Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/08/2026, 02:48
Behavioral task
behavioral1
Sample
skuld.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
skuld.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target skuld.exe
- Size 15.3MB
- Sample260806-daxmcsxtdw
- SHA256 a48d13c8760ba533fef095ce3c303b81662f684809138fbaa4310edea6d4c260
- MD5 b71e222e7daf72a0bcddc27dcc9cb7f5
- SHA1 b0fc85f0d14f02a15ec0d829bf23baea85ead7d4
- SHA512 5f9b282b0e84e443ce90f2c1ff13224a4b9a1e60f100d60e0c974a36851a99fd2950eaa381dec3ba92d51ab955d5d52109feaf290e2d62c72d1cd3011dc2a48e
- SSDEEP 196608:15+4UVyZ6jSvZ5n9pTY3kUGERodlqd0mdmM5WIOC:1rUe59OGGodlVlMcIO
- TLSH T174F68D43ECB556E9C099917AC6668612BB753C884B3163D36B60FB346F33BD0AE78740
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects SkuldStealer 1 IoCs
resource yara_rule behavioral1/files/0x00020000000233b5-4.dat family_skuld - Executes dropped EXE 2 IoCs
pid Process 2328 SecurityHealthSystray.exe 5676 SecurityHealthWatcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe" skuld.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Watcher Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthWatcher.exe" skuld.exe - Looks up external IP address via web service 1 TTPs 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 ip-api.com 60 api.ipify.org 61 api.ipify.org 5 api.ipify.org 13 api.ipify.org 15 api.ipify.org - Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 3944 netsh.exe 3908 netsh.exe 4468 netsh.exe 3508 netsh.exe 3712 netsh.exe 4424 netsh.exe - Detects videocard installed 1 TTPs 6 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1568 wmic.exe 5236 wmic.exe 5220 wmic.exe 2084 wmic.exe 3772 wmic.exe 1068 wmic.exe - GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 18 Go-http-client/1.1 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5768 skuld.exe Token: SeIncreaseQuotaPrivilege 5488 wmic.exe Token: SeSecurityPrivilege 5488 wmic.exe Token: SeTakeOwnershipPrivilege 5488 wmic.exe Token: SeLoadDriverPrivilege 5488 wmic.exe Token: SeSystemProfilePrivilege 5488 wmic.exe Token: SeSystemtimePrivilege 5488 wmic.exe Token: SeProfSingleProcessPrivilege 5488 wmic.exe Token: SeIncBasePriorityPrivilege 5488 wmic.exe Token: SeCreatePagefilePrivilege 5488 wmic.exe Token: SeBackupPrivilege 5488 wmic.exe Token: SeRestorePrivilege 5488 wmic.exe Token: SeShutdownPrivilege 5488 wmic.exe Token: SeDebugPrivilege 5488 wmic.exe Token: SeSystemEnvironmentPrivilege 5488 wmic.exe Token: SeRemoteShutdownPrivilege 5488 wmic.exe Token: SeUndockPrivilege 5488 wmic.exe Token: SeManageVolumePrivilege 5488 wmic.exe Token: 33 5488 wmic.exe Token: 34 5488 wmic.exe Token: 35 5488 wmic.exe Token: 36 5488 wmic.exe Token: SeIncreaseQuotaPrivilege 5488 wmic.exe Token: SeSecurityPrivilege 5488 wmic.exe Token: SeTakeOwnershipPrivilege 5488 wmic.exe Token: SeLoadDriverPrivilege 5488 wmic.exe Token: SeSystemProfilePrivilege 5488 wmic.exe Token: SeSystemtimePrivilege 5488 wmic.exe Token: SeProfSingleProcessPrivilege 5488 wmic.exe Token: SeIncBasePriorityPrivilege 5488 wmic.exe Token: SeCreatePagefilePrivilege 5488 wmic.exe Token: SeBackupPrivilege 5488 wmic.exe Token: SeRestorePrivilege 5488 wmic.exe Token: SeShutdownPrivilege 5488 wmic.exe Token: SeDebugPrivilege 5488 wmic.exe Token: SeSystemEnvironmentPrivilege 5488 wmic.exe Token: SeRemoteShutdownPrivilege 5488 wmic.exe Token: SeUndockPrivilege 5488 wmic.exe Token: SeManageVolumePrivilege 5488 wmic.exe Token: 33 5488 wmic.exe Token: 34 5488 wmic.exe Token: 35 5488 wmic.exe Token: 36 5488 wmic.exe Token: SeIncreaseQuotaPrivilege 5280 wmic.exe Token: SeSecurityPrivilege 5280 wmic.exe Token: SeTakeOwnershipPrivilege 5280 wmic.exe Token: SeLoadDriverPrivilege 5280 wmic.exe Token: SeSystemProfilePrivilege 5280 wmic.exe Token: SeSystemtimePrivilege 5280 wmic.exe Token: SeProfSingleProcessPrivilege 5280 wmic.exe Token: SeIncBasePriorityPrivilege 5280 wmic.exe Token: SeCreatePagefilePrivilege 5280 wmic.exe Token: SeBackupPrivilege 5280 wmic.exe Token: SeRestorePrivilege 5280 wmic.exe Token: SeShutdownPrivilege 5280 wmic.exe Token: SeDebugPrivilege 5280 wmic.exe Token: SeSystemEnvironmentPrivilege 5280 wmic.exe Token: SeRemoteShutdownPrivilege 5280 wmic.exe Token: SeUndockPrivilege 5280 wmic.exe Token: SeManageVolumePrivilege 5280 wmic.exe Token: 33 5280 wmic.exe Token: 34 5280 wmic.exe Token: 35 5280 wmic.exe Token: 36 5280 wmic.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 5768 wrote to memory of 5776 5768 skuld.exe 85 PID 5768 wrote to memory of 5488 5768 skuld.exe 86 PID 5768 wrote to memory of 5280 5768 skuld.exe 88 PID 5768 wrote to memory of 764 5768 skuld.exe 89 PID 5768 wrote to memory of 2084 5768 skuld.exe 90 PID 5768 wrote to memory of 3944 5768 skuld.exe 91 PID 5768 wrote to memory of 1308 5768 skuld.exe 94 PID 5768 wrote to memory of 988 5768 skuld.exe 97 PID 5768 wrote to memory of 2328 5768 skuld.exe 98 PID 5768 wrote to memory of 5676 5768 skuld.exe 99 PID 2328 wrote to memory of 2452 2328 SecurityHealthSystray.exe 100 PID 5676 wrote to memory of 4236 5676 SecurityHealthWatcher.exe 101 PID 2328 wrote to memory of 1016 2328 SecurityHealthSystray.exe 102 PID 2328 wrote to memory of 5872 2328 SecurityHealthSystray.exe 103 PID 2328 wrote to memory of 2896 2328 SecurityHealthSystray.exe 104 PID 2328 wrote to memory of 3772 2328 SecurityHealthSystray.exe 105 PID 2328 wrote to memory of 3908 2328 SecurityHealthSystray.exe 106 PID 5768 wrote to memory of 4940 5768 skuld.exe 108 PID 2328 wrote to memory of 2592 2328 SecurityHealthSystray.exe 111 PID 2328 wrote to memory of 1244 2328 SecurityHealthSystray.exe 112 PID 2328 wrote to memory of 3884 2328 SecurityHealthSystray.exe 113 PID 2328 wrote to memory of 1068 2328 SecurityHealthSystray.exe 114 PID 2328 wrote to memory of 4468 2328 SecurityHealthSystray.exe 115 PID 2328 wrote to memory of 5312 2328 SecurityHealthSystray.exe 123 PID 2328 wrote to memory of 884 2328 SecurityHealthSystray.exe 124 PID 2328 wrote to memory of 3428 2328 SecurityHealthSystray.exe 125 PID 2328 wrote to memory of 1568 2328 SecurityHealthSystray.exe 126 PID 2328 wrote to memory of 3508 2328 SecurityHealthSystray.exe 127 PID 2328 wrote to memory of 632 2328 SecurityHealthSystray.exe 128 PID 2328 wrote to memory of 2128 2328 SecurityHealthSystray.exe 129 PID 2328 wrote to memory of 1944 2328 SecurityHealthSystray.exe 130 PID 2328 wrote to memory of 5236 2328 SecurityHealthSystray.exe 131 PID 2328 wrote to memory of 3712 2328 SecurityHealthSystray.exe 132 PID 2328 wrote to memory of 2812 2328 SecurityHealthSystray.exe 133 PID 2328 wrote to memory of 1564 2328 SecurityHealthSystray.exe 134 PID 2328 wrote to memory of 4512 2328 SecurityHealthSystray.exe 135 PID 2328 wrote to memory of 5220 2328 SecurityHealthSystray.exe 136 PID 2328 wrote to memory of 4424 2328 SecurityHealthSystray.exe 137 - Views/modifies file attributes 1 TTPs 5 IoCs
pid Process 5776 attrib.exe 1308 attrib.exe 988 attrib.exe 2452 attrib.exe 4236 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\skuld.exe"C:\Users\Admin\AppData\Local\Temp\skuld.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\skuld.exe2⤵
- Views/modifies file attributes
PID:5776
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5488
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5280
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name2⤵PID:764
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
PID:2084
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3944
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- Views/modifies file attributes
PID:1308
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe2⤵
- Views/modifies file attributes
PID:988
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe3⤵
- Views/modifies file attributes
PID:2452
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID3⤵PID:1016
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption3⤵PID:5872
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name3⤵PID:2896
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
PID:3772
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3908
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID3⤵PID:2592
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption3⤵PID:1244
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name3⤵PID:3884
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
PID:1068
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4468
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID3⤵PID:5312
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption3⤵PID:884
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name3⤵PID:3428
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
PID:1568
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3508
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID3⤵PID:632
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption3⤵PID:2128
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name3⤵PID:1944
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
PID:5236
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3712
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID3⤵PID:2812
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption3⤵PID:1564
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name3⤵PID:4512
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
PID:5220
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4424
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe3⤵
- Views/modifies file attributes
PID:4236
-
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵PID:4940
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
- Size 15.3MB
- SHA256 a48d13c8760ba533fef095ce3c303b81662f684809138fbaa4310edea6d4c260
- MD5 b71e222e7daf72a0bcddc27dcc9cb7f5
- SHA1 b0fc85f0d14f02a15ec0d829bf23baea85ead7d4
- SHA512 5f9b282b0e84e443ce90f2c1ff13224a4b9a1e60f100d60e0c974a36851a99fd2950eaa381dec3ba92d51ab955d5d52109feaf290e2d62c72d1cd3011dc2a48e
- SSDEEP 196608:15+4UVyZ6jSvZ5n9pTY3kUGERodlqd0mdmM5WIOC:1rUe59OGGodlVlMcIO
- TLSH T174F68D43ECB556E9C099917AC6668612BB753C884B3163D36B60FB346F33BD0AE78740
- MD5 SHA1 SHA512 SSDEEP TLSH