skuld | dfd013a0e2566374af2ebd8285b007f98648d32818a78f26e0b54636b0a30d09

Analysis

max time kernel
3s
max time network
4s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2025, 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

java.exe
Size

3.1MB
MD5

52f6fdc64da8d83940ca9d41eb977642
SHA1

108c332d195c71c02fb5828c92511cef17f3f2c5
SHA256

dfd013a0e2566374af2ebd8285b007f98648d32818a78f26e0b54636b0a30d09
SHA512

ca8dd0d166ac0decfeddc976eff6c51ff84e68a33795ec75d850f37f326cd3f6032c676b3979e02b67b4db969ccb4bb621d8f5b98d3c44c53725198175c864f5
SSDEEP

98304:3rQ+aebSxU4J4uUVD/qxfkEHyHFK4rhWf9I:31NbSxgHzwlS3W

Score

10^/10

skuld stealer upx

Malware Config

Extracted

Family

skuld

https://discord.com/api/webhooks/1337103338013065317/vnGdvyysdbW3CdsH_5Wvz09nWo0u7sXuT9xKqqm6Y_jdYJrvazINIkq8YSg4t0-G9X2j

Signatures

Skuld family
skuld
Skuld stealer
An info stealer written in Go lang.
stealer skuld

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5416-0-0x00007FF771BF0000-0x00007FF77261B000-memory.dmp	upx
behavioral1/memory/5416-1-0x00007FF771BF0000-0x00007FF77261B000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5416	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5416 wrote to memory of 5296	5416	java.exe	87
PID 5416 wrote to memory of 5296	5416	java.exe	87

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5296	attrib.exe

C:\Users\Admin\AppData\Local\Temp\java.exe
"C:\Users\Admin\AppData\Local\Temp\java.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\java.exe
  2⤵
  - Views/modifies file attributes
  PID:5296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5416-0-0x00007FF771BF0000-0x00007FF77261B000-memory.dmp

Filesize
10.2MB

Download
memory/5416-1-0x00007FF771BF0000-0x00007FF77261B000-memory.dmp

Filesize
10.2MB

Download