b589c1b67ffd3ecd82ed4f65363751e810d8f6ecf07ae1edbed5c517d5db39ea

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_4e5249a25011587406bc494c4865cc7b_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260818-wllncaxejc
SHA256 b589c1b67ffd3ecd82ed4f65363751e810d8f6ecf07ae1edbed5c517d5db39ea
MD5 4e5249a25011587406bc494c4865cc7b
SHA1 8c5a7510e7a2f6f394c5ea75b93609fa393e592c
SHA512 388dc6f94f3ca10b3066f37435f459d2e8653dbb5f07779ad55b6eeeaa29a9585b631c0427b0cd7844cbfe1e437e93e5ea8fa6b90d639a1771d5206cc9ce693d
SSDEEP 12288:AnbcDwtdnGvexqti9LUTstAOKAEfrd/mTxtosZ7ZwL/nKJLZmX1:AnDtdn+MLIstAOKH8xtok1wGLZmX1
TLSH
T19FE4F101F9D040B0D4E569728CB896120ABBFE5795E5FE5B72C87B013833C51DB29ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4440	403B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_4e5249a25011587406bc494c4865cc7b_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	403B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 4440	4164	2026-08-18_4e5249a25011587406bc494c4865cc7b_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-18_4e5249a25011587406bc494c4865cc7b_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_4e5249a25011587406bc494c4865cc7b_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Users\Admin\AppData\Local\Temp\403B.tmp
  "C:\Users\Admin\AppData\Local\Temp\403B.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

403B.tmp

Path C:\Users\Admin\AppData\Local\Temp\403B.tmp
Size 702KB
SHA256 3463bea4507bef44a1a9ea6bb825833eea09bb7081f87a978628341d545a1135
MD5 8fe73f69d1d0371c3fd758f0b2bad0e1
SHA1 fbb4e3c715f98fc1bd4327098c282f8ab80d0e9c
SHA512 fa9105140e04ce6204763de0b5952bff0f23139fd650a8418259850b2e661240927d3e1bc5b33d32cb7b9bd12ccd011d71b50c1b1ea26928f416c076801b83d6
SSDEEP 12288:AnbcDwyXZ7cEPdonj6lL5B45Re1CZ4QNpS3RZuO+vxC5/mLNoKJLZmX1:AnDyXZPPdojeL5B8e1C22U3RMO+vxW4+
TLSH
T139E40102F9C000B5D0E56D729CB996410ABBFE5345E6ED5726C83B053873C61DB2AABF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download