cryptodef | fdb374fe4ecf52bbda7ccd5e11d0f40b74b13d8259d72a89498d25d7b0c8dc1e

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 05:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_43c84f88c21dbd635a7e42cbd98ef6b0_elex_wannacry.exe
Size 36KB
Sample260730-ge8f7sce78
SHA256 fdb374fe4ecf52bbda7ccd5e11d0f40b74b13d8259d72a89498d25d7b0c8dc1e
MD5 43c84f88c21dbd635a7e42cbd98ef6b0
SHA1 b5fab9f48b735fcd027c75bfc3ae9847d6743ec2
SHA512 465cc02932fe854314cae4e98d67c2247830d51643b11eb0a088dc99159c3da8e7471c89d4bffcf4ea49d431c3dcd574605ad34ab2d5358f78704239d278f2bc
SSDEEP 384:5vZBIeR0u7wCOVqheen8YmD+h1dsN8ERwrfMEsRZtMMdygOqpJ7:NHxbwCOVqhe+8Ymcuwrvl0b
TLSH
T156F2DB786AD52972F33BDE758AF241877A747C22B912190F4085B3700C33E76AF69A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cryptodef trojan

Malware Config

Signatures

Family: CryptoDef
CryptoDef is a Windows trojan written in C.
trojan cryptodef

Detects CryptoDef 1 IoCs

resource	yara_rule
behavioral2/files/0x000d000000016ce7-4.dat	family_cryptodef

Executes dropped EXE 1 IoCs

pid	Process
3084	eilgx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_43c84f88c21dbd635a7e42cbd98ef6b0_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eilgx.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 3084	4400	2026-07-30_43c84f88c21dbd635a7e42cbd98ef6b0_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_43c84f88c21dbd635a7e42cbd98ef6b0_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_43c84f88c21dbd635a7e42cbd98ef6b0_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Local\Temp\eilgx.exe
  "C:\Users\Admin\AppData\Local\Temp\eilgx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eilgx.exe

Path C:\Users\Admin\AppData\Local\Temp\eilgx.exe
Size 36KB
SHA256 62cfcad97c73ee1cdfec0aa1edf6ac8bfbb4632036c63ac94f0fb13c6983c9d4
MD5 cc8ca9c8552a842661d9cb1983fcfb91
SHA1 7e88b8f6deb07bb1b1426b6fdaecbd3ea4f412f9
SHA512 ec3e98ffa1eb4a97697642da55d0f6dc576c4a4c1dad9696b8e3c5e16c539183e50806e8edce1da79e0afec6ac07f47097eee4cdec1d0a7f680e3f4797b1864b
SSDEEP 384:5vZBIeR0u7wCOVqheen8YmD+h1dsN8ERwrfMEsRZtMMdygOqpJDh:NHxbwCOVqhe+8Ymcuwrvl0jh
TLSH
T135F2DB786AD52972F37BDE758AF241877A747C22B912190F4085B3700C33E76AF69A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download