Resubmissions
08-11-2024 22:44
241108-2nx22s1jg1 10Analysis
-
max time kernel
116s -
max time network
115s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
08-11-2024 22:44
Behavioral task
behavioral1
Sample
slinky.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
15 signatures
1800 seconds
General
-
Target
slinky.exe
-
Size
14.2MB
-
MD5
d02a74cc7cb238ae3ef85ea82fade1ed
-
SHA1
af4b5c5c803f76faace1695b4a7018f1b87c3a51
-
SHA256
64fd7264b8e2bc82b4012b191049a923f8bb3dc6d99c261a2ad07871f1d8b91c
-
SHA512
77696145cab73ce201e5231feb020f645fa0cd23fcd4b1eef0cd695e5544410a3f127dd0c6f3723a17836e59f90e96e50770591650f3ce36fe22f1ce2168f04b
-
SSDEEP
196608:ZWJafoL/tUoTX4Z2bh1Yf0k7Ma/rkFlgdTaUrPPbdfw:ZWsfm/vbh1lkSFCdTauZo
Score
10/10
Malware Config
Extracted
Family
skuld
C2
https://ptb.discord.com/api/webhooks/1296774769303359571/SuAqJEaZ8HyMJeY4XNdTzjqboa7EQQC9NlFu7Nm8gWVWabNPEFyEqvUIK1mdFAcYMMWN
Signatures
-
Skuld family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe" slinky.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org 8 ip-api.com 4 api.ipify.org -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 9 Go-http-client/1.1 -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings taskmgr.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C slinky.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 slinky.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 slinky.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1464 wmic.exe 1464 wmic.exe 1464 wmic.exe 1464 wmic.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1060 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 552 slinky.exe Token: SeIncreaseQuotaPrivilege 1464 wmic.exe Token: SeSecurityPrivilege 1464 wmic.exe Token: SeTakeOwnershipPrivilege 1464 wmic.exe Token: SeLoadDriverPrivilege 1464 wmic.exe Token: SeSystemProfilePrivilege 1464 wmic.exe Token: SeSystemtimePrivilege 1464 wmic.exe Token: SeProfSingleProcessPrivilege 1464 wmic.exe Token: SeIncBasePriorityPrivilege 1464 wmic.exe Token: SeCreatePagefilePrivilege 1464 wmic.exe Token: SeBackupPrivilege 1464 wmic.exe Token: SeRestorePrivilege 1464 wmic.exe Token: SeShutdownPrivilege 1464 wmic.exe Token: SeDebugPrivilege 1464 wmic.exe Token: SeSystemEnvironmentPrivilege 1464 wmic.exe Token: SeRemoteShutdownPrivilege 1464 wmic.exe Token: SeUndockPrivilege 1464 wmic.exe Token: SeManageVolumePrivilege 1464 wmic.exe Token: 33 1464 wmic.exe Token: 34 1464 wmic.exe Token: 35 1464 wmic.exe Token: 36 1464 wmic.exe Token: SeIncreaseQuotaPrivilege 1464 wmic.exe Token: SeSecurityPrivilege 1464 wmic.exe Token: SeTakeOwnershipPrivilege 1464 wmic.exe Token: SeLoadDriverPrivilege 1464 wmic.exe Token: SeSystemProfilePrivilege 1464 wmic.exe Token: SeSystemtimePrivilege 1464 wmic.exe Token: SeProfSingleProcessPrivilege 1464 wmic.exe Token: SeIncBasePriorityPrivilege 1464 wmic.exe Token: SeCreatePagefilePrivilege 1464 wmic.exe Token: SeBackupPrivilege 1464 wmic.exe Token: SeRestorePrivilege 1464 wmic.exe Token: SeShutdownPrivilege 1464 wmic.exe Token: SeDebugPrivilege 1464 wmic.exe Token: SeSystemEnvironmentPrivilege 1464 wmic.exe Token: SeRemoteShutdownPrivilege 1464 wmic.exe Token: SeUndockPrivilege 1464 wmic.exe Token: SeManageVolumePrivilege 1464 wmic.exe Token: 33 1464 wmic.exe Token: 34 1464 wmic.exe Token: 35 1464 wmic.exe Token: 36 1464 wmic.exe Token: SeDebugPrivilege 1060 taskmgr.exe Token: SeSystemProfilePrivilege 1060 taskmgr.exe Token: SeCreateGlobalPrivilege 1060 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 552 wrote to memory of 1888 552 slinky.exe 83 PID 552 wrote to memory of 1888 552 slinky.exe 83 PID 552 wrote to memory of 5060 552 slinky.exe 84 PID 552 wrote to memory of 5060 552 slinky.exe 84 PID 552 wrote to memory of 1464 552 slinky.exe 85 PID 552 wrote to memory of 1464 552 slinky.exe 85 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1888 attrib.exe 5060 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\slinky.exe"C:\Users\Admin\AppData\Local\Temp\slinky.exe"1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\slinky.exe2⤵
- Views/modifies file attributes
PID:1888
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- Views/modifies file attributes
PID:5060
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1464
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1060
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3364
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.2MB
MD5d02a74cc7cb238ae3ef85ea82fade1ed
SHA1af4b5c5c803f76faace1695b4a7018f1b87c3a51
SHA25664fd7264b8e2bc82b4012b191049a923f8bb3dc6d99c261a2ad07871f1d8b91c
SHA51277696145cab73ce201e5231feb020f645fa0cd23fcd4b1eef0cd695e5544410a3f127dd0c6f3723a17836e59f90e96e50770591650f3ce36fe22f1ce2168f04b