45108b0ace36418a5943828f3ed4ff397939025d362e1cff0f28f8fcd9ce19a4

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_85586f58c78c4e7d2a07e4b53ec56087_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
Size 94KB
Sample261102-tjfcfafe99
SHA256 45108b0ace36418a5943828f3ed4ff397939025d362e1cff0f28f8fcd9ce19a4
MD5 85586f58c78c4e7d2a07e4b53ec56087
SHA1 f26ea21591d800aaaebef616b2cd986b2439d876
SHA512 549bf6c4fbfec12a15647ef1ba5edaa98ca46af2841d8e78f8e4e200fd9fd277d40fe004d93367a3ec5c1c29b25697ac442b6636285a6cbd2c1fe5bf9dbfe9a2
SSDEEP 1536:Sdyql1M7wIIEuti7rEYivykYkpaWj0OocG7mJAm/lGb3Lls:SdV1Z1i3QKqjGCJr/lf
TLSH
T1B2939E127AE180F2C48541BC1A9C8F54AB7BBC1445B9D903EB544A8BEFF22D2D73E316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3924	sppsrv.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xpwunp.dat	2026-11-01_85586f58c78c4e7d2a07e4b53ec56087_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
File created	C:\Windows\SysWOW64\sppsrv.exe	2026-11-01_85586f58c78c4e7d2a07e4b53ec56087_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2568	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_85586f58c78c4e7d2a07e4b53ec56087_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sppsrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 2568	5960	2026-11-01_85586f58c78c4e7d2a07e4b53ec56087_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-11-01_85586f58c78c4e7d2a07e4b53ec56087_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_85586f58c78c4e7d2a07e4b53ec56087_amadey_elex_manuscrypt_rhadamanthys_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_del.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2568

C:\Windows\SysWOW64\sppsrv.exe
C:\Windows\SysWOW64\sppsrv.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_del.bat

Path C:\Users\Admin\AppData\Local\Temp\_del.bat
Size 350B
SHA256 6143ccd18b982ef5c04681e036bf94d38d92a0de3c58521d5f2b28a1ea7826b3
MD5 50ca05b7cf467523a8d8833deb384d98
SHA1 a1b4d4f0d4c8e9cfba4c9be107b1a3e6004efe4a
SHA512 93d1ddb4f976096bd07065bcd0ed86e65321f324d9de2f1a30b396a625c9127b4719c3c368b4896c05cc95827905ae640b0ae47fad5f733e0774c834fd5c9d0e
TLSH
T121E0D806414F5D390304D40B05F6B5C981214EE516DB27742221CA4D01D1D6BF4A3A71
MD5 SHA1 SHA512 TLSH

Submit Download

sppsrv.exe

Path C:\Windows\SysWOW64\sppsrv.exe
Size 94KB
SHA256 dd289a54067b02e833fb913b4a85c23306eb817e66bf86884a3f37107ec3a386
MD5 f69a4c9ed014a93168a293cba83e8230
SHA1 41fb13ff5bd0ce1f717e7bad1c973d816e7262e3
SHA512 0e544a9c71a15278d95dc96c483d2d40a6ce4a75fe671358c1a0470130a16b8dddc7a0263904739c22391539776c0a8281cba46696e0ba8d53f57195bf1af5c7
SSDEEP 1536:Sdyql1M7wIIEuti7rEYivykYkpaWj0OocG7mJAm/lGb31ls:SdV1Z1i3QKqjGCJr/lp
TLSH
T14F939E127AE180F2C48541BC1A9C8F54AB7BBD1445B9D903EB544A8BEFF22D2D73E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xpwunp.dat

Path C:\Windows\SysWOW64\xpwunp.dat
Size 740B
SHA256 cd95333c4ee5d0f021ab201d6333e82d5bdc6b7fb7e822a2331dc90f515b887f
MD5 43a936ca642ba08f4220b6ece18e3667
SHA1 c96ff3401f482e42fbd9fe8e330253cf42462d1c
SHA512 720fdfd8af07bd5032101296ad70f63fc9aa7879835bb81ea5dc375ba93a8aa0c1d9872f3ba3ba502bdf64de1aab460cccc4c8e8485438e6985d3cae3beea2b0
TLSH
T1960165FC35993CA530BD26791DB438654246087F261528F9BDD845F81FF15199A09C73
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads