3e6050c270bfa8eece1156dd9c599fef36f6a98cd7e15909c934fe1801c173e0

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 05:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_8cc673061db9d3a8aa0d87eb4af09f85_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260802-gjjzeaware
SHA256 3e6050c270bfa8eece1156dd9c599fef36f6a98cd7e15909c934fe1801c173e0
MD5 8cc673061db9d3a8aa0d87eb4af09f85
SHA1 bd11721a73205029393d38ab4057b3c418efc122
SHA512 c279956569eccaf8734f6535dfe010857eac25f88abc7f595261b5855e885da3e1c3b6c4c0f3d9215b27884c9e6f9bff797c90a30083a48b75f701cc0f95e4ec
SSDEEP 12288:AnbcDwLStAP27j0RRTRpd8++d1duyOx94KJLZmX1:AnDLR274NpEd141x9FLZmX1
TLSH
T1A7E40101F9C041B1C4E629364CB996010ABBFD9795E0FE5762C877413837E91EB29AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5676	EA1D.tmp

Executes dropped EXE 1 IoCs

pid	Process
5676	EA1D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_8cc673061db9d3a8aa0d87eb4af09f85_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EA1D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 5676	4808	2026-08-02_8cc673061db9d3a8aa0d87eb4af09f85_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_8cc673061db9d3a8aa0d87eb4af09f85_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_8cc673061db9d3a8aa0d87eb4af09f85_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Users\Admin\AppData\Local\Temp\EA1D.tmp
  "C:\Users\Admin\AppData\Local\Temp\EA1D.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EA1D.tmp

Path C:\Users\Admin\AppData\Local\Temp\EA1D.tmp
Size 702KB
SHA256 7f047bd41f096466a363dbe9e761e653da04a3b28161696d602620b6838b1294
MD5 072f4423cb87f78dc2a885f64ecd11f8
SHA1 2de0eb01b8d2e8479556c0c454c216dc07e006a7
SHA512 8befd5ea8028b57e0638f561fe4c5f089d2af247fec38c89c4fc18c7b3acf59e52eedbac5c2fc48f50cf0bb368ec5178c774fac74ec695c669519241f5220542
SSDEEP 12288:AnbcDwQwUQtnO0pkSRM6pLmHlnH5YieKJLZmX1:AnD+aOWFO6tIZXLZmX1
TLSH
T194E4F101F98040F4D4E569324CB996120BBBFE5745E5FA4762C87B423837D909B3ABBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download