45108b0ace36418a5943828f3ed4ff397939025d362e1cff0f28f8fcd9ce19a4

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_85586f58c78c4e7d2a07e4b53ec56087_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
Size 94KB
Sample261102-tjfcfafe99
SHA256 45108b0ace36418a5943828f3ed4ff397939025d362e1cff0f28f8fcd9ce19a4
MD5 85586f58c78c4e7d2a07e4b53ec56087
SHA1 f26ea21591d800aaaebef616b2cd986b2439d876
SHA512 549bf6c4fbfec12a15647ef1ba5edaa98ca46af2841d8e78f8e4e200fd9fd277d40fe004d93367a3ec5c1c29b25697ac442b6636285a6cbd2c1fe5bf9dbfe9a2
SSDEEP 1536:Sdyql1M7wIIEuti7rEYivykYkpaWj0OocG7mJAm/lGb3Lls:SdV1Z1i3QKqjGCJr/lf
TLSH
T1B2939E127AE180F2C48541BC1A9C8F54AB7BBC1445B9D903EB544A8BEFF22D2D73E316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4384	sppsrv.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xpwunp.dat	2026-11-01_85586f58c78c4e7d2a07e4b53ec56087_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
File created	C:\Windows\SysWOW64\sppsrv.exe	2026-11-01_85586f58c78c4e7d2a07e4b53ec56087_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
680	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_85586f58c78c4e7d2a07e4b53ec56087_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sppsrv.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 680	4088	2026-11-01_85586f58c78c4e7d2a07e4b53ec56087_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-11-01_85586f58c78c4e7d2a07e4b53ec56087_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_85586f58c78c4e7d2a07e4b53ec56087_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_del.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:680

C:\Windows\SysWOW64\sppsrv.exe
C:\Windows\SysWOW64\sppsrv.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_del.bat

Path C:\Users\Admin\AppData\Local\Temp\_del.bat
Size 350B
SHA256 6143ccd18b982ef5c04681e036bf94d38d92a0de3c58521d5f2b28a1ea7826b3
MD5 50ca05b7cf467523a8d8833deb384d98
SHA1 a1b4d4f0d4c8e9cfba4c9be107b1a3e6004efe4a
SHA512 93d1ddb4f976096bd07065bcd0ed86e65321f324d9de2f1a30b396a625c9127b4719c3c368b4896c05cc95827905ae640b0ae47fad5f733e0774c834fd5c9d0e
TLSH
T121E0D806414F5D390304D40B05F6B5C981214EE516DB27742221CA4D01D1D6BF4A3A71
MD5 SHA1 SHA512 TLSH

Submit Download

sppsrv.exe

Path C:\Windows\SysWOW64\sppsrv.exe
Size 94KB
SHA256 a859031997101c1b3d649db50a44da2cc72553c0bfe89b50236ee34d99145504
MD5 93c5bc741866cea558e30a2ff2035396
SHA1 3465b80bc500bdb4ee411f70cd7fa899815d57da
SHA512 e20f6509c4bc188b03626ca6274f4771f19e34a9016b2b5dd493ce49e2a95b2b7e2611a3ec000034c0e19e90a9bac015f486df4aba01ee3d66c02948a2c71bda
SSDEEP 1536:Sdyql1M7wIIEuti7rEYivykYkpaWj0OocG7mJAm/lGb3qls:SdV1Z1i3QKqjGCJr/lO
TLSH
T13F939E127AE180F2C48541BC1A9C8F54AB7BBD1445B9D903EB544A8BEFF22D2D73E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xpwunp.dat

Path C:\Windows\SysWOW64\xpwunp.dat
Size 740B
SHA256 30cb1d1754c2faa8e5ae33d5718211a6a906eeef7bb4c8585ef06a27960ab11a
MD5 2475b5067465a28dafbb524376bc7af8
SHA1 6675d28398ab81ac1eae38b2bdc97b1f52aab9d2
SHA512 d31f3dbb74df6609c97bf603a18a7356280bea8a7a09001824ef71c2f87e1aad332692840655c2a1e26e068116eec0fc89ef5c731fe3ceb38030c03defaa01b7
TLSH
T12B01B0002233924CA1A88701E12AA60A62E23334204BC1DD8C2CABF8F32F3C8284B122
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads