skuld | e2386170a278f82835c7c888d330fca7f058588cee728db554af82766f373520

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2024 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

skuld.exe
Size

3.2MB
MD5

51ff57438f949975b4968961bc2642c4
SHA1

cba4898a4d42746c39fe11ebcd4045d4630932b2
SHA256

e2386170a278f82835c7c888d330fca7f058588cee728db554af82766f373520
SHA512

cb1b62473c08d25b49a9c5618ef0399db7bccff983cb11dfd9ec624a203ec1ef3958eef9822672c94676a7cdd484334dca03387450915dddc593bf4541efe859
SSDEEP

98304:9TlvH/VJ51LkW/0A3u+tjoOPztarROVJeE:bVKOu+pkROVJ

Score

10^/10

skuld discovery persistence stealer upx

Malware Config

Extracted

Family

skuld

https://discord.com/api/webhooks/1297685898183315507/dhotfNp8hFrKwfpwrk-upDYLgWkBSeuTImqAAVTnlndZgb3UvqPW2LZA6LIM7wOIg4Sp

Signatures

Skuld stealer
An info stealer written in Go lang.
stealer skuld

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	skuld.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3648-0-0x0000000000D50000-0x0000000001798000-memory.dmp	upx
behavioral2/memory/3648-1-0x0000000000D50000-0x0000000001798000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
4436	msedge.exe
4436	msedge.exe
944	identity_helper.exe
944	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3648	skuld.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 2920	3648	skuld.exe	85
PID 3648 wrote to memory of 2920	3648	skuld.exe	85
PID 4436 wrote to memory of 1800	4436	msedge.exe	102
PID 4436 wrote to memory of 1800	4436	msedge.exe	102
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 744	4436	msedge.exe	103
PID 4436 wrote to memory of 624	4436	msedge.exe	104
PID 4436 wrote to memory of 624	4436	msedge.exe	104
PID 4436 wrote to memory of 4704	4436	msedge.exe	105
PID 4436 wrote to memory of 4704	4436	msedge.exe	105
PID 4436 wrote to memory of 4704	4436	msedge.exe	105
PID 4436 wrote to memory of 4704	4436	msedge.exe	105
PID 4436 wrote to memory of 4704	4436	msedge.exe	105
PID 4436 wrote to memory of 4704	4436	msedge.exe	105
PID 4436 wrote to memory of 4704	4436	msedge.exe	105
PID 4436 wrote to memory of 4704	4436	msedge.exe	105
PID 4436 wrote to memory of 4704	4436	msedge.exe	105
PID 4436 wrote to memory of 4704	4436	msedge.exe	105
PID 4436 wrote to memory of 4704	4436	msedge.exe	105
PID 4436 wrote to memory of 4704	4436	msedge.exe	105
PID 4436 wrote to memory of 4704	4436	msedge.exe	105
PID 4436 wrote to memory of 4704	4436	msedge.exe	105
PID 4436 wrote to memory of 4704	4436	msedge.exe	105
PID 4436 wrote to memory of 4704	4436	msedge.exe	105
PID 4436 wrote to memory of 4704	4436	msedge.exe	105
PID 4436 wrote to memory of 4704	4436	msedge.exe	105

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2920	attrib.exe

C:\Users\Admin\AppData\Local\Temp\skuld.exe
"C:\Users\Admin\AppData\Local\Temp\skuld.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\skuld.exe
  2⤵
  - Views/modifies file attributes
  PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb840d46f8,0x7ffb840d4708,0x7ffb840d4718
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,8170126300015286476,17942657849539385850,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,8170126300015286476,17942657849539385850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,8170126300015286476,17942657849539385850,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8170126300015286476,17942657849539385850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8170126300015286476,17942657849539385850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8170126300015286476,17942657849539385850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8170126300015286476,17942657849539385850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,8170126300015286476,17942657849539385850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,8170126300015286476,17942657849539385850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8170126300015286476,17942657849539385850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8170126300015286476,17942657849539385850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8170126300015286476,17942657849539385850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:1912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d6ec2888b1504d7be13ecfc612c83acf

SHA1
43f1ba63eae86e9ccd79737c20f06765aac8801e

SHA256
73095900881df5182535b1bb3375a2fbeda4359689252e8d986b5ec87fcd022a

SHA512
30dcc1050e2645b68f8a0cf9d76ed757119339dd39b7a21239579b6b8738bc6c8e5f1076a3278569b174c3b675350b0b80c6160a867aa18cf928d55a076a2ceb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
71c0e270fb2e560796d92f81d756190c

SHA1
2265917361c7356204024f80b90e5aa7c8039416

SHA256
9a3b8b564632d4efa9cb6d5e1fe5cc5e83a560a3e0a254c392317abc47f54775

SHA512
c2d131bcab45f33aa00d44f2adbceece1bb9838b7a1fc80762b5a90b4a52f789afce5f79b318e22654cde12ae205a8b7edad328f5ee7e7c55ba4f33780b82258

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6337f62e360fab27bb4c40a84490acb1

SHA1
51f832ea0df1d317d8f6a64cd651806c097a143b

SHA256
d5dede6243f6c4811f4c10ffd4bbea615082dec3b104a2edfad160fce62a8145

SHA512
9d7cbd82265ad934fda71bac9cd13088b03d0efd7199374f08034cc5c463c82b6ed2086657bda575f326a0c045034118330b91e69b4f2ae030d3160ab25ca593

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
84f1fcc5b6788890775381e35da5c6f0

SHA1
d5a19a5abd9c1adb454d38e428bb91c0841f1993

SHA256
2de7c3da40f09a8c3b8c2542938b9bfcce8d28235eb2119b35f407ec3bd5b082

SHA512
14dffa901d39a5a3b5692ef3a4b79edd5bdac759d82657e39052bf8c5be12b884ac17d245e197a3bf23aca5798a2108a2420c51374be086c64711781809183c9

Download Submit
memory/3648-0-0x0000000000D50000-0x0000000001798000-memory.dmp

Filesize
10.3MB

Download
memory/3648-1-0x0000000000D50000-0x0000000001798000-memory.dmp

Filesize
10.3MB

Download