Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2024 07:33

General

  • Target

    cmd.exe

  • Size

    9.9MB

  • MD5

    240ff0a244a7a888a0df074b70473063

  • SHA1

    85be735983e86eb656a920dde212fc5d467d642c

  • SHA256

    f596fc4e9e9568c7fe0cac3b46d5e23932062cadc20f1c055f2ac2ab884bd00a

  • SHA512

    83ea2029ea67799889cb3b088bb717fc41a1db85819ca42078de57aa0fb6cc66b578e6642a84d9ac0fb26cd3897ed1cd046e7818d0e79394ee6f149fbb1c2c4d

  • SSDEEP

    98304:pzU4brhxBASgf/gEpiji6Ig8TWApEIICafZm/mbnXg:pxrhxBAGZji6IdThqRTXg

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1303801444024979538/ccYtBFXL53k2JjPdccF4_Q0RyJhiTuYgSfRuahpcQBQF-lyG_YEYV7JcEsJ-czgGGLml

Signatures

  • Skuld family
  • Skuld stealer

    An info stealer written in Go lang.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cmd.exe
    "C:\Users\Admin\AppData\Local\Temp\cmd.exe"
    1⤵
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\cmd.exe
      2⤵
      • Views/modifies file attributes
      PID:536
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      2⤵
      • Views/modifies file attributes
      PID:1712
    • C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe

    Filesize

    9.9MB

    MD5

    240ff0a244a7a888a0df074b70473063

    SHA1

    85be735983e86eb656a920dde212fc5d467d642c

    SHA256

    f596fc4e9e9568c7fe0cac3b46d5e23932062cadc20f1c055f2ac2ab884bd00a

    SHA512

    83ea2029ea67799889cb3b088bb717fc41a1db85819ca42078de57aa0fb6cc66b578e6642a84d9ac0fb26cd3897ed1cd046e7818d0e79394ee6f149fbb1c2c4d