4b5ee4842c3086236a9d57d3cfc235dc57aa016bb4892c055fb67ec8fe71b6d2

General

Target
2026-07-19_39ee42f0e05d1da005f916d6c6ccc5d3_cryptolocker_elex.exe
Size 42KB
Sample260719-jca42ahv9x
SHA256 4b5ee4842c3086236a9d57d3cfc235dc57aa016bb4892c055fb67ec8fe71b6d2
MD5 39ee42f0e05d1da005f916d6c6ccc5d3
SHA1 77515addced4423e96ada6287e33a99971493ee6
SHA512 12832f4393959e10dd20c8897a9127039910f57e3190e183a8247ce75c49527c1d154c04a7b0a1b55905f089a8ac48a98357583e1899d9f4268e0360f228f338
SSDEEP 768:btB9g/WItCSsA5dAXwr3BGub4PnPXHSP0:btB9g/xtCSqOxGFPXHSP0
TLSH
T1771373347FE55A72D377CAB545F3E1C2A976BC227906DA1D91CEA3480833B02EC90A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Detection of CryptoLocker Variants 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024683-13.dat	CryptoLocker_rule2
behavioral1/memory/5112-19-0x0000000000400000-0x0000000000408000-memory.dmp	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-07-19_39ee42f0e05d1da005f916d6c6ccc5d3_cryptolocker_elex.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

pid	Process
5112	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_39ee42f0e05d1da005f916d6c6ccc5d3_cryptolocker_elex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gewos.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1	gewos.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c0000000100000004000000001000000f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	gewos.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 5112	3296	2026-07-19_39ee42f0e05d1da005f916d6c6ccc5d3_cryptolocker_elex.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-19_39ee42f0e05d1da005f916d6c6ccc5d3_cryptolocker_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_39ee42f0e05d1da005f916d6c6ccc5d3_cryptolocker_elex.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gewos.exe

Path C:\Users\Admin\AppData\Local\Temp\gewos.exe
Size 42KB
SHA256 b8c6493544976369cc6c06f572fecd9e9ec40a3a7894e77b47a3e4b3aa002882
MD5 04ad0f2feee6d0d575dbe208fdc0ade4
SHA1 9f3874874d34a9ba90871a5b235e1941a56a27a5
SHA512 3198f1ce47d419ed513f290db04e0cdb19ad6f4ad3bbae496b3eeb0a7e40ff54a34cb0d80770126c738cf04a243930f48cd97b5507adaeccdaec22c9be9602f2
SSDEEP 768:btB9g/WItCSsA5dAXwr3BGub4PnPXHSPG:btB9g/xtCSqOxGFPXHSPG
TLSH
T17D1363347FE55A72D377CAB545F3E1C2A975BC227906DA1D91CEA3480833B06EC90A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gewosik.exe

Path C:\Users\Admin\AppData\Local\Temp\gewosik.exe
Size 184B
SHA256 b29b228b67be3d9bff8c35edb9189bb605746f6ad2edd2bbaecd96b06c3ce134
MD5 84be737600248322abef7a31ca2a850b
SHA1 4a32b519c805005cc4249e70b3df63851210e34b
SHA512 b98e92e3804d7ea239ba861bdfbec0c3089ace98df0454250f433b726812896e4ad5249079aafaeff3f764d40e024ab1c3a6b22513c6b677654c43c34dca7e32
TLSH
T1ACC0C0F2A82088A714203B169C81321612136D04EF80CC30D1C538CEC6F0FB20D02901
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3296-0-0x0000000000404000-0x0000000000405000-memory.dmp

Download

memory/3296-1-0x0000000002140000-0x0000000002146000-memory.dmp

Download

memory/3296-2-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3296-3-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/5112-19-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5112-28-0x0000000000400000-0x0000000000408000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads