975efdee3563a9a843532c889bbaef469f78b82080d73010f52bd2499a065584

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_974a02a97d7cb567738efe07ca99d951_amadey_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 1.3MB
Sample260824-e6zbhacp5x
SHA256 975efdee3563a9a843532c889bbaef469f78b82080d73010f52bd2499a065584
MD5 974a02a97d7cb567738efe07ca99d951
SHA1 ac0ded224d9cfc794edd55984656672c9d0b66fa
SHA512 41d2d1b01e01a5f7b98df5100efbee3ca5879c5caf89b6b0be3aea39ede53baa2414f882aa3751a1915d668a810fbcbad82fd33c93d216d17621160c2e9f4efb
SSDEEP 12288:gBB6q1pEZxlyo6ejC+SMbCIN8IWkImNq:wBvpEzlFGZINnBNq
TLSH
T1875531C99D143899F05E60B2A1CB54EDE8C22F2D22A20B8162DC71F5A571BD3B3DC7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5672	4864	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_974a02a97d7cb567738efe07ca99d951_amadey_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-23_974a02a97d7cb567738efe07ca99d951_amadey_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_974a02a97d7cb567738efe07ca99d951_amadey_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 288
  2⤵
  - Program crash
  PID:5672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4864 -ip 4864
1⤵
PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4864-2-0x0000000005460000-0x0000000005560000-memory.dmp

Download

memory/4864-3-0x00000000057F0000-0x000000000585B000-memory.dmp

Download

memory/4864-0-0x0000000000400000-0x00000000051B6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads