e399f9696254b18ecdc1916073fe645cd75e19340b017c545f6fe6cef35f7df0

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_84f2cadabd3acd327af97a6649ca4d3f_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260806-2wva5asdmh
SHA256 e399f9696254b18ecdc1916073fe645cd75e19340b017c545f6fe6cef35f7df0
MD5 84f2cadabd3acd327af97a6649ca4d3f
SHA1 e1b5799d46bc28c0ab087e94f54bb4944aa8d0b1
SHA512 7dcd6d8352078c9073ffbc6b53fb8b955e75aeadf5554fea7294caef1f5c5127c382e30f79cbb495779672821f6328bf502a056342f81cb7ad1da3f69a2e1351
SSDEEP 12288:AnbcDwgdtYMg3TnalhY8HFglOroZCylkmCv0qtgKJLZmX1:AnDgoTn+hhFglOroBlE9NLZmX1
TLSH
T111E4F142B9D040B1E4E66E764CB8920106BBFE5791F5EE4776C83B063833C519739ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4604	3A31.tmp

Executes dropped EXE 1 IoCs

pid	Process
4604	3A31.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_84f2cadabd3acd327af97a6649ca4d3f_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3A31.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 4604	4416	2026-08-06_84f2cadabd3acd327af97a6649ca4d3f_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-06_84f2cadabd3acd327af97a6649ca4d3f_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_84f2cadabd3acd327af97a6649ca4d3f_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Users\Admin\AppData\Local\Temp\3A31.tmp
  "C:\Users\Admin\AppData\Local\Temp\3A31.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3A31.tmp

Path C:\Users\Admin\AppData\Local\Temp\3A31.tmp
Size 702KB
SHA256 6906fdfda3350fa42c66f9c371d8ef3c11dfd493576cbd8f49717298c46c1d36
MD5 496522037b93b643ab13aacc9a16bd72
SHA1 b8d4df828a116a93587482870e8d39204639be2b
SHA512 f1543ac89adbabace0601766cd5a967e78b6af6b5546e0a2429da072451c15dec95219b392c91dc44d869db19c5d7d0c081cbc4a966749bf4dd67719bc064270
SSDEEP 12288:AnbcDw/sd1+H+/JNu8tbWNOH+oBVFbFYFJTI1kWeuU6FwKJLZmX1:AnD/sye/JJtbc4t9FY/I1quUkLZmX1
TLSH
T151E4F101F98040B4D4E66E368CB956010AB6FE6785E5EE5762C83B063873D50D72ABFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download