cryptodef | c8ab3b0c4e1aeae64edd7efdbf6a64f336a5378fac2f3528a0cad37b12ef62f7

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_5415ae9b41c7135a28547713abaa71a0_elex_wannacry.exe
Size 54KB
Sample260718-ne2f8acz2x
SHA256 c8ab3b0c4e1aeae64edd7efdbf6a64f336a5378fac2f3528a0cad37b12ef62f7
MD5 5415ae9b41c7135a28547713abaa71a0
SHA1 5dbfb58b036caf303be146d6704d322f689175dd
SHA512 b150be6059293c526a4a872b3e122c003ac232b9ea8f8f7465f921604b993b7247aff5ab204531bad5b0c9f3da918012bb170d35e6016c4a03796c3daa3c19b0
SSDEEP 768:NHxbwCOVqhe+8YmcuwrvGBETGxtJH7jAKtzkyCzkKiWmpfrT:fETVqhp8AvGBFswzLKiWmB
TLSH
T1F9434438AED51572F37BDE758AF651C7AA747C227902280F4086B3540C33F76AEA5A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cryptodef trojan

Malware Config

Signatures

Family: CryptoDef
CryptoDef is a Windows trojan written in C.
trojan cryptodef

Detects CryptoDef 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000016b3a-4.dat	family_cryptodef

Executes dropped EXE 1 IoCs

pid	Process
4560	eilgx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_5415ae9b41c7135a28547713abaa71a0_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eilgx.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 4560	1824	2026-07-18_5415ae9b41c7135a28547713abaa71a0_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_5415ae9b41c7135a28547713abaa71a0_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_5415ae9b41c7135a28547713abaa71a0_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Local\Temp\eilgx.exe
  "C:\Users\Admin\AppData\Local\Temp\eilgx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eilgx.exe

Path C:\Users\Admin\AppData\Local\Temp\eilgx.exe
Size 54KB
SHA256 8ae65936dc5b08c5c19480733d6c1b0aaa4b8e1690eca74d75f8368440681f27
MD5 0095b5797ab8b543f240d1517b1a9de0
SHA1 49b3c57d6e03635261393804c6924ea44f78e361
SHA512 ccc0694201c62863dbfde6b27f021da32a2ebbcc1dc884a9467856146607f98a464b25236f73cb3902faaa541598eac12da28e5b9952d5db9f1ddd57902ccad4
SSDEEP 768:NHxbwCOVqhe+8YmcuwrvGBETGxtJH7jAKtzkyCzkKiWmpfrd:fETVqhp8AvGBFswzLKiWmP
TLSH
T1BB434438AED51572F37BDE758AF651C7AA747C227902280F4086B3540C33F76AEA5A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download