7e17b81d3717384d834e20b14c2d9b24afa9d50d91b5c00a5cb6367d05569ce1

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_8bef7bfb58f79fb64d69392fafb9d6fc_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260720-nl2essgv2k
SHA256 7e17b81d3717384d834e20b14c2d9b24afa9d50d91b5c00a5cb6367d05569ce1
MD5 8bef7bfb58f79fb64d69392fafb9d6fc
SHA1 e4634318d06ad2672548628aaad4084d41b582cd
SHA512 67faf1d1cd58e765e80792afcc3c70acafc424229b8b15ee4d676a50dad689e94f51be3aad5561c74fc7dd624382d2eb39ff1a15a67d4735e7c39cb3e2bf23ba
SSDEEP 12288:AnbcDw6VscWTJNNgVk/qvC4oCa8yO7aPSRb0Oae1sD0GKWfzWWKB00zwKJLZmX1:AnD0hW9NNYIqvCjqyO2PabVQ0GKWSWKI
TLSH
T1BAE4F142F98081B0C4E56E364CB996010A7AFE5791E5FE5772C87B017C33C519B2ABEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3364	4A7C.tmp

Executes dropped EXE 1 IoCs

pid	Process
3364	4A7C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_8bef7bfb58f79fb64d69392fafb9d6fc_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4A7C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5536 wrote to memory of 3364	5536	2026-07-20_8bef7bfb58f79fb64d69392fafb9d6fc_elex_karagany_manuscrypt_rhadamanthys_stop.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-20_8bef7bfb58f79fb64d69392fafb9d6fc_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_8bef7bfb58f79fb64d69392fafb9d6fc_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Users\Admin\AppData\Local\Temp\4A7C.tmp
  "C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4A7C.tmp

Path C:\Users\Admin\AppData\Local\Temp\4A7C.tmp
Size 702KB
SHA256 bd89acb89ec06f1aa852d91dcc88826f5b526385feda918619f89f64bde1ad6f
MD5 d7624c0b7fc6cffa82df4b5ae1813140
SHA1 ae43bde7061be4101dace39198bd2004debc3400
SHA512 ad707b9657109f3262437e5bc0d6ef45741b8c75e7cb9220a312b5d8ab2c315171d888864299380c6df769128d8b7bed566cdb24a29dfc6a29af7943830005de
SSDEEP 12288:AnbcDw3rS2jrZFZhx113Ms5CMV+eXc/kb8vh0+TDxKJLZmX1:AnD3r7fZFp1fQfbcC0+TwLZmX1
TLSH
T1C5E40101B98040B4D8E1AE754CB86A120AB6FE5794F9FD5762C87B053833D90DB25EBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download