cryptodef | e51c4cf640be8a9f7980405d4bd47c0d3f67408e4c88eea82da81ece88e0e5df

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_5e088e2123f0d7a884dcc2b96af8f2fd_elex_wannacry.exe
Size 55KB
Sample260805-a8cs3avdjd
SHA256 e51c4cf640be8a9f7980405d4bd47c0d3f67408e4c88eea82da81ece88e0e5df
MD5 5e088e2123f0d7a884dcc2b96af8f2fd
SHA1 2fee2212208e0a8d3600d435e5b97cb40790d1f2
SHA512 0d0f64821bd11d495493d4bf85d941c5eed0cda9b0be41dceb83cc30100499a879be8a7f5dc8bae816ec316828018f3431d5af8d8b9eb671461f21ddaf57ab1b
SSDEEP 768:NHxbwCOVqhe+8YmcuwrvGBETGxtJH7jAKtzkyCzkKiWmpfrjvL:fETVqhp8AvGBFswzLKiWmJvL
TLSH
T174433338AED51572F37BDE758AF651C7AA747C227902290F4086B3500C33F76AEA5A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cryptodef trojan

Malware Config

Signatures

Family: CryptoDef
CryptoDef is a Windows trojan written in C.
trojan cryptodef

Detects CryptoDef 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001b85c-4.dat	family_cryptodef

Executes dropped EXE 1 IoCs

pid	Process
4124	eilgx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_5e088e2123f0d7a884dcc2b96af8f2fd_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eilgx.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 4124	3804	2026-08-04_5e088e2123f0d7a884dcc2b96af8f2fd_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_5e088e2123f0d7a884dcc2b96af8f2fd_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_5e088e2123f0d7a884dcc2b96af8f2fd_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Users\Admin\AppData\Local\Temp\eilgx.exe
  "C:\Users\Admin\AppData\Local\Temp\eilgx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eilgx.exe

Path C:\Users\Admin\AppData\Local\Temp\eilgx.exe
Size 55KB
SHA256 30926a2709c50f15b05a8003fd1079aa9bb4f911c1fbfb3723bfa2601723196b
MD5 2fd25f3b9dc0399c895fe39a0ca6fdb5
SHA1 123a3dd5c4704480b0ff2b476438de1e2be8d151
SHA512 4ee6baeb8f87d8de3c785d26718c55e707aa0097f27573c950981070657635eebabd619790385f7f0ea789fa2d7ede7b82c4e7a7d79cb3184bc8b61ca9120a78
SSDEEP 768:NHxbwCOVqhe+8YmcuwrvGBETGxtJH7jAKtzkyCzkKiWmpfrjvA:fETVqhp8AvGBFswzLKiWmJvA
TLSH
T151433238AED51572F37BDE758AF651C7AA747C227902290F4086B3500C33F76AEA5A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download