skuld | 9756e20697023876ef8e570658d2b35bed2548bf05c124b2f96f6203dae243c7

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-06-2024 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.exe
Size

14.2MB
MD5

2d48e14160b815234bfcc517f6500231
SHA1

381c3152ca6ad548ea2bd8a83423e6e4bfe5508b
SHA256

9756e20697023876ef8e570658d2b35bed2548bf05c124b2f96f6203dae243c7
SHA512

9c2c38a399c8d985ee058814bf87dad90347aed7faf2c9597f011da63fd7f6f6d405e689cf3be3c108f675bf4589ff078a8ecb2dba1bafc15aaa1ce9458e31b8
SSDEEP

196608:IMhP4WgzpUmKAU/o4z3wVSIPLFFrL0AGtWT6U:IyP2mo40HLvL7Gty

Score

10^/10

skuld persistence stealer

Malware Config

Extracted

Family

skuld

https://discord.com/api/webhooks/1253813102223298560/O-L6iguyX5rluzD2U1_iyLQ7zm9faaFnF1M8hhYXbMbx7q6jl_GsrV427yX8oo062mN0

Signatures

Skuld stealer
An info stealer written in Go lang.
stealer skuld

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	main.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	main.exe
Token: SeIncreaseQuotaPrivilege	3120	wmic.exe
Token: SeSecurityPrivilege	3120	wmic.exe
Token: SeTakeOwnershipPrivilege	3120	wmic.exe
Token: SeLoadDriverPrivilege	3120	wmic.exe
Token: SeSystemProfilePrivilege	3120	wmic.exe
Token: SeSystemtimePrivilege	3120	wmic.exe
Token: SeProfSingleProcessPrivilege	3120	wmic.exe
Token: SeIncBasePriorityPrivilege	3120	wmic.exe
Token: SeCreatePagefilePrivilege	3120	wmic.exe
Token: SeBackupPrivilege	3120	wmic.exe
Token: SeRestorePrivilege	3120	wmic.exe
Token: SeShutdownPrivilege	3120	wmic.exe
Token: SeDebugPrivilege	3120	wmic.exe
Token: SeSystemEnvironmentPrivilege	3120	wmic.exe
Token: SeRemoteShutdownPrivilege	3120	wmic.exe
Token: SeUndockPrivilege	3120	wmic.exe
Token: SeManageVolumePrivilege	3120	wmic.exe
Token: 33	3120	wmic.exe
Token: 34	3120	wmic.exe
Token: 35	3120	wmic.exe
Token: 36	3120	wmic.exe
Token: SeIncreaseQuotaPrivilege	3120	wmic.exe
Token: SeSecurityPrivilege	3120	wmic.exe
Token: SeTakeOwnershipPrivilege	3120	wmic.exe
Token: SeLoadDriverPrivilege	3120	wmic.exe
Token: SeSystemProfilePrivilege	3120	wmic.exe
Token: SeSystemtimePrivilege	3120	wmic.exe
Token: SeProfSingleProcessPrivilege	3120	wmic.exe
Token: SeIncBasePriorityPrivilege	3120	wmic.exe
Token: SeCreatePagefilePrivilege	3120	wmic.exe
Token: SeBackupPrivilege	3120	wmic.exe
Token: SeRestorePrivilege	3120	wmic.exe
Token: SeShutdownPrivilege	3120	wmic.exe
Token: SeDebugPrivilege	3120	wmic.exe
Token: SeSystemEnvironmentPrivilege	3120	wmic.exe
Token: SeRemoteShutdownPrivilege	3120	wmic.exe
Token: SeUndockPrivilege	3120	wmic.exe
Token: SeManageVolumePrivilege	3120	wmic.exe
Token: 33	3120	wmic.exe
Token: 34	3120	wmic.exe
Token: 35	3120	wmic.exe
Token: 36	3120	wmic.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 1996	5112	main.exe	92
PID 5112 wrote to memory of 1996	5112	main.exe	92
PID 5112 wrote to memory of 3120	5112	main.exe	93
PID 5112 wrote to memory of 3120	5112	main.exe	93
PID 5112 wrote to memory of 4188	5112	main.exe	94
PID 5112 wrote to memory of 4188	5112	main.exe	94

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1996	attrib.exe
4188	attrib.exe

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\main.exe
  2⤵
  - Views/modifies file attributes
  PID:1996
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3120
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe

Filesize
14.2MB

MD5
2d48e14160b815234bfcc517f6500231

SHA1
381c3152ca6ad548ea2bd8a83423e6e4bfe5508b

SHA256
9756e20697023876ef8e570658d2b35bed2548bf05c124b2f96f6203dae243c7

SHA512
9c2c38a399c8d985ee058814bf87dad90347aed7faf2c9597f011da63fd7f6f6d405e689cf3be3c108f675bf4589ff078a8ecb2dba1bafc15aaa1ce9458e31b8

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads