Overview

overview

10

Static

static

10

crusaderh.exe

windows10-2004-x64

10

crusaderh.exe

windows10-ltsc_2021-x64

10

crusaderh.exe

windows11-21h2-x64

10

Resubmissions

07/04/2025, 21:56

250407-1tnvwswky9 10

07/04/2025, 21:55

250407-1s4vqawky6 10

Analysis

  • max time kernel
    33s
  • max time network
    36s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250314-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    07/04/2025, 21:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    crusaderh.exe

  • Size

    10.3MB

  • MD5

    3546535c86608256106fbbcd12947541

  • SHA1

    fe89e73f8a6258d4802599cfeb68a5d64211f62b

  • SHA256

    3b3cfcf886394c7de10668f91f41842cf042f5eb3982dfab754c6c062b36968f

  • SHA512

    3386a25743192b625788d5f7ac0eb042c7b740448129e178ae4c3ca78384ea056653cadaed2487bfde7c103d8f18bbb6f80415a1ef160d00a536b046cd34f2d2

  • SSDEEP

    98304:IEmfFRZ6PUsNpPRK1GGnsC+asUL+R/w6sA0rn7AEcb:IvFRsPUXGGnsjjUL+R/wiy5cb

Score
10/10
skuldpersistencestealer

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1358292626033479860/bWGdGqkSCGvNdRIBRnMP6UScL2OEb5UwrQVRSjwGQZv-ahN0TLFNqRlxmegpGo3-6Lyl

Signatures

  • Skuld family
    skuld
  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\crusaderh.exe
    "C:\Users\Admin\AppData\Local\Temp\crusaderh.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5696
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\crusaderh.exe
      2⤵
      • Views/modifies file attributes
      PID:1952
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    PID:1468

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    Filesize

    9.3MB

    MD5

    c3afd1141367e528d81ba4f59543744f

    SHA1

    dfed0a1c01d9c76e30b61d03d4d4cb3279c9881f

    SHA256

    d983bc06471d2332be4c3af4ffa7ab1538a618b2ce8de95486d118aa2539ca34

    SHA512

    0aa3bafb81acc7230dcb5f43e57616827a5ee53db3f00613e44e94d4e02c8968f528b67fc47ba571df3f12bc5364c6c3901ee8eaf5aa856add26acb7bed8daf6

    Download Submit