c6fc0145a734cb3fc66f41b95ebc378794fc37068d0da2f08bb5909985201bb4

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_c896d6b9bd7a8e318ea163897718ecd5_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260804-rh2g6sca74
SHA256 c6fc0145a734cb3fc66f41b95ebc378794fc37068d0da2f08bb5909985201bb4
MD5 c896d6b9bd7a8e318ea163897718ecd5
SHA1 9cafe103103dd55e31ce25fbf45077fa5e164082
SHA512 794510c192f96e68a9d7560a1380c5d3f60cc2bb4037cbaeb94e79edf9160664778ba2f5e8dbe3dab0d26d2ddb1380d7269b88abddfde052101ec16dfe1f7cc9
SSDEEP 12288:AnbcDwZ4lNfKY9igQeVNsx7JzgbB/hFVX0e2KJLZmX1:AnDmlNycQYC7Jzg3jXnLZmX1
TLSH
T119E4F142F9C040B4D5E529369CB955120ABAFD6784E5EA5732C83B053873C82E739AFF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4800	B8D6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B8D6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_c896d6b9bd7a8e318ea163897718ecd5_elex_karagany_manuscrypt_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 4800	4216	2026-08-04_c896d6b9bd7a8e318ea163897718ecd5_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_c896d6b9bd7a8e318ea163897718ecd5_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_c896d6b9bd7a8e318ea163897718ecd5_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Users\Admin\AppData\Local\Temp\B8D6.tmp
  "C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B8D6.tmp

Path C:\Users\Admin\AppData\Local\Temp\B8D6.tmp
Size 702KB
SHA256 fd0b0d7f44c9fd7ae200714314d615f6f6817dbed3e3e60ec0ada66aa8c1d276
MD5 993010d20985d07549bfff90c7b76d5d
SHA1 e6e04b7d5eeb6524fd9e45230b3b7c87a863af35
SHA512 48106ac462938e0d62e3b7d8c19e9398d6c9c635f25e17f6de69d667da4a71263142281aa435f2a95445f7c0e8ba27ca4b4843a9cf484b64257114c7e2a0ee41
SSDEEP 12288:AnbcDwI+yipAqoIugloaw9sDUJTrD6g9mTu3vctQoi2GIaIYzGM9FUi5fKJLZmX1:AnDI+/HoIJlxw+YJTrD63dQZLIANiLZe
TLSH
T13BE4F102F9C040B1D4E26A324CB965010ABAFD6785E5F94B26C87B053973D51DB3AFBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download