fe72559042649b323a89cb7227f40ed0baab76a1338d553642ebfe6aeedb47ab

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_96ff827e9ba2e694e9bad97d5a5ab7b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260729-vx8ftack8v
SHA256 fe72559042649b323a89cb7227f40ed0baab76a1338d553642ebfe6aeedb47ab
MD5 96ff827e9ba2e694e9bad97d5a5ab7b3
SHA1 dba4be4cfc678e5fbe678609290dd5339ae9674a
SHA512 56cd80d4f82bf5ad9b365a988ba8588599011355082d72c38288aff5b01bd376e2ef27a42d40612103a31883e47a294788cc24784a55c7292d88cdba29f19f57
SSDEEP 12288:AnbcDwIzbcSrqkAsMQGk9Jqx+cNHPPZ9mtfKJLZmX1:AnDInHqsMUJqDNHPPKgLZmX1
TLSH
T119E4F102F9C041B4D4E26A718CB95A010ABBFE5785E5FE6776C83A057873C40D739ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3296	43C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_96ff827e9ba2e694e9bad97d5a5ab7b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	43C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 3296	4548	2026-07-29_96ff827e9ba2e694e9bad97d5a5ab7b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-29_96ff827e9ba2e694e9bad97d5a5ab7b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_96ff827e9ba2e694e9bad97d5a5ab7b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Local\Temp\43C.tmp
  "C:\Users\Admin\AppData\Local\Temp\43C.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

43C.tmp

Path C:\Users\Admin\AppData\Local\Temp\43C.tmp
Size 702KB
SHA256 dfa703a0ed346d113b8ae8ceb7f4c44d32cb20ecb891292bf492c77e2e724c80
MD5 e3d402a0c6470aa26935c289263d21eb
SHA1 2b1f3f7758c5523a3d26a99cf43fc3484f573e1b
SHA512 7bcc7fd34af99a8c49a68b0700b1f3e4969f7c03516f1801cba9761020ecc9d5a200f497af9539f36f9b259c987eb3423c2747163998d8a55a3132f391d26e8d
SSDEEP 12288:AnbcDwzpoeOf4ZBrtXeDQcRhZP6RtxgKEvmDC5AycWZ4WoKJLZmX1:AnDzQYtXsR6RtxVEv1AyTpLZmX1
TLSH
T15CE4F152F9C040B4D0E62E364CB89612097AFEA788E5ED5726C837493873D41D739EBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download