c3aa6604c00c6a19f60f3067ae970effe6c8a79bd7620168e322dfd28e322626

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_47df309b24fba27d55262fc513cd4deb_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260810-tyhq4ssgrd
SHA256 c3aa6604c00c6a19f60f3067ae970effe6c8a79bd7620168e322dfd28e322626
MD5 47df309b24fba27d55262fc513cd4deb
SHA1 e034a74e098f3ccf6f5e6b121af98983b3c660be
SHA512 942f7fd1d3f042d0ad1707147de481e6d344b2361eb3e8557c2f02cc2f99147eb2e55c8d176fdf7b8f5d1e82d5ddcfa170481c999f0f40f977dade3401f455d7
SSDEEP 12288:AnbcDwrvXMsXZCrNA4Cba3JSct4LT3qvTsxyoAKJLZmX1:AnDrvXHXGSzV24Lrqv4xyotLZmX1
TLSH
T16AE4F102F9C040B1D4E669325CB946120ABAFE5785F4AE8772C83B453877C51DB39EAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4664	D538.tmp

Executes dropped EXE 1 IoCs

pid	Process
4664	D538.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_47df309b24fba27d55262fc513cd4deb_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D538.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 4664	2944	2026-08-10_47df309b24fba27d55262fc513cd4deb_elex_karagany_manuscrypt_rhadamanthys_stop.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-10_47df309b24fba27d55262fc513cd4deb_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_47df309b24fba27d55262fc513cd4deb_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\D538.tmp
  "C:\Users\Admin\AppData\Local\Temp\D538.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D538.tmp

Path C:\Users\Admin\AppData\Local\Temp\D538.tmp
Size 702KB
SHA256 4e5e5a9bbe33241d4893bec63b58fa8c53c2b2e52428f5ecd12fca422339eb78
MD5 1db74cf98e25065070647f2ea39ace47
SHA1 27dca8c221efafea02ae4c9189528cacf417f9ec
SHA512 4d1f7204618d701b27700493cdedf67bac4b2717ffc3aaf38eba8d472f14281b64d9198673bfa2e8e58886827e736dae64a54fd81d72ab33d3d4739b7ca70e1a
SSDEEP 12288:AnbcDw+WkGIWlU1IebtF7xqHwTpSgshfm/FyukUOKJLZmX1:AnD+oEI6ntgUSJhm/FyuVjLZmX1
TLSH
T12EE4F102F9D040B5D4E669315CB996010ABAFD6785F5FE8722C87B063833C519B26BFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download