30d61bee1eb3355120c8764286b17097b305b30f14945a4a6f5eb08c6170e4c6

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_bab70a45d34039549e011019874f3c01_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260804-w7gxaavwex
SHA256 30d61bee1eb3355120c8764286b17097b305b30f14945a4a6f5eb08c6170e4c6
MD5 bab70a45d34039549e011019874f3c01
SHA1 2b2a52543420dcfdd71c2077fbd75b15dfb95a01
SHA512 d0624618c114bfaf3652e4ff7b2efeec674072048c2ce7f5543747a921069780e371a44e7c67f7791a4fc740af053d3f31c1933faf466c1a2beb34147a05ea26
SSDEEP 12288:AnbcDwjCnTjAD5KC6cbOExeQtGK3WKJLZmX1:AnDunT8DUoObQtDLLZmX1
TLSH
T1DCE40102F98040B1D4E56E358CB8690106BBFE5785E5EA5772C83B423973C51EB39AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5684	2F24.tmp

Executes dropped EXE 1 IoCs

pid	Process
5684	2F24.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_bab70a45d34039549e011019874f3c01_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2F24.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 5684	4292	2026-08-04_bab70a45d34039549e011019874f3c01_elex_karagany_manuscrypt_rhadamanthys_stop.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-04_bab70a45d34039549e011019874f3c01_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_bab70a45d34039549e011019874f3c01_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Users\Admin\AppData\Local\Temp\2F24.tmp
  "C:\Users\Admin\AppData\Local\Temp\2F24.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2F24.tmp

Path C:\Users\Admin\AppData\Local\Temp\2F24.tmp
Size 702KB
SHA256 61c05ee7ee31d5e6ba894f80f3cebd4816527c2156ceba0700da4b33cd2128fa
MD5 ae755b46c53b54725c11fb4af4188b16
SHA1 192f00e7deb49c21834979573d2c7746d6c1fdf6
SHA512 6ac7916f12b296bb888bed676ad222f53c51f6e7233d2e35e81a71451fae6f06ff5f9d60122ada1146010e22ff86521229b71eb15271ce80fbbdde49d7b3b03e
SSDEEP 12288:AnbcDwYDTZIxBZY6JEhlm92eKR5XZrh/KWQ+bLO54FKJLZmX1:AnDUSvYCEhlm0V5JNHQ+044LZmX1
TLSH
T197E4F142F9C040B5D4E66D368CB896020ABABD1750E6EA4B72C83B067973C51D735BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download