c630d20fd34d5185deef00fdb0efefdf301c16e418200d48ff5fffa35cdf09dc

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 13:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_5ec363817c942b2e833299d3277ff5b1_elex_manuscrypt_rhadamanthys_silence_stop.exe
Size 399KB
Sample261107-q3ecpsyxcw
SHA256 c630d20fd34d5185deef00fdb0efefdf301c16e418200d48ff5fffa35cdf09dc
MD5 5ec363817c942b2e833299d3277ff5b1
SHA1 cc688ff234baca92ef31d493a0d46e55928ff25d
SHA512 c753970fcf91a0636d59a3834f57bf58779479d39f9336f76423e1c57fdc04b7987777723c97806cff94f0c310025ff28d4cf29724919f3200ec9e5554461431
SSDEEP 12288:VdEq2hPEZiH7Rey0duJyuVWFBu/CDGkebEg9gM:VdE7EZiH1ey0duJyuVWFBu/CDGkebEgX
TLSH
T194948E2BB3850372C29303B2269E9AD3B73EB975137A85D362A8411D1372EE493773D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3024	WinDDK.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WinDDK.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WinDDK.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_5ec363817c942b2e833299d3277ff5b1_elex_manuscrypt_rhadamanthys_silence_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinDDK.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4712	2026-11-07_5ec363817c942b2e833299d3277ff5b1_elex_manuscrypt_rhadamanthys_silence_stop.exe
4712	2026-11-07_5ec363817c942b2e833299d3277ff5b1_elex_manuscrypt_rhadamanthys_silence_stop.exe
3024	WinDDK.exe
3024	WinDDK.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 3024	4712	2026-11-07_5ec363817c942b2e833299d3277ff5b1_elex_manuscrypt_rhadamanthys_silence_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-07_5ec363817c942b2e833299d3277ff5b1_elex_manuscrypt_rhadamanthys_silence_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_5ec363817c942b2e833299d3277ff5b1_elex_manuscrypt_rhadamanthys_silence_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4712
- C:\WinDDK\WinDDK.exe
  C:\WinDDK\WinDDK.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WinDDK.exe

Path C:\WinDDK\WinDDK.exe
Size 399KB
SHA256 81aca414d4b3e2e52a738359509c9d9040a5e7c062fcf3ea453addfd3fd1aa71
MD5 983bd6e8913ac6bb49ff13a37f608323
SHA1 60212de0fa1173be60c50ea9cedbef34a7699bf2
SHA512 df2ba6bc2b538c3badeac1fd33128feb4f12963c8f47281d69cc477083fd5899918d1ca64db53dc8d2497ec3ba2f25689b67a90e898a6d2816ed9c4e5522cea5
SSDEEP 12288:VdEq2hPEZ2H7Rey0duJyuVWFBu/CDGkebEg9gM:VdE7EZ2H1ey0duJyuVWFBu/CDGkebEgX
TLSH
T106948E2BB7810372C29203B2369E9AD3B73EB975137A85D362A8411D1372EE493773D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp-0.bin

Path C:\WinDDK\tmp-0.bin
Size 8KB
SHA256 a4353777cb0ca3d1a576b8fd820d07472fda17e7ce09733174ca0e5843ee2869
MD5 d4a4c8d0d3f12d15e49e00b0ad3bdaa1
SHA1 59a5f8e38a8b35e126091cc59bec4ccfc94d67c3
SHA512 ed9adaa640c26f893cd83eb1372558d596c5655015c9aafde308c24ddca60765e3e35c5549314ab3355469efc28860026d449ec65fef0e0e06e2c98223f45ab2
SSDEEP 3:Xtlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllu:+X
MD5 SHA1 SHA512 SSDEEP

Submit Download