2c38187c52a6a428ebbc06359c8286918034e7ca0f6f36bf3c9651abdcf09e01

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_ff2b0408cae9d720505091f4f51778b4_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260720-xa78msdv3v
SHA256 2c38187c52a6a428ebbc06359c8286918034e7ca0f6f36bf3c9651abdcf09e01
MD5 ff2b0408cae9d720505091f4f51778b4
SHA1 801a16da2a42854e62c2093b26c11428a38ace43
SHA512 833aba6471378c170989cd954d5f3bab1583da350a2bca5349e0624c0d58c782f949b2a9fe4fa39a8812f2845f5fa1cf39654c796e22013181a61d53ae782595
SSDEEP 12288:AnbcDwu2/QgE4OD2Cp0LjDztMrleFOC1+XDQyb6DtykKJLZmX1:AnDF/33EOL3B5q8UctyBLZmX1
TLSH
T139E4F142B9C04070D5E22D718CB996120ABABE5785F5ED4B72C977013933D91C73ABAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5872	DF3B.tmp

Executes dropped EXE 1 IoCs

pid	Process
5872	DF3B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DF3B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_ff2b0408cae9d720505091f4f51778b4_elex_karagany_manuscrypt_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 5872	556	2026-07-20_ff2b0408cae9d720505091f4f51778b4_elex_karagany_manuscrypt_rhadamanthys_stop.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-20_ff2b0408cae9d720505091f4f51778b4_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_ff2b0408cae9d720505091f4f51778b4_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:556
- C:\Users\Admin\AppData\Local\Temp\DF3B.tmp
  "C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DF3B.tmp

Path C:\Users\Admin\AppData\Local\Temp\DF3B.tmp
Size 702KB
SHA256 f790115e61d057d5b5a4f79b091781a01e5cbb75bdab8e26cf0eb6c5910d1c4d
MD5 3000f14a51799a97fd12591e566934fb
SHA1 05d10bfe55324ba039165e9ab679b2e6bdbc9375
SHA512 f9a3b0e9d14d024717254d8f5c498080773aca89cfa5a6e2f58fbb7f3912b59781cb95791756cb586775c4ee1f9fc85a066e4aa57c71fc442c3ff7ca339b7611
SSDEEP 12288:AnbcDwmrLBBrOWxe8L9DRqodB74gMOq1T8N6TdW4ed2KJLZmX1:AnDmR59Rfdy7O5N644+rLZmX1
TLSH
T1C8E40152F9C040B1D0E569718CB886420ABAFE5795E1F95B62C87B013833D519B3ABFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download