ef555634e3c3274e52b9fb9310e3c46fbfac0fb6b90665ee923db39cd99eb14c

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_ace96881ec9069a73d652406efac4254_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260825-e3v5nswhjb
SHA256 ef555634e3c3274e52b9fb9310e3c46fbfac0fb6b90665ee923db39cd99eb14c
MD5 ace96881ec9069a73d652406efac4254
SHA1 8614937d0f5eced648c9a6988666fea53115cdea
SHA512 21886f63cd2b830eb0fed72f15c4072d57d9b99998a636fb47ae6f944249b37ba3681db691fc1fecfa8711d328928092b209c86d60c7cda457f8e0d2021d054a
SSDEEP 12288:AnbcDw018uDR6YdH5RvgtkYtbGjkY9N/2mdj0KJLZmX1:AnD8PL5Rvgtk2tos0LZmX1
TLSH
T12AE40142F9C040B4D0E56E768CB99A010A7ABE5344F9F95B62C87B023D73C51D729EBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4904	9C75.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_ace96881ec9069a73d652406efac4254_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9C75.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5860 wrote to memory of 4904	5860	2026-08-24_ace96881ec9069a73d652406efac4254_elex_karagany_manuscrypt_rhadamanthys_stop.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-24_ace96881ec9069a73d652406efac4254_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_ace96881ec9069a73d652406efac4254_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Users\Admin\AppData\Local\Temp\9C75.tmp
  "C:\Users\Admin\AppData\Local\Temp\9C75.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9C75.tmp

Path C:\Users\Admin\AppData\Local\Temp\9C75.tmp
Size 702KB
SHA256 e7a7c4330eb5d25131b84d77676e0b50b4b72cfd9d0ff25765ab59c8f0ae72d8
MD5 15f2f9dd253501084a8999dbd52341c3
SHA1 1ccbafb6718cbeb130daf0b6f1f67d9aa05310ff
SHA512 cc664bc42b039faf52d50cb8ac576321d17d14b7df84495f7fdfc3f3845b7ac896c3154a942142725289269339aebefd603a7c32d6a5c85a03b0de6aa85cea13
SSDEEP 12288:AnbcDwO520YFSSxsoIYqZh26F0JT+qOBVpIUobOdrKJLZmX1:AnDC20YFTUGJ+BjIUALLZmX1
TLSH
T1F5E40142FDC040B4D4E169368CB996110AB6FE5784E1FD9B22C87B043973C51DB36BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download