afad067ca72e5a8a359f59e150938b7aa75585ef0df522bfdfdbb28a37bd63b0

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 17:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_ae076de8ce1dd503b9e425dcbf24ae6f_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260818-vl491swfqc
SHA256 afad067ca72e5a8a359f59e150938b7aa75585ef0df522bfdfdbb28a37bd63b0
MD5 ae076de8ce1dd503b9e425dcbf24ae6f
SHA1 c628e3bb7fc22061d96711aab1c1b56846bee8b2
SHA512 0394e0b65a85d73efc25a393ef181a6644899121abf5fb9f71c6cf022f9479b42e5e20487137190b8be53befe8cc0102c2b28e1ae7ad1b8ae8f1b3e12938dd7b
SSDEEP 12288:AnbcDwZkIQFwCD6igtUFALpSMw6B3NgdQ0OBl2qau2d/C6vCfcKJLZmX1:AnDZkwC4pDPBdgdB+2H/CVfZLZmX1
TLSH
T148E40142F9C040B1D4E56D768CB996020A7EFE9788E5F95722C83B053833D519B39EBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
436	3399.tmp

Executes dropped EXE 1 IoCs

pid	Process
436	3399.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_ae076de8ce1dd503b9e425dcbf24ae6f_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3399.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 436	3916	2026-08-18_ae076de8ce1dd503b9e425dcbf24ae6f_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-18_ae076de8ce1dd503b9e425dcbf24ae6f_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_ae076de8ce1dd503b9e425dcbf24ae6f_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Users\Admin\AppData\Local\Temp\3399.tmp
  "C:\Users\Admin\AppData\Local\Temp\3399.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3399.tmp

Path C:\Users\Admin\AppData\Local\Temp\3399.tmp
Size 702KB
SHA256 6cd088ed67342905de7b29f331ea4f5f61d85d45afa4d1f116cab96fdfc43538
MD5 bf8c70fbe3f65d221045d2990e96cfe6
SHA1 7e495dc36877edef78d7640f4b353cee3739ee04
SHA512 135e443e54d24ad3f53f7afb714c290337aab7e6087d6f660c084a1fe7f2254b8bdc46fcd4da9f54ac400d293a25f764d00a54ac0778fcf9ffd6088485e698d5
SSDEEP 12288:AnbcDwiwI0b+gzL0g+qwtYfzQSrKaSW2LQCcVCE+ZkmbBon12KJLZmX1:AnDiCigkgMtiz6JW2LQ3Ukmu1rLZmX1
TLSH
T118E4F102F9C040B4D5E52D324CB996000ABAFE5785F9FE9762C87B453833D51A739ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download