f337081fa8915861db280354a111b3164242645a85f20ce4949d84088f6fec05

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 19:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_342d09178ac8c8ec9a0be4d1ff853386_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260704-xzktmsgv8n
SHA256 f337081fa8915861db280354a111b3164242645a85f20ce4949d84088f6fec05
MD5 342d09178ac8c8ec9a0be4d1ff853386
SHA1 e863318eb279a3747d8854d7e266c7b975d6902a
SHA512 8ffb3522b36579639fb6d432b58d5a07236cf5fc34d752b232690c39c5666794a580ffe8eb50539fa7e01e954200cc88e075fbca5d10d721041710ef721c5c17
SSDEEP 12288:AnbcDwjhfBluINlZErESBwJquL+AGNGsuS7kZKqeKJLZmX1:AnDFfV7SaEuLPqGsuS7/uLZmX1
TLSH
T1BBE4F102F9C040B5D4D66E365C795A1106BAFE6791E1FA5762C83B023C37D80DB26EBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5548	FBA1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_342d09178ac8c8ec9a0be4d1ff853386_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FBA1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 5548	1212	2026-07-04_342d09178ac8c8ec9a0be4d1ff853386_elex_karagany_manuscrypt_rhadamanthys_stop.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-04_342d09178ac8c8ec9a0be4d1ff853386_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_342d09178ac8c8ec9a0be4d1ff853386_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Local\Temp\FBA1.tmp
  "C:\Users\Admin\AppData\Local\Temp\FBA1.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FBA1.tmp

Path C:\Users\Admin\AppData\Local\Temp\FBA1.tmp
Size 702KB
SHA256 a3c19b3e8e240822ca439a2870b1e7866d7a48d4ca29ec72792f028e1faefb6f
MD5 551e5ac5fae3637395792dda23e77997
SHA1 4d52f5aed12f9bc65b1f56d555dacb41035de2fa
SHA512 815e82bc858accf3d497f5bb53642928d9118cfc4bd0168fc5daa5af89a501b06bfd23dccd2018e0ac93f2b19744b70d75fc0ca9da05286110c2e08ca590541b
SSDEEP 12288:AnbcDwnTrd1Muwjqj+ZQLBHK9wiBS9+M3cwmK8j8WNXzScKJLZmX1:AnDn3dXw+q69q9xBWjcwmpVXzSZLZmX1
TLSH
T1DAE4F202F8C041B4D4EA6D368CB5961106BAFE9B85E5ED4761C87B063933D109B39EFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download