cryptodef | c86d1c6536f4befafa7abc534be69fd3b793421bac8459adbf1d3b6e51b839a1

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 21:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_8d7ccdd6397d5bb19bdaa0bc8c78017d_elex_wannacry.exe
Size 34KB
Sample260718-1hfedags9v
SHA256 c86d1c6536f4befafa7abc534be69fd3b793421bac8459adbf1d3b6e51b839a1
MD5 8d7ccdd6397d5bb19bdaa0bc8c78017d
SHA1 9b821897087927e90c1eec0ebd34f57f404eb85f
SHA512 503c11731fe0979b6347a7faea19d39fd99e281a5364642fae9d020ac50842302ad0a1f85e84d54b44129c64a5afd201dacec25807894da215578b540ae1ff76
SSDEEP 384:5vZBIeR0u7wCOVqheen8YmD+h1dsN8ERwrfMEsRZtMMdygOq/:NHxbwCOVqhe+8Ymcuwrvl0/
TLSH
T155F2CC785AC52972F33BDE758AF651877A747C22B912190F4085B3700C33E76AF69A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cryptodef trojan

Malware Config

Signatures

Family: CryptoDef
CryptoDef is a Windows trojan written in C.
trojan cryptodef

Detects CryptoDef 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000001b86d-4.dat	family_cryptodef

Executes dropped EXE 1 IoCs

pid	Process
5064	eilgx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_8d7ccdd6397d5bb19bdaa0bc8c78017d_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eilgx.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 5064	548	2026-07-18_8d7ccdd6397d5bb19bdaa0bc8c78017d_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_8d7ccdd6397d5bb19bdaa0bc8c78017d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_8d7ccdd6397d5bb19bdaa0bc8c78017d_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548
- C:\Users\Admin\AppData\Local\Temp\eilgx.exe
  "C:\Users\Admin\AppData\Local\Temp\eilgx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eilgx.exe

Path C:\Users\Admin\AppData\Local\Temp\eilgx.exe
Size 34KB
SHA256 2e29edeea23b51e03390bd72306c34553a291bbebe17942034bc3fea23f5d740
MD5 839b41e839446d9d1e58928c8589870f
SHA1 c465683bebf47c4559e1857ab5a4a099ea78f667
SHA512 8cedd21820e299da439caf7f28bd66fc99ddcdce07c8e8777d7ef4a95c5ffcb9fd21980974f62fc4eafd5c26dd96c8549b1ed43ffd03a0d973520fbdcdcc9fb6
SSDEEP 384:5vZBIeR0u7wCOVqheen8YmD+h1dsN8ERwrfMEsRZtMMdygOqAy:NHxbwCOVqhe+8Ymcuwrvl0Ay
TLSH
T1E3F2CC789AC52972F33BDE758AF651877A747C22B912190F4085B3700C33E76AF69A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download