Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 23:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Lucid.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Lucid.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target Lucid.exe
- Size 47.9MB
- Sample261102-3fvsdsfz6r
- SHA256 9d376777b33d5fe5f04b0c761563385f8f8c4e8b597fec05814edb5e24389b84
- MD5 99c506d6bb2d9b7a98cb8bdb11d3daee
- SHA1 7f3db4aac1176c61dfb6c2517398ab4de57fa731
- SHA512 b9292ae91a4265eb0a008386f1d6de17601d05150f7d17760f2de23102482f53c3b736a5a91061e27ec1db203542f20ceb85e8e2ef5dbfabf2e60ac5712c7cef
- SSDEEP 786432:XhoeuOK+JXJmDQTk+M8OcH/ffIhhxJkCcZvvQvZHu1Erj38Q:XhTuOK+J5mb+243f2Cgj3
- TLSH T144B7BE06EB910AE7E026D534CA65C233E7B1BC6A8239834F14D5E70E1FF72614F5E6A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Lucid.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Lucid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Lucid.exe - Loads dropped DLL 4 IoCs
pid Process 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe -
resource yara_rule behavioral2/files/0x000d00000001c4a5-19.dat themida behavioral2/memory/5404-20-0x0000000180000000-0x0000000180969000-memory.dmp themida behavioral2/memory/5404-23-0x0000000180000000-0x0000000180969000-memory.dmp themida behavioral2/memory/5404-22-0x0000000180000000-0x0000000180969000-memory.dmp themida behavioral2/memory/5404-63-0x0000000180000000-0x0000000180969000-memory.dmp themida behavioral2/memory/5404-76-0x0000000180000000-0x0000000180969000-memory.dmp themida behavioral2/memory/5404-77-0x0000000180000000-0x0000000180969000-memory.dmp themida - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Lucid.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Lucid.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Lucid.exe - Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe 5404 Lucid.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5404 Lucid.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5404 Lucid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lucid.exe"C:\Users\Admin\AppData\Local\Temp\Lucid.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5404
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Lucid\21523b2d0109\41917be10636f6cf
- Size 454B
- SHA256 8044c9ecb9b287e1a27945f5811ae2ad037b00d78bfc53ef9f35f395a5669f56
- MD5 974f532ec444dd4c6ae251e32b56e9ee
- SHA1 4f66c7292f491eea92d08b5ac80d8ba4efa509ae
- SHA512 081f983921cd0c26c08d88c554883997132609e3391a402e2399799a984f7e7525262d4422425cd97c49a33cdf9d9bf77b53b25aec97f544156018b007d79a76
- TLSH T1D1F0DC2201F1C033DB4EA13F4E1B5D3AA0EA48590712F145A1CAE6F9643B7862219641
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\21523b2d0109\97c44eec6f54938a
- Size 310B
- SHA256 27c00ba4a0b3a0e3ffe28d7a39361b4db6fae6ddd5feeb4061d22056dbbec139
- MD5 94500280657535f0908542f06415e3cc
- SHA1 6854b60c59dd4231ecb3be0048aecf3ecb809f11
- SHA512 6fee27c6df9ad92db6b434ed8e6c7b982a61a8a77acfcec8ae0a1fbadce2d45c8184d0c09891fe886e8d2a1af2df95e6ae06a92ceea10166e0a077436edd3656
- TLSH T162E07DF50A5A5E53F2C90870C88E98938B875CD8ABB25DD8594C32AC633D252E190C91
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\21523b2d0109\97c44eec6f54938a
- Size 294B
- SHA256 45c4a7c24a81c7d8dba7238b50d096a21e40511dbf282622efee446111c17a09
- MD5 b301041dee4ad4eac625c8a39d496e47
- SHA1 b1485f805f7d9016587baa71afa25c351bc42040
- SHA512 d348eb226392a67663a6c5661d0c85ae0cd49ed71c66470588ad292a1421ff9cd04dc323e5d044b456f62e426d6b820d783c2a2b63e5e8d297ac967694b18b90
- TLSH T145E0EB28738E65F3F0C53A7395378C61136D700D3732E3B49C88611A8332300891EB62
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\21523b2d0109\d08799cfbe13524d
- Size 262B
- SHA256 0577cf1c798f1b7a22da90cffef569d3931c5312a0de32883c7f32a774af3e58
- MD5 f4d841a82a44bfa311a3d30f480fe310
- SHA1 410d26b2dc2fd668bf8bbd697c902ecf79c1b4a5
- SHA512 5eff649ad5e34b12fc9fc19b5fd16f651e03ed7f5602cb4e4099fa5e5d38233948f2f19cfd6f76ffd2c6a39de941d38eb3084eecea8a9884d6dfae90364b7496
- TLSH T1C2D09720B511E002FA0613F28ECB076C699ECC21457F4704C40FA5BD683B7B8C021380
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\21523b2d0109\d08799cfbe13524d
- Size 262B
- SHA256 a4bf42bdecca4a3ccc4afc20d04d548960f2b718bf757ced3b29d9c8f86516be
- MD5 b00e8371ce9119b22907b0583b0bdd1e
- SHA1 f2a28f8b1208c32343749d447fec343bfad28fcc
- SHA512 c3770ce7c13697ad8ef62e0ce04f559649cc305108e898425206928ab568f146cd6c5c05375da5e1c80f7ecb3671cf72cb435cea6877da9d09ddb6c54c964d74
- TLSH T1FCD095224384B107F516D337D3675BDC755C5053971772686C5A6131D43F738054B795
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\Cache\Natives\719F639C31330D3BB36E3F.5404\LucidAuth.dll
- Size 3.6MB
- SHA256 b9bcd58db7e4c3a386c9fe00313cf2cf52c495004c571930c0e910ce72556655
- MD5 856ed024fc46e2bcab613db583a92231
- SHA1 cada60d583ffc9324eb25b14acad36140cbfed9c
- SHA512 2f7a30ef6e74c2286ca3c2bccdf68214a3d1b060aefe158d1bf71d882b2f898ed0a594e965a1857786550e1ccdcd699bb6ed8c4d3d3ee4d1ef5ffda1626f7302
- SSDEEP 98304:oBUQ+j0psqwu/SLt635+S9mK0Q85irbK29:oBUPwps80t635+S9RQ5abK
- TLSH T1540633A13789D98DC92DD2F15EAE431437628B540D0C7F6B7790B7922EB0199337CACA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\Cache\Natives\719F639C31330D3BB36E3F.5404\av_libglesv2.dll
- Size 5.1MB
- SHA256 53191a77fe783cd757ca7767077c2a64a662e7043777a5b4ab74980d4a0b73e3
- MD5 e6198925c32669264eb2a37a5c5706bb
- SHA1 f2bad0cfc40bc642dfcd7242c3fcfe736b617eab
- SHA512 d2836c7335e70171d2dc0e143b9752b1d4947d3b6fe424c2078118aeabf12ac008b7be91adcba6e2616e143c5732afa6a0089f412a5e2d97a3ad76aed6c99aa7
- SSDEEP 49152:UrRhIIcDUAsu5h76YosYgIiiHtY+52ZKLArXaqxRyiEIrYeoEFjWhM+/9+XmEFqZ:aiQsmz2ZdKMyiEIrYeoRnL6Uyfq
- TLSH T190467C03F29250DEC41DD278875B9223F635B8450725B6DF26A893252F77FE06B3AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\Cache\Natives\719F639C31330D3BB36E3F.5404\libHarfBuzzSharp.dll
- Size 1.7MB
- SHA256 145ade963eba427027d5e1381db5d51a0ef9e98e9fef9efbfa6074ca20da246f
- MD5 fdfc5facbb8d7ed52bcfeda911586cd6
- SHA1 ae248fd8f3e3df80bab5dacdc098a0a7136ba94d
- SHA512 d49b78bda3a0e70e5b70eb537ce5cf28b00c5578d8edd2e5bd0e9b8dbc3e6cb983bb5ea38dfda0170ff2851fecd78e702c00c7483628d920527546e94903a5b1
- SSDEEP 49152:48lOq9ewF9RTbAsC0e+yPWojc7dGl09x4HJg:I2dclAJ
- TLSH T19C85AE4AE2AA10E9D9BFC078D666950BE7A274050314DFEF25E08695EF23FF5167E300
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\Cache\Natives\719F639C31330D3BB36E3F.5404\libSkiaSharp.dll
- Size 11.1MB
- SHA256 7dec3ba900ab353491e6446f0083739924c6f8dd668832e2f09d38ebffdbbe1c
- MD5 7b0859b4d5a23d2436bd165f86bf9d4c
- SHA1 a8cb4ecdca12e2b07974b0478c9f5494e283d784
- SHA512 0b87163b211c0da87af194f9438d397489e2a9d550b4f56613ce8e44ea7a48d3676fbb8161fe72050401618e69eefa7da12c0f7a3d7634ad78c461a572409de0
- SSDEEP 98304:51DUue0xnR1JG+VyXb0UDfgFTdbkLhQgPLSmrQ7zMEGFD:51DVUDoPkOgPLS5MEGFD
- TLSH T1FCC65C02769B54BDC44AC4B4934B5A67AD2434CB0B35BCEF418592393FBABF42F39618
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Lucid\Scripts\Workspace\Welcome.lua
- Size 29B
- SHA256 c8710424354c8ae5c4b697ef09715aa8705f3464147d290a01d0102fdb47b2ee
- MD5 951f1145bbcfe549400c5544650cfa06
- SHA1 4f080aaa2136545f4090142bd6870166c98c995e
- SHA512 633006281076f71a42138c4a79f8fcd9bb8d9e5eb3b28010242ca4791a354048c07202070743890bc7eb6433d895526bfc66d9c2b7cdcfcd420bb979f29d1e72
- MD5 SHA1 SHA512