skuld | 9a04cf68c8bdf577d27658c7e84be1ccf6122bf6208ab1300e1d9803fd065748

Analysis

max time kernel
60s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

niggahater.exe
Size

9.3MB
MD5

fc68d81900b7bf69d8d8b1f3119f45a2
SHA1

6b8016a4249fc9a6775de5f06ebc592c2bedb99e
SHA256

9a04cf68c8bdf577d27658c7e84be1ccf6122bf6208ab1300e1d9803fd065748
SHA512

21e111e52f951cac84ad7751cc088afc526b7aeb612dd57515f3e2aae758f92b84ff47d00a16b5cb21acef432aeafbb532231379a28e874008ef883bccbfdfe0
SSDEEP

98304:4SDHIt0tY1iZ9t292M5AueUfEBv1aIiivmXe:Xot0tU2M5AXU8huX

Score

10^/10

skuld persistence stealer

Malware Config

Extracted

Family

skuld

https://discord.com/api/webhooks/1242897203878690918/3TJ-b5Y1hE8vdA1jciurp1SRLYdg0seUEpr6gPy5i4GjM535DSt29zAtN9Y3olfzBn9t

Signatures

Skuld stealer
An info stealer written in Go lang.
stealer skuld

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	niggahater.exe

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org
6	api.ipify.org
10	api.ipify.org
14	api.ipify.org
15	api.ipify.org

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3008	niggahater.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 116	3008	niggahater.exe	83
PID 3008 wrote to memory of 116	3008	niggahater.exe	83
PID 3008 wrote to memory of 3644	3008	niggahater.exe	84
PID 3008 wrote to memory of 3644	3008	niggahater.exe	84

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
116	attrib.exe
3644	attrib.exe

C:\Users\Admin\AppData\Local\Temp\niggahater.exe
"C:\Users\Admin\AppData\Local\Temp\niggahater.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\niggahater.exe
  2⤵
  - Views/modifies file attributes
  PID:116
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe

Filesize
9.3MB

MD5
fc68d81900b7bf69d8d8b1f3119f45a2

SHA1
6b8016a4249fc9a6775de5f06ebc592c2bedb99e

SHA256
9a04cf68c8bdf577d27658c7e84be1ccf6122bf6208ab1300e1d9803fd065748

SHA512
21e111e52f951cac84ad7751cc088afc526b7aeb612dd57515f3e2aae758f92b84ff47d00a16b5cb21acef432aeafbb532231379a28e874008ef883bccbfdfe0

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads