ff13092c274e441e5a240a98654d4ee0d07d875e1c3f49a8ed2bf1b440d92ce5

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_9ae8ef18d71b42d39ce14a0e2124350d_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260818-vtbyfaad74
SHA256 ff13092c274e441e5a240a98654d4ee0d07d875e1c3f49a8ed2bf1b440d92ce5
MD5 9ae8ef18d71b42d39ce14a0e2124350d
SHA1 85b6b83bd4621c697035828e47db1cb9242d1100
SHA512 5889ea83f25fd284da6f5031b2cad7bb49854ab263b55b87da914d8393e257d9231ccc010969785689a0a8b2d45c576337822370d3413684342795155a3a81de
SSDEEP 12288:AnbcDwfgp6NqDfJtDlnkcKnN2SqZp0wkSKJLZmX1:AnDYp6UlTrKN2Sup0vLZmX1
TLSH
T172E4F102FDC040B0D5E56D314CB996110ABBFE5794F5FE4B62C877063833D91AB29AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5092	77F5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_9ae8ef18d71b42d39ce14a0e2124350d_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77F5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5240 wrote to memory of 5092	5240	2026-08-18_9ae8ef18d71b42d39ce14a0e2124350d_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-18_9ae8ef18d71b42d39ce14a0e2124350d_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_9ae8ef18d71b42d39ce14a0e2124350d_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Users\Admin\AppData\Local\Temp\77F5.tmp
  "C:\Users\Admin\AppData\Local\Temp\77F5.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

77F5.tmp

Path C:\Users\Admin\AppData\Local\Temp\77F5.tmp
Size 702KB
SHA256 add376091434ff3edf88d28acfaf887802ae05ff4865a0974c7e7362538abe64
MD5 2d8c2a6feb2b4c2dba88c77b4aae80c6
SHA1 91c57e8fca399c97e3047fd0ff423e566afa4872
SHA512 2c384993561b2e0a51fc8f09ed9d00598855dcb8e2823b8c64aec4964768aa42b532aa631d6c32130b38b8c2d7c4a8695df7cccb7ee47d9b819665112deca224
SSDEEP 12288:AnbcDwyTTecDr5bV7JvaDIA19cXCGhK7KF24WGzvKJLZmX1:AnDSeYPVCACEK7n5LZmX1
TLSH
T102E4F102F98040B1C4E529364CB986120ABBFE9784E5FD5B76C87B453C33D519B39ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download