3565a1ebf4db9df286a7ab5393d8837f1c3920273557f853a586c8789a24bde3

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_32c8b15a067ee8deea051639e4ab5edd_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260803-w6ds8sysg1
SHA256 3565a1ebf4db9df286a7ab5393d8837f1c3920273557f853a586c8789a24bde3
MD5 32c8b15a067ee8deea051639e4ab5edd
SHA1 012ae1cdab9290a2f910c48b7c149419a1a93877
SHA512 797e12929e73471198909ab391c581227476714a0adb6aed4ac2139938d1c00dd7ca8afce394347bf3c1b7e1bc3c9448a71290ee4c4ca8532b2754834b891952
SSDEEP 12288:AnbcDw0xCIrpcIqcXIvK0voK8H9ImDtWL5QH029uKJLZmX1:AnD0xCIrimIvH8H5EdSbFLZmX1
TLSH
T1E1E40101F9C040B0D4E66E325CB95A400ABAFE5756F6E98B62C83B053C73D519739BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4616	7C6A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7C6A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_32c8b15a067ee8deea051639e4ab5edd_elex_karagany_manuscrypt_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 4616	1080	2026-08-03_32c8b15a067ee8deea051639e4ab5edd_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_32c8b15a067ee8deea051639e4ab5edd_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_32c8b15a067ee8deea051639e4ab5edd_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\7C6A.tmp
  "C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7C6A.tmp

Path C:\Users\Admin\AppData\Local\Temp\7C6A.tmp
Size 702KB
SHA256 7a104caf85a1ec45efdfebbc24fe8dbf05a1a1496685665cac9f6e5cfb8fc26d
MD5 11999688f35cd614bca57e51695b246d
SHA1 21b2ba172ac67c6f2272ad26670068ab8b32e4d2
SHA512 c3de2ea8e9a9be317ffd814b0ccf88fb24022e4becfe0a0a8f8b97a0080091942cd42aed86d7c986a84047285bec8a508ab79a37abdbcbaaa18ee0133d87a7cb
SSDEEP 12288:AnbcDwYIWxG5Jm+tz9lPjuVDpNezVNYJNB8HguA9KJLZmX1:AnD/NIqzTPwDuzwnJtQLZmX1
TLSH
T1F6E40102B9C040B5C9E959314CBA560106BAFD5B45E5FE5B32C83B463833D91EB39BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download