Overview

overview

10

Static

static

3

2025-04-20...ch.exe

windows10-2004-x64

10

2025-04-20...ch.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    103s
  • max time network
    105s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250410-en
  • resource tags

    arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    20/04/2025, 22:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-20_ceef5ed46adabf633d4475585bc179c3_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe

  • Size

    10.3MB

  • MD5

    ceef5ed46adabf633d4475585bc179c3

  • SHA1

    b3bcadd9d8c718b8cdcfa5041b4536fd9d40177e

  • SHA256

    b7903a40c0e842844a520e7a83dc75afb8a149138fa1f7660ca60b3a2d3446ec

  • SHA512

    b39b368f8fefdad0fecaae400acb21542940ae0752eba65fe832993e5c98bdbe806508792b48b9d7ca5812fcba2ff9da9997ad234573e80402d12708858ed682

  • SSDEEP

    98304:JweCb+Tm9b6V+eOAyfVracl+A9rUhUheEEbPhhlxa:JrCbMm9QOAyfVWcl5dbEbJ

Score
10/10
skuldpersistencestealer

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1363515615066980373/T6lkOVEKv7irgU64Lu2XAKyjuMv0154kp6uPvUcuKY5wDPExChNH1WmD9HdAZH2DVB9_

Signatures

  • Skuld family
    skuld
  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-20_ceef5ed46adabf633d4475585bc179c3_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-20_ceef5ed46adabf633d4475585bc179c3_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2025-04-20_ceef5ed46adabf633d4475585bc179c3_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
      2⤵
      • Views/modifies file attributes
      PID:1816
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3796

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    Filesize

    9.8MB

    MD5

    0e6fdfb79230494af35db08015dfcfbb

    SHA1

    e6903205aec6d08beccae1aee49f944882a04597

    SHA256

    668daac72418fcb5a40dc66965ee1ef176450989a91c568fdef2dabee859bf9b

    SHA512

    e7d95982ad01432227dcc4e43ecc0291a7c6c6f1bd3c3acebb53d3b8f41516b91daebb9ec07225d220bcc12b073b60d02d44e8d903395f3baac4dacfdd5fb1b7

    Download Submit