65efbe2887028e30a849e689ada32f55c379387c7700ad84fabb6587329fbcbd

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_7e1a90786fa3c645211c5a1cd96299c3_elex_manuscrypt_rhadamanthys_stop.exe
Size 87KB
Sample260808-ksbwyacl91
SHA256 65efbe2887028e30a849e689ada32f55c379387c7700ad84fabb6587329fbcbd
MD5 7e1a90786fa3c645211c5a1cd96299c3
SHA1 0dcbc82d64969daf6a4cb03eddf23aad8c0dbf38
SHA512 70dd8d885ab6bd0abdf6a9729500f59cf908e380a45bb95b79acf13dfd20823441ba0b93b5e68085abfe1aa7717d31e4c0ef0109f60ba699219aa04c381c87a0
SSDEEP 1536:hD99+cKAyn9DzU/1RgsuPIFFby7vh2+ARD/c6h:lvyn9XU/PKiFby7vcNRl
TLSH
T131936C21BEC15071C232417142EFA7E29AB9BD72675A4F5EDB8A7D440FF22C07221A97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1220	pdfview_update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_7e1a90786fa3c645211c5a1cd96299c3_elex_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdfview_update.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 1220	4536	2026-08-08_7e1a90786fa3c645211c5a1cd96299c3_elex_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-08_7e1a90786fa3c645211c5a1cd96299c3_elex_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_7e1a90786fa3c645211c5a1cd96299c3_elex_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\pdfview_update.exe
  "C:\Users\Admin\AppData\Local\Temp\pdfview_update.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pdfview_update.exe

Path C:\Users\Admin\AppData\Local\Temp\pdfview_update.exe
Size 87KB
SHA256 a8fac9ef6deed0a60397c747f6daad4a08023894c5b4a5c71f8776116171cb5b
MD5 1a96c765ed153a1ef2a34eb45502bf90
SHA1 cf3b4837d455fa7765e809325968654167ce35d7
SHA512 0413f60b2f1b3074826aa10833909b75e5d327ea91945aa9e09ab585cac8ed2a58ec5a6089887febe350d16342cf923db2f3485682f89e98e6ed7f12a97e0476
SSDEEP 1536:hD99+cKAyn9DzU/1RgsuPIFFby7vh2+ARD/c6+:lvyn9XU/PKiFby7vcNRy
TLSH
T1DE936D21BEC15071C232417142EFA7E29ABDBD72675A4F4EDB8A7D440FF22C07221A97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1220-10-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/4536-0-0x0000000000402000-0x0000000000403000-memory.dmp