2026-08-21_07f6dc2e2c172a9e227110bff249998d_elex_lockbit_valleyrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_07f6dc2e2c172a9e227110bff249998d_elex_lockbit_valleyrat
Size 297KB
Sample260821-nsdx3sdn21
SHA256 87560bf00e5c672cbf14e5bd2b0b7d6ee9a656af2346c8d045c895e6478a4692
MD5 07f6dc2e2c172a9e227110bff249998d
SHA1 929fd91d3a02bcb52c3d42e1aa33bed0cba74fe2
SHA512 498a04ec062087f04d9c0a12a071212dc2c1e1aa2be1f63ac674111e65353a147bc06ddb2658a19da9074b212f55e702f5734419140288b081a44517abcaede7
SSDEEP 3072:V+F60aGQ4Fa0ghRgYpPFsQt2tMRsYpZhODMSmcRERk8rqCBqNj:VQBghRBt2bGOjkk8rqCBq
TLSH
T11F545B11EA90C038F4D206F26DF56CF1A0A8BD30679C40FBB2D15BAAB9297F645317D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_07f6dc2e2c172a9e227110bff249998d_elex_lockbit_valleyrat

File Explorer

2026-08-21_07f6dc2e2c172a9e227110bff249998d_elex_lockbit_valleyrat

.exe 297KB

2026-08-21_07f6dc2e2c172a9e227110bff249998d_elex_lockbit_valleyrat

IMPHASH 0259e0e70aa9080396d016d5b2dfc310
SHA256 87560bf00e5c672cbf14e5bd2b0b7d6ee9a656af2346c8d045c895e6478a4692
MD5 07f6dc2e2c172a9e227110bff249998d
SHA1 929fd91d3a02bcb52c3d42e1aa33bed0cba74fe2
SHA512 498a04ec062087f04d9c0a12a071212dc2c1e1aa2be1f63ac674111e65353a147bc06ddb2658a19da9074b212f55e702f5734419140288b081a44517abcaede7
SSDEEP 3072:V+F60aGQ4Fa0ghRgYpPFsQt2tMRsYpZhODMSmcRERk8rqCBqNj:VQBghRBt2bGOjkk8rqCBq
TLSH
T11F545B11EA90C038F4D206F26DF56CF1A0A8BD30679C40FBB2D15BAAB9297F645317D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

88241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\alpc999\Desktop\UAC\UACME-3.1.9\Source\Akagi\output\Win32\Debug\Akagi.pdb

kernel32

FreeLibrary LoadLibraryW GetStartupInfoW TerminateThread GetCurrentProcess GetCurrentThreadId InitializeProcThreadAttributeList DeleteProcThreadAttributeList CreateThread SetEvent UnmapViewOfFile HeapFree MultiByteToWideChar RaiseException IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter MapViewOfFile CreateFileMappingW VirtualFree OutputDebugStringW GetFileSizeEx FindNextFileW FindFirstFileW DeleteFileW WaitForSingleObject CopyFileW GetFileAttributesW FindClose CreateFileW SetUnhandledExceptionFilter GetProcessHeap TerminateProcess Sleep CreateDirectoryW GetProcAddress HeapAlloc HeapDestroy HeapCreate SetLastError WideCharToMultiByte FileTimeToDosDateTime GetLastError CloseHandle GetTempFileNameA GetTempPathA WriteFile SetFilePointer ReadFile GetFileInformationByHandle FileTimeToLocalFileTime DeleteFileA CreateFileA ExitThread GetCommandLineW LoadLibraryExW GetModuleHandleW GetModuleFileNameW ExitProcess UpdateProcThreadAttribute VirtualAlloc VirtualQuery

user32

PostQuitMessage DefWindowProcW SendMessageW GetProcessWindowStation GetThreadDesktop LoadImageW GetUserObjectInformationW MessageBoxW GetDesktopWindow DispatchMessageW TranslateMessage GetMessageW CreateWindowExW RegisterClassExW UnregisterClassW GetDC

gdi32

SwapBuffers SetPixelFormat ChoosePixelFormat

advapi32

OpenSCManagerW RegCreateKeyExW RegDeleteKeyW RegSetValueExW RegDeleteValueW RegFlushKey RegQueryValueExW RegCreateKeyW RegOpenKeyW RegEnumKeyExW CreateProcessWithLogonW CreateProcessAsUserW QueryServiceStatusEx OpenServiceW RegCloseKey CloseServiceHandle RegCopyTreeW RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW

shell32

SHGetKnownFolderPath SHCreateItemFromParsingName ShellExecuteExW

ole32

CoCreateInstance StringFromGUID2 CoUninitialize CoInitializeEx CoCreateGuid CoTaskMemFree CoGetObject CLSIDFromString StringFromCLSID

oleaut32

SafeArrayCreateVector SafeArrayUnaccessData SafeArrayAccessData SysAllocString SafeArrayDestroy SysFreeString

vcruntime140d

_except_handler4_common __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_LoadLibraryExW memcmp memcpy memchr

ucrtbased

strcat_s strcpy_s _CrtDbgReportW _CrtDbgReport __stdio_common_vsprintf_s _wsplitpath_s wcscpy_s terminate _wmakepath_s

ntdll

NtAllocateVirtualMemory NtWriteVirtualMemory NtSetValueKey RtlFreeSid RtlAllocateAndInitializeSid RtlLengthSid NtOpenProcessToken NtDuplicateToken NtFilterToken NtQueryInformationToken NtSetInformationToken NtOpenProcess NtSetInformationThread NtProtectVirtualMemory LdrEnumerateLoadedModules LdrFindResource_U LdrFindEntryForAddress LdrGetDllHandle LdrGetProcedureAddress RtlInitString RtlEqualUnicodeString RtlExpandEnvironmentStrings_U RtlFormatCurrentUserKeyPath RtlAppendUnicodeStringToString LdrUnloadDll RtlGetCurrentPeb RtlAcquirePebLock RtlReleasePebLock NtResumeProcess RtlLengthRequiredSid RtlInitializeSid RtlSubAuthoritySid RtlSubAuthorityCountSid RtlCreateUserThread RtlGetVersion RtlNtStatusToDosError RtlCreateHeap RtlDestroyHeap RtlSetHeapInformation RtlCreateBoundaryDescriptor RtlDeleteBoundaryDescriptor RtlAddSIDToBoundaryDescriptor NtQuerySystemInformation NtCreatePrivateNamespace NtDeletePrivateNamespace NtFsControlFile NtReadFile NtQueryInformationFile NtCreateSection NtMapViewOfSection NtUnmapViewOfSection NtCreateKey NtEnumerateValueKey NtQueryValueKey NtDeleteKey NtDeleteValueKey NtQueryInformationProcess NtFreeVirtualMemory NtSuspendProcess NtTerminateProcess RtlRaiseStatus RtlImageNtHeader NtIsProcessInJob RtlImageDirectoryEntryToData RtlFreeHeap RtlAllocateHeap RtlPrefixUnicodeString NtClose RtlInitUnicodeString NtOpenKey LdrLoadDll LdrGetDllHandleEx NtNotifyChangeDirectoryFile NtCreateFile NtWaitForSingleObject NtSetEvent NtCreateEvent RtlDosPathNameToNtPathName_U NtDeleteFile RtlFreeUnicodeString RtlWow64EnableFsRedirectionEx RtlComputeCrc32 RtlQueryElevationFlags RtlGetFrame RtlPopFrame RtlRandomEx RtlPushFrame LdrAccessResource RtlAppendUnicodeToString

apphelp

SdbWriteDWORDTag SdbWriteBinaryTag SdbEndWriteListTag SdbWriteStringTag SdbBeginWriteListTag SdbCreateDatabase SdbStartIndexing SdbStopIndexing SdbCommitIndexes SdbDeclareIndex SdbCloseDatabaseWrite

opengl32

glDrawBuffer glEnd glLoadIdentity glColor4i wglCreateContext wglMakeCurrent glBegin glClear glVertex2i glReadPixels glMatrixMode glDrawPixels

comctl32

ord17

cabinet

ord14 ord13 ord10 ord11

msdelta

ApplyDeltaB DeltaFree GetDeltaInfoB

bcrypt

BCryptDecrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider BCryptDestroyKey

Name

.textbss

Size

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

170KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

858B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rtc

Size

1024B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_07f6dc2e2c172a9e227110bff249998d_elex_lockbit_valleyrat

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

vcruntime140d

ucrtbased

ntdll

apphelp

opengl32

comctl32

cabinet

msdelta

bcrypt

generic