67e0f09dc493b12d1059454e73f4304d9e002d8e65b95773d8e6fb597c072229

Analysis

max time kernel
148s
max time network
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_7102c38b714443327c1467d253526576_elex_virlock.exe
Size 111KB
Sample260715-c6geksh14r
SHA256 67e0f09dc493b12d1059454e73f4304d9e002d8e65b95773d8e6fb597c072229
MD5 7102c38b714443327c1467d253526576
SHA1 63de5b608e2b35b4487f4598e71c31d03c29a428
SHA512 b189a8e47888977227922efd2007ac8a32a4e234f1638d457db44caf0493dab3dee83616249177f4cb24364590f8bd808dc0739309d586fe6824b09804008e23
SSDEEP 3072:9JwVS4D9vWu8fMFQA7hzcJBJt8WTEidwZVSm:KnxvWjNA7hQDJt8WTwZ
TLSH
T1A2B3BFB734E1ADA2C3E74E73DA236AB481FBCC611C5E06C6E699F52D4A34719640D32C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3260	5556	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_7102c38b714443327c1467d253526576_elex_virlock.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_7102c38b714443327c1467d253526576_elex_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_7102c38b714443327c1467d253526576_elex_virlock.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 264
  2⤵
  - Program crash
  PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5556 -ip 5556
1⤵
PID:3208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5556-0-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/5556-1-0x0000000000400000-0x000000000041D000-memory.dmp