cb3742ca211aa29800654982aae3458d7c3bf57ceee7a61d039c62140c3dfd5e

Analysis

max time kernel
148s
max time network
9s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_6871ee877e95a92b0c25d0594b711f44_elex_manuscrypt_rhadamanthys_silence_stop.exe
Size 256KB
Sample261017-s2vdmsht6q
SHA256 cb3742ca211aa29800654982aae3458d7c3bf57ceee7a61d039c62140c3dfd5e
MD5 6871ee877e95a92b0c25d0594b711f44
SHA1 9c9cf0f24831aed7ac1d71dd308e0beb77d51434
SHA512 b77f5b0a580e931f04cb6d8b9aa9bf2f96d4a83397b12d6594d10578762d61f5be2834ef056fba9133e9cba891f7a20811cb41a127ab9c19410bd95675b7564a
SSDEEP 3072:EfbA7uidA7AyemWvik8STpUpbQ47+CcfIyZ+cjDtHKaGKRejorRVKWI1uaaMRc8:Vdw3Wi2T2tPPEZzhHPzRej6z0u2u8
TLSH
T1F0449D217A818272C2A3027116F8DBB3A63EBD324B7599CBB3D80B5D1770AD19735793
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3600	WinDDK.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WinDDK.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WinDDK.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_6871ee877e95a92b0c25d0594b711f44_elex_manuscrypt_rhadamanthys_silence_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinDDK.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5624	2026-10-16_6871ee877e95a92b0c25d0594b711f44_elex_manuscrypt_rhadamanthys_silence_stop.exe
5624	2026-10-16_6871ee877e95a92b0c25d0594b711f44_elex_manuscrypt_rhadamanthys_silence_stop.exe
3600	WinDDK.exe
3600	WinDDK.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5624 wrote to memory of 3600	5624	2026-10-16_6871ee877e95a92b0c25d0594b711f44_elex_manuscrypt_rhadamanthys_silence_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-16_6871ee877e95a92b0c25d0594b711f44_elex_manuscrypt_rhadamanthys_silence_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_6871ee877e95a92b0c25d0594b711f44_elex_manuscrypt_rhadamanthys_silence_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5624
- C:\WinDDK\WinDDK.exe
  C:\WinDDK\WinDDK.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WinDDK.exe

Path C:\WinDDK\WinDDK.exe
Size 256KB
SHA256 e9cdfc40412e9b9929a9dec7bdc1d0e8220f72699e68dcf36b98d0a3bdce6c69
MD5 fe28902e70e1c5a7d02a84e3286b15cd
SHA1 abec5831fcb76002397e394e7d848314bbd57d5b
SHA512 089eee6f21923d783bf394f0a78fdad7a2cb2b55ded00f65b332d5c3d7c64520ad73dc4ad444edfbb9011fbb19c6a1ede3e210baed6fcd1f9df24f166f95ddfd
SSDEEP 3072:EfbA7uidA7AyemWvik8STpUpbQ47+CcfIyZ+cjwtHKaGKRejorRVKWI1uaaMRc8:Vdw3Wi2T2tPPEZz4HPzRej6z0u2u8
TLSH
T127449D217A818272C2A3027116F8DBB3A63EBD324B7599CBB3D80B5D1770AD19735793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp-0.bin

Path C:\WinDDK\tmp-0.bin
Size 8KB
SHA256 a4353777cb0ca3d1a576b8fd820d07472fda17e7ce09733174ca0e5843ee2869
MD5 d4a4c8d0d3f12d15e49e00b0ad3bdaa1
SHA1 59a5f8e38a8b35e126091cc59bec4ccfc94d67c3
SHA512 ed9adaa640c26f893cd83eb1372558d596c5655015c9aafde308c24ddca60765e3e35c5549314ab3355469efc28860026d449ec65fef0e0e06e2c98223f45ab2
SSDEEP 3:Xtlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllu:+X
MD5 SHA1 SHA512 SSDEEP

Submit Download