b868cac1184984811494f8f2c2c73970baeda01c71076555b3e435d9f537b9c3

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_30a6dc10e25906b17640991b6a9a68a8_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
Size 223KB
Sample260821-dpsa7afn41
SHA256 b868cac1184984811494f8f2c2c73970baeda01c71076555b3e435d9f537b9c3
MD5 30a6dc10e25906b17640991b6a9a68a8
SHA1 ab2b4782681f4c67b1725ea6f6fc099131971b72
SHA512 3953bfb40d3f97f2dff5da543e9ca533bbea28400530491f6d337e7ad379987fef5c095c5e90c85d5ceeac2a0919370ccc69b07762abaa2adf54713acf56cc6e
SSDEEP 3072:dFMS4gx0h0LEyAmQkwpoLqpRY5g2YL+ikQCZf/hsnfen4:JdK9PlfAhcuZHa2n
TLSH
T15B247B107A82C072D2B302710AF8DBB29A7DBDB24F659DCBA7D40B5D0A701D19B35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4872	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_30a6dc10e25906b17640991b6a9a68a8_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3412	2026-08-20_30a6dc10e25906b17640991b6a9a68a8_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
3412	2026-08-20_30a6dc10e25906b17640991b6a9a68a8_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
4872	WMIC.exe
4872	WMIC.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 4872	3412	2026-08-20_30a6dc10e25906b17640991b6a9a68a8_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-20_30a6dc10e25906b17640991b6a9a68a8_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_30a6dc10e25906b17640991b6a9a68a8_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Intel\WMIC.exe
  C:\Intel\WMIC.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WMIC.exe

Path C:\Intel\WMIC.exe
Size 223KB
SHA256 2a3c62348fb9a92da5c0d9e8a48d7ef0f41efae9a01e0d3e906ec22e823d93ce
MD5 795150ea10144cc7dc3ef8ef397c91ac
SHA1 b73ce55f46787c89e9c104d6bfe6935dbe582cc1
SHA512 30f592cf44dc14eac94d56850b44eee6d865919f04c1a78219b415868c8f7e7fa89fb546b826bf310c07cddd23525f69c4b50d2e8a3db9c8103774e4604d3ada
SSDEEP 3072:dFMS4gx0h0LEyAmQkwpoLqpRY5g2YL+ikQCZf/hsnCen4:JdK9PlfAhcuZHaDn
TLSH
T1FE247B107A82C072D2B302710AF8DBB2997DBDB24F669DCBA7D40B5D0A701D19B35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp-0.bin

Path C:\Intel\tmp-0.bin
Size 8KB
SHA256 35cd676cdea38e0b8deba3edf7471a9c54b2a0b10f5456f1d65cf0d850b39d86
MD5 299005f60425a4c8c8b2c7ceb5b882b3
SHA1 ab72d1a6c28410c7bbd12d775692b22292feb0a7
SHA512 313f8d64dfc18fbad0c6099921061c3f5290292f92f8d99a9fadc0b2d2c09a6b509c7aad61430e9e961476d8f0b8282dc450ba3d8c96d777c2566c42996e229d
SSDEEP 3:Xtllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll:U0lld
MD5 SHA1 SHA512 SSDEEP

Submit Download