d6ad9c6dfa09f0ebc98534dcab4e816b0801f14580c6ed6ba6c3ecc364afa79f

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 04:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_1064f26ca952170a88ce836f9fb9e324_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260718-fgxbaagy2p
SHA256 d6ad9c6dfa09f0ebc98534dcab4e816b0801f14580c6ed6ba6c3ecc364afa79f
MD5 1064f26ca952170a88ce836f9fb9e324
SHA1 3ec45b593bb34e97e01529da8784e02da24b7efb
SHA512 c252739474712f77aec1172b5ae3c1e28bcd7ef6355c99deb0842fc33ed4c1d42ba79781a189f3d72fd36f27812f6a28edd21a823cbbd2a0c563a47996dc7aa9
SSDEEP 12288:AnbcDwW92Pkewgmx5gHrlcK3KDDPnblKX0S+1sQWMKJLZmX1:AnDQ2Q5qcKmDEX5+aLZmX1
TLSH
T132E40202F9C040B5D4E52E355CB956010ABAFE5795E9FA5732C83B023833D91DF29AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4268	6EED.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_1064f26ca952170a88ce836f9fb9e324_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6EED.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4268	4148	2026-07-17_1064f26ca952170a88ce836f9fb9e324_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_1064f26ca952170a88ce836f9fb9e324_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_1064f26ca952170a88ce836f9fb9e324_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\6EED.tmp
  "C:\Users\Admin\AppData\Local\Temp\6EED.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6EED.tmp

Path C:\Users\Admin\AppData\Local\Temp\6EED.tmp
Size 702KB
SHA256 15b1a39e02ff092ffac4b9554cca0fc5d1ceffcefb33b12d784593fe7da87e89
MD5 f18471b530f8072ef8701a319ea4536d
SHA1 5257d2c871a076372e4725fffb536c2a0ff61795
SHA512 9300870d41afb5dbeb986ef6e9d81514252654fdd129dd786fc3119f677c1f9aebe15ccbb0f4a835a9825995acf1bdff2305fb961e88a0a0df30fc3259adf24a
SSDEEP 12288:AnbcDwKMYhDCEFszZYjTXsEUe6Q2S2H109dOfjXvHQwwLuKJLZmX1:AnDHYhDTFkyEH1GOHYDLZmX1
TLSH
T179E40202F9C081F4D5E529365CF996020ABAFD6781E5FD5726C83B413833D909B29AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download