10144c59e76bd6156a213c5b84b2a81da554ec7803c5a776369a2e2740099884

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_bea223846d38246011d831328f803ecf_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260820-3fbdraxcrb
SHA256 10144c59e76bd6156a213c5b84b2a81da554ec7803c5a776369a2e2740099884
MD5 bea223846d38246011d831328f803ecf
SHA1 ea281d17dd676411b22e1e7305d3a14c1cfc2b4a
SHA512 e9e03b849a71b3625d11d9d3f28f090f16004a9c2f78584b680a27dcae59dfc078740cb678948809d3f03634dfe83dee9710f25a0f27e381a020a59ec02e09da
SSDEEP 12288:AnbcDwDNNOfxQzeg4hfEUGNf03ngyhHx+SKAUK6o/t46Yjv+i+eK6KJLZmX1:AnDDIQzEMUGNungyhwAUKF2JvRJOLZmF
TLSH
T1BAE4F142F9C040B0D4E52A725CB855020ABBFD6791E9EE5762C83B063837D91D739EBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3800	6D85.tmp

Executes dropped EXE 1 IoCs

pid	Process
3800	6D85.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_bea223846d38246011d831328f803ecf_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6D85.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 7112 wrote to memory of 3800	7112	2026-08-20_bea223846d38246011d831328f803ecf_elex_karagany_manuscrypt_rhadamanthys_stop.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-20_bea223846d38246011d831328f803ecf_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_bea223846d38246011d831328f803ecf_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7112
- C:\Users\Admin\AppData\Local\Temp\6D85.tmp
  "C:\Users\Admin\AppData\Local\Temp\6D85.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6D85.tmp

Path C:\Users\Admin\AppData\Local\Temp\6D85.tmp
Size 702KB
SHA256 a0264e59d51f358c96c4203ded41c35e6685eb02e03607c824abf3bc6672db86
MD5 319d6200c8c1319d110cd7b093ced8ac
SHA1 22bbc6606fe19ac0b6b611f0e3b7f75cbdc852e5
SHA512 a93bf072afa5fee189fafaf14be3936ee2e3e85f5d2d38269f12ec69df00bd2fdd4ef7557175cd3cf720e2bd8a6b097f76be886a1f4f0cedfc3c339d59bd790d
SSDEEP 12288:AnbcDwDVhKwEhov+lQPOpq2rdNZ606usUtjz3TkZhWrIKJLZmX1:AnDrKrhoGlQPszR6uZ33UaVLZmX1
TLSH
T1CEE40142B9C040B4C8E52A368CB996010A77FD5785E5FE4B23C93B453937C919B29BFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download