1351332f4de5d1f83502a45ac335821ab4d3342c139c3a4086fe2dab3a625215

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_667b33775cf2da314354d269f921e670_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
Size 223KB
Sample260903-mrrbcafm6s
SHA256 1351332f4de5d1f83502a45ac335821ab4d3342c139c3a4086fe2dab3a625215
MD5 667b33775cf2da314354d269f921e670
SHA1 e6a3b07fa85b56d19ac10f72e44133c3001469f2
SHA512 bc449795992c25c8f8dcec9b7857aeea8f9bd2f5a4bf1d905dc4321ff169707f9a2c3ac00f228414fe5ffae9d842c1b8add92a0ef3d57d34d9c63c4bfc36c619
SSDEEP 3072:dFMS4gx0h0LEyAmQkwpoLqpRY5g2YL+ikQCZf/hsnaen4:JdK9PlfAhcuZHa7n
TLSH
T1FE247B107A82C072D2B302710AF8DBB6997DBDB24F669DCBA7D40B5D0A701C19B35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2880	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_667b33775cf2da314354d269f921e670_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4412	2026-09-01_667b33775cf2da314354d269f921e670_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
4412	2026-09-01_667b33775cf2da314354d269f921e670_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
2880	WMIC.exe
2880	WMIC.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 2880	4412	2026-09-01_667b33775cf2da314354d269f921e670_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-01_667b33775cf2da314354d269f921e670_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_667b33775cf2da314354d269f921e670_elex_manuscrypt_rhadamanthys_silence_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Intel\WMIC.exe
  C:\Intel\WMIC.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WMIC.exe

Path C:\Intel\WMIC.exe
Size 223KB
SHA256 62585eab4f7719c85a32fe2b062781ecea2e8e9e740614bbbde3bc626d2ad77b
MD5 f003de430b6a389267ec981eb47145e1
SHA1 65a785809973dcf1c08878079a1ec26e2f430e69
SHA512 f3f94cdb29d3fb770761fb41b558164407adc129bae2bea14c8b0aaa03c08d1b438af04251ca7f192415760931901d950091870d98e8f3286372776b5e03b0c4
SSDEEP 3072:dFMS4gx0h0LEyAmQkwpoLqpRY5g2YL+ikQCZf/hsnEen4:JdK9PlfAhcuZHahn
TLSH
T1F2247B107A82C072D2B302710AF8DBB6997DBDB24F669DCBA7D40B5D0A701C19B35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp-0.bin

Path C:\Intel\tmp-0.bin
Size 8KB
SHA256 a750545b2fe0454bd2223796acbfae783b6e0f0e0cbf9e3556a3223c088c9534
MD5 fecb5aa1f2928e0275c3c9679e7cab8f
SHA1 e12a2e6d8e0510f1340526679c009c33e9f57700
SHA512 180f01634912bc03626c413ad187501be82efcdb1d2d73f18897c3fe3874c0f11b3dd5fc3a7e7c3d0c9ea0a95d2c68b8404e7584ce57d3a7e239fcc4cc7b91eb
SSDEEP 3:Xtllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllld:U0llo3M
TLSH
T1D2020443D3371154F431D11C431CDD0F701DC41D4531C4105D74005300F044400D0000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp-0.bin

Path C:\Intel\tmp-0.bin
Size 8KB
SHA256 35cd676cdea38e0b8deba3edf7471a9c54b2a0b10f5456f1d65cf0d850b39d86
MD5 299005f60425a4c8c8b2c7ceb5b882b3
SHA1 ab72d1a6c28410c7bbd12d775692b22292feb0a7
SHA512 313f8d64dfc18fbad0c6099921061c3f5290292f92f8d99a9fadc0b2d2c09a6b509c7aad61430e9e961476d8f0b8282dc450ba3d8c96d777c2566c42996e229d
SSDEEP 3:Xtllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll:U0lld
MD5 SHA1 SHA512 SSDEEP

Submit Download