18f0f4b79bd66551ed261d46cd7f5fadcfc722d845a952f40851c34af890833b

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_30d79965b01d3b8e76ac9e892c875ecb_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260720-r282csfv7s
SHA256 18f0f4b79bd66551ed261d46cd7f5fadcfc722d845a952f40851c34af890833b
MD5 30d79965b01d3b8e76ac9e892c875ecb
SHA1 328fd51d56c20af8d5b31de6f760033a3b15a7cc
SHA512 eb1bf51f3abf53c5cff4b3993c5dd410864482a21187fa919162d87b01ae826d7f8c8bb1bdac013d08b7ef7996740420cc26455246495faca330b631d451828c
SSDEEP 12288:AnbcDwiotOJHe9Jv9PTzmaK49ITIciabKn6uqnYrBsP1UWKJLZmX1:AnDigSe/v9PP8sciaU60FMaLZmX1
TLSH
T112E40202F98040B0D5E66E364CBD56010BBBFE5785F5FA1762C87F413933C51AB29AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4316	4750.tmp

Executes dropped EXE 1 IoCs

pid	Process
4316	4750.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_30d79965b01d3b8e76ac9e892c875ecb_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4750.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 4316	1856	2026-07-20_30d79965b01d3b8e76ac9e892c875ecb_elex_karagany_manuscrypt_rhadamanthys_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-20_30d79965b01d3b8e76ac9e892c875ecb_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_30d79965b01d3b8e76ac9e892c875ecb_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\4750.tmp
  "C:\Users\Admin\AppData\Local\Temp\4750.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4750.tmp

Path C:\Users\Admin\AppData\Local\Temp\4750.tmp
Size 702KB
SHA256 3af2a032d81ea18f67f9326f7eed3b13456333dc99896f099a6007084c901cba
MD5 71795f9ff893df83ac530e17a6688923
SHA1 8dc3e8f35fcf6d97ee355a334fe0e68349656788
SHA512 4f98b3494319794827c742905c996bf6722d2af0a69a1607e5466b5f74e8c183ac0ebd95cdd1e4fa9050f0a2d65e616a658afd0297a294668d8d5caefca70587
SSDEEP 12288:AnbcDwt8Rq9ILXQNZFoYITw1R/Pex9AL8irOjKwawuJCKJLZmX1:AnDCs9SXQNHHwEe7AgjKtNLZmX1
TLSH
T116E40142F9C040F1D4E269364CB996010AB7FEA784F5E94B66C43B063833D51E726EBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download