2e687ff049ad46e17fbd88d7cd3d46a93384fc1734e235b45be012bd3b06144a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_2362d5652ac6e49b6b9bb6ac1f092850_elex_mafia_manuscrypt_rhadamanthys_stop_tofsee.exe
Size 736KB
Sample260724-llpd5afe24
SHA256 2e687ff049ad46e17fbd88d7cd3d46a93384fc1734e235b45be012bd3b06144a
MD5 2362d5652ac6e49b6b9bb6ac1f092850
SHA1 8dde389a285869fef1053dcb1dfb4b36edac4682
SHA512 2a3b3b9f5e34c93bebb48513544d0bd0d4aefc70ddfc456ed92e235d8811724250c697bf72cd747308c9fd3c854426382ebc48cc610f14cb06a2759309e4a3d7
SSDEEP 12288:/6JUE3KfYXoPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y6:/6JUvfYXoPne87HtO/DF1+9codjeWyZx
TLSH
T157F4012076858031F36A07314AA9E6D40969AC780BE9F1CFF7B87D3A58345D38A7725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_2362d5652ac6e49b6b9bb6ac1f092850_elex_mafia_manuscrypt_rhadamanthys_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-24_2362d5652ac6e49b6b9bb6ac1f092850_elex_mafia_manuscrypt_rhadamanthys_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_2362d5652ac6e49b6b9bb6ac1f092850_elex_mafia_manuscrypt_rhadamanthys_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3820-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/3820-1-0x0000000000400000-0x00000000004BF000-memory.dmp