1222bc32605900100024d7ba103968ef9d77c6a6318c73cc148269f109c77545

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_5ac94dfb7c3c26fb8257a2f3d352a95a_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260819-qqlagsfc95
SHA256 1222bc32605900100024d7ba103968ef9d77c6a6318c73cc148269f109c77545
MD5 5ac94dfb7c3c26fb8257a2f3d352a95a
SHA1 73bea844b05b0e5be89feb73857242c4a9c73011
SHA512 4378721119c5a2cde2ab8de50aeccaa99044c08e5c3a9dc34128c4507434251da5f9523e01a237584bfab7263602ae2e9d6498be6196fa0017213de354dfd6ad
SSDEEP 12288:AnbcDwmujwVJ+J+nL9miBegh3RH9vBGc9F/7VEkdrKJLZmX1:AnDJwM+nL9miBLt95GGl7ViLZmX1
TLSH
T1BCE40202F9C040B5C5E55D768CB986120A7BFE9385E1EA4762C837463933C519B3AFBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1056	7352.tmp

Executes dropped EXE 1 IoCs

pid	Process
1056	7352.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_5ac94dfb7c3c26fb8257a2f3d352a95a_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7352.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 1056	1272	2026-08-19_5ac94dfb7c3c26fb8257a2f3d352a95a_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-19_5ac94dfb7c3c26fb8257a2f3d352a95a_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_5ac94dfb7c3c26fb8257a2f3d352a95a_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\7352.tmp
  "C:\Users\Admin\AppData\Local\Temp\7352.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7352.tmp

Path C:\Users\Admin\AppData\Local\Temp\7352.tmp
Size 702KB
SHA256 7ef6b88516cc222f32bbdc19388f0bedcb12e2dd0ce97cb48b1a8829afcc6239
MD5 453e19ec5c0f850bb96daac65a4b06a7
SHA1 05b35144ea604aa0e443bbbda8f50f0fcea3b8ac
SHA512 bdb5586de54299c195f86bdd5bc453f14daa3d609ed5fe95f413518648c6923033e604c9f2ca368a981aafb982d72179f84dcb9a1f566adc612f5ea616ff2fe5
SSDEEP 12288:AnbcDwXsJ30Wus4S1A7ZG8vIYqMGm7uEo8jDcy4XeydxqJ8TKJLZmX1:AnDcJ3U41IZGpqwEoYcLXey/2rLZmX1
TLSH
T16EE40202F9C040B0D4E62D368CF9951109BAFE2789E5E95727C477057C73C61AB2ABBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download