cc590a208bb7f419b543f6e77774ccf865477b5acee05ea41e5739ee1115f8b8

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_fa73768c2e8bf4ebc7e7e598cac9b04b_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260720-pws2vaav6n
SHA256 cc590a208bb7f419b543f6e77774ccf865477b5acee05ea41e5739ee1115f8b8
MD5 fa73768c2e8bf4ebc7e7e598cac9b04b
SHA1 d3219143b389f746712eccd90df049e910fb96ba
SHA512 9621798a3a20ce5bc3d83b17adb0335927c7c4e59ebd57ce0ce0ea3a9daf7ada2afc65f3096e70487af80d9dea50b1e7ef0376f65c057b70e5accb8396e9b3bd
SSDEEP 12288:AnbcDwecFi11vz7vclIMDmoBjwgodCW6dZBPdk3AntKJLZmX1:AnDecMUDxj3aa1dkAALZmX1
TLSH
T15FE40102F9C040B5D4E56E725CB95A0106BAFE5742E5BE4B61C87B413933C50EB2AAEF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1272	80CF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_fa73768c2e8bf4ebc7e7e598cac9b04b_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80CF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1272	1236	2026-07-20_fa73768c2e8bf4ebc7e7e598cac9b04b_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_fa73768c2e8bf4ebc7e7e598cac9b04b_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_fa73768c2e8bf4ebc7e7e598cac9b04b_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\80CF.tmp
  "C:\Users\Admin\AppData\Local\Temp\80CF.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

80CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\80CF.tmp
Size 702KB
SHA256 34f07ec496ca148b53559344b5e9f6f5490c63aedca1881c1cc260ccf6d9c473
MD5 7cd889655bba6a290ee30483841b72b2
SHA1 879b87d0ff1688f355561544a4def68e5f54093d
SHA512 1ad47b3461b42c002fc4680449785c471680e3cedad921b5c7d9f5d3554d050bf27e84ad2e13e609996659ba756d1c80a3847ec4b1f1ab12ba7cb302edddb0c5
SSDEEP 12288:AnbcDwMVa+g8KzYTPZ2ESnc4utTvCxOyaLox6flVCaf61yrKJLZmX1:AnDghT6nc4utT6xOLLYAMNbLZmX1
TLSH
T162E4F152F9C080B1D4E669329CB5950106BAFE6B80E5FD4772C87B053833D51DB3AAEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download