69a41a26e5bdf5148a62f416e58a97edb6cbd97cb9f65dedee4bf7a002eaab12

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 05:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_8980d43fe5df694aab4ee15484ddd8c0_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260802-gk27dadh78
SHA256 69a41a26e5bdf5148a62f416e58a97edb6cbd97cb9f65dedee4bf7a002eaab12
MD5 8980d43fe5df694aab4ee15484ddd8c0
SHA1 764685539327e0494df045d13b438cf783ccc896
SHA512 541b67eed2e5a5dba1437fa0e242782b6ec9c685d1a0f66aa56ba5833b685393594258fa90830da8ad2516a48ff003bfb8f46853d3d7e7ddb5cb8827356a1423
SSDEEP 12288:AnbcDwl9jik0NXwY5ToJzg0afoFKma+YMD3yDKJLZmX1:AnDl1IH5ToZg0agFKr+PD3pLZmX1
TLSH
T1F6E40242F9C040B4D1E569328CF996010E7BBE5784E2EE4772C83B463D73D51A729AAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1212	B4B0.tmp

Executes dropped EXE 1 IoCs

pid	Process
1212	B4B0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_8980d43fe5df694aab4ee15484ddd8c0_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B4B0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 1212	4300	2026-08-02_8980d43fe5df694aab4ee15484ddd8c0_elex_karagany_manuscrypt_rhadamanthys_stop.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-02_8980d43fe5df694aab4ee15484ddd8c0_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_8980d43fe5df694aab4ee15484ddd8c0_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Users\Admin\AppData\Local\Temp\B4B0.tmp
  "C:\Users\Admin\AppData\Local\Temp\B4B0.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B4B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\B4B0.tmp
Size 702KB
SHA256 d8005d5e114059a6b766581fafcc30ad4f55c70d6c8d017a445afefd4ed0d868
MD5 f9ce7dca883aabf9d39acf02a06b2711
SHA1 4c90ea4e510ae042a60cdf1fa806a68e231048f4
SHA512 e1d4afc6bd2b22b1c816bd22451fea56e41e17c0128d9e85c531ace2c9091a471ff97d08ff877a8289a57fbf75e8d781bc996328c9c6887153784e526eae0ab0
SSDEEP 12288:AnbcDwDU6Gk8L7NY2HXGcxJkxqt52t2u6cQTl+KJLZmX1:AnDDUigm23GcxJoqtMtkcolTLZmX1
TLSH
T185E4F102F9C040B5D4E56A324CB99A020ABBFE5745E5FD5B32C83B453873D509B29EBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download