57fe1f230585619f8be2c8233ecf02b9c9f6c861ce174111298a3c3a2c02b0d0

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_9a7a3fd7391f4662a6aa38b3a45ef259_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Size 449KB
Sample260728-2dlahaxfpg
SHA256 57fe1f230585619f8be2c8233ecf02b9c9f6c861ce174111298a3c3a2c02b0d0
MD5 9a7a3fd7391f4662a6aa38b3a45ef259
SHA1 04fa5d663610e65d9bae44e5b1ce33873d5847af
SHA512 58d44fb0c63c5e8cd170a3b263e1b7a52c0aa0418c779ec69a608b6c97db1aa63029db57d1a52c91c95d5ff53632e64e809a1daef21d99690f3c93e915659fc8
SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMG:nGyHm1dAAJybXdE7IlZ8s0qG
TLSH
T170A409E13740C0A0DBAB4E79C43B5FAF1432654EED75560E31D9BF1B6D29381821ACAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5672 set thread context of 4620	5672	2026-07-28_9a7a3fd7391f4662a6aa38b3a45ef259_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	90

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_9a7a3fd7391f4662a6aa38b3a45ef259_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5672 wrote to memory of 4620	5672	2026-07-28_9a7a3fd7391f4662a6aa38b3a45ef259_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	90
PID 5672 wrote to memory of 4620	5672	2026-07-28_9a7a3fd7391f4662a6aa38b3a45ef259_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	90
PID 5672 wrote to memory of 4620	5672	2026-07-28_9a7a3fd7391f4662a6aa38b3a45ef259_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	90
PID 5672 wrote to memory of 4620	5672	2026-07-28_9a7a3fd7391f4662a6aa38b3a45ef259_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	90
PID 5672 wrote to memory of 4620	5672	2026-07-28_9a7a3fd7391f4662a6aa38b3a45ef259_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-28_9a7a3fd7391f4662a6aa38b3a45ef259_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_9a7a3fd7391f4662a6aa38b3a45ef259_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Users\Admin\AppData\Local\Temp\2026-07-28_9a7a3fd7391f4662a6aa38b3a45ef259_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-28_9a7a3fd7391f4662a6aa38b3a45ef259_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
  2⤵
  PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4620-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download