20fe700fef4930e974c6d1eee21b0bc219071f1662eef7802bba6ce789106749

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_cfb778f10c0d20ae2aae86529c0f2747_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260814-heflvswhqe
SHA256 20fe700fef4930e974c6d1eee21b0bc219071f1662eef7802bba6ce789106749
MD5 cfb778f10c0d20ae2aae86529c0f2747
SHA1 b0f7ddd1ffc1d7b329a852bf922c52ef0c379551
SHA512 cb306b8a7d5e95197799122ede18c320a16e6fd63edd0b6a5786b1dc782646ad300e4eab19b6907321db0b32c7c7c9f2d09e1247192049e89bf219db420acca6
SSDEEP 12288:AnbcDwHhrETZk0cIhXWDZFJzXMajGE6sS2jGtTjmBWr2pkb5KJLZmX1:AnDH5UHcUGZFpcgGE7S2ytTnQDLZmX1
TLSH
T173E4F142F9C041B4C5E26A364CB996010A7BBE5755E9FD5B62C83B423C33C419B39ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4092	8FF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_cfb778f10c0d20ae2aae86529c0f2747_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8FF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 4092	2456	2026-08-14_cfb778f10c0d20ae2aae86529c0f2747_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-14_cfb778f10c0d20ae2aae86529c0f2747_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_cfb778f10c0d20ae2aae86529c0f2747_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\8FF.tmp
  "C:\Users\Admin\AppData\Local\Temp\8FF.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8FF.tmp

Path C:\Users\Admin\AppData\Local\Temp\8FF.tmp
Size 702KB
SHA256 5a96c712f944db8fd626ad91eee19182c5aab018b4873f22842c4cc5a3d06914
MD5 751a07a4dc7612adc12cec7d6897de55
SHA1 a3a87a184e0080de3fd6d0429e266e62ed245b91
SHA512 bf0ecf45c8a04501a11135597c493f0a9d8df1533dc59f3b01805df453e288def9a86a450542220b2ab2b779d7c503f96ddd40f671f444f30cab795a5021efb9
SSDEEP 12288:AnbcDwtcCJEprEtVpTagW7vkVOfUkl19oOtYKOqSNTV9F+FKJLZmX1:AnDtcCJEpypmrvkcskhN+RqyTA4LZmX1
TLSH
T1F9E4F102B9C040B1D4E6A9359CB996020ABBFE9784E5ED4772C437427833D919739EBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download