dfd68c69f9ce3494fd3f0adf51cc21054b6e71e9ccce95005437102256b1bca9

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_a4de8ceb2c51664baf843642e5ba6fcb_coinminer_cryptolocker_elex.exe
Size 26KB
Sample260817-cdsl5s1epa
SHA256 dfd68c69f9ce3494fd3f0adf51cc21054b6e71e9ccce95005437102256b1bca9
MD5 a4de8ceb2c51664baf843642e5ba6fcb
SHA1 28b8deea063daffb1c0757f007cd3f9ece0c5d0b
SHA512 d4bc4aa8ebfe11563e73a2c450e7665f5907029b26ff5278398c208daaa36c8ef632b5a58df19783b76da760d0d9d73b0f4626518a128148cbaf5c61d6984257
SSDEEP 192:gf85bTA1Wm4wtaTJlRGt+1sKYdK8LKUc+BxJ6wfHsoh5O9iuOjAwNpV4c4/m2fcf:gf85/A1U5rRGTxKaFfhU8J/zz47Frm
TLSH
T14BC2E630BBF89D61E377853405F7F690687A7D513E0A961E665AF38C0933B50A8A0F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery spyware trojan upx

Malware Config

Signatures

Detection of CryptoLocker Variants 3 IoCs

resource	yara_rule
behavioral2/memory/1892-0-0x0000000000400000-0x000000000040D000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x001100000001b1a4-13.dat	CryptoLocker_rule2
behavioral2/memory/1376-27-0x0000000000400000-0x000000000040D000-memory.dmp	CryptoLocker_rule2

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/memory/1892-0-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/files/0x001100000001b1a4-13.dat	UPX
behavioral2/memory/1376-27-0x0000000000400000-0x000000000040D000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
1376	gewos.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1892-0-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/files/0x001100000001b1a4-13.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_a4de8ceb2c51664baf843642e5ba6fcb_coinminer_cryptolocker_elex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gewos.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1	gewos.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c0000000100000004000000001000000f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	gewos.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1376	1892	2026-08-17_a4de8ceb2c51664baf843642e5ba6fcb_coinminer_cryptolocker_elex.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_a4de8ceb2c51664baf843642e5ba6fcb_coinminer_cryptolocker_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_a4de8ceb2c51664baf843642e5ba6fcb_coinminer_cryptolocker_elex.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gewos.exe

Path C:\Users\Admin\AppData\Local\Temp\gewos.exe
Size 26KB
SHA256 44618ec95b90ce79e05cd51f1a4d02153eb91157ddaeedfa45219751d81feace
MD5 d8f8ff0c19e7226d4a13e943d054e561
SHA1 2c2a2a151432a37b3bb0ce87543f002a83f93c27
SHA512 6ab414a4c2cd784b4ce9e54858ce9dc04a89dd091721c9ce725b4a950fe8229aa531437b6140848fbb995b04e6656c1f6a66a812f3dce2c4c5e4df9a8cb6affc
SSDEEP 192:gf85bTA1Wm4wtaTJlRGt+1sKYdK8LKUc+BxJ6wfHsoh5O9iuOjAwNpV4c4/m2fcJ:gf85/A1U5rRGTxKaFfhU8J/zz47Fr0
TLSH
T110C2E630BBF89D61E377853405F7F290687A7D513D0A961E669AF38C0933B50A9A0F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gewosik.exe

Path C:\Users\Admin\AppData\Local\Temp\gewosik.exe
Size 183B
SHA256 7d6e8e7a704d442682a75a78bf620db186099bdbfdc84ce73b4063540165760c
MD5 cdff22532a4fc5347e39c3a5f30e0e88
SHA1 1e2407ae52fcd1e45ab258698784f71fd16cbf6f
SHA512 6ad77944f3f16d47ffc5b0102d8be0488138adb20ff8954162c14a732aed315e0742dcc0175ac4a99eb0f7c231ba37effa00503fc812108503f12a453a29aa9a
TLSH
T1C1C0C0F28810886F44213E16CCC1731A2112BD04EE400C30D1C930CCC6F0B324D02500
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1376-21-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/1376-20-0x0000000002160000-0x0000000002166000-memory.dmp

Download

memory/1376-27-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1892-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1892-1-0x0000000002210000-0x0000000002216000-memory.dmp

Download

memory/1892-2-0x0000000002210000-0x0000000002216000-memory.dmp

Download

memory/1892-3-0x0000000000400000-0x0000000000406000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads