4c71059de14392e3ee4c0f8f477944601cf8aec3177cd5677f55115ce7539126

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 21:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_039d7e31edab942fe6f8a938b352a0c6_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260804-1afp6sen2w
SHA256 4c71059de14392e3ee4c0f8f477944601cf8aec3177cd5677f55115ce7539126
MD5 039d7e31edab942fe6f8a938b352a0c6
SHA1 abf859774b891445eb81223e5e429176cac910f4
SHA512 a90dde11cc2a4c7067976ecda2ee9995481f931fa6dfb1464ef35bbec81747438b4913f6e6269a43207e78edd8dd1c556b486abee1f852376e7604bd9f509f5e
SSDEEP 12288:AnbcDwDcsRWDSRZugoXsCAeQUnaOs1x/IR+FKJLZmX1:AnDDcmJTk6V/AtLZmX1
TLSH
T176E4F142F9C000B5D4E52E358CB965010A7BBE9745F6EA9762C83B413873C91D726FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5808	3275.tmp

Executes dropped EXE 1 IoCs

pid	Process
5808	3275.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_039d7e31edab942fe6f8a938b352a0c6_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3275.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5904 wrote to memory of 5808	5904	2026-08-04_039d7e31edab942fe6f8a938b352a0c6_elex_karagany_manuscrypt_rhadamanthys_stop.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-04_039d7e31edab942fe6f8a938b352a0c6_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_039d7e31edab942fe6f8a938b352a0c6_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Users\Admin\AppData\Local\Temp\3275.tmp
  "C:\Users\Admin\AppData\Local\Temp\3275.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3275.tmp

Path C:\Users\Admin\AppData\Local\Temp\3275.tmp
Size 702KB
SHA256 c54c040972a5ca18fd47c83649ad8d96c585fc9d093086cf562034fc86b32c2e
MD5 c438c1e8214f55736a358d8fd49cbec2
SHA1 b4f951613d1ed3c6ba417cd62818372231147a2a
SHA512 d993fb9b59d362b45d463e03c9eb86891eb7a9e9aadb1dd64d2c87be03e5dd16ae2e2b2be733d7506eaf9ef4c3d7a0a91f0f6e3796ad9211051c8af1deb29ef2
SSDEEP 12288:AnbcDwaIE0xTFwJPXnei5boyOCfYcqnaoZCgkKJLZmX1:AnD/oPXnT9tbqbCgBLZmX1
TLSH
T130E4F102F8C041B1C4E56A364CB9951207BAEE6745F5EE4762C83B463833D51EB39AAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download