65e3cc3476be41b2ec83985a63b334d298c918b895e25ae89a78f99140e2a5ab

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_088e5224ca99632aedab71d5b7d0db91_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260804-d31jqacd32
SHA256 65e3cc3476be41b2ec83985a63b334d298c918b895e25ae89a78f99140e2a5ab
MD5 088e5224ca99632aedab71d5b7d0db91
SHA1 325a92031c90fc661c3ac0cd82830f2dfa9e9a1b
SHA512 c1a3429d2cb1838708d8c00368b5e452469e59afc2f098af299bdbc51952d84fc00d188518498db7dd551b4b00de152610370658be2906a497bd015c563edf4c
SSDEEP 12288:AnbcDwhZFPX1vkrAIJNjdeL9uIn/720MIe2WGJTPHeLQtHZNLKJLZmX1:AnDzF5CJNjxuT2se2nJTP+LQt5N+LZmF
TLSH
T1AAE4F102B9C040B4D8E56A325CB996110ABBFE5B95E5FE4732C83B053933D50D729BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4464	8C29.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_088e5224ca99632aedab71d5b7d0db91_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8C29.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 4464	4972	2026-08-03_088e5224ca99632aedab71d5b7d0db91_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_088e5224ca99632aedab71d5b7d0db91_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_088e5224ca99632aedab71d5b7d0db91_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\8C29.tmp
  "C:\Users\Admin\AppData\Local\Temp\8C29.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8C29.tmp

Path C:\Users\Admin\AppData\Local\Temp\8C29.tmp
Size 702KB
SHA256 c1e772022bcc8c1c96d07953f09abbd2d489e1d6d3c0f10c1354b1514fc60b9c
MD5 9addfb9eebab4d79dcc4af83282f828f
SHA1 6bdff96c0761bd028d9158d0caac40fc37b147af
SHA512 4288fe75e302bd39cc95861fcea800facaa82ec435a47b8a27832c2ce1996224e352eaa225387ab8955e3b80faa67d423af8a920c7c895e3ee5a5cff60669c31
SSDEEP 12288:AnbcDwcuamGLbdi9XrlKR+gpG52PWpLFgnD/OsBDqKPeKJLZmX1:AnDko9XBKkwsgnD9dPzLZmX1
TLSH
T1ADE40242F98040B0D4E569768CB656010A7BFE6385E1FE9B62C83B067873C51D729AFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download