Analysis

  • max time kernel
    1368s
  • max time network
    1430s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    26-10-2024 20:06

General

  • Target

    main.exe

  • Size

    14.2MB

  • MD5

    32555cfe5d6baeaf6a7fe7bb7fb65b2c

  • SHA1

    d96b09517a45fdbcb852751dadbf6f8ba880c809

  • SHA256

    7514379d03a14596ecf9e1a378d844d90314561d660e0c3947131e279fa27f73

  • SHA512

    53ff705e8180255fed91da6d1e671b4cdd5d9bb837679748d54acb7da75a8419684d9795e69fa259b6b89e9f09678dde8d941de74e7d3034e43a593a11ad7f1e

  • SSDEEP

    196608:JMhP4WgzpUmKAUIo4z3wVSIPLFFrL0AGtWT6U:JyP2Zo40HLvL7Gty

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1253745341237301298/0bupEAbWw7WhJJNHQZuklnmeXgWr4vsCHwsXRKwqRFI02WfhfcKZFllI_i5uOwkWj_II

Signatures

  • Skuld family
  • Skuld stealer

    An info stealer written in Go lang.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    1⤵
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3472
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\main.exe
      2⤵
      • Views/modifies file attributes
      PID:3460
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      2⤵
      • Views/modifies file attributes
      PID:4772
    • C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe

    Filesize

    14.2MB

    MD5

    32555cfe5d6baeaf6a7fe7bb7fb65b2c

    SHA1

    d96b09517a45fdbcb852751dadbf6f8ba880c809

    SHA256

    7514379d03a14596ecf9e1a378d844d90314561d660e0c3947131e279fa27f73

    SHA512

    53ff705e8180255fed91da6d1e671b4cdd5d9bb837679748d54acb7da75a8419684d9795e69fa259b6b89e9f09678dde8d941de74e7d3034e43a593a11ad7f1e