d1492d44ec32e11dcfdbdc8f2c7d6bd39981d98f646d88a497171658cec5ba2a

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_cd59c5e4a93b2423f40b68967a3fd5ef_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260720-p2a38acy3t
SHA256 d1492d44ec32e11dcfdbdc8f2c7d6bd39981d98f646d88a497171658cec5ba2a
MD5 cd59c5e4a93b2423f40b68967a3fd5ef
SHA1 78521479238abe7a0fcb182ffc16b1d1a8bc5fdd
SHA512 66b0c04d8e93eec87bbc3a0eaa284b5495fb554959e569c8b6015115bb8721b59fc6f42926e040c7d6d8bf9be678086836bc7bd04c3625ba3725c9c5b9b51e44
SSDEEP 12288:AnbcDwaeWAXeCpXgd5yPTjWFv7LYTE8fPghIaCRVKJLZmX1:AnDuAOLdgP8Yx3g6aeILZmX1
TLSH
T105E4F102F9C080B4D5E66E359CB856010ABBFD5749E1EA5722C83B053873D51DB3AEBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3404	5402.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_cd59c5e4a93b2423f40b68967a3fd5ef_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5402.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 52 wrote to memory of 3404	52	2026-07-20_cd59c5e4a93b2423f40b68967a3fd5ef_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_cd59c5e4a93b2423f40b68967a3fd5ef_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_cd59c5e4a93b2423f40b68967a3fd5ef_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:52
- C:\Users\Admin\AppData\Local\Temp\5402.tmp
  "C:\Users\Admin\AppData\Local\Temp\5402.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5402.tmp

Path C:\Users\Admin\AppData\Local\Temp\5402.tmp
Size 702KB
SHA256 3c55fa687c23a1ba88ded0c4bd8ab5e6dd02eddf99a0891163dc45f55e82afa4
MD5 b4f8dfc5ce99ebb820d71fb4b71b961f
SHA1 ceba35b1630f93f353bf6894cc58a54ffd7b7bfb
SHA512 3bbc2397bb8ed87b6e1ece0f3f8a16224789bb5c06ce491a20dc078f5107633303133026a55d40f83876466a096964cfb018a1cd0d7f38362c1c6ff0661bb40b
SSDEEP 12288:AnbcDwok5i11mVrdEnRxkhczJ87f95y/jZR+BKJLZmX1:AnD95iYELINPy/FxLZmX1
TLSH
T17FE4F102F8D080B5D4E56D368CB956010ABBFE6B45E5ED5B62C83B053833C51DB29AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download