8bd82931ee510c3dfcbc011aafaf07b09468307a064d961cb580bccb7b67a5b1

Analysis

max time kernel
150s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_302e2087150bbd6a436042ac4fb75aa9_elex_manuscrypt_rhadamanthys_stop.exe
Size 92KB
Sample260803-ldsftafp8w
SHA256 8bd82931ee510c3dfcbc011aafaf07b09468307a064d961cb580bccb7b67a5b1
MD5 302e2087150bbd6a436042ac4fb75aa9
SHA1 36836341786e3b3b61f37037b4405f11f3f7d9e1
SHA512 6c6a3318842730e97c02239c763ce7be5364d4ac35859480b5e6c9deea87bbf92b211a6a164489d44278e39a76110dcd8d36b070a1985a3d226a4207bd9dbb61
SSDEEP 1536:hD99+cKAyn9DzU/1RgsuPIFFby7vh2+ARD/c6jX:lvyn9XU/PKiFby7vcNRf
TLSH
T146935D21BEC55031C337417182FB62E2AA797C727A5A4F4ED7867D440EB36C0B621E9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2620	pdfview_update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_302e2087150bbd6a436042ac4fb75aa9_elex_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdfview_update.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2620	2496	2026-08-03_302e2087150bbd6a436042ac4fb75aa9_elex_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_302e2087150bbd6a436042ac4fb75aa9_elex_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_302e2087150bbd6a436042ac4fb75aa9_elex_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\pdfview_update.exe
  "C:\Users\Admin\AppData\Local\Temp\pdfview_update.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pdfview_update.exe

Path C:\Users\Admin\AppData\Local\Temp\pdfview_update.exe
Size 92KB
SHA256 ade26b8228d7cb12b2f112bddc755cd510f3d5061dbd5e1c003d91ffa5bbd02f
MD5 c6824fb1224112fc9661598315bd417c
SHA1 b5dc7dd36c3712c7bab79c6c51354903d36cbb6d
SHA512 c1c60e80e90858d32d6c60a138a5324bfce936605ce48720da80f95b5d5fc51659a1a75cbcf951bd5d566b15543eff04a356dda61ed2eac64ea9396a9ad15d0c
SSDEEP 1536:hD99+cKAyn9DzU/1RgsuPIFFby7vh2+ARD/c6jR:lvyn9XU/PKiFby7vcNRJ
TLSH
T149936E21BEC55031C337417182FB62E2AA797C727A5A4F4ED7867D440EB36C0B621E9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2496-0-0x0000000000402000-0x0000000000403000-memory.dmp

Download

memory/2620-10-0x0000000000400000-0x0000000000406000-memory.dmp