Overview

overview

10

Static

static

10

skuld.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    14s
  • max time network
    16s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/04/2025, 20:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    skuld.exe

  • Size

    10.3MB

  • MD5

    8b844f81ee3b1f6b91f70e8e83210f5b

  • SHA1

    5e2c67f68ea2d2d1d331edd000bcb7b1d12624ea

  • SHA256

    f9bde9d5622470f983e497aa54ca8333796bbb7b1fa92d49fb8e50b05489fab6

  • SHA512

    485a868d8f6e1dbe9575644ed5a252bbc8e86bd28c6adb9090b5d31b97953db3801d6261f4ea90b3f4181265123047855790d1897909f509633c8f88decf2a23

  • SSDEEP

    98304:8lJTC3t04XErIWPjfR/dUCBA0rU0UhZEPbl:8nTC904ajfR/dUCiL6Pbl

Score
10/10
skuldpersistencestealer

Malware Config

Extracted

Family

skuld

C2

https://discordapp.com/api/webhooks/1358176018480763082/KRzYhVK83SkkWXqkgpHZchqaHT7jufMoWg40zH8kOvRh-ra5lweCdwpMBFLX669IaMx7

Signatures

  • Skuld family
    skuld
  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\skuld.exe
    "C:\Users\Admin\AppData\Local\Temp\skuld.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\skuld.exe
      2⤵
      • Views/modifies file attributes
      PID:3296
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    PID:3388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    Filesize

    7.0MB

    MD5

    1dd59cd7f8f9ac9d873e64125c72052d

    SHA1

    a9addce83b4f0c45ec4c7ab9ac4ca380e51c9fb3

    SHA256

    46ceb5653967d33fde527a089c91333b8d7b3e7f0d3a5f66564312fb608fa3cb

    SHA512

    f1681dff5e277f28a48bdad91bb8023631603595802d6973803def0e2afc0bd32d7243f1d6060cb89aeda3fe801e8bbad351cf671fe6df97638c9ed3ce61a52e

    Download Submit