3bea957d4f1821abaa2c98b6ab0aa3cb01d91e2c30ea49a2731e4e300abef107

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_dc3d076c31ee0e9ec49e0974714a652d_elex_manuscrypt_rhadamanthys_stop.exe
Size 85KB
Sample260809-3qlbpsfm4w
SHA256 3bea957d4f1821abaa2c98b6ab0aa3cb01d91e2c30ea49a2731e4e300abef107
MD5 dc3d076c31ee0e9ec49e0974714a652d
SHA1 25c646c3375cb205a7c73dc20226b28ada7b343f
SHA512 35d415ce10aa997c3b984076ad97527105da9d0a75f95821f6b7a4a3805b9a295d6f99ade06f531845bc79bab04327da324413f5b308dc2dda4b8a6330b15ee7
SSDEEP 1536:hD99+cKAyn9DzU/1RgsuPIFFby7vh2+ARD/cz:lvyn9XU/PKiFby7vcNRK
TLSH
T129836C11BEC15071C232417142DFA7B29ABDBD72575A4F9EEB8A7D480FF22C07221A97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4232	pdfview_update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_dc3d076c31ee0e9ec49e0974714a652d_elex_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdfview_update.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 4232	4356	2026-08-09_dc3d076c31ee0e9ec49e0974714a652d_elex_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_dc3d076c31ee0e9ec49e0974714a652d_elex_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_dc3d076c31ee0e9ec49e0974714a652d_elex_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Users\Admin\AppData\Local\Temp\pdfview_update.exe
  "C:\Users\Admin\AppData\Local\Temp\pdfview_update.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pdfview_update.exe

Path C:\Users\Admin\AppData\Local\Temp\pdfview_update.exe
Size 86KB
SHA256 f20aa3a75e031edf2d3f4447691aa413863a23ad6d86eb0be6babe45eeb83a4e
MD5 76ebe29edb1135d369d9338a49e16c1e
SHA1 6fee96f5d76e8c982ab64b465c74034356a7a175
SHA512 9e7c2f6b6143b4b85bd244966b3438e3a9482e4f334599f7305a51c4d5b7a184385d241b5345563cd49f142e3d0989c903e395f6dff0a7cec275fa83a048a304
SSDEEP 1536:hD99+cKAyn9DzU/1RgsuPIFFby7vh2+ARD/cB:lvyn9XU/PKiFby7vcNRs
TLSH
T145835C11BEC15071C232417142DFA7B29ABDBD72575A4F9EEB8A7D480FF22C07221A97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4232-10-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/4356-0-0x0000000000402000-0x0000000000403000-memory.dmp