3f8a1d885ad08631400c4d348f10232f97501eb0b4ecf1c1de926af6f47e4718

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_6a1bc191846e5f3655836646526708ac_elex_manuscrypt_rhadamanthys_silence_stop.exe
Size 432KB
Sample260709-vs5jcset9p
SHA256 3f8a1d885ad08631400c4d348f10232f97501eb0b4ecf1c1de926af6f47e4718
MD5 6a1bc191846e5f3655836646526708ac
SHA1 fd615974af222dec31b07a41aa7297d570550553
SHA512 368c5f1ad8dd3b67d25a4e0e5a1dac3cd2abe1e04abf578dd21833fba9b73602017715760fdaaf24f6cac3c39931984661530238e51641d119c379fa0f68d217
SSDEEP 12288:gdEq2hPEZ/Hu6vxnE0qxPxQ50PmhhL+e+MEqkFd8v:gdE7EZ/Hu6vxnE0qxPxQ50PmhhL+e+Mv
TLSH
T19C947E1BB7810373C29303B2269E9AD3B73DB875137A85D266A8811D1372EE4937B3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5928	WinDDK.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_6a1bc191846e5f3655836646526708ac_elex_manuscrypt_rhadamanthys_silence_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinDDK.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4592	2026-07-09_6a1bc191846e5f3655836646526708ac_elex_manuscrypt_rhadamanthys_silence_stop.exe
4592	2026-07-09_6a1bc191846e5f3655836646526708ac_elex_manuscrypt_rhadamanthys_silence_stop.exe
5928	WinDDK.exe
5928	WinDDK.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 5928	4592	2026-07-09_6a1bc191846e5f3655836646526708ac_elex_manuscrypt_rhadamanthys_silence_stop.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-09_6a1bc191846e5f3655836646526708ac_elex_manuscrypt_rhadamanthys_silence_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_6a1bc191846e5f3655836646526708ac_elex_manuscrypt_rhadamanthys_silence_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4592
- C:\WinDDK\WinDDK.exe
  C:\WinDDK\WinDDK.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WinDDK.exe

Path C:\WinDDK\WinDDK.exe
Size 432KB
SHA256 61689a834dc1e880a8720f56ee464778a80370e4b6dc612d64cf067ed5cf7b2f
MD5 dfda016a57601bbf5a569944af167f7b
SHA1 66a17612c644556ab0cdec34894c5e2adf8e3363
SHA512 cea036d055366ef6f4eef582e4ef33f7cc28661a8c8c5729d8694b9ae372372917578455a75b39729c2a5124c208c7f22c70c08f105754a27b44810544625eda
SSDEEP 12288:gdEq2hPEZBHu6vxnE0qxPxQ50PmhhL+e+MEqkFd8v:gdE7EZBHu6vxnE0qxPxQ50PmhhL+e+Mv
TLSH
T1C3947E1BB7810373C29303B2269E9AD3B73DB875137A85D266A8811D1372EE4937B3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp-0.bin

Path C:\WinDDK\tmp-0.bin
Size 8KB
SHA256 9e7390b1258ff36572f3817ec7aa917654f353e5325f2348712822ff1444600e
MD5 a59cb579397a9e251b60bfd4e28f682b
SHA1 56d299e4cca6c252e5911c888e5eff12821eeed5
SHA512 ca25086c01f71ce5c881e3c79b036beea69160b0205f981c232219d3e83cc839b1f6d44f91a6bb9451c050434506b576d38dd37db1d09164fc1cbd79d21404f5
SSDEEP 3:Xtlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllv:+ULtV
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp-0.bin

Path C:\WinDDK\tmp-0.bin
Size 8KB
SHA256 a4353777cb0ca3d1a576b8fd820d07472fda17e7ce09733174ca0e5843ee2869
MD5 d4a4c8d0d3f12d15e49e00b0ad3bdaa1
SHA1 59a5f8e38a8b35e126091cc59bec4ccfc94d67c3
SHA512 ed9adaa640c26f893cd83eb1372558d596c5655015c9aafde308c24ddca60765e3e35c5549314ab3355469efc28860026d449ec65fef0e0e06e2c98223f45ab2
SSDEEP 3:Xtlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllu:+X
MD5 SHA1 SHA512 SSDEEP

Submit Download