6c04b849e7df815e78ae72d3d9df6d69263d363ef4bb5aaafabc21311d63847a

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 06:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_42cd809f6306bf83c4a88138ef708461_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
Size 94KB
Sample260706-hgrrxaez5k
SHA256 6c04b849e7df815e78ae72d3d9df6d69263d363ef4bb5aaafabc21311d63847a
MD5 42cd809f6306bf83c4a88138ef708461
SHA1 ac9284f13ef3c89b1f5c6da9b07c733a418cbff1
SHA512 4f2a7c0f8f535ea798551b97f221f3222d74ba05237e42c2d3c75291d1fdb1256ee8954f4821e62d377c349a3e7a22ce41b11baebf2023e95ef38ec56375449b
SSDEEP 1536:Sdyql1M7wIIEuti7rEYivykYkpaWj0OlgG7mJAm/lGb3ils:SdV1Z1i3QKqlgGCJr/lW
TLSH
T126939E127AE180B2C48541BC1A9C8F54AB7BBC1455BDD903EB544A8BEFF22D1D73E316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6336	sppsrv.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xpwunp.dat	2026-07-06_42cd809f6306bf83c4a88138ef708461_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
File created	C:\Windows\SysWOW64\sppsrv.exe	2026-07-06_42cd809f6306bf83c4a88138ef708461_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_42cd809f6306bf83c4a88138ef708461_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sppsrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1156	2852	2026-07-06_42cd809f6306bf83c4a88138ef708461_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-06_42cd809f6306bf83c4a88138ef708461_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_42cd809f6306bf83c4a88138ef708461_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_del.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1156

C:\Windows\SysWOW64\sppsrv.exe
C:\Windows\SysWOW64\sppsrv.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_del.bat

Path C:\Users\Admin\AppData\Local\Temp\_del.bat
Size 350B
SHA256 ed9084759464740be1f0c4db67faddd9ac3cd89537ddcfd43356c269a4e61a15
MD5 8361d72d3d90f98961dbf42fe373f563
SHA1 70c76f0721769aee280ac81523f5c63f880ad28c
SHA512 a586b678add485a1d30c9321712f72af37d33f6809b49254733b34b1409bafc66bb6f9ff1b93b2798b6b503b785e2f230be2bb91cd8da7467c20d298fff67d4b
TLSH
T1E3E0D80403DF4D291605841A46E0BDCAC190AE75268B17706721824D92E597BF1A7F96
MD5 SHA1 SHA512 TLSH

Submit Download

sppsrv.exe

Path C:\Windows\SysWOW64\sppsrv.exe
Size 94KB
SHA256 22dd166710ad07d4fc2c7542a1111e5660a6c6075e21fbdc7c5f337921cef73f
MD5 0a12b22846c91d32cbab9baaa795e9e5
SHA1 6e08e78483e844728d301b4831f08de24b249849
SHA512 4e08e63d6613e7d8a76bf46d62bace6adc2d03f995f80766130ee078b2db323635c1211e31516960c801624f35a7968fb8951a4f4f22f62ee38f6b0f195f940c
SSDEEP 1536:Sdyql1M7wIIEuti7rEYivykYkpaWj0OlgG7mJAm/lGb3Mls:SdV1Z1i3QKqlgGCJr/lA
TLSH
T199939E127AE180B2C48541BC1A9C8F54ABBBBC1445BDD903EB544A8BEFF22D1D73E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xpwunp.dat

Path C:\Windows\SysWOW64\xpwunp.dat
Size 740B
SHA256 136a007b8a29952cbb74964ac3f7909341d50fa4dc4336b19409190bf559195f
MD5 ae9630e730fdc468cb52ac690b3723ca
SHA1 244f48c6d930bd9353bd215d72dd9336ca14b170
SHA512 f6b9f7cbb3a58516a4e22f7230ab4ecb5828b8c15220f21ce19a23eb85b39e9f9081c2260b5945d8c421f5489dfba950a1dbf28399ca3527b305f4f05c3fe432
TLSH
T11601B57C664A90B404C0EBAD3F6E27E2283EACD207CE63F3C4085542B76079558F5B17
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads