b435c583337a560aa5d00aebee2a73fcd73b4600aac66c9e4b965bf323580bac

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_7187eab86aca671867406c5bb0552299_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260804-stf62sch34
SHA256 b435c583337a560aa5d00aebee2a73fcd73b4600aac66c9e4b965bf323580bac
MD5 7187eab86aca671867406c5bb0552299
SHA1 1ebddae0e8711e0e8576df8ea71f434fd2a42570
SHA512 6c34be370577f6f64dbcbac03ed40c6380dbe93963ff266dcba471071dab71d6006a8244509be7c407b78f710518d80e2324d587ca232621bb8de05b6c416142
SSDEEP 12288:AnbcDwe65fgbV9XzGIttTP0yudcCtfJ94wa6XKPM26IibcwKJLZmX1:AnDHfMnXLtTcvcMP4wWM26IiodLZmX1
TLSH
T1ECE40102F9C040B5D4E66D354CBD96010ABABD6741E5FE4762C83B063973D50AB2AAFF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4336	B12A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4336	B12A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_7187eab86aca671867406c5bb0552299_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B12A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 4336	3720	2026-08-04_7187eab86aca671867406c5bb0552299_elex_karagany_manuscrypt_rhadamanthys_stop.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-04_7187eab86aca671867406c5bb0552299_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_7187eab86aca671867406c5bb0552299_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\AppData\Local\Temp\B12A.tmp
  "C:\Users\Admin\AppData\Local\Temp\B12A.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B12A.tmp

Path C:\Users\Admin\AppData\Local\Temp\B12A.tmp
Size 702KB
SHA256 6d4591da5afe217db3cad6454a17eb09246cbbbb5115fc6239dbab807f32df10
MD5 a3b103168ff266e654afe2b4c9828710
SHA1 7471e55be305ec2d8df9bdb3feeda3da24e82b10
SHA512 568f563a848bd3157e1cfe619d9aef943146b20a00db57572e207c9b5caff000db6539ea2dbd904a30f0992d62f8537aa770da2c11d7dae9a802bd7dda15ba71
SSDEEP 12288:AnbcDwwwUB+HGmj6jEmozMtbA778d55CzZN/sv3kZ0KJLZmX1:AnDFHmEmozMBAEWZ1zZRLZmX1
TLSH
T1DDE4F102F9C040B4C5E969759CB956120ABBFD6785E5FD5B22C83B023833C51DB29BEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download