ca5d00586ad9d2f23161e23c1b11efd1d8d03af5808458282dca218bdb72e319

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_d01ebc73b83f9f0b6aed9984840fef28_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260805-ltdbtsyyfv
SHA256 ca5d00586ad9d2f23161e23c1b11efd1d8d03af5808458282dca218bdb72e319
MD5 d01ebc73b83f9f0b6aed9984840fef28
SHA1 3fdd51489c39e32b33b8be1ea947ace67f4889f2
SHA512 060fb48a8f05d03c2682cd12b39b64df05c2c57c6fc2434f238fe4f7232cff0198387d0d078cdf6acfe2eb3e7d3990ef44eb442992541a5e57945fd52a0b4454
SSDEEP 12288:AnbcDwlj1krOmGmKi87/LsU6UaHaQmTT490LuaQhpaF3q2IKJLZmX1:AnDNWjyPq5aQEeFaBq6LZmX1
TLSH
T13EE4F141F9C040F0D4E66E324CB996010A7BFE6781E5BA5762C83B057C37E519B39ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1284	AD3E.tmp

Executes dropped EXE 1 IoCs

pid	Process
1284	AD3E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_d01ebc73b83f9f0b6aed9984840fef28_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AD3E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 1284	5032	2026-08-05_d01ebc73b83f9f0b6aed9984840fef28_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_d01ebc73b83f9f0b6aed9984840fef28_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_d01ebc73b83f9f0b6aed9984840fef28_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Users\Admin\AppData\Local\Temp\AD3E.tmp
  "C:\Users\Admin\AppData\Local\Temp\AD3E.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AD3E.tmp

Path C:\Users\Admin\AppData\Local\Temp\AD3E.tmp
Size 702KB
SHA256 02db66a8bf535f902fb6c4e7457d65ebaec4a1b1adae7989f692f0df66dd3dcb
MD5 4c07da910f23e0a22aa050b8b71129fe
SHA1 11ad0775c1b0cc99ee70a2a3f9ca9397e18aeb57
SHA512 670f716393391d5c0a11a496fb8a7667bfba07f0453f7ad8e9045eafa2ec5edd8e4928027610074c68ed46a73f346721de63eeab4a2e486ea087fa80c2c2df55
SSDEEP 12288:AnbcDwYyd4EyAHa9MzbIDvw+hCYWKJLZmX1:AnD34EyAHtaY+kaLZmX1
TLSH
T1F7E40142F9C040B4D4E67D758CB996110ABBBE9B44E5FD8722C837063833D50DB39AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download