875d9c268b1f5d15c5643c883075fc20ba2c1452f52c91a9442acd2fc2eaaac1

Analysis

max time kernel
148s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_8ebe93560dd1b4c36e46d0d9dcf1c0f1_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260719-xplcesct2z
SHA256 875d9c268b1f5d15c5643c883075fc20ba2c1452f52c91a9442acd2fc2eaaac1
MD5 8ebe93560dd1b4c36e46d0d9dcf1c0f1
SHA1 3950d252a71b8663116a2794b9cd31c2734a7942
SHA512 96ca9268351d5af1ad2e71b03f0b0cf787851c1c0fc7124b3d0a82922a254e010e96dc750bdd0de3dd94dc2d813dd5d03d306add6cda81935bb68b5995583f8b
SSDEEP 12288:AnbcDw8v2457PAE9/4FX5D+MM7ldqdpE8SsoYsBDDKmyRjTsrKJLZmX1:AnD8u4hAE9/KJOa3E8PoTwxBTseLZmX1
TLSH
T18EE4F142B9C040B1D8E559764CB696120ABBED5781E5FE4772C83B053833C51EB39ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1700	72C5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_8ebe93560dd1b4c36e46d0d9dcf1c0f1_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72C5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 1700	4692	2026-07-19_8ebe93560dd1b4c36e46d0d9dcf1c0f1_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_8ebe93560dd1b4c36e46d0d9dcf1c0f1_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_8ebe93560dd1b4c36e46d0d9dcf1c0f1_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Users\Admin\AppData\Local\Temp\72C5.tmp
  "C:\Users\Admin\AppData\Local\Temp\72C5.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

72C5.tmp

Path C:\Users\Admin\AppData\Local\Temp\72C5.tmp
Size 702KB
SHA256 431c1654ffd41ad90f737200074ca074a6043964151be8f8923470e512e5a365
MD5 d282cad26b246ba05f864aaf67fb3303
SHA1 d2eb104d8c915ce90b9301c3066ff28c918497a9
SHA512 07889413bf1a855c288c9f08efa315784abf9da9da547f6a3d4fac54627d10587a75878cd94560b7c7a8472a4519af7da882220c6302a479f87d15dfb8d55e6f
SSDEEP 12288:AnbcDw1BEgonoUclWPmYd5rz+8E+MLa3oxllTCRAxsKJLZmX1:AnD1BunoFWPmYd5r9MUClZSAxpLZmX1
TLSH
T1DBE40242F9C040B1D1E569768CB946020ABBBE5741E5FD8776C87B423C33C51DB2AEAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download