Analysis
- user interaction
yes - max time kernel
150s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 23:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Lucid.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Lucid.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target Lucid.exe
- Size 47.9MB
- Sample261102-3fvsdsfz6r
- SHA256 9d376777b33d5fe5f04b0c761563385f8f8c4e8b597fec05814edb5e24389b84
- MD5 99c506d6bb2d9b7a98cb8bdb11d3daee
- SHA1 7f3db4aac1176c61dfb6c2517398ab4de57fa731
- SHA512 b9292ae91a4265eb0a008386f1d6de17601d05150f7d17760f2de23102482f53c3b736a5a91061e27ec1db203542f20ceb85e8e2ef5dbfabf2e60ac5712c7cef
- SSDEEP 786432:XhoeuOK+JXJmDQTk+M8OcH/ffIhhxJkCcZvvQvZHu1Erj38Q:XhTuOK+J5mb+243f2Cgj3
- TLSH T144B7BE06EB910AE7E026D534CA65C233E7B1BC6A8239834F14D5E70E1FF72614F5E6A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Lucid.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Lucid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Lucid.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation Lucid.exe - Loads dropped DLL 4 IoCs
pid Process 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe -
resource yara_rule behavioral1/files/0x000700000002441f-20.dat themida behavioral1/memory/4720-21-0x0000000180000000-0x0000000180969000-memory.dmp themida behavioral1/memory/4720-23-0x0000000180000000-0x0000000180969000-memory.dmp themida behavioral1/memory/4720-24-0x0000000180000000-0x0000000180969000-memory.dmp themida behavioral1/memory/4720-64-0x0000000180000000-0x0000000180969000-memory.dmp themida behavioral1/memory/4720-77-0x0000000180000000-0x0000000180969000-memory.dmp themida behavioral1/memory/4720-78-0x0000000180000000-0x0000000180969000-memory.dmp themida - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Lucid.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Lucid.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Lucid.exe - Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe 4720 Lucid.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4720 Lucid.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4720 Lucid.exe 4720 Lucid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lucid.exe"C:\Users\Admin\AppData\Local\Temp\Lucid.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4720
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Lucid\63d120ccdea8\0fe333ca7984f0ae
- Size 454B
- SHA256 493ed59e05094bacce2eae1d9c381e054a8917418bfa2835e37c767c827c24aa
- MD5 b7c92ca3bdbdfde8ab7c0c038d0936f4
- SHA1 f2603c29ce4e547fdf5d4cf9a51a77908dda60dd
- SHA512 cb35795401c5ef3c493378b364d92e02f58edd89498a8e83109efbebc78c2d5d39261b68c489f70d434c6aeb9bd2c48651e419658d0a70fe5c8e2421b2756bab
- TLSH T1FFF0234A74022D47D984333C389B1C8C18C528D4A7F1D2884A0B72815520BC878F491E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\63d120ccdea8\93b65b01465c8b0e
- Size 294B
- SHA256 4166003f107c3488392f3f5cf1a2c19b6ed8dfa2559229cf0283dde1d6786c5d
- MD5 0c5ff85900ac627aa48f783c87a8f8d3
- SHA1 aa00835149f67d90b6412dd5d603e00fdf55c6ea
- SHA512 0ff7ac540203010313e2ed158639acb7af9606fa0064cf24e697a0b0b6881800b83d7fab443f335c34b6586507e836b920fcfc497a9ae5c0168f0d2d286710ef
- TLSH T16FE0EB6384C8218FE0298134A9CFCDC198B6AC712B9BB640B801B2F208233013444F40
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\63d120ccdea8\93b65b01465c8b0e
- Size 310B
- SHA256 0480fd2be6dc8e81d9190ad2d725f467fe48e855aa3160946fa37f9efda8ced8
- MD5 45268259df03f6e02e1d24cad5f5e6d5
- SHA1 16e2cd2eed7ff1c57b281e36b7e8b6a8c9ff8936
- SHA512 d89f7cfe11d3bbbbbc35be72f532be245227dae02b2dd8ee87bb3da8267084fc7cba9b2ac8bed7dc1c0df449de73aaf68a38f3fdaa176844d70c3d2362633524
- TLSH T1BAE07D4087389083E539E3B8586F5D3CDA41097546F347998D10B44CB41BA21960A943
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\63d120ccdea8\a46bc48a65d2326a
- Size 262B
- SHA256 2f7e09c1cede9fa153a21b94f9e94b80c0be9c97264fde3b1834a7d0a999ddeb
- MD5 4de4a8b3ddc9fb1ffeb7249bcb1d2745
- SHA1 06262be81a88fb8fe9f32c5b834ecf582176d2bd
- SHA512 0dd7a0daa9500002e3af837a649126dee992a9e722866c5700d76302445cfcf7817294b2cf967ead39eefa766e46fd58acb39b3e4c3b9bbedf8ff67b8aaa3f01
- TLSH T12ED02B41213584A3E0A00270DCDB8A4C06955A1C03975391120064E98C6E7527415F46
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\63d120ccdea8\a46bc48a65d2326a
- Size 262B
- SHA256 6c05803ac391b80133f7d205e2e06a06a93f578ca4e3b5faffd3a77890a4ca65
- MD5 d2d094f52acf174beb40f350f105742a
- SHA1 2763ba37621e4ef4b3e5290706e170e382835c20
- SHA512 a3c0463099392532c3f8c668a4daac5ef9d719b63028206375af7693f650c873e476fee5655438ba4cc7f83e622e2fce7bd28303b3ef9d1113e5d975ae9cb474
- TLSH T1D8D02B404166444BD14F0A788DCF9818C49188704396E6E0980722321086AD76CF4520
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\Cache\Natives\719F639C31330D3BB36E3F\LucidAuth.dll
- Size 3.6MB
- SHA256 b9bcd58db7e4c3a386c9fe00313cf2cf52c495004c571930c0e910ce72556655
- MD5 856ed024fc46e2bcab613db583a92231
- SHA1 cada60d583ffc9324eb25b14acad36140cbfed9c
- SHA512 2f7a30ef6e74c2286ca3c2bccdf68214a3d1b060aefe158d1bf71d882b2f898ed0a594e965a1857786550e1ccdcd699bb6ed8c4d3d3ee4d1ef5ffda1626f7302
- SSDEEP 98304:oBUQ+j0psqwu/SLt635+S9mK0Q85irbK29:oBUPwps80t635+S9RQ5abK
- TLSH T1540633A13789D98DC92DD2F15EAE431437628B540D0C7F6B7790B7922EB0199337CACA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\Cache\Natives\719F639C31330D3BB36E3F\av_libglesv2.dll
- Size 5.1MB
- SHA256 53191a77fe783cd757ca7767077c2a64a662e7043777a5b4ab74980d4a0b73e3
- MD5 e6198925c32669264eb2a37a5c5706bb
- SHA1 f2bad0cfc40bc642dfcd7242c3fcfe736b617eab
- SHA512 d2836c7335e70171d2dc0e143b9752b1d4947d3b6fe424c2078118aeabf12ac008b7be91adcba6e2616e143c5732afa6a0089f412a5e2d97a3ad76aed6c99aa7
- SSDEEP 49152:UrRhIIcDUAsu5h76YosYgIiiHtY+52ZKLArXaqxRyiEIrYeoEFjWhM+/9+XmEFqZ:aiQsmz2ZdKMyiEIrYeoRnL6Uyfq
- TLSH T190467C03F29250DEC41DD278875B9223F635B8450725B6DF26A893252F77FE06B3AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\Cache\Natives\719F639C31330D3BB36E3F\libHarfBuzzSharp.dll
- Size 1.7MB
- SHA256 145ade963eba427027d5e1381db5d51a0ef9e98e9fef9efbfa6074ca20da246f
- MD5 fdfc5facbb8d7ed52bcfeda911586cd6
- SHA1 ae248fd8f3e3df80bab5dacdc098a0a7136ba94d
- SHA512 d49b78bda3a0e70e5b70eb537ce5cf28b00c5578d8edd2e5bd0e9b8dbc3e6cb983bb5ea38dfda0170ff2851fecd78e702c00c7483628d920527546e94903a5b1
- SSDEEP 49152:48lOq9ewF9RTbAsC0e+yPWojc7dGl09x4HJg:I2dclAJ
- TLSH T19C85AE4AE2AA10E9D9BFC078D666950BE7A274050314DFEF25E08695EF23FF5167E300
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\Cache\Natives\719F639C31330D3BB36E3F\libSkiaSharp.dll
- Size 11.1MB
- SHA256 7dec3ba900ab353491e6446f0083739924c6f8dd668832e2f09d38ebffdbbe1c
- MD5 7b0859b4d5a23d2436bd165f86bf9d4c
- SHA1 a8cb4ecdca12e2b07974b0478c9f5494e283d784
- SHA512 0b87163b211c0da87af194f9438d397489e2a9d550b4f56613ce8e44ea7a48d3676fbb8161fe72050401618e69eefa7da12c0f7a3d7634ad78c461a572409de0
- SSDEEP 98304:51DUue0xnR1JG+VyXb0UDfgFTdbkLhQgPLSmrQ7zMEGFD:51DVUDoPkOgPLS5MEGFD
- TLSH T1FCC65C02769B54BDC44AC4B4934B5A67AD2434CB0B35BCEF418592393FBABF42F39618
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\Logs\Interface\Crash-2026-11-02-233048-4.log
- Size 1KB
- SHA256 284224b6fbc0664f37088dbe6d4555d838f30dc6005b929650fe49a7a1a89fa7
- MD5 718e99ff6c8cddf433368096e8562fa7
- SHA1 c918f260f70a75450aabd5ccf1bfb5652234e467
- SHA512 989be7ab5bb8fac999119b530c1f8628b9f0458e5e620a4cf8e65fe184bcee7cb5d8b7654c365c9879fc0ba96bf608f47829b7581ba1781409593e8b6fd45ed9
- TLSH T1DD313430614843690AE1463075655282E9FBA7440035E665F6ECC0293EDBD3653EF7FA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\Logs\Interface\Lucid-2026-11-02.log
- Size 22KB
- SHA256 c988f51757641a976c22afcb99e6be811f0e236b1a19bf8c91690aac903b85f2
- MD5 39d2a2bdd86b51429f128d84b363b298
- SHA1 e84b7eb5c9c6406f06bfa0031c8022afec450687
- SHA512 cd8930bfd1b69a547b6424c9a5aea71f5a29363911f75f991981a93a6721c2b7e5d744b54cc45ed7f890fe73eac2fc3edc02bb2d123892a014f30020aefc1af0
- SSDEEP 384:p+69URL+69URx+69URX+69URA+69URj+69URa+69URa+69URN+69URN+69UR0+6W:a
- TLSH T147A21224624C837A0AE24A31B454A182D9FB67084135FA65F2EDC0153EDBD3653EF7F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\Scripts\Workspace\Welcome.lua
- Size 29B
- SHA256 c8710424354c8ae5c4b697ef09715aa8705f3464147d290a01d0102fdb47b2ee
- MD5 951f1145bbcfe549400c5544650cfa06
- SHA1 4f080aaa2136545f4090142bd6870166c98c995e
- SHA512 633006281076f71a42138c4a79f8fcd9bb8d9e5eb3b28010242ca4791a354048c07202070743890bc7eb6433d895526bfc66d9c2b7cdcfcd420bb979f29d1e72
- MD5 SHA1 SHA512