fc895c55c20c828962f82323a8e0ab81e34ddab5834f08d3a7bed4b2835d517c

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_5a3f8b58959db57d4192fc88a538eaa9_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample261024-pe287abx2k
SHA256 fc895c55c20c828962f82323a8e0ab81e34ddab5834f08d3a7bed4b2835d517c
MD5 5a3f8b58959db57d4192fc88a538eaa9
SHA1 f74994d8c90cdae71e36f8af657d3f39658a72da
SHA512 f841fa36817d9c83c279fc0b0567dc964e124b36fa6220ff0efb7b4fd4bfa5555fcfdd4973fd8820eedf8343be8c26ea8b2c0b7d133ac17eeb8cbad5f80a1fb8
SSDEEP 12288:AnbcDwBt2/R38za9l9NlLSDlW2STIE2MeoN7tzLnEm2jltjKJLZmX1:AnDBemzarhdTfnNxfEmk/WLZmX1
TLSH
T1B3E40141F9C080B0D5E269368CB959010ABBFEA780E5E95B66C83B063873D519735FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1680	A9F2.tmp

Executes dropped EXE 1 IoCs

pid	Process
1680	A9F2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_5a3f8b58959db57d4192fc88a538eaa9_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A9F2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 1680	4460	2026-10-22_5a3f8b58959db57d4192fc88a538eaa9_elex_karagany_manuscrypt_rhadamanthys_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-22_5a3f8b58959db57d4192fc88a538eaa9_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_5a3f8b58959db57d4192fc88a538eaa9_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Users\Admin\AppData\Local\Temp\A9F2.tmp
  "C:\Users\Admin\AppData\Local\Temp\A9F2.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A9F2.tmp

Path C:\Users\Admin\AppData\Local\Temp\A9F2.tmp
Size 702KB
SHA256 b2bcb3eb835c24ce3f94e50eac4a618d848f3e707512e28db1e7d9369f6f5038
MD5 2ec6d8bafecfedf674ad14b466588f1b
SHA1 33fe89709e5af437acee9c2ebaf49e67f509eda8
SHA512 80fc9e78a334818f6191ab3dad5d32bea37afa959d4ed0d9ed0431be220f9acbf77c7ac6bf26db7fdf42c7b8df4b47057c88b2eddb36489bc03b2bc882028de0
SSDEEP 12288:AnbcDwwr/o2sQZRq+bkQr0/T+e6G7g5x7l798vvfP8/2lzKJLZmX1:AnDwdsQZbr07BMhl0vfPUimLZmX1
TLSH
T190E4F141F88080B5D4E67D364CB98A010ABBFE5795E4EE4772C83B453873D51DB28AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download