db3e7a037806b68eaebc44fb46bbac63683c255621913da629566b37cd0539d6

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 05:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_80f84c00297be161ca00f853ac733747_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260807-fs3mfa1saz
SHA256 db3e7a037806b68eaebc44fb46bbac63683c255621913da629566b37cd0539d6
MD5 80f84c00297be161ca00f853ac733747
SHA1 39dda58daa1eeeb6a189f87ff44b129b826fdf07
SHA512 3c4f05a682eae3b08e54de27dfce6b552f7473b7a49ef9a716c1eda6223900daa7e25556a300ddd0754d518794ba6ba08e669c811abcfde54b3c8ca3e0f09c12
SSDEEP 12288:AnbcDw6NoBNc97d8ICePpZhZfYvFlEp78OWcJN4BWnGAo3HSf9NhvWKJLZmX1:AnD6UNc97d8FeJZ8rq78VcweGAo3Hw/8
TLSH
T1FFE4F102F8C040B5C8E56E358CB946110ABAFE9785E1FE5762C97B423C33D51D736AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4144	35BC.tmp

Executes dropped EXE 1 IoCs

pid	Process
4144	35BC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_80f84c00297be161ca00f853ac733747_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35BC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6032 wrote to memory of 4144	6032	2026-08-07_80f84c00297be161ca00f853ac733747_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-07_80f84c00297be161ca00f853ac733747_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_80f84c00297be161ca00f853ac733747_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6032
- C:\Users\Admin\AppData\Local\Temp\35BC.tmp
  "C:\Users\Admin\AppData\Local\Temp\35BC.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

35BC.tmp

Path C:\Users\Admin\AppData\Local\Temp\35BC.tmp
Size 702KB
SHA256 4bd67ec2e4bba0daba2ec3d26825bcbb65439a3eee8d7c952e242c5109da6625
MD5 a5789e6d6de34d8a7db368ce09a9421a
SHA1 b4649887d9d9c94f68bdfc9ed571b3e8406b8d87
SHA512 396727087c7a04e07caa3d035df423fbfd6f03498000c515762fb0364f1669984ad4b39e62c10f88254ac898d3c4373e827730c022bc4d2491f0b87ea19a79db
SSDEEP 12288:AnbcDwsl7cGGC7ZJPEJh3It6CNDWfd2gZeed2bJ/GKJLZmX1:AnDslQGGyPEJh4vNm7NkbJ/7LZmX1
TLSH
T14AE4F102F9C080B1D4E56D354CB986110ABAFD5788E5E99B76C83B463833C51DB36ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download