b435c583337a560aa5d00aebee2a73fcd73b4600aac66c9e4b965bf323580bac

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_7187eab86aca671867406c5bb0552299_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260804-stf62sch34
SHA256 b435c583337a560aa5d00aebee2a73fcd73b4600aac66c9e4b965bf323580bac
MD5 7187eab86aca671867406c5bb0552299
SHA1 1ebddae0e8711e0e8576df8ea71f434fd2a42570
SHA512 6c34be370577f6f64dbcbac03ed40c6380dbe93963ff266dcba471071dab71d6006a8244509be7c407b78f710518d80e2324d587ca232621bb8de05b6c416142
SSDEEP 12288:AnbcDwe65fgbV9XzGIttTP0yudcCtfJ94wa6XKPM26IibcwKJLZmX1:AnDHfMnXLtTcvcMP4wWM26IiodLZmX1
TLSH
T1ECE40102F9C040B5D4E66D354CBD96010ABABD6741E5FE4762C83B063973D50AB2AAFF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2132	91E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_7187eab86aca671867406c5bb0552299_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2132	1452	2026-08-04_7187eab86aca671867406c5bb0552299_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_7187eab86aca671867406c5bb0552299_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_7187eab86aca671867406c5bb0552299_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Users\Admin\AppData\Local\Temp\91E.tmp
  "C:\Users\Admin\AppData\Local\Temp\91E.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

91E.tmp

Path C:\Users\Admin\AppData\Local\Temp\91E.tmp
Size 702KB
SHA256 2f2b75baf2bfbbb809c3ab3d7dfa624d4a709493c0f73f4c11dbad8262b9330c
MD5 0ac95211ffdad2d15901111dfc727bab
SHA1 082c0c343e753d5bd6ea45c08ac9c048e2509e58
SHA512 2565afe95b01790994e4b7e123023e9c5599a87a0e58cb93d56f05f21408a7239e2e2b5ecd98b69748da109b8e5b25f92192dca04e97e99bb72b212f5ca3822a
SSDEEP 12288:AnbcDwJaqPW+0UNWtuBF7hmY9MM7M4hDNPf3OyOz3iuKJLZmX1:AnDJasW+0rtZ4hVfXOrcLZmX1
TLSH
T1B3E4F142F8C040B5D9E56D764CF989010ABBFE5790E6FE5722C87B023833C519729AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download