4124922d4d55bbdb527d2984aece08d31f7a2b5de2ebcc37b11c3b72a380c22f

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_20053627c839cf93c94644e9cc396a74_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260810-2tnessv1c1
SHA256 4124922d4d55bbdb527d2984aece08d31f7a2b5de2ebcc37b11c3b72a380c22f
MD5 20053627c839cf93c94644e9cc396a74
SHA1 eecfcc52ab7c18d9af10042a562d0b7e1cb8a0da
SHA512 8214d4293d75b9ca9775c21521f3b19d10743c3b1548f51e28127bd4d909a18aacec30a5ab59e06c6f9273c036478cabdb29913fcf1a122b9dcb5581418556d1
SSDEEP 12288:AnbcDwGrdIVsBmiXj4niotHScxGaSAmh2ErEETU6RzfKCNCKJLZmX1:AnDGrdIW4ikniotPpn+BmuLZmX1
TLSH
T15DE40242F8C040B0C4E569359CB946110ABAFEA785E5FE8762C87F413977C509B39ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5308	E3B4.tmp

Executes dropped EXE 1 IoCs

pid	Process
5308	E3B4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_20053627c839cf93c94644e9cc396a74_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E3B4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 5308	1756	2026-08-10_20053627c839cf93c94644e9cc396a74_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-10_20053627c839cf93c94644e9cc396a74_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_20053627c839cf93c94644e9cc396a74_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\E3B4.tmp
  "C:\Users\Admin\AppData\Local\Temp\E3B4.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E3B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\E3B4.tmp
Size 702KB
SHA256 1907469a8eb4e1ed4fba14ae8f365b1781cf302ddf67c8341e9d7869cda2d36f
MD5 83009ebf040a890f70526865ebbb327b
SHA1 c688f490893c9bdc458c8e3a209a9300d5f37d9c
SHA512 969a26f43c0938a958707eb69394d12a169da0f78999025711d4635725ceddab2d93c7d7d09b2a8c6e45938e22e454f98003a4f8b08382d51cb0fb02d06fc5da
SSDEEP 12288:AnbcDwLgw/H7okCYWpQSs4d0GBwq2KgszugrKAXKJLZmX1:AnDkwv7RC1s4JH1gsKgr8LZmX1
TLSH
T1BCE40102F9C040B1C9E629358CB996010A7BFE6795E5ED8761C43B413873D91DB2EAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download