3f8a1d885ad08631400c4d348f10232f97501eb0b4ecf1c1de926af6f47e4718

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_6a1bc191846e5f3655836646526708ac_elex_manuscrypt_rhadamanthys_silence_stop.exe
Size 432KB
Sample260709-vs5jcset9p
SHA256 3f8a1d885ad08631400c4d348f10232f97501eb0b4ecf1c1de926af6f47e4718
MD5 6a1bc191846e5f3655836646526708ac
SHA1 fd615974af222dec31b07a41aa7297d570550553
SHA512 368c5f1ad8dd3b67d25a4e0e5a1dac3cd2abe1e04abf578dd21833fba9b73602017715760fdaaf24f6cac3c39931984661530238e51641d119c379fa0f68d217
SSDEEP 12288:gdEq2hPEZ/Hu6vxnE0qxPxQ50PmhhL+e+MEqkFd8v:gdE7EZ/Hu6vxnE0qxPxQ50PmhhL+e+Mv
TLSH
T19C947E1BB7810373C29303B2269E9AD3B73DB875137A85D266A8811D1372EE4937B3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4268	WinDDK.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_6a1bc191846e5f3655836646526708ac_elex_manuscrypt_rhadamanthys_silence_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinDDK.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3076	2026-07-09_6a1bc191846e5f3655836646526708ac_elex_manuscrypt_rhadamanthys_silence_stop.exe
3076	2026-07-09_6a1bc191846e5f3655836646526708ac_elex_manuscrypt_rhadamanthys_silence_stop.exe
4268	WinDDK.exe
4268	WinDDK.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 4268	3076	2026-07-09_6a1bc191846e5f3655836646526708ac_elex_manuscrypt_rhadamanthys_silence_stop.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-09_6a1bc191846e5f3655836646526708ac_elex_manuscrypt_rhadamanthys_silence_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_6a1bc191846e5f3655836646526708ac_elex_manuscrypt_rhadamanthys_silence_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3076
- C:\WinDDK\WinDDK.exe
  C:\WinDDK\WinDDK.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WinDDK.exe

Path C:\WinDDK\WinDDK.exe
Size 432KB
SHA256 f862c5c0b62f2515d3d6ec4bd019bd8b4761ca353dfb8a6ba432acc98e8fc259
MD5 723a526291e162df0b2e9929612b7876
SHA1 a66205e211f3acb60170c427de1791d84c9043ea
SHA512 ce937b0cbacf69f19c46d33a29a902a53c9e1ef326b8366e088caccd7dd05f31fb03506df94f8611ba47b8d408c8f4d298befa3bd83f59077b50e57ef7d62709
SSDEEP 12288:gdEq2hPEZ4Hu6vxnE0qxPxQ50PmhhL+e+MEqkFd8v:gdE7EZ4Hu6vxnE0qxPxQ50PmhhL+e+Mv
TLSH
T190947E1BB7810373C29303B2269E9AD3B73DB875137A85D266A8811D1372EE4937B3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp-0.bin

Path C:\WinDDK\tmp-0.bin
Size 8KB
SHA256 d1d1eebbf8cebfe88c5fce3e878bf31b567efbbf003187c1b3c4da2d1f37635d
MD5 52fe4232bda48a60278960fa801a6586
SHA1 b169df7820aa3be52a4626a4e9ad9229f12faa58
SHA512 14a034d7d9bbf907cb5de9eaf55bd4eab03fd0f66364518174ba698e91255a0867371c068d44b2c9dbb705ce9f8d3d456b7651f1d96b83cccbfe5251e624bef9
SSDEEP 3:Xtlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll/:v
MD5 SHA1 SHA512 SSDEEP

Submit Download