Overview

overview

10

Static

static

3

0RMQNB2.vmp.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2024 06:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0RMQNB2.vmp.exe

  • Size

    13.6MB

  • MD5

    537e63b336d6786b54142a3858d04cfc

  • SHA1

    d45e5d30634b91a59bfdc8cf882a910409d52543

  • SHA256

    82fcf0065f059a7a65719efbd76369f70043fd68880b96074d3da82c0f8e693d

  • SHA512

    59665fdb746fe15dab993b0550af789b1fd5caa6a365d41f20715b0bb9d9ddc19cf14569582e217523c379fcdf07437ee063ea6a47822aea13c33f8b39857295

  • SSDEEP

    393216:fgQy/GlBZVPOnr4jdmRwb2c1KVjWAYI9aZ+5B:fgwfA+qwb3sV6AYB

Score
10/10
skuldstealer

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1278685696588124283/sHga8EVjouFXXrvPxaHU2YXCRJIVE1RYWbSaVSKowDG7Boj-3cTXc-qc4i12g0-7911uD

Signatures

  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0RMQNB2.vmp.exe
    "C:\Users\Admin\AppData\Local\Temp\0RMQNB2.vmp.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4504-0-0x00007FFDBB780000-0x00007FFDBB921000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4504-1-0x00007FFDBBD50000-0x00007FFDBBD52000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4504-2-0x00000000007F0000-0x00000000028CB000-memory.dmp

    Filesize

    32.9MB

    Download

  • memory/4504-13-0x00007FFDBB780000-0x00007FFDBB921000-memory.dmp

    Filesize

    1.6MB

    Download