055d54e3d502dc17520629db7688da8818504919938f58d2fc061e071d14a1ef

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_50f0335e3faa389dc3145ae936fea1bb_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260808-tk35wsec95
SHA256 055d54e3d502dc17520629db7688da8818504919938f58d2fc061e071d14a1ef
MD5 50f0335e3faa389dc3145ae936fea1bb
SHA1 1030a89d524a7bbfe96bc55c1d6c3a1f56f14491
SHA512 b00ef157c04985aedacc141cfea695e45fd517f58b4672e962513299fa0a5f6ff545ade2dd47e7b8ccf5811b20d2566741b392c943a8617fc6ab82a930d6da1c
SSDEEP 12288:AnbcDw/918zwBinAkg3cysXnmXX7T7KJLZmX1:AnD/8zwQAxcysEXGLZmX1
TLSH
T17FE4F102F9C040B0D4E6A9358CB995110ABAFE5784E5F94736C83B453973D81EB29BFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2112	231E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_50f0335e3faa389dc3145ae936fea1bb_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	231E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 2112	4772	2026-08-08_50f0335e3faa389dc3145ae936fea1bb_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-08_50f0335e3faa389dc3145ae936fea1bb_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_50f0335e3faa389dc3145ae936fea1bb_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\231E.tmp
  "C:\Users\Admin\AppData\Local\Temp\231E.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

231E.tmp

Path C:\Users\Admin\AppData\Local\Temp\231E.tmp
Size 702KB
SHA256 45e251350d5740fa1bd951893265c3e7a77de90b01d8858a01fdcb571fa5939b
MD5 9b144edcd1dd74cb9cf91aa490f3d184
SHA1 a8f95b3f666cdb921d5594ab1f8f770d5d056974
SHA512 e282c2c3075e5f2fa075607e96bd35c8dec25080d177f3ed196e18b7b42245ecfa2e34a54a888e19547b306969db73ae11890881749e1729e0762c07901d0688
SSDEEP 12288:AnbcDw68ETdvp+vXNGu0I61rk04nuj2zmO66zduNrTaMur0TOnKJLZmX1:AnDFK20r1rkznuumO66AKMuoTO6LZmX1
TLSH
T124E40102F9C040B5C4E92D368CBD96020ABBBD5795E4EE4762C83B463873D919725BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download