fe72559042649b323a89cb7227f40ed0baab76a1338d553642ebfe6aeedb47ab

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_96ff827e9ba2e694e9bad97d5a5ab7b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260729-vx8ftack8v
SHA256 fe72559042649b323a89cb7227f40ed0baab76a1338d553642ebfe6aeedb47ab
MD5 96ff827e9ba2e694e9bad97d5a5ab7b3
SHA1 dba4be4cfc678e5fbe678609290dd5339ae9674a
SHA512 56cd80d4f82bf5ad9b365a988ba8588599011355082d72c38288aff5b01bd376e2ef27a42d40612103a31883e47a294788cc24784a55c7292d88cdba29f19f57
SSDEEP 12288:AnbcDwIzbcSrqkAsMQGk9Jqx+cNHPPZ9mtfKJLZmX1:AnDInHqsMUJqDNHPPKgLZmX1
TLSH
T119E4F102F9C041B4D4E26A718CB95A010ABBFE5785E5FE6776C83A057873C40D739ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2468	7B84.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_96ff827e9ba2e694e9bad97d5a5ab7b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7B84.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 2468	3088	2026-07-29_96ff827e9ba2e694e9bad97d5a5ab7b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-29_96ff827e9ba2e694e9bad97d5a5ab7b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_96ff827e9ba2e694e9bad97d5a5ab7b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Users\Admin\AppData\Local\Temp\7B84.tmp
  "C:\Users\Admin\AppData\Local\Temp\7B84.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7B84.tmp

Path C:\Users\Admin\AppData\Local\Temp\7B84.tmp
Size 702KB
SHA256 b523b967f4205fc1ae7e1ffc3d7f1330619f1651b99d63192fad8aed27304dd3
MD5 739a311f127f434514e89d608e7e6775
SHA1 1554c56cba396f3da6967400cb38f67046cf3bf7
SHA512 8dacaa78d22367be94d50d9579beaeb66dbc0459f282479d0fe42e6dfe4940a747ad7203a362d9032a42df9306dbfbb9609a7a49b5bf30959c53871efc8f6a6e
SSDEEP 12288:AnbcDw1tJOS3qoHoBmDjVP0+MilAuJVfT8Qjnvb/Z1yENlAKJLZmX1:AnDdOShoBmDrAKTvjLeENXLZmX1
TLSH
T164E40102F8C080B0D4E55E364CB96A010A7BFE6799E6F95722C437463C77D509B29EBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download