2d80af195c187b2a393338a6309c04ec6f4c7597b6bee0dbcbb1909b8030da81

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_ac40a35af7a1844384cf45eabea4b6d6_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260802-vs627atvht
SHA256 2d80af195c187b2a393338a6309c04ec6f4c7597b6bee0dbcbb1909b8030da81
MD5 ac40a35af7a1844384cf45eabea4b6d6
SHA1 9d53c42138fdb7307a6ce3af25433100f0d5bb9b
SHA512 6ec7ed70923b217bbf5b9e97920c49c971fe2b58d35d07bf24354c74eab1fe3656325367edf81a2b6c9e07a09e07172845d2c07f4d6b3de4f1ec896d1bbe9464
SSDEEP 12288:AnbcDwkmlBw+YrQlFS4UWCZUmSZXe5d3AEpczVQ693sFtpW29KxOYKKJLZmX1:AnDdl9rSjWCZU9ZO5Zls93+H10/LZmX1
TLSH
T12BE40142F9C040B4D0E52E368CB956020AFBBE5751F5AD5B72C97B053833C919B39AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
848	463B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	463B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_ac40a35af7a1844384cf45eabea4b6d6_elex_karagany_manuscrypt_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 848	4332	2026-08-02_ac40a35af7a1844384cf45eabea4b6d6_elex_karagany_manuscrypt_rhadamanthys_stop.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-02_ac40a35af7a1844384cf45eabea4b6d6_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_ac40a35af7a1844384cf45eabea4b6d6_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Users\Admin\AppData\Local\Temp\463B.tmp
  "C:\Users\Admin\AppData\Local\Temp\463B.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

463B.tmp

Path C:\Users\Admin\AppData\Local\Temp\463B.tmp
Size 702KB
SHA256 6e1cd0bdf378addc70087f0f877ba6de3a6ada8fa8f7ac22220f25ae14d8b93a
MD5 015849ff2a3a87993fe4aaf9d8f1639d
SHA1 ca3220b564a8b52c4e92d0d9c064f638d7ba7855
SHA512 c30caebdec977365b8e0579f7c06851eb7b926a4d22762c197892411d4cf27e34cc398fc84f7fddc819b6cc31b590776fd186cef02fd574df0c55203e2368291
SSDEEP 12288:AnbcDw0rSKx9e8gCeQfVWxoy8I/ACJXERR3CaFluoIKJLZmX1:AnDfwfgbmlMYCJXwtFjuSLZmX1
TLSH
T191E4F142B8D040F5D4E66E324CB999010ABAFE5754E4ED5B62C87B053C33C919B39BEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download