Analysis
- user interaction
yes - max time kernel
17s - max time network
18s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/09/2026, 02:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Kumper.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Kumper.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target Kumper.exe
- Size 3.0MB
- Sample260907-ddbjasxdqe
- SHA256 7a8c4b246dc523f6ba8808e1e8edb564b889b213ba40f641fe4575e7c9539826
- MD5 d51523ee06c6d4651d792668343fccd1
- SHA1 1f5d3c6c7d28f4a20f2e56ddf687ff7b775a61b2
- SHA512 2a64055f63deb0c712dc4acbb5701af81585330df4405361bb2866f4989dbc2ef4e93c07707b1a92e42a63b35df5ea60fef58696a104aa3b04fd3d53f24e2452
- SSDEEP 49152:NvNOfEEcUzDTJMNVxJUBDrkcX7jG9p6r1y0ITB1tccNAyxkJ53OVuyG69c/Y:NV4l6JUZNy0ITB1tccNAXsc
- TLSH T110E5BF56A3A501E8C5B7D138CA469607FB72744913339BDB13E08A6A6F53BF16B3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest Kumper.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Kumper.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools Kumper.exe - Looks for VMWare services registry key. 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci Kumper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse Kumper.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3056 Kumper.exe 3056 Kumper.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe 3056 Kumper.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3056 Kumper.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeBackupPrivilege 3056 Kumper.exe Token: SeSecurityPrivilege 3056 Kumper.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3056 Kumper.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kumper.exe"C:\Users\Admin\AppData\Local\Temp\Kumper.exe"1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3056