Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 22:23
Behavioral task
behavioral1
Sample
tims external.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
tims external.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target tims external.exe
- Size 3.5MB
- Sample260802-2a2s3sysaz
- SHA256 390f9565d6870bf4113e892631ab3b031a667ae925de977cb4caaae5220f73c3
- MD5 8781d00925eca981b513ea88b78626c5
- SHA1 a27434c9066bcdd72fc2d16b3e0873c3dc959da1
- SHA512 34876f7135f6b52a41d96ab70c63acad44c84c564fc6fff3ff61ae7c9dfb82e3dd38d3ef5dcdcdfe35fd645df376bf8fcf4da683b8ae3fdca20570b9419947eb
- SSDEEP 98304:TFRoy38sw+X/xX8kRw/C3o+SzVdkXJIoTzkmHuVTp8/YDnho:TMM8sw+X5XP2wovPMJIeovy1
- TLSH T1FD06337EB2268792DA9E6372E47CC0A4385D7AB493E031F27351BEC3C6F835465395A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects SkuldStealer 3 IoCs
resource yara_rule behavioral2/memory/3632-1-0x0000000000C10000-0x0000000001608000-memory.dmp family_skuld behavioral2/memory/3632-2-0x0000000000C10000-0x0000000001608000-memory.dmp family_skuld behavioral2/memory/3632-3-0x0000000000C10000-0x0000000001608000-memory.dmp family_skuld - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com 6 api.ipify.org 2 api.ipify.org -
resource yara_rule behavioral2/memory/3632-0-0x0000000000C10000-0x0000000001608000-memory.dmp upx behavioral2/memory/3632-1-0x0000000000C10000-0x0000000001608000-memory.dmp upx behavioral2/memory/3632-2-0x0000000000C10000-0x0000000001608000-memory.dmp upx behavioral2/memory/3632-3-0x0000000000C10000-0x0000000001608000-memory.dmp upx - GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 7 Go-http-client/1.1 - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3648 wmic.exe 3648 wmic.exe 3648 wmic.exe 3648 wmic.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 3632 tims external.exe Token: SeIncreaseQuotaPrivilege 3648 wmic.exe Token: SeSecurityPrivilege 3648 wmic.exe Token: SeTakeOwnershipPrivilege 3648 wmic.exe Token: SeLoadDriverPrivilege 3648 wmic.exe Token: SeSystemProfilePrivilege 3648 wmic.exe Token: SeSystemtimePrivilege 3648 wmic.exe Token: SeProfSingleProcessPrivilege 3648 wmic.exe Token: SeIncBasePriorityPrivilege 3648 wmic.exe Token: SeCreatePagefilePrivilege 3648 wmic.exe Token: SeBackupPrivilege 3648 wmic.exe Token: SeRestorePrivilege 3648 wmic.exe Token: SeShutdownPrivilege 3648 wmic.exe Token: SeDebugPrivilege 3648 wmic.exe Token: SeSystemEnvironmentPrivilege 3648 wmic.exe Token: SeRemoteShutdownPrivilege 3648 wmic.exe Token: SeUndockPrivilege 3648 wmic.exe Token: SeManageVolumePrivilege 3648 wmic.exe Token: 33 3648 wmic.exe Token: 34 3648 wmic.exe Token: 35 3648 wmic.exe Token: 36 3648 wmic.exe Token: SeIncreaseQuotaPrivilege 3648 wmic.exe Token: SeSecurityPrivilege 3648 wmic.exe Token: SeTakeOwnershipPrivilege 3648 wmic.exe Token: SeLoadDriverPrivilege 3648 wmic.exe Token: SeSystemProfilePrivilege 3648 wmic.exe Token: SeSystemtimePrivilege 3648 wmic.exe Token: SeProfSingleProcessPrivilege 3648 wmic.exe Token: SeIncBasePriorityPrivilege 3648 wmic.exe Token: SeCreatePagefilePrivilege 3648 wmic.exe Token: SeBackupPrivilege 3648 wmic.exe Token: SeRestorePrivilege 3648 wmic.exe Token: SeShutdownPrivilege 3648 wmic.exe Token: SeDebugPrivilege 3648 wmic.exe Token: SeSystemEnvironmentPrivilege 3648 wmic.exe Token: SeRemoteShutdownPrivilege 3648 wmic.exe Token: SeUndockPrivilege 3648 wmic.exe Token: SeManageVolumePrivilege 3648 wmic.exe Token: 33 3648 wmic.exe Token: 34 3648 wmic.exe Token: 35 3648 wmic.exe Token: 36 3648 wmic.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3632 wrote to memory of 4904 3632 tims external.exe 89 PID 3632 wrote to memory of 3648 3632 tims external.exe 91 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4904 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tims external.exe"C:\Users\Admin\AppData\Local\Temp\tims external.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\tims external.exe"2⤵
- Views/modifies file attributes
PID:4904
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3648
-