Overview

overview

10

Static

static

3

2025-04-20...ch.exe

windows10-2004-x64

10

2025-04-20...ch.exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    104s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250410-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/04/2025, 22:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-20_ceef5ed46adabf633d4475585bc179c3_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe

  • Size

    10.3MB

  • MD5

    ceef5ed46adabf633d4475585bc179c3

  • SHA1

    b3bcadd9d8c718b8cdcfa5041b4536fd9d40177e

  • SHA256

    b7903a40c0e842844a520e7a83dc75afb8a149138fa1f7660ca60b3a2d3446ec

  • SHA512

    b39b368f8fefdad0fecaae400acb21542940ae0752eba65fe832993e5c98bdbe806508792b48b9d7ca5812fcba2ff9da9997ad234573e80402d12708858ed682

  • SSDEEP

    98304:JweCb+Tm9b6V+eOAyfVracl+A9rUhUheEEbPhhlxa:JrCbMm9QOAyfVWcl5dbEbJ

Score
10/10
skuldpersistencestealer

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1363515615066980373/T6lkOVEKv7irgU64Lu2XAKyjuMv0154kp6uPvUcuKY5wDPExChNH1WmD9HdAZH2DVB9_

Signatures

  • Skuld family
    skuld
  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-20_ceef5ed46adabf633d4475585bc179c3_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-20_ceef5ed46adabf633d4475585bc179c3_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3484
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2025-04-20_ceef5ed46adabf633d4475585bc179c3_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
      2⤵
      • Views/modifies file attributes
      PID:1600
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    PID:5036

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    Filesize

    6.8MB

    MD5

    62a6d7afdeaca105e5941628242e6e78

    SHA1

    4c41dcdbf9872dc3b6072bc82fcab7bbea3a0107

    SHA256

    d010592f0e34da114848b768893f17057cd6154fb947d8d62722113bee0f1f11

    SHA512

    b2f834ff12621cc27d06a0bfa4f5012b1a77525191ee3e16d4ba1f85e484f0429c5dde62d8fe794fefa1074dbece29eeb99db1638e3b5e0bb40067618d0f8a92

    Download Submit