Overview

overview

10

Static

static

3

2025-04-20...ch.exe

windows10-2004-x64

10

2025-04-20...ch.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    105s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250410-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/04/2025, 22:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-20_ceef5ed46adabf633d4475585bc179c3_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe

  • Size

    10.3MB

  • MD5

    ceef5ed46adabf633d4475585bc179c3

  • SHA1

    b3bcadd9d8c718b8cdcfa5041b4536fd9d40177e

  • SHA256

    b7903a40c0e842844a520e7a83dc75afb8a149138fa1f7660ca60b3a2d3446ec

  • SHA512

    b39b368f8fefdad0fecaae400acb21542940ae0752eba65fe832993e5c98bdbe806508792b48b9d7ca5812fcba2ff9da9997ad234573e80402d12708858ed682

  • SSDEEP

    98304:JweCb+Tm9b6V+eOAyfVracl+A9rUhUheEEbPhhlxa:JrCbMm9QOAyfVWcl5dbEbJ

Score
10/10
skuldpersistencestealer

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1363515615066980373/T6lkOVEKv7irgU64Lu2XAKyjuMv0154kp6uPvUcuKY5wDPExChNH1WmD9HdAZH2DVB9_

Signatures

  • Skuld family
    skuld
  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-20_ceef5ed46adabf633d4475585bc179c3_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-20_ceef5ed46adabf633d4475585bc179c3_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4220
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2025-04-20_ceef5ed46adabf633d4475585bc179c3_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
      2⤵
      • Views/modifies file attributes
      PID:5232
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    PID:5436

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    Filesize

    9.4MB

    MD5

    2ee6cf991fcffea2690181913222dbb3

    SHA1

    96d09804663490373872a649fe97032b447a8681

    SHA256

    42b4ac6132984316034fe83273892055c2fb8e3b70151ccb3779a06879e69a90

    SHA512

    207b6306a186a08a751b617c244b8a591b31f0a1557ebee599d6abc863493964a3ab40ef9e16a93415538d7ee4be11ba7b590588b88089b2bce99593ac3614fd

    Download Submit