Analysis
-
max time kernel
88s -
max time network
91s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17-04-2024 23:04
General
-
Target
Lucifer v2.26.zip
-
Size
10.5MB
-
MD5
11d445f011d60d4d7ca2e0cc8fad1bb9
-
SHA1
ff36ba4b984dd12b5c382421329eec504f2e21df
-
SHA256
758b35d2794d43aee02959bf4d1ed7df9ec40c31c39e8a09c6d574a66422ac43
-
SHA512
ad8f18e1f3b9e529203935ae79652ff2277fd82ee3427a8c76abada6b62d13323be2b23ffc25d244845b42e4b089949ebd2b398a4679fc5fba1324d3abe42884
-
SSDEEP
196608:KYpzYmJGS+Yqb+q2vaJeKuuZZQ91Gy4tJfSZ5ixVlDQRU/tMpTYFev:KYdYmJ5Jq2vB5iy4tJqZ5iHlDQUMpTYY
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 15 IoCs
Detects Themida, an advanced Windows software protection system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Modifies registry class 9 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Lucifer v2.26.zip"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Lucifer v2.26\Lucifer v2.26.exe"C:\Users\Admin\Desktop\Lucifer v2.26\Lucifer v2.26.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18.8MB
-
Filesize
2.0MB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
2.0MB