abc1e76a19921a55885df4a6890d6f91a0994a33df118cdb81c6f739a8f99d1a

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_6ddf9945c74e0b207c0298437fbdd13e_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Size 449KB
Sample260817-xpcqaagk51
SHA256 abc1e76a19921a55885df4a6890d6f91a0994a33df118cdb81c6f739a8f99d1a
MD5 6ddf9945c74e0b207c0298437fbdd13e
SHA1 da9f3a691a7dee6835f3497bf02c37be68d4a72e
SHA512 4bb08227df978eb8b3d789eb18c576e1a5597dea528d8b1891b8b61e3ab1c20b22886285df523eff91d99c0cce0b0d314bf219edc65cc73e34656ddae8920130
SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxM/:nGyHm1dAAJybXdE7IlZ8s0q/
TLSH
T13FA4F8F0A7408060DBE79679C43B8DAB9433A90D9D25595F395ABF1E3D31383423A89F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5576 set thread context of 4956	5576	2026-08-17_6ddf9945c74e0b207c0298437fbdd13e_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_6ddf9945c74e0b207c0298437fbdd13e_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5576 wrote to memory of 4956	5576	2026-08-17_6ddf9945c74e0b207c0298437fbdd13e_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	89
PID 5576 wrote to memory of 4956	5576	2026-08-17_6ddf9945c74e0b207c0298437fbdd13e_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	89
PID 5576 wrote to memory of 4956	5576	2026-08-17_6ddf9945c74e0b207c0298437fbdd13e_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	89
PID 5576 wrote to memory of 4956	5576	2026-08-17_6ddf9945c74e0b207c0298437fbdd13e_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	89
PID 5576 wrote to memory of 4956	5576	2026-08-17_6ddf9945c74e0b207c0298437fbdd13e_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_6ddf9945c74e0b207c0298437fbdd13e_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_6ddf9945c74e0b207c0298437fbdd13e_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5576
- C:\Users\Admin\AppData\Local\Temp\2026-08-17_6ddf9945c74e0b207c0298437fbdd13e_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-17_6ddf9945c74e0b207c0298437fbdd13e_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
  2⤵
  PID:4956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4956-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4956-3-0x0000000000400000-0x000000000041F000-memory.dmp