2d873cc8bee49bb6e0d37c7e9ed76abe01aa4ed1976a891f81cdb26c35a5867b

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_1698070584bc65d7ffba5a003b6f2186_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260805-ngc7eaweqe
SHA256 2d873cc8bee49bb6e0d37c7e9ed76abe01aa4ed1976a891f81cdb26c35a5867b
MD5 1698070584bc65d7ffba5a003b6f2186
SHA1 31498dc82385fc3cd6d7dee139609562e380e5a1
SHA512 492700f39117a926e00e553987fdd10ef94514b677c5746da3d761ff4a89bc960da4ddf777743c7c9967470cb27663835169d15266a57e26e25ae0fbf0fb5dad
SSDEEP 12288:AnbcDwK53qTxJWfOtZufhAFFRtY3WavEkuQ/Hwkmqo3wQ127VrGKJLZmX1:AnDLJW+Z2hALKMkJ/Hw74HLZmX1
TLSH
T18CE4F102F9C040F5D4E629365CB85A110ABBFE6794E5EE4762C47B063C33C429739ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2360	7E8D.tmp

Executes dropped EXE 1 IoCs

pid	Process
2360	7E8D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7E8D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_1698070584bc65d7ffba5a003b6f2186_elex_karagany_manuscrypt_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 2360	264	2026-08-05_1698070584bc65d7ffba5a003b6f2186_elex_karagany_manuscrypt_rhadamanthys_stop.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-05_1698070584bc65d7ffba5a003b6f2186_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_1698070584bc65d7ffba5a003b6f2186_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:264
- C:\Users\Admin\AppData\Local\Temp\7E8D.tmp
  "C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7E8D.tmp

Path C:\Users\Admin\AppData\Local\Temp\7E8D.tmp
Size 702KB
SHA256 3e673364866ce9d77f8edc515cec8e8ef74407802a48b18adfc23cb871874078
MD5 1233acd76d39a46f6c9d30828d3b3c91
SHA1 8eabfc59c25c89bd7601b05c07dc4ae38eb5e7d4
SHA512 107c4f8e8a78e57608f14524f92a14fba254d56210f88fc1108d29a62b3244ebc4cd5c889d33ca5c1b0eda13645ec55969e4a07b8d8656ea4dd9cacdd4199beb
SSDEEP 12288:AnbcDwRV+DX/fhZ83T+QNpGUjS/b47BBfvkD/KJKJLZmX1:AnDRV+DvfhZ83icUUjSU7QDC8LZmX1
TLSH
T17BE40102F9C080B5D4E66A354CB946100AB7FD9794E6EA4732C83B467873C51DB29BFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download