d47c76858f0013c249269176b7ecc62dc716b14388914b5ca6fea119b9c86e0b

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_86c8980712239453faae6526d75292be_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260804-shqakscf69
SHA256 d47c76858f0013c249269176b7ecc62dc716b14388914b5ca6fea119b9c86e0b
MD5 86c8980712239453faae6526d75292be
SHA1 5a1d9f1e6f5cad6127d299700fb0b9302ef6b9ce
SHA512 c0f919c64d733cc4a63ba34ec2125e61bcb333f4dd1b386374d21884391988ae9c0aa0035d817435669d0be92180a7eb2a10c59f51aaab18f42e843d3bfdbf03
SSDEEP 12288:AnbcDwiaHKTndKEOA2GnmteHee2vHswSV9tTIKJLZmX1:AnDiaHCMun+e+e2vHv+9hVLZmX1
TLSH
T1BEE40142F8C040B4D5E56E728CB842120ABBFE6795E5ED4762C87B413833D51DB29BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4152	D23A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4152	D23A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_86c8980712239453faae6526d75292be_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D23A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 4152	4412	2026-08-04_86c8980712239453faae6526d75292be_elex_karagany_manuscrypt_rhadamanthys_stop.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-04_86c8980712239453faae6526d75292be_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_86c8980712239453faae6526d75292be_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Users\Admin\AppData\Local\Temp\D23A.tmp
  "C:\Users\Admin\AppData\Local\Temp\D23A.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D23A.tmp

Path C:\Users\Admin\AppData\Local\Temp\D23A.tmp
Size 702KB
SHA256 2025046bb1f82f199486e7a1b5985c73538f52ef9eba29d8e0eb28cd78dfe276
MD5 7f954564a0215804c105482ef5db9ce6
SHA1 97d3ba83502b4f719d73f13a80dd8e8c5c78ab91
SHA512 351b42753c916df97746bb23e38dde9b85034e914e48a9dbc676970882df4ed41320e1da4222a81199c7d36369e14d05e26ebff78c79e09516917472a0e5fd95
SSDEEP 12288:AnbcDwrT3M01cgD1lQRAwnhM+/co778zjz+36fFwbz7iKJLZmX1:AnDroyRDURAwbf38fz+q0zTLZmX1
TLSH
T114E40142F9D040B1D0E56D319CB996020ABAFE5754E9FD4762C83B423877C909B36EBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download