Overview

overview

10

Static

static

10

Virtual.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1s
  • max time network
    6s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-07-2024 04:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Virtual.exe

  • Size

    9.5MB

  • MD5

    9b1daa6658805e529507b156c38b66bc

  • SHA1

    723ac528242dd7fc326b05c05d01f31cff6e8ce3

  • SHA256

    b67152ff3c406d1341542a941ff89e5aefefea93a8cf93837325d7f5fce76616

  • SHA512

    ab175d7b12a56bc4123970b9850364745fae8c5e221ca29c9ab7697798f6043361e143b42366bd5d0974a602572711c56323e8be8b7f7435d204978de2ce0e66

  • SSDEEP

    98304:4jNhw+CwCA27YvY33ocXIj5FTTGEg57F/Fz2hIr:0C+CwCV3ocXg5FTTjghiIr

Score
10/10
skuldexecutionpersistencespywarestealer

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1262926533543067740/XBJE1nKhvEw7wJqFaXOEJmKXk_1awtk_zBZiDb8iqvHxjbAh7BNsQaHPn0nUd07PJWN_

Signatures

  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Virtual.exe
    "C:\Users\Admin\AppData\Local\Temp\Virtual.exe"
    1⤵
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\Virtual.exe
      2⤵
      • Views/modifies file attributes
      PID:2860
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      2⤵
      • Views/modifies file attributes
      PID:2036
    • C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1896
    • C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get name
      2⤵
      • Detects videocard installed
      • Suspicious use of AdjustPrivilegeToken
      PID:4744
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\Virtual.exe
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:3036
    • C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      2⤵
        PID:924
      • C:\Windows\System32\Wbem\wmic.exe
        wmic cpu get Name
        2⤵
          PID:3356

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dgaye1kb.bwg.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
        Filesize

        9.5MB

        MD5

        9b1daa6658805e529507b156c38b66bc

        SHA1

        723ac528242dd7fc326b05c05d01f31cff6e8ce3

        SHA256

        b67152ff3c406d1341542a941ff89e5aefefea93a8cf93837325d7f5fce76616

        SHA512

        ab175d7b12a56bc4123970b9850364745fae8c5e221ca29c9ab7697798f6043361e143b42366bd5d0974a602572711c56323e8be8b7f7435d204978de2ce0e66

        Download Submit

      • memory/3036-9-0x0000015348880000-0x00000153488A2000-memory.dmp

        Filesize

        136KB

        Download