9ad43994be27b8156dfcb82fbe8549b258985f3579adcc94d8712a3e4d1c3294

Analysis

Target

Redline_2021_stealer-main/Kurome.Host/Kurome.Host.exe
Size

119KB
MD5

4fde0f80c408af27a8d3ddeffea12251
SHA1

e834291127af150ce287443c5ea607a7ae337484
SHA256

1b644cdb1c7247c07d810c0ea10bec34dc5600f3645589690a219de08cf2dedb
SHA512

3693aeaa2cc276060b899f21f6f57f435b75fec5bcd7725b2dd79043b341c12ebc29bd43b287eb22a3e31fd2b50c4fa36bf020f9f3db5e2f75fe8cc747eca5f5

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Kurome.Host.exe

description pid process

Token: SeDebugPrivilege 3092 Kurome.Host.exe

description	pid	process
Token: SeDebugPrivilege	3092	Kurome.Host.exe

C:\Users\Admin\AppData\Local\Temp\Redline_2021_stealer-main\Kurome.Host\Kurome.Host.exe
"C:\Users\Admin\AppData\Local\Temp\Redline_2021_stealer-main\Kurome.Host\Kurome.Host.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3092

memory/3092-130-0x0000000000740000-0x0000000000764000-memory.dmp

Filesize
144KB

Download
memory/3092-131-0x0000000005080000-0x00000000050A6000-memory.dmp

Filesize
152KB

Download
memory/3092-132-0x0000000005900000-0x0000000005F18000-memory.dmp

Filesize
6.1MB

Download
memory/3092-133-0x0000000005170000-0x0000000005182000-memory.dmp

Filesize
72KB

Download
memory/3092-134-0x00000000051D0000-0x000000000520C000-memory.dmp

Filesize
240KB

Download
memory/3092-135-0x00000000053B0000-0x000000000547E000-memory.dmp

Filesize
824KB

Download
memory/3092-136-0x0000000005590000-0x000000000569A000-memory.dmp

Filesize
1.0MB

Download
memory/3092-138-0x0000000005480000-0x00000000054D0000-memory.dmp

Filesize
320KB

Download
memory/3092-137-0x0000000005310000-0x0000000005338000-memory.dmp

Filesize
160KB

Download