Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
31/10/2026, 07:56
General
- Target 2026-10-30_1b81633b4d3e211b9bf2490754eafefa_elex_virlock.exe
- Size 591KB
- Sample261031-jsvtdaby2j
- SHA256 d502626b0a2a429e27abb4781928d93868ae0ce5e7a933c8dfefd61a4657f6d6
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Renames multiple (73) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 2 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_1b81633b4d3e211b9bf2490754eafefa_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_1b81633b4d3e211b9bf2490754eafefa_elex_virlock.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\GAIcMggA\LmUAoAQA.exe"C:\Users\Admin\GAIcMggA\LmUAoAQA.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 12723⤵
- Program crash
-
-
-
C:\ProgramData\FKggIwQo\cYAkoMYw.exe"C:\ProgramData\FKggIwQo\cYAkoMYw.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exeC:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe"C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe" -burn.unelevated BurnPipe.{5241A001-6375-4C62-9501-4F23F17CBF40} {B8AE8E2D-C5A3-44B4-8F85-31839A9CF50D} 34604⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\ProgramData\FKggIwQo\cYAkoMYw.exeC:\ProgramData\FKggIwQo\cYAkoMYw.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\GAIcMggA\LmUAoAQA.exeC:\Users\Admin\GAIcMggA\LmUAoAQA.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 9962⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4704 -ip 47041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4640 -ip 46401⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
cYAkoMYw.exe
AAok.exe
AYoc.ico
CUYs.exe
CoEa.exe
CokI.exe
CwAw.exe
EEAO.exe
EIMu.exe
EgUm.exe
EkUk.exe
EkoM.exe
GAsu.exe
GYks.exe
GoYK.exe
GwQC.exe
IAUA.exe
IEQW.ico
IIcE.exe
IsgW.exe
IwQG.exe
KAke.exe
KEAu.exe
KEIe.exe
KQIg.exe
Ksgi.exe
KswC.exe
MAIk.exe
MQgI.exe
MUYO.exe
McAI.exe
McgE.ico
MwMG.exe
MwQG.ico
OMgE.exe
OUAM.exe
OUYs.exe
OcsS.exe
OkgS.exe
QAcM.exe
QIIY.ico
QIcs.exe
QYUI.exe
QcUg.exe
QksI.exe
QoUS.exe
SIsE.exe
SMcm.exe
SQwK.exe
SUMI.exe
SUgW.exe
SYog.ico
Sgwm.exe
Swkc.ico
UUAq.exe
UgAI.exe
WEcY.exe
YMAo.exe
YQUm.ico
YYYo.exe
aMgE.exe
agIG.exe
aswg.exe
cAwY.exe
cUYw.exe
eMQw.exe
eYgc.exe
eYsG.exe
eoMg.exe
ewge.exe
gEAg.exe
gMwy.exe
gUQc.exe
gsII.exe
gsMC.exe
gwcM.exe
iAEK.ico
iIsy.exe
iUsg.exe
icwK.exe
ikUE.exe
isYo.exe
kAMg.exe
kcsO.exe
kwAE.exe
mMgy.exe
mgkw.exe
mkIy.exe
oUUM.exe
owko.exe
qEQY.exe
qMso.exe
qQAo.exe
qQQe.exe
qUAa.exe
qcYe.exe
sYIk.exe
skwQ.exe
sooY.exe
uAgy.exe
uoUO.exe
uwYe.ico
uwwW.exe
vcredist_x86.exe
wMsC.exe
wssE.exe
wwQK.exe
yoUq.exe
logo.png
wixstdba.dll
LmUAoAQA.exe
f.inf
memory/3528-1012-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4640-1014-0x0000000000400000-0x0000000000425000-memory.dmp
memory/4640-1013-0x0000000000400000-0x0000000000425000-memory.dmp
memory/4704-1010-0x0000000000400000-0x0000000000425000-memory.dmp
memory/4704-1009-0x0000000000400000-0x0000000000425000-memory.dmp
memory/4704-6-0x0000000000400000-0x0000000000425000-memory.dmp
memory/4828-13-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4828-1011-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4956-19-0x0000000000400000-0x0000000000496000-memory.dmp
memory/4956-0-0x0000000000400000-0x0000000000496000-memory.dmp