007bd4ef25e6a2103eec3abfb601a693deafba0ae6d8a93c0a4736d3936453ab

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_11cec3e8c3f2e938a9b765b57fa378d0_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260807-cde12sem4t
SHA256 007bd4ef25e6a2103eec3abfb601a693deafba0ae6d8a93c0a4736d3936453ab
MD5 11cec3e8c3f2e938a9b765b57fa378d0
SHA1 40ec039bd9ca4e56e95f5b6788b7d319fe39efb0
SHA512 62da7cef4a7d7c0edc98cd9326e852eef01a2db7273d8774fb1cde8358a88ec6612ea3c3bb6221db8bd0651ab37661602eb85d3907db0e700605e118daed1be2
SSDEEP 12288:AnbcDwwB0CGGCT+8McX2sdgRQwT28AnM8hsKWBT9ZKJLZmX1:AnDw74hMnQTM8pWBBMLZmX1
TLSH
T13FE4F142F9C040B4D5E56A364CB585010BBBBE9781E5FA4772C87B063837D90DB39EAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2564	47AE.tmp

Executes dropped EXE 1 IoCs

pid	Process
2564	47AE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_11cec3e8c3f2e938a9b765b57fa378d0_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47AE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2564	1200	2026-08-07_11cec3e8c3f2e938a9b765b57fa378d0_elex_karagany_manuscrypt_rhadamanthys_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-07_11cec3e8c3f2e938a9b765b57fa378d0_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_11cec3e8c3f2e938a9b765b57fa378d0_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\47AE.tmp
  "C:\Users\Admin\AppData\Local\Temp\47AE.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

47AE.tmp

Path C:\Users\Admin\AppData\Local\Temp\47AE.tmp
Size 702KB
SHA256 d855d8d8c42c8c313ff5276f36319419552b41676695c7ef78545c929152ad27
MD5 7c9053dacd27152398026fbcfe00b16c
SHA1 67b8feb99468968fbfd8b2d7d40e96397d448f92
SHA512 ac46bad138722bd2914512f694f7cca0dfacf66a91b7696c1b6d7180b0562e90e64fbbdcfe0d11ce99c26b22a9b1c0cf6cec5a70019d201728723bc633a5e18c
SSDEEP 12288:AnbcDwX+ST3xIVXAVeCV6If6mgy5jNNT7FmOYlij5KJLZmX1:AnDOcBmAr8Zy5jrT7I7ldLZmX1
TLSH
T116E4F142FAD040B0D4E569768CBA45010ABBFE6751E1F95766C87B013837C90EB29BFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download