b2aa68bd3cd74679908b1b1bd6748f0b1a8de4809f2587031cd553558f35b44c

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_2fde0b0d29a106076cf295107ebe1bd3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample261024-v8j8csbt4y
SHA256 b2aa68bd3cd74679908b1b1bd6748f0b1a8de4809f2587031cd553558f35b44c
MD5 2fde0b0d29a106076cf295107ebe1bd3
SHA1 e8747c8de2a52a97f218abe16d383e7bd51966d3
SHA512 441745442b14f6f0d25aea9ea99fe469851d875aa81837c40faf6f453ae70d96967640583647cc9b4d0c3e906311da40ed5bd56c8becb0105dcba7b4d21fbcbb
SSDEEP 12288:AnbcDwj3JZDvN9z6Tf8uDFbKlRvHi4e2Y9hi96L8mgKJLZmX1:AnDj3zvNRSrElZ9eLOYL8ELZmX1
TLSH
T139E4F142FDC041B5D1E56E324CB856110A7AFD9382E5EE9736C837027C33D91A739AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5584	F901.tmp

Executes dropped EXE 1 IoCs

pid	Process
5584	F901.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_2fde0b0d29a106076cf295107ebe1bd3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F901.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 5584	1128	2026-10-22_2fde0b0d29a106076cf295107ebe1bd3_elex_karagany_manuscrypt_rhadamanthys_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-22_2fde0b0d29a106076cf295107ebe1bd3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_2fde0b0d29a106076cf295107ebe1bd3_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\AppData\Local\Temp\F901.tmp
  "C:\Users\Admin\AppData\Local\Temp\F901.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F901.tmp

Path C:\Users\Admin\AppData\Local\Temp\F901.tmp
Size 702KB
SHA256 200ae0392ae08faf9c386d7b8bf6bcd00557ef8e3d1afdc4d97096d9ca59442b
MD5 1827f165188db2ea6913bb14c16fbc36
SHA1 4ba2181045b8bf394c4e3037f13b65e4cf756527
SHA512 55c9a884a47332614ecd36680155e1638eca7efab33347667180cff9ee2c328383737533d9095c6cc6e06463c55cc6cfb059d01c54b5d4f42431a217bd333046
SSDEEP 12288:AnbcDweEbEgmxtV1TDz57lKNzImMvQ+BJGQpCJTKJLZmX1:AnDeEbNmxtV1TtlKN8FtBWJGLZmX1
TLSH
T153E40242F9C080B1D4E269368CB995110A7AFE6781E5ED4762C837063933D91DB39EFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download