skuld | a4849f4b4803684252d35b0b96222e896c90f947a97711b626abd00e3142ffb3

Analysis

max time kernel
7s
max time network
14s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2024 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.exe
Size

3.2MB
MD5

9752c4717f3b7e1ad53f53a4f410f83f
SHA1

f58d6011fd394506d5f5b13e04b6fb00d752fe40
SHA256

a4849f4b4803684252d35b0b96222e896c90f947a97711b626abd00e3142ffb3
SHA512

afb74b717482f4cae044e8b0e8cb362c2c3fbef9282004d1d7062a6d634ff3229f0a5fc2f3f191730e16a5caca0c4d18631d9fb7687d872ffec93459a57aafd5
SSDEEP

98304:7150ZCgssFKffCnRjy7tpQt3vraLYXPJKHpuR:R5Es8sfCjipi/u8XPoHpu

Score

10^/10

skuld persistence stealer upx

Malware Config

Signatures

Skuld stealer
An info stealer written in Go lang.
stealer skuld

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5076-0-0x0000000000610000-0x0000000001058000-memory.dmp	upx
behavioral2/memory/5076-1-0x0000000000610000-0x0000000001058000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

main.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	main.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

main.exe

description pid process

Token: SeDebugPrivilege 5076 main.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

main.exe

description pid process target process

PID 5076 wrote to memory of 3768 5076 main.exe attrib.exe
PID 5076 wrote to memory of 3768 5076 main.exe attrib.exe
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

3768 attrib.exe

description	pid	process
Token: SeDebugPrivilege	5076	main.exe

description	pid	process	target process
PID 5076 wrote to memory of 3768	5076	main.exe	attrib.exe
PID 5076 wrote to memory of 3768	5076	main.exe	attrib.exe

pid	process
3768	attrib.exe

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\main.exe
  2⤵
  - Views/modifies file attributes
  PID:3768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5076-0-0x0000000000610000-0x0000000001058000-memory.dmp

Filesize
10.3MB

Download
memory/5076-1-0x0000000000610000-0x0000000001058000-memory.dmp

Filesize
10.3MB

Download