B39BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download