Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 02:48
Behavioral task
behavioral1
Sample
skuld.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
skuld.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target skuld.exe
- Size 15.3MB
- Sample260806-daxmcsxtdw
- SHA256 a48d13c8760ba533fef095ce3c303b81662f684809138fbaa4310edea6d4c260
- MD5 b71e222e7daf72a0bcddc27dcc9cb7f5
- SHA1 b0fc85f0d14f02a15ec0d829bf23baea85ead7d4
- SHA512 5f9b282b0e84e443ce90f2c1ff13224a4b9a1e60f100d60e0c974a36851a99fd2950eaa381dec3ba92d51ab955d5d52109feaf290e2d62c72d1cd3011dc2a48e
- SSDEEP 196608:15+4UVyZ6jSvZ5n9pTY3kUGERodlqd0mdmM5WIOC:1rUe59OGGodlVlMcIO
- TLSH T174F68D43ECB556E9C099917AC6668612BB753C884B3163D36B60FB346F33BD0AE78740
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects SkuldStealer 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c48a-4.dat family_skuld - Executes dropped EXE 4 IoCs
pid Process 5864 SecurityHealthSystray.exe 4984 SecurityHealthSystray.exe 3732 SecurityHealthWatcher.exe 960 SecurityHealthWatcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe" skuld.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Watcher Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthWatcher.exe" skuld.exe - Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 1 ip-api.com 8 api.ipify.org 13 api.ipify.org - Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 5 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 576 netsh.exe 3980 netsh.exe 3740 netsh.exe 5992 netsh.exe 4876 netsh.exe - Detects videocard installed 1 TTPs 5 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4636 wmic.exe 4440 wmic.exe 1504 wmic.exe 5936 wmic.exe 3876 wmic.exe - GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 11 Go-http-client/1.1 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4740 wmic.exe 4740 wmic.exe 4740 wmic.exe 4740 wmic.exe 4524 wmic.exe 4524 wmic.exe 4524 wmic.exe 4524 wmic.exe 3196 wmic.exe 3196 wmic.exe 3196 wmic.exe 3196 wmic.exe 5936 wmic.exe 5936 wmic.exe 5936 wmic.exe 5936 wmic.exe 1176 wmic.exe 1176 wmic.exe 1176 wmic.exe 1176 wmic.exe 5164 wmic.exe 5164 wmic.exe 5164 wmic.exe 5164 wmic.exe 856 wmic.exe 856 wmic.exe 856 wmic.exe 856 wmic.exe 2116 wmic.exe 2116 wmic.exe 2116 wmic.exe 2116 wmic.exe 3876 wmic.exe 3876 wmic.exe 3876 wmic.exe 3876 wmic.exe 2804 wmic.exe 2804 wmic.exe 2804 wmic.exe 2804 wmic.exe 4352 wmic.exe 4352 wmic.exe 4352 wmic.exe 4352 wmic.exe 5876 wmic.exe 5876 wmic.exe 5876 wmic.exe 5876 wmic.exe 4636 wmic.exe 4636 wmic.exe 4636 wmic.exe 4636 wmic.exe 1776 wmic.exe 1776 wmic.exe 1776 wmic.exe 1776 wmic.exe 5428 wmic.exe 5428 wmic.exe 5428 wmic.exe 5428 wmic.exe 2896 wmic.exe 2896 wmic.exe 2896 wmic.exe 2896 wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4620 skuld.exe Token: SeIncreaseQuotaPrivilege 4740 wmic.exe Token: SeSecurityPrivilege 4740 wmic.exe Token: SeTakeOwnershipPrivilege 4740 wmic.exe Token: SeLoadDriverPrivilege 4740 wmic.exe Token: SeSystemProfilePrivilege 4740 wmic.exe Token: SeSystemtimePrivilege 4740 wmic.exe Token: SeProfSingleProcessPrivilege 4740 wmic.exe Token: SeIncBasePriorityPrivilege 4740 wmic.exe Token: SeCreatePagefilePrivilege 4740 wmic.exe Token: SeBackupPrivilege 4740 wmic.exe Token: SeRestorePrivilege 4740 wmic.exe Token: SeShutdownPrivilege 4740 wmic.exe Token: SeDebugPrivilege 4740 wmic.exe Token: SeSystemEnvironmentPrivilege 4740 wmic.exe Token: SeRemoteShutdownPrivilege 4740 wmic.exe Token: SeUndockPrivilege 4740 wmic.exe Token: SeManageVolumePrivilege 4740 wmic.exe Token: 33 4740 wmic.exe Token: 34 4740 wmic.exe Token: 35 4740 wmic.exe Token: 36 4740 wmic.exe Token: SeIncreaseQuotaPrivilege 4740 wmic.exe Token: SeSecurityPrivilege 4740 wmic.exe Token: SeTakeOwnershipPrivilege 4740 wmic.exe Token: SeLoadDriverPrivilege 4740 wmic.exe Token: SeSystemProfilePrivilege 4740 wmic.exe Token: SeSystemtimePrivilege 4740 wmic.exe Token: SeProfSingleProcessPrivilege 4740 wmic.exe Token: SeIncBasePriorityPrivilege 4740 wmic.exe Token: SeCreatePagefilePrivilege 4740 wmic.exe Token: SeBackupPrivilege 4740 wmic.exe Token: SeRestorePrivilege 4740 wmic.exe Token: SeShutdownPrivilege 4740 wmic.exe Token: SeDebugPrivilege 4740 wmic.exe Token: SeSystemEnvironmentPrivilege 4740 wmic.exe Token: SeRemoteShutdownPrivilege 4740 wmic.exe Token: SeUndockPrivilege 4740 wmic.exe Token: SeManageVolumePrivilege 4740 wmic.exe Token: 33 4740 wmic.exe Token: 34 4740 wmic.exe Token: 35 4740 wmic.exe Token: 36 4740 wmic.exe Token: SeIncreaseQuotaPrivilege 4524 wmic.exe Token: SeSecurityPrivilege 4524 wmic.exe Token: SeTakeOwnershipPrivilege 4524 wmic.exe Token: SeLoadDriverPrivilege 4524 wmic.exe Token: SeSystemProfilePrivilege 4524 wmic.exe Token: SeSystemtimePrivilege 4524 wmic.exe Token: SeProfSingleProcessPrivilege 4524 wmic.exe Token: SeIncBasePriorityPrivilege 4524 wmic.exe Token: SeCreatePagefilePrivilege 4524 wmic.exe Token: SeBackupPrivilege 4524 wmic.exe Token: SeRestorePrivilege 4524 wmic.exe Token: SeShutdownPrivilege 4524 wmic.exe Token: SeDebugPrivilege 4524 wmic.exe Token: SeSystemEnvironmentPrivilege 4524 wmic.exe Token: SeRemoteShutdownPrivilege 4524 wmic.exe Token: SeUndockPrivilege 4524 wmic.exe Token: SeManageVolumePrivilege 4524 wmic.exe Token: 33 4524 wmic.exe Token: 34 4524 wmic.exe Token: 35 4524 wmic.exe Token: 36 4524 wmic.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 4620 wrote to memory of 4912 4620 skuld.exe 90 PID 4620 wrote to memory of 4740 4620 skuld.exe 91 PID 4620 wrote to memory of 4524 4620 skuld.exe 93 PID 4620 wrote to memory of 3196 4620 skuld.exe 94 PID 4620 wrote to memory of 5936 4620 skuld.exe 95 PID 4620 wrote to memory of 576 4620 skuld.exe 96 PID 4620 wrote to memory of 1100 4620 skuld.exe 97 PID 4620 wrote to memory of 2496 4620 skuld.exe 98 PID 4620 wrote to memory of 4984 4620 skuld.exe 102 PID 4984 wrote to memory of 2584 4984 SecurityHealthSystray.exe 103 PID 4984 wrote to memory of 1176 4984 SecurityHealthSystray.exe 104 PID 4984 wrote to memory of 5164 4984 SecurityHealthSystray.exe 105 PID 4620 wrote to memory of 3732 4620 skuld.exe 106 PID 4984 wrote to memory of 856 4984 SecurityHealthSystray.exe 108 PID 3732 wrote to memory of 2956 3732 SecurityHealthWatcher.exe 109 PID 4620 wrote to memory of 2116 4620 skuld.exe 110 PID 4984 wrote to memory of 3876 4984 SecurityHealthSystray.exe 111 PID 4984 wrote to memory of 3980 4984 SecurityHealthSystray.exe 112 PID 4984 wrote to memory of 2804 4984 SecurityHealthSystray.exe 114 PID 4984 wrote to memory of 4352 4984 SecurityHealthSystray.exe 115 PID 4984 wrote to memory of 5876 4984 SecurityHealthSystray.exe 116 PID 4984 wrote to memory of 4636 4984 SecurityHealthSystray.exe 117 PID 4984 wrote to memory of 3740 4984 SecurityHealthSystray.exe 118 PID 4984 wrote to memory of 1776 4984 SecurityHealthSystray.exe 119 PID 4984 wrote to memory of 5428 4984 SecurityHealthSystray.exe 120 PID 4984 wrote to memory of 2896 4984 SecurityHealthSystray.exe 121 PID 4984 wrote to memory of 4440 4984 SecurityHealthSystray.exe 122 PID 4984 wrote to memory of 5992 4984 SecurityHealthSystray.exe 123 PID 4984 wrote to memory of 904 4984 SecurityHealthSystray.exe 124 PID 4984 wrote to memory of 4908 4984 SecurityHealthSystray.exe 125 PID 4984 wrote to memory of 3448 4984 SecurityHealthSystray.exe 126 PID 4984 wrote to memory of 1504 4984 SecurityHealthSystray.exe 127 PID 4984 wrote to memory of 4876 4984 SecurityHealthSystray.exe 128 - Views/modifies file attributes 1 TTPs 5 IoCs
pid Process 4912 attrib.exe 1100 attrib.exe 2496 attrib.exe 2584 attrib.exe 2956 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\skuld.exe"C:\Users\Admin\AppData\Local\Temp\skuld.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\skuld.exe2⤵
- Views/modifies file attributes
PID:4912
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3196
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
PID:5936
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:576
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- Views/modifies file attributes
PID:1100
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe2⤵
- Views/modifies file attributes
PID:2496
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe3⤵
- Views/modifies file attributes
PID:2584
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1176
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5164
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name3⤵
- Suspicious behavior: EnumeratesProcesses
PID:856
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
PID:3876
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3980
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2804
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4352
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5876
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
PID:4636
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3740
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1776
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5428
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2896
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
PID:4440
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:5992
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID3⤵PID:904
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption3⤵PID:4908
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name3⤵PID:3448
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
PID:1504
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4876
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe3⤵
- Views/modifies file attributes
PID:2956
-
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2116
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe1⤵
- Executes dropped EXE
PID:5864
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe1⤵
- Executes dropped EXE
PID:960
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
- Size 15.3MB
- SHA256 a48d13c8760ba533fef095ce3c303b81662f684809138fbaa4310edea6d4c260
- MD5 b71e222e7daf72a0bcddc27dcc9cb7f5
- SHA1 b0fc85f0d14f02a15ec0d829bf23baea85ead7d4
- SHA512 5f9b282b0e84e443ce90f2c1ff13224a4b9a1e60f100d60e0c974a36851a99fd2950eaa381dec3ba92d51ab955d5d52109feaf290e2d62c72d1cd3011dc2a48e
- SSDEEP 196608:15+4UVyZ6jSvZ5n9pTY3kUGERodlqd0mdmM5WIOC:1rUe59OGGodlVlMcIO
- TLSH T174F68D43ECB556E9C099917AC6668612BB753C884B3163D36B60FB346F33BD0AE78740
- MD5 SHA1 SHA512 SSDEEP TLSH