3e9800470c713deb181d6f111ed0df6955865a588ec6dcd345ba16f6a10d7c29

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_b6a1e64e3e8d1191ac0aa293405c0a19_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260803-hf7rqsdd94
SHA256 3e9800470c713deb181d6f111ed0df6955865a588ec6dcd345ba16f6a10d7c29
MD5 b6a1e64e3e8d1191ac0aa293405c0a19
SHA1 d108bc16efd7777bf5ec9783c33a3844882995c6
SHA512 567f30dc0110431ee952ea5e017b94450131d5e1df389c1cc2db93214030938eeae4dd7a05a20b104db01d7b0cfb978215ccec6e715376219b11308cc31df4e4
SSDEEP 12288:AnbcDwvb+A5Q8yVtba5cI09pnUj7zxi1KJLZmX1:AnDh5Q8yVtu5cIMs7zxioLZmX1
TLSH
T1E7E4F102F9C080B5D0E56E364CB956410ABBFEA744F5ED8722C837463977C41A729AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5372	205F.tmp

Executes dropped EXE 1 IoCs

pid	Process
5372	205F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_b6a1e64e3e8d1191ac0aa293405c0a19_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	205F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 5372	2292	2026-08-03_b6a1e64e3e8d1191ac0aa293405c0a19_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_b6a1e64e3e8d1191ac0aa293405c0a19_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_b6a1e64e3e8d1191ac0aa293405c0a19_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\205F.tmp
  "C:\Users\Admin\AppData\Local\Temp\205F.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

205F.tmp

Path C:\Users\Admin\AppData\Local\Temp\205F.tmp
Size 702KB
SHA256 250f1aa5aebf020991073d81c98d2717fee9e1213f7c1dee77e17b1110c1e3ca
MD5 b0bb14d5e701897ebc8167a2e6557483
SHA1 8f5da5c4528cb59f04ee8418c615b8852b645c4a
SHA512 0a3f338d9b7423cee79551b2cc44a48b183b7db75d8eaaff9a6dc991a2576eb3b756c1c233877ab3119fd542232e77776ae71989c0b81be5aad3c3ab0b8879b3
SSDEEP 12288:AnbcDwU57cGx6Zw/N/hPV6jjd7ZfEWKf1vTAjKJLZmX1:AnDxGx64Yl+FNvTJLZmX1
TLSH
T18FE40101F89040B4D4E56D369CB986010677BE5385E9EE5B62C83B423933D91EB39FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download