Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 08:25
General
- Target 2026-08-09_5837ed2bf16f56cb6196e79c91015209_elex_virlock.exe
- Size 579KB
- Sample260809-ka911sbr9x
- SHA256 cfca767aad61f89d3d434ddab510a7edf9c4d62558cbd9a3eeb01afea99aaeb5
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_5837ed2bf16f56cb6196e79c91015209_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_5837ed2bf16f56cb6196e79c91015209_elex_virlock.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\xoUAwgsw\YoUQIkMM.exe"C:\Users\Admin\xoUAwgsw\YoUQIkMM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 12043⤵
- Program crash
-
-
-
C:\ProgramData\ruUIwgAQ\vqUUIkQk.exe"C:\ProgramData\ruUIwgAQ\vqUUIkQk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exeC:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe"C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe" -burn.unelevated BurnPipe.{1B8C98BD-CDAA-4735-9AA4-2F13A15468D6} {ED4D3C6E-5FA4-4BDB-BAF0-AF68DCE57DED} 15844⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Users\Admin\xoUAwgsw\YoUQIkMM.exeC:\Users\Admin\xoUAwgsw\YoUQIkMM.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\ruUIwgAQ\vqUUIkQk.exeC:\ProgramData\ruUIwgAQ\vqUUIkQk.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1440 -ip 14401⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
vqUUIkQk.exe
AEka.exe
EQgq.exe
IkQO.exe
IsMU.exe
KgcG.exe
OcUC.exe
OwcU.exe
SQUs.exe
UkQy.exe
YIAi.exe
YMoK.ico
YUYw.ico
awwa.exe
coYw.exe
ggEA.exe
mYsS.exe
sMwQ.exe
uAoG.exe
ucwG.exe
vcredist_x86.exe
logo.png
wixstdba.dll
f.inf
YoUQIkMM.exe
memory/1440-6-0x0000000000400000-0x0000000000423000-memory.dmp
memory/1440-242-0x0000000000400000-0x0000000000423000-memory.dmp
memory/2800-0-0x0000000000400000-0x0000000000493000-memory.dmp
memory/2800-20-0x0000000000400000-0x0000000000493000-memory.dmp
memory/4188-244-0x0000000000400000-0x0000000000423000-memory.dmp
memory/4544-14-0x0000000000400000-0x0000000000421000-memory.dmp
memory/4544-243-0x0000000000400000-0x0000000000421000-memory.dmp
memory/6012-245-0x0000000000400000-0x0000000000421000-memory.dmp