cryptodef | fffdb7b54cb80dca8512b02ed99644937e2c9f511fb7680ae2da13b0cda50e6e

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_94eac05c408ae4a7c3fc7a56d70b2841_elex_wannacry.exe
Size 35KB
Sample260722-s2mnsst1ev
SHA256 fffdb7b54cb80dca8512b02ed99644937e2c9f511fb7680ae2da13b0cda50e6e
MD5 94eac05c408ae4a7c3fc7a56d70b2841
SHA1 41ef54f58e6c88023a27a1bfe9d24eb808e6ff12
SHA512 6f3fa09659a990726659b0f9d0f90b80d517390c08a319555a4cfe086dc3c6d5bbbf2513ec363c587ddd0400cf3a5720d17771f43e0e27b77413a3510d50259d
SSDEEP 384:5vZBIeR0u7wCOVqheen8YmD+h1dsN8ERwrfMEsRZtMMdygOqpR:NHxbwCOVqhe+8Ymcuwrvl0v
TLSH
T1D3F2DC786AD52972F33BDE758AF641877A747C22B912190F4085B3700C33E76AF69A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cryptodef trojan

Malware Config

Signatures

Family: CryptoDef
CryptoDef is a Windows trojan written in C.
trojan cryptodef

Detects CryptoDef 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5aa-4.dat	family_cryptodef

Executes dropped EXE 1 IoCs

pid	Process
5260	eilgx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_94eac05c408ae4a7c3fc7a56d70b2841_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eilgx.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5344 wrote to memory of 5260	5344	2026-07-22_94eac05c408ae4a7c3fc7a56d70b2841_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-22_94eac05c408ae4a7c3fc7a56d70b2841_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_94eac05c408ae4a7c3fc7a56d70b2841_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5344
- C:\Users\Admin\AppData\Local\Temp\eilgx.exe
  "C:\Users\Admin\AppData\Local\Temp\eilgx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eilgx.exe

Path C:\Users\Admin\AppData\Local\Temp\eilgx.exe
Size 35KB
SHA256 1bc93a58f9382144df29459b3d1e7a437c95bd5e40488f6fa992c6c533d9f3c9
MD5 bcd890bec1621a487ff9a8fc1db0acca
SHA1 5ba5690253d6f6ad4009ccf08b2a559f28245266
SHA512 ae2481abc442bb8acdb673f16d1605c2a9b8e925f7f65284ccff034f6c365e47bce87eec9357b5d843018d7391e6441472a04b5508fa9955b0a67cd882a51076
SSDEEP 384:5vZBIeR0u7wCOVqheen8YmD+h1dsN8ERwrfMEsRZtMMdygOqpM:NHxbwCOVqhe+8Ymcuwrvl0O
TLSH
T14EF2DB786AD52972F33BDE758AF641877A747C22B912190F4085B3700C33E76AF69A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download