Analysis
- user interaction
yes - max time kernel
117s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 04:01
General
- Target LumiChess.exe
- Size 37.0MB
- Sample261027-elhs1scf53
- SHA256 fcc387d3c78259bfae5a3173e0edca9dd3f1e4516a75e02eca10ce50537f2bc4
Malware Config
Signatures
- Loads dropped DLL 64 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\LumiChess.exe"C:\Users\Admin\AppData\Local\Temp\LumiChess.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LumiChess.exe"C:\Users\Admin\AppData\Local\Temp\LumiChess.exe"2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ComputerRestorePoint -ErrorAction SilentlyContinue | ForEach-Object { $_.SequenceNumber }"3⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_imagingtk.pyi
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
SDL2.dll
base.cp312-win_amd64.pyd
bufferproxy.cp312-win_amd64.pyd
color.cp312-win_amd64.pyd
constants.cp312-win_amd64.pyd
display.cp312-win_amd64.pyd
draw.cp312-win_amd64.pyd
event.cp312-win_amd64.pyd
math.cp312-win_amd64.pyd
rect.cp312-win_amd64.pyd
rwobject.cp312-win_amd64.pyd
surface.cp312-win_amd64.pyd
surflock.cp312-win_amd64.pyd
python3.dll
python312.dll
select.pyd
Lorem ipsum.txt
memory/5244-1267-0x00007FFB17FD0000-0x00007FFB1823C000-memory.dmp
memory/5244-1279-0x00007FFB17FD0000-0x00007FFB1823C000-memory.dmp
memory/5244-1299-0x00000215F2090000-0x00000215F2738000-memory.dmp
memory/5244-1300-0x00007FFB17FD0000-0x00007FFB1823C000-memory.dmp
memory/5244-1296-0x00007FFB17FD0000-0x00007FFB1823C000-memory.dmp
memory/5244-1295-0x00000215F2090000-0x00000215F2738000-memory.dmp
memory/5244-1291-0x00000215F2090000-0x00000215F2738000-memory.dmp
memory/5244-1292-0x00007FFB17FD0000-0x00007FFB1823C000-memory.dmp
memory/5244-1287-0x00000215F2090000-0x00000215F2738000-memory.dmp
memory/5244-1288-0x00007FFB17FD0000-0x00007FFB1823C000-memory.dmp
memory/5244-1284-0x00007FFB17FD0000-0x00007FFB1823C000-memory.dmp
memory/5244-1283-0x00000215F2090000-0x00000215F2738000-memory.dmp
memory/5244-1261-0x0000000068B40000-0x0000000068B7C000-memory.dmp
memory/5244-1259-0x00007FFB17FD0000-0x00007FFB1823C000-memory.dmp
memory/5244-1260-0x000000006A880000-0x000000006A8A7000-memory.dmp
memory/5244-1258-0x00000215F2090000-0x00000215F2738000-memory.dmp
memory/5244-1262-0x00000215F2090000-0x00000215F2738000-memory.dmp
memory/5244-1263-0x00007FFB17FD0000-0x00007FFB1823C000-memory.dmp
memory/5244-1278-0x00000215F2090000-0x00000215F2738000-memory.dmp
memory/5244-1266-0x00000215F2090000-0x00000215F2738000-memory.dmp
memory/5244-1270-0x00000215F2090000-0x00000215F2738000-memory.dmp
memory/5244-1271-0x00007FFB17FD0000-0x00007FFB1823C000-memory.dmp
memory/5244-1275-0x00007FFB17FD0000-0x00007FFB1823C000-memory.dmp
memory/5244-1274-0x00000215F2090000-0x00000215F2738000-memory.dmp
memory/5612-1243-0x00007FFB14D9F000-0x00007FFB14DA0000-memory.dmp
memory/5612-1246-0x000002475E600000-0x000002475E622000-memory.dmp
memory/5612-1256-0x00007FFB14C10000-0x00007FFB155B4000-memory.dmp
memory/5612-1257-0x00007FFB14C10000-0x00007FFB155B4000-memory.dmp
memory/5612-1254-0x00007FFB14C10000-0x00007FFB155B4000-memory.dmp
memory/5612-1251-0x00007FFB14C10000-0x00007FFB155B4000-memory.dmp
memory/5612-1253-0x00007FFB14C10000-0x00007FFB155B4000-memory.dmp
memory/5612-1252-0x00007FFB14C10000-0x00007FFB155B4000-memory.dmp
memory/5612-1250-0x00007FFB14C10000-0x00007FFB155B4000-memory.dmp
memory/5612-1249-0x00007FFB14C10000-0x00007FFB155B4000-memory.dmp
memory/5612-1248-0x00007FFB14C10000-0x00007FFB155B4000-memory.dmp
memory/5612-1247-0x00007FFB14C10000-0x00007FFB155B4000-memory.dmp