5cba8566ce70e12b089eee80f361133a58155b9546bf6be6507c63d2804267d6

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_c8edd997fcd8977e3385a4d9dbbdbcbe_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260801-p3atvawanf
SHA256 5cba8566ce70e12b089eee80f361133a58155b9546bf6be6507c63d2804267d6
MD5 c8edd997fcd8977e3385a4d9dbbdbcbe
SHA1 3de013701ddf5030e2e66d5a4a9c3573d99be9d4
SHA512 a5745adf2b634114d78b3bdab271d3d354e1cf68dc22dbbb68b2411b5fccee73bc18fb01c9f529b25489907929e801d530a90970998de4f62114d58d7bbe423f
SSDEEP 12288:AnbcDwHd2Izrl0BKOKF67IE9aA/ALj1EFgHqGJS3gvKJLZmX1:AnDHjl0lOUsj1EFgs7LZmX1
TLSH
T11FE4F112F9C040F1D4E66D725CB956010ABBFE6784E5EE1722C83A053833D51DB29EBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4280	FBEF.tmp

Executes dropped EXE 1 IoCs

pid	Process
4280	FBEF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_c8edd997fcd8977e3385a4d9dbbdbcbe_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FBEF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4280	4884	2026-08-01_c8edd997fcd8977e3385a4d9dbbdbcbe_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_c8edd997fcd8977e3385a4d9dbbdbcbe_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_c8edd997fcd8977e3385a4d9dbbdbcbe_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\FBEF.tmp
  "C:\Users\Admin\AppData\Local\Temp\FBEF.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FBEF.tmp

Path C:\Users\Admin\AppData\Local\Temp\FBEF.tmp
Size 702KB
SHA256 9c93718f2050a30024d1c96367b2b1c83dcd52920d4a34f19f7d83a7c0297806
MD5 6c442e6ef5dcc84b6eb32cfee6f1777f
SHA1 30d2d4c05176118090d7458fa65b937ab8193ba7
SHA512 50d568ecfc5767226c7cef95839af5816ad4d1d03a542db094121325c9cf76d83b930b8a52792fa9fc0f0da426afe01776dc7482f3a2d1207468f85dc936743b
SSDEEP 12288:AnbcDwFn+diCnl2Po0X2jU6zJo943DXnOIAWBGbNEEKJLZmX1:AnDN+dxFVUYa81AyGbNEhLZmX1
TLSH
T1C0E4F102F9C040B5C9E969725CB9960106BBFE6345E5EE4772C87B053833C91DB29BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download