0dbd546b53e4fa6864b297ee09d327d1dd2b9f3eceaa3d052cef3d2363a572f6

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_e4163522ed6504d502da43141eb9fe6e_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260720-svedvaev6l
SHA256 0dbd546b53e4fa6864b297ee09d327d1dd2b9f3eceaa3d052cef3d2363a572f6
MD5 e4163522ed6504d502da43141eb9fe6e
SHA1 968fee09edee6d39d410d96a91ccb7478aae743c
SHA512 5527cfe2660752d40beef5a5e356c558c862e0675f7f03b7aaef24823caaa31e255abec1f8b59cba9801bb677a41b7e0d4b01f369c492a67020531adf19fbd2b
SSDEEP 12288:AnbcDwPiwTtoP+YwbPp7ppk19jiMEtlyfiNkK0lKJLZmX1:AnDPigVp7pKniNkK0YLZmX1
TLSH
T180E4F102F9C080B4D4E56D324CB956010BBAFE5781E5FE5772C83B467D37D819B28AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5960	3CD0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_e4163522ed6504d502da43141eb9fe6e_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3CD0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 5960	1308	2026-07-20_e4163522ed6504d502da43141eb9fe6e_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_e4163522ed6504d502da43141eb9fe6e_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_e4163522ed6504d502da43141eb9fe6e_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\3CD0.tmp
  "C:\Users\Admin\AppData\Local\Temp\3CD0.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3CD0.tmp

Path C:\Users\Admin\AppData\Local\Temp\3CD0.tmp
Size 702KB
SHA256 d5e32669cc8aecbf54df1763e9a3a546695751ab61ca4149381ecabd6c9627b6
MD5 aa503293be86dcd2e16e7199a98d77af
SHA1 406bdcc028870e0477b437995c7ff64b20e3b65c
SHA512 0efe9e384fd8baa979fe78a215b2ee12b5cf7939b7c180883c5fefc75eff50a8530f051917f2576affb222bf0014fed8e4a0ce21877398b3f8db56708d9ff86b
SSDEEP 12288:AnbcDwyxzR/1ZN4DmVAXEE+N/bh/SRNQSXBKJLZmX1:AnDyn/zNQmMEEJkLZmX1
TLSH
T19EE40142F8C040B5D5E66A314CB95A100A7BFE6795F5FD4B22C87B013833D91DB29AAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download