227759692b9d64abc50c45ff776de5f2092d3e07f009a41bb0a29a716694cc80

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_97a22ada0b7d07b2cdd73da547355a84_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260704-wm2e7aa18x
SHA256 227759692b9d64abc50c45ff776de5f2092d3e07f009a41bb0a29a716694cc80
MD5 97a22ada0b7d07b2cdd73da547355a84
SHA1 10e6f3565a8678b84a4adacc576a38b2518e8ec2
SHA512 70a2e22309c3d2954f146fc28cb76efb6dd2f0d872692a1f2d485ca6cff842c1ae76e62b50bf940935e3d0407e130bf1a6e2bc20816ede6156f7acbcc81260f4
SSDEEP 12288:AnbcDwiklxH1MHHEyMlzDhyZ1WUecC4FlSPyOh49lp7oHKJLZmX1:AnDxUQYDlFsPyH9EaLZmX1
TLSH
T198E40212F9C040B4D5E56D325CB945120ABAFD6784F5FAA762C83B423833D41EB25BEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6024	8C1E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8C1E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_97a22ada0b7d07b2cdd73da547355a84_elex_karagany_manuscrypt_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5988 wrote to memory of 6024	5988	2026-07-04_97a22ada0b7d07b2cdd73da547355a84_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-04_97a22ada0b7d07b2cdd73da547355a84_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_97a22ada0b7d07b2cdd73da547355a84_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Users\Admin\AppData\Local\Temp\8C1E.tmp
  "C:\Users\Admin\AppData\Local\Temp\8C1E.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8C1E.tmp

Path C:\Users\Admin\AppData\Local\Temp\8C1E.tmp
Size 702KB
SHA256 da0d08e53c71a49652f612ca842218b2bf77bd453d8b3410e706e7406ec2ca9e
MD5 b0f40b991586bc95fa71120fdf8af6bf
SHA1 15b1a31be50e8916a88a11082c3f907fbe4aa188
SHA512 f4fa41461fff8e897b1be25aa4de56cb31a3c1af430c2d2658058d34054925106b4a67134bfdf8015ec1d2d86c1bc7cf25e0ed9668bf0d9911c633a0fa0352d9
SSDEEP 12288:AnbcDwNgfqYXn8pe5ziuBoS2yd04RtRonR8iTpV6xyHA1ykRcKJLZmX1:AnDClX8pc04QpV6yHA1yoLZmX1
TLSH
T16EE40102F9C000B4D5E66D358CF956420ABABEA385E5FD47A2C87B413933C51D729BEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download