f9ffe63ff5c831885d014ab4fd66982f8a185f4ed50c27f0bda56ebae2184e1f

Analysis

max time kernel
148s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_4a01eef232bf7b001a633dff0cec7272_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260713-2jfbfab141
SHA256 f9ffe63ff5c831885d014ab4fd66982f8a185f4ed50c27f0bda56ebae2184e1f
MD5 4a01eef232bf7b001a633dff0cec7272
SHA1 d98048e8d67434232e58c017b2315725179f5f77
SHA512 28f8a5b2ddb2d851a8a8aa60eafe8bd7367f57ee0a3e687053225102701c31a8ade6e5c6eac6082d9fbfc23efa6a009927056201b7dd6f02702337cb8c1ecf81
SSDEEP 12288:AnbcDwQu8ZNBhfIEzEJ25wRuWRwDPlKG3UKJLZmX1:AnDf8ZrhfIE46wUHD/3xLZmX1
TLSH
T1F9E4F142F9C040B1D4E52D318CB856020ABBBD5785E6FE9B76C43B057833D919B29FAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1348	46BF.tmp

Executes dropped EXE 1 IoCs

pid	Process
1348	46BF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_4a01eef232bf7b001a633dff0cec7272_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46BF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1348	1384	2026-07-13_4a01eef232bf7b001a633dff0cec7272_elex_karagany_manuscrypt_rhadamanthys_stop.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-13_4a01eef232bf7b001a633dff0cec7272_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_4a01eef232bf7b001a633dff0cec7272_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Local\Temp\46BF.tmp
  "C:\Users\Admin\AppData\Local\Temp\46BF.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

46BF.tmp

Path C:\Users\Admin\AppData\Local\Temp\46BF.tmp
Size 702KB
SHA256 27badcacb756ac20a722194e44342ef7a66494796dfba1a85466fcb5fa75a3c7
MD5 3176823d6d080e7eb1abbf998fe5738c
SHA1 03d652053e9b1f8b70ac4c878576ba57b3e31ca3
SHA512 c400aeccaaa0ff1c66aa2c4c616618ed0f7de8d81a9547ceb823c8678cc3055adb3f873a9d2cde52a35ac15ab975db61ea7a55259bb3cf0c3d0a1d8dc183b378
SSDEEP 12288:AnbcDw+n8eVXoPV0xd3CE9kScf561s8ZuWnjwtyRGgzlUZKJLZmX1:AnD+R4MdSEzQ61swu+wgRGgzyMLZmX1
TLSH
T129E4F102F9D080F1C4E56E314CB981110EBAFE6745E5EA5722C87B467C73CA19B25BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download