Analysis
- user interaction
yes - max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 22:23
Behavioral task
behavioral1
Sample
tims external.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
tims external.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target tims external.exe
- Size 3.5MB
- Sample260802-2a2s3sysaz
- SHA256 390f9565d6870bf4113e892631ab3b031a667ae925de977cb4caaae5220f73c3
- MD5 8781d00925eca981b513ea88b78626c5
- SHA1 a27434c9066bcdd72fc2d16b3e0873c3dc959da1
- SHA512 34876f7135f6b52a41d96ab70c63acad44c84c564fc6fff3ff61ae7c9dfb82e3dd38d3ef5dcdcdfe35fd645df376bf8fcf4da683b8ae3fdca20570b9419947eb
- SSDEEP 98304:TFRoy38sw+X/xX8kRw/C3o+SzVdkXJIoTzkmHuVTp8/YDnho:TMM8sw+X5XP2wovPMJIeovy1
- TLSH T1FD06337EB2268792DA9E6372E47CC0A4385D7AB493E031F27351BEC3C6F835465395A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects SkuldStealer 6 IoCs
resource yara_rule behavioral1/memory/536-0-0x0000000000720000-0x0000000001118000-memory.dmp family_skuld behavioral1/memory/536-1-0x0000000000720000-0x0000000001118000-memory.dmp family_skuld behavioral1/memory/536-2-0x0000000000720000-0x0000000001118000-memory.dmp family_skuld behavioral1/memory/536-4-0x0000000000720000-0x0000000001118000-memory.dmp family_skuld behavioral1/memory/536-6-0x0000000000720000-0x0000000001118000-memory.dmp family_skuld behavioral1/memory/536-8-0x0000000000720000-0x0000000001118000-memory.dmp family_skuld - Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org 19 api.ipify.org 21 ip-api.com 42 ip-api.com -
resource yara_rule behavioral1/memory/536-0-0x0000000000720000-0x0000000001118000-memory.dmp upx behavioral1/memory/536-1-0x0000000000720000-0x0000000001118000-memory.dmp upx behavioral1/memory/536-2-0x0000000000720000-0x0000000001118000-memory.dmp upx behavioral1/memory/536-4-0x0000000000720000-0x0000000001118000-memory.dmp upx behavioral1/memory/536-6-0x0000000000720000-0x0000000001118000-memory.dmp upx behavioral1/memory/536-8-0x0000000000720000-0x0000000001118000-memory.dmp upx - GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 43 Go-http-client/1.1 - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 536 tims external.exe Token: SeIncreaseQuotaPrivilege 2108 wmic.exe Token: SeSecurityPrivilege 2108 wmic.exe Token: SeTakeOwnershipPrivilege 2108 wmic.exe Token: SeLoadDriverPrivilege 2108 wmic.exe Token: SeSystemProfilePrivilege 2108 wmic.exe Token: SeSystemtimePrivilege 2108 wmic.exe Token: SeProfSingleProcessPrivilege 2108 wmic.exe Token: SeIncBasePriorityPrivilege 2108 wmic.exe Token: SeCreatePagefilePrivilege 2108 wmic.exe Token: SeBackupPrivilege 2108 wmic.exe Token: SeRestorePrivilege 2108 wmic.exe Token: SeShutdownPrivilege 2108 wmic.exe Token: SeDebugPrivilege 2108 wmic.exe Token: SeSystemEnvironmentPrivilege 2108 wmic.exe Token: SeRemoteShutdownPrivilege 2108 wmic.exe Token: SeUndockPrivilege 2108 wmic.exe Token: SeManageVolumePrivilege 2108 wmic.exe Token: 33 2108 wmic.exe Token: 34 2108 wmic.exe Token: 35 2108 wmic.exe Token: 36 2108 wmic.exe Token: SeIncreaseQuotaPrivilege 2108 wmic.exe Token: SeSecurityPrivilege 2108 wmic.exe Token: SeTakeOwnershipPrivilege 2108 wmic.exe Token: SeLoadDriverPrivilege 2108 wmic.exe Token: SeSystemProfilePrivilege 2108 wmic.exe Token: SeSystemtimePrivilege 2108 wmic.exe Token: SeProfSingleProcessPrivilege 2108 wmic.exe Token: SeIncBasePriorityPrivilege 2108 wmic.exe Token: SeCreatePagefilePrivilege 2108 wmic.exe Token: SeBackupPrivilege 2108 wmic.exe Token: SeRestorePrivilege 2108 wmic.exe Token: SeShutdownPrivilege 2108 wmic.exe Token: SeDebugPrivilege 2108 wmic.exe Token: SeSystemEnvironmentPrivilege 2108 wmic.exe Token: SeRemoteShutdownPrivilege 2108 wmic.exe Token: SeUndockPrivilege 2108 wmic.exe Token: SeManageVolumePrivilege 2108 wmic.exe Token: 33 2108 wmic.exe Token: 34 2108 wmic.exe Token: 35 2108 wmic.exe Token: 36 2108 wmic.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 536 wrote to memory of 2516 536 tims external.exe 85 PID 536 wrote to memory of 2108 536 tims external.exe 89 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2516 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tims external.exe"C:\Users\Admin\AppData\Local\Temp\tims external.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\tims external.exe"2⤵
- Views/modifies file attributes
PID:2516
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2108
-