cryptodef | 5b52cbc5dfd71fb54b8110876b9f33323fbe464be0fcee67d2b5cc25a909af1f

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_fb704c4a4ca6def65b5a39720609b0aa_elex_wannacry.exe
Size 54KB
Sample260821-klbbtswfma
SHA256 5b52cbc5dfd71fb54b8110876b9f33323fbe464be0fcee67d2b5cc25a909af1f
MD5 fb704c4a4ca6def65b5a39720609b0aa
SHA1 5c544df4611f0e80579c8111981d74212c59b221
SHA512 fab59916a3a67d89e4203fcf6ef015d407882e82b615335d3014a6d82d86d934ed3cdb91294ed9e350c6d5de327d36234d2fda88c8219a19451a31ba58d83247
SSDEEP 768:NHxbwCOVqhe+8YmcuwrvGBETGxtJH7jAKtzkyCzkKiWmp3VM8d:fETVqhp8AvGBFswzLKiWmpf
TLSH
T137432138AED51572F37BDE758AF651C7AA747C227902280F4086B3540C33F76AEA5A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cryptodef trojan

Malware Config

Signatures

Family: CryptoDef
CryptoDef is a Windows trojan written in C.
trojan cryptodef

Detects CryptoDef 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000001b83c-4.dat	family_cryptodef

Executes dropped EXE 1 IoCs

pid	Process
4068	eilgx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_fb704c4a4ca6def65b5a39720609b0aa_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eilgx.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 4068	3788	2026-08-21_fb704c4a4ca6def65b5a39720609b0aa_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-21_fb704c4a4ca6def65b5a39720609b0aa_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_fb704c4a4ca6def65b5a39720609b0aa_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Users\Admin\AppData\Local\Temp\eilgx.exe
  "C:\Users\Admin\AppData\Local\Temp\eilgx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eilgx.exe

Path C:\Users\Admin\AppData\Local\Temp\eilgx.exe
Size 54KB
SHA256 a12696ebe2d1e59f336e8972eb039d52f737596e39b1340154aaa78c5c03967a
MD5 80bfe3b95155086049c376be6fd2abe5
SHA1 d5b8c1d401afd8f70a51a4f8a1ade01c4c7ee45a
SHA512 e7ce46743c43c0a4f42c33cb234e478d9cf82f1f40d820e1ea491fc600a3c39a75f5ba56db6c0a1d4bce6d942e99c13e88116936491bcee6e6a29cfca5302d43
SSDEEP 768:NHxbwCOVqhe+8YmcuwrvGBETGxtJH7jAKtzkyCzkKiWmp3VM8f:fETVqhp8AvGBFswzLKiWmpd
TLSH
T1A0432138AED51572F37BDE758AF651C7AA747C227902280F4086B3540C33F76AEA5A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download