888f41d8bf91fde349b7bac36efacc09618163fd16c858917ee8b40f46d08a8b

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_efe87093e388b8f7a4ef763fcc2e950d_cryptolocker_elex.exe
Size 36KB
Sample261102-xc563acv9w
SHA256 888f41d8bf91fde349b7bac36efacc09618163fd16c858917ee8b40f46d08a8b
MD5 efe87093e388b8f7a4ef763fcc2e950d
SHA1 60ffe92529941724a3958d00574fc93efbb132b0
SHA512 d4776ed9024154d846c09373be5a5c65663962857d38a9740bf6e08b45273c9d25263b84bc7e81670c4f926521fdd67e9de9916af52d2c6b11fde75ddfd41de7
SSDEEP 384:btBYQg/WIEhUCSNyepEjYnDOAlzVoGp6C0/zzodV7tkq4l8tFFxE2BodcAOjb82Y:btB9g/WItCSsA5dAXwr3BGub4PnPX
TLSH
T158F2A5347FE55E62D337C5B544F3E1C2AA66BD2279168A1EA2CFB3490933B02EC5091D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Custom signature

Detection of CryptoLocker Variants 2 IoCs

resource	yara_rule
behavioral2/files/0x000900000001af5f-12.dat	CryptoLocker_rule2
behavioral2/memory/1588-20-0x0000000000400000-0x0000000000408000-memory.dmp	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1588	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	gewos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	gewos.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_efe87093e388b8f7a4ef763fcc2e950d_cryptolocker_elex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gewos.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5392 wrote to memory of 1588	5392	2026-11-02_efe87093e388b8f7a4ef763fcc2e950d_cryptolocker_elex.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-02_efe87093e388b8f7a4ef763fcc2e950d_cryptolocker_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_efe87093e388b8f7a4ef763fcc2e950d_cryptolocker_elex.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gewos.exe

Path C:\Users\Admin\AppData\Local\Temp\gewos.exe
Size 36KB
SHA256 9092982b55dc5d90d94c4348a0aec12040f44cf3a7db7a8bd84824eb4b4f3837
MD5 3b54efa75ec503ccd9f3b2f5d62b0f16
SHA1 98bf3ae69ac09f13eace8b3f9280edc5d8992281
SHA512 dad21c44009f6f853d921af39414effb111f9bc08057685aba779439d142faae93205005b24ab8f465a5966f59a011f7e76992de5069130f696a57ec1c4451cf
SSDEEP 384:btBYQg/WIEhUCSNyepEjYnDOAlzVoGp6C0/zzodV7tkq4l8tFFxE2BodcAOjb82D:btB9g/WItCSsA5dAXwr3BGub4PnP0
TLSH
T1E203A5347FE55E62D337C5B544F3E1C2AA66BD2279168A1E92CFB3490933B02EC50A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gewosik.exe

Path C:\Users\Admin\AppData\Local\Temp\gewosik.exe
Size 183B
SHA256 1badc5a9b2a415e3eac420a3b02eb10cfdf8dc740be46a67352d13db9ff85022
MD5 70f9d2306f8788f1cfe906c8ee80500c
SHA1 41f40d517aa21599b3f92dfa10fd1aeabdcb74ea
SHA512 4f768f180fc0b3a5da3ea8a397847a1dfb03c22d21c1800050b165800b3bff8c0b8034d7053cb9714a3e0186bdcc9d8e27874529e04d8b1eb686dade4c6d4cb1
TLSH
T186C0C0F6CC10C857141032628C81321176237D0CEE401C30C0C53DCFCAF0B728D46540
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1588-20-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1588-22-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/1588-28-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5392-0-0x0000000000404000-0x0000000000405000-memory.dmp

Download

memory/5392-1-0x00000000021F0000-0x00000000021F6000-memory.dmp

Download

memory/5392-8-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5392-2-0x0000000000400000-0x0000000000406000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads