055d54e3d502dc17520629db7688da8818504919938f58d2fc061e071d14a1ef

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_50f0335e3faa389dc3145ae936fea1bb_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260808-tk35wsec95
SHA256 055d54e3d502dc17520629db7688da8818504919938f58d2fc061e071d14a1ef
MD5 50f0335e3faa389dc3145ae936fea1bb
SHA1 1030a89d524a7bbfe96bc55c1d6c3a1f56f14491
SHA512 b00ef157c04985aedacc141cfea695e45fd517f58b4672e962513299fa0a5f6ff545ade2dd47e7b8ccf5811b20d2566741b392c943a8617fc6ab82a930d6da1c
SSDEEP 12288:AnbcDw/918zwBinAkg3cysXnmXX7T7KJLZmX1:AnD/8zwQAxcysEXGLZmX1
TLSH
T17FE4F102F9C040B0D4E6A9358CB995110ABAFE5784E5F94736C83B453973D81EB29BFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4516	6992.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_50f0335e3faa389dc3145ae936fea1bb_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6992.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 4516	2372	2026-08-08_50f0335e3faa389dc3145ae936fea1bb_elex_karagany_manuscrypt_rhadamanthys_stop.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-08_50f0335e3faa389dc3145ae936fea1bb_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_50f0335e3faa389dc3145ae936fea1bb_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\6992.tmp
  "C:\Users\Admin\AppData\Local\Temp\6992.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6992.tmp

Path C:\Users\Admin\AppData\Local\Temp\6992.tmp
Size 702KB
SHA256 b49ea331035f16cbc0825fd9e9b6109f2a932d0c54dba1afaa02a4d4e7cff58a
MD5 7d962f2eb03392c32d02a691ef9ad985
SHA1 e421145968010629ffc3678c9da0f15d57e6b60e
SHA512 1e8721847d7dd72af83e7c50e14d0ee8b8f5b6a91e69f8e1e6a8db61c114d9542752fb7ffc0d71b2a2c160efdd3383e5a2c0b95ebeac475919f562bb68a7f3d6
SSDEEP 12288:AnbcDwtsq8wK+obirxxqf5LqANT6KtlhaNtAHFnQ+AoA0RrnLbKJLZmX1:AnDtLpK+oEOf9qk6NtCQyAGbLOLZmX1
TLSH
T1A8E4F142F9C081B0D4E65D315CB85A010ABBFEA395E5FA5722C83B453933C919B35ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download