Overview

overview

10

Static

static

10

2025-04-19...ch.exe

windows10-2004-x64

10

2025-04-19...ch.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    101s
  • max time network
    104s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250410-en
  • resource tags

    arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19/04/2025, 21:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-19_389a06b07cba83dbb84fa1b1abb68de2_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe

  • Size

    10.2MB

  • MD5

    389a06b07cba83dbb84fa1b1abb68de2

  • SHA1

    fae30c76998aa8b9d8e5ac3dd40f5f07c89639d2

  • SHA256

    b5b2c083eb9c1286c263bebc4280d1ae3fa0fd96ab1afd8ab6240e87cd9d660a

  • SHA512

    7d359c0837123899818f6dc08ff48ba75897a707294990d70e7ffdb60d340d46c70b8220a0058225c4d21991f8282b9efa403f8e5747a3300cf9ff5a12bcce5f

  • SSDEEP

    98304:nvU6XUJNe9vI/XtozXTTs4E5UwqR+jAqrRL/HEqUYew5:n87NeK/XKri5UwqR+Eksq

Score
10/10
skuldpersistencestealer

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1347918418443112581/GkDwq8MHjdCAhyHtTdvrRd6q8Bx-z0ijbWTpNUbq0uK2sxpU3rbS1VmRdlbJmS43hP3U

Signatures

  • Skuld family
    skuld
  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-19_389a06b07cba83dbb84fa1b1abb68de2_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-19_389a06b07cba83dbb84fa1b1abb68de2_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2025-04-19_389a06b07cba83dbb84fa1b1abb68de2_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
      2⤵
      • Views/modifies file attributes
      PID:5760
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    1⤵
      PID:420

    Network

    MITRE ATT&CK Enterprise v16

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      Filesize

      10.2MB

      MD5

      389a06b07cba83dbb84fa1b1abb68de2

      SHA1

      fae30c76998aa8b9d8e5ac3dd40f5f07c89639d2

      SHA256

      b5b2c083eb9c1286c263bebc4280d1ae3fa0fd96ab1afd8ab6240e87cd9d660a

      SHA512

      7d359c0837123899818f6dc08ff48ba75897a707294990d70e7ffdb60d340d46c70b8220a0058225c4d21991f8282b9efa403f8e5747a3300cf9ff5a12bcce5f

      Download Submit