Analysis
- max time kernel
150s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 11:33
Behavioral task
behavioral1
Sample
skuld.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
skuld.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target skuld.exe
- Size 10.5MB
- Sample260924-nn7dtscf26
- SHA256 a2ee851e7a59dc264056b27dcab513ab3ffa5ad539dd281afef13daa961eb256
- MD5 46febbc8946d77f2c577a0c8b8b58636
- SHA1 fa1b090ad6850af9b6c0c71d3be96706173fa412
- SHA512 1b940520c878059109cce8e8ce6f6f830ddc513f7027a1de5c313f8bd6533dc263196aa2cc55f4f6de9987b64935bc1c598725e216858b5c6acc8ed5456fbfb9
- SSDEEP 98304:2K5jfhifzuHVcOsLoSU9E82/ALT4UhvBbYnDTo6GEa:24ofzuHF4X/ALT9hvBOwKa
- TLSH T1D5B64A57ECA551E8C0AE8175C6669623BB713C894B3063C36B90FA346F77BD0ADB9700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
skuld
C2
-
https://discord.com/api/webhooks/1550251072981835876/PKnE7plcRq1z7--o56KvuRDMmlEXcWzjSScLye1lkaSTyVxjErqaCFOpHBBBv03ywvVp
Signatures
- Detects SkuldStealer 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c566-2.dat family_skuld - Executes dropped EXE 1 IoCs
pid Process 4564 SecurityHealthSystray.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe" skuld.exe - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org 5 api.ipify.org 1 ip-api.com - GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 8 Go-http-client/1.1 - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5780 wmic.exe 5780 wmic.exe 5780 wmic.exe 5780 wmic.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 4152 skuld.exe Token: SeIncreaseQuotaPrivilege 5780 wmic.exe Token: SeSecurityPrivilege 5780 wmic.exe Token: SeTakeOwnershipPrivilege 5780 wmic.exe Token: SeLoadDriverPrivilege 5780 wmic.exe Token: SeSystemProfilePrivilege 5780 wmic.exe Token: SeSystemtimePrivilege 5780 wmic.exe Token: SeProfSingleProcessPrivilege 5780 wmic.exe Token: SeIncBasePriorityPrivilege 5780 wmic.exe Token: SeCreatePagefilePrivilege 5780 wmic.exe Token: SeBackupPrivilege 5780 wmic.exe Token: SeRestorePrivilege 5780 wmic.exe Token: SeShutdownPrivilege 5780 wmic.exe Token: SeDebugPrivilege 5780 wmic.exe Token: SeSystemEnvironmentPrivilege 5780 wmic.exe Token: SeRemoteShutdownPrivilege 5780 wmic.exe Token: SeUndockPrivilege 5780 wmic.exe Token: SeManageVolumePrivilege 5780 wmic.exe Token: 33 5780 wmic.exe Token: 34 5780 wmic.exe Token: 35 5780 wmic.exe Token: 36 5780 wmic.exe Token: SeIncreaseQuotaPrivilege 5780 wmic.exe Token: SeSecurityPrivilege 5780 wmic.exe Token: SeTakeOwnershipPrivilege 5780 wmic.exe Token: SeLoadDriverPrivilege 5780 wmic.exe Token: SeSystemProfilePrivilege 5780 wmic.exe Token: SeSystemtimePrivilege 5780 wmic.exe Token: SeProfSingleProcessPrivilege 5780 wmic.exe Token: SeIncBasePriorityPrivilege 5780 wmic.exe Token: SeCreatePagefilePrivilege 5780 wmic.exe Token: SeBackupPrivilege 5780 wmic.exe Token: SeRestorePrivilege 5780 wmic.exe Token: SeShutdownPrivilege 5780 wmic.exe Token: SeDebugPrivilege 5780 wmic.exe Token: SeSystemEnvironmentPrivilege 5780 wmic.exe Token: SeRemoteShutdownPrivilege 5780 wmic.exe Token: SeUndockPrivilege 5780 wmic.exe Token: SeManageVolumePrivilege 5780 wmic.exe Token: 33 5780 wmic.exe Token: 34 5780 wmic.exe Token: 35 5780 wmic.exe Token: 36 5780 wmic.exe Token: SeDebugPrivilege 4564 SecurityHealthSystray.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4152 wrote to memory of 5916 4152 skuld.exe 91 PID 4152 wrote to memory of 5864 4152 skuld.exe 92 PID 4152 wrote to memory of 5780 4152 skuld.exe 94 - Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 5864 attrib.exe 5916 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\skuld.exe"C:\Users\Admin\AppData\Local\Temp\skuld.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\skuld.exe2⤵
- Views/modifies file attributes
PID:5916
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- Views/modifies file attributes
PID:5864
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5780
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4564
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
- Size 10.5MB
- SHA256 a2ee851e7a59dc264056b27dcab513ab3ffa5ad539dd281afef13daa961eb256
- MD5 46febbc8946d77f2c577a0c8b8b58636
- SHA1 fa1b090ad6850af9b6c0c71d3be96706173fa412
- SHA512 1b940520c878059109cce8e8ce6f6f830ddc513f7027a1de5c313f8bd6533dc263196aa2cc55f4f6de9987b64935bc1c598725e216858b5c6acc8ed5456fbfb9
- SSDEEP 98304:2K5jfhifzuHVcOsLoSU9E82/ALT4UhvBbYnDTo6GEa:24ofzuHF4X/ALT9hvBOwKa
- TLSH T1D5B64A57ECA551E8C0AE8175C6669623BB713C894B3063C36B90FA346F77BD0ADB9700
- MD5 SHA1 SHA512 SSDEEP TLSH