c9c0c6b69424f133710e0c301ba128946aaeb41e4f6b4c900254df2a22e15f53

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_94d59ad77cfe094be4892dc059681066_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260731-h2dqsack3t
SHA256 c9c0c6b69424f133710e0c301ba128946aaeb41e4f6b4c900254df2a22e15f53
MD5 94d59ad77cfe094be4892dc059681066
SHA1 6ed7104d2303278fcb5fbe81343d3d8e37c4a673
SHA512 bce06041270cd75fbe4c3f2462a050239e7ba843441d9d222b0a2c68dd65335990688c9aee0c291668c4a79d5ad2544424c0e81f03058af32c2428287a699fad
SSDEEP 12288:AnbcDwFwZNaP/MLZCHOfyTTYAvCs47TWdpSqRPKXylKs3/bKKJLZmX1:AnDqZGkLQHOfaEAR4fWdcuOyY6LZmX1
TLSH
T159E40142F9C080F5C4E62E364CB956020ABBBE9784E5F95766C83B427D33C419725AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2508	9466.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_94d59ad77cfe094be4892dc059681066_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9466.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 2508	3744	2026-07-31_94d59ad77cfe094be4892dc059681066_elex_karagany_manuscrypt_rhadamanthys_stop.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-31_94d59ad77cfe094be4892dc059681066_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_94d59ad77cfe094be4892dc059681066_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Users\Admin\AppData\Local\Temp\9466.tmp
  "C:\Users\Admin\AppData\Local\Temp\9466.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9466.tmp

Path C:\Users\Admin\AppData\Local\Temp\9466.tmp
Size 702KB
SHA256 1be556ad4975b7ecbeb76b768a7784ec4628d04f90b5949c284cf992ed8d85d4
MD5 a5b3da2a81b7d140bd4ca522b0d31c08
SHA1 15db52a3b3b3835c7023b831112d338a23daf648
SHA512 6bdedbae72fe050b2f547a6ff4c8ed9e1912eb7623ee98addc3cd2df1063a546d1171ceb0d712a496b23510d050de4e50718fcefbeebaaab42272d88a78795b5
SSDEEP 12288:AnbcDwRwu/xy3xF5F5WfH76BS1/xl5NNLN28uQ11OPjFKJLZmX1:AnD158xDFAfH76BSZ5PN28uQnOPj4LZe
TLSH
T16BE4F142F9C040B4D5E569369CB996010BBBBE5785E5EE4732C837053833C91EB29EBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download