skuld | 4c62630d86e3a8989ab9167a21822e686b9559e55421a1c779ad05eccfc6c908

Analysis

max time kernel
103s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
13/04/2025, 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-13_e80a935708de68867ead4bb0970a1cb6_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
Size

10.3MB
MD5

e80a935708de68867ead4bb0970a1cb6
SHA1

caa4a3e54c849a1c8cb8e095e2f022942a9d5410
SHA256

4c62630d86e3a8989ab9167a21822e686b9559e55421a1c779ad05eccfc6c908
SHA512

d56f447971d9605491366d3e15fb264ff5a8b722a9fbc3d0e172ce7386b263b6f3a4a654f59e26bcccf0fbdc70a499500cc5e5363218d16e08deb3b7e3a7914b
SSDEEP

98304:AkbS4GeZk9WMOfpgu+NsFUqNEXzR/wLA0rn7QEMb:Ad4dZkFu+NsyCEXzR/wcypMb

Score

10^/10

skuld persistence stealer

Malware Config

Extracted

Family

skuld

https://discord.com/api/webhooks/1359962319148552262/rZhAvPTXLzaOSKyR1uwxW6MD_NJEUB5gXuznUEFFSSsBRLToarEs-ALUaMaDYY8Kazj0

Signatures

Skuld family
skuld
Skuld stealer
An info stealer written in Go lang.
stealer skuld

Executes dropped EXE 1 IoCs

pid	Process
3204	SecurityHealthSystray.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	2025-04-13_e80a935708de68867ead4bb0970a1cb6_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6024	2025-04-13_e80a935708de68867ead4bb0970a1cb6_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
Token: SeDebugPrivilege	3204	SecurityHealthSystray.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 6024 wrote to memory of 3788	6024	2025-04-13_e80a935708de68867ead4bb0970a1cb6_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe	86
PID 6024 wrote to memory of 3788	6024	2025-04-13_e80a935708de68867ead4bb0970a1cb6_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe	86
PID 3436 wrote to memory of 3204	3436	cmd.exe	89
PID 3436 wrote to memory of 3204	3436	cmd.exe	89
PID 3204 wrote to memory of 932	3204	SecurityHealthSystray.exe	91
PID 3204 wrote to memory of 932	3204	SecurityHealthSystray.exe	91

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3788	attrib.exe
932	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2025-04-13_e80a935708de68867ead4bb0970a1cb6_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-13_e80a935708de68867ead4bb0970a1cb6_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6024
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\2025-04-13_e80a935708de68867ead4bb0970a1cb6_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
  2⤵
  - Views/modifies file attributes
  PID:3788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    3⤵
    - Views/modifies file attributes
    PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe

Filesize
10.3MB

MD5
e80a935708de68867ead4bb0970a1cb6

SHA1
caa4a3e54c849a1c8cb8e095e2f022942a9d5410

SHA256
4c62630d86e3a8989ab9167a21822e686b9559e55421a1c779ad05eccfc6c908

SHA512
d56f447971d9605491366d3e15fb264ff5a8b722a9fbc3d0e172ce7386b263b6f3a4a654f59e26bcccf0fbdc70a499500cc5e5363218d16e08deb3b7e3a7914b

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads