Overview
overview
10Static
static
10Redline St....2.exe
windows10-2004-x64
10Redline St...ck.exe
windows10-2004-x64
10Redline St...ub.exe
windows10-2004-x64
10Redline St...st.exe
windows10-2004-x64
10Redline St....2.exe
windows10-2004-x64
10Redline St...er.exe
windows10-2004-x64
10Redline St....2.exe
windows10-2004-x64
10Redline St...ck.exe
windows10-2004-x64
10Redline St....2.exe
windows10-2004-x64
10Redline St...el.exe
windows10-2004-x64
10Redline St....2.exe
windows10-2004-x64
10Redline St...ck.exe
windows10-2004-x64
10Redline St...me.exe
windows10-2004-x64
8Redline St...48.exe
windows10-2004-x64
7Redline St...ar.exe
windows10-2004-x64
1Analysis
-
max time kernel
29s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2023 20:27
Behavioral task
behavioral1
Sample
Redline Stealer v24.2 cracked [XT_CH]/Kurome.Builder/Kurome.Builder v24.2.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
Redline Stealer v24.2 cracked [XT_CH]/Kurome.Builder/Kurome.Builder_crack.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Redline Stealer v24.2 cracked [XT_CH]/Kurome.Builder/stub.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral4
Sample
Redline Stealer v24.2 cracked [XT_CH]/Kurome.Host/Kurome.Host.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Redline Stealer v24.2 cracked [XT_CH]/Kurome.Loader/._cache_Kurome Loader 20.2.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
Redline Stealer v24.2 cracked [XT_CH]/Kurome.Loader/._cache_KuromeLoader.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Redline Stealer v24.2 cracked [XT_CH]/Kurome.Loader/Kurome Loader 24.2.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral8
Sample
Redline Stealer v24.2 cracked [XT_CH]/Kurome.Loader/Kurome.Loader_crack.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Redline Stealer v24.2 cracked [XT_CH]/Panel/RedLine_24_2/Panel/._cache_Panel 20.2.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
Redline Stealer v24.2 cracked [XT_CH]/Panel/RedLine_24_2/Panel/._cache_Panel.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
Redline Stealer v24.2 cracked [XT_CH]/Panel/RedLine_24_2/Panel/Panel 24.2.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
Redline Stealer v24.2 cracked [XT_CH]/Panel/RedLine_24_2/Panel/Panel_crack.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Redline Stealer v24.2 cracked [XT_CH]/Panel/RedLine_24_2/Tools/Chrome.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
Redline Stealer v24.2 cracked [XT_CH]/Panel/RedLine_24_2/Tools/NetFramework48.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral15
Sample
Redline Stealer v24.2 cracked [XT_CH]/Panel/RedLine_24_2/Tools/WinRar.exe
Resource
win10v2004-20230220-en
General
-
Target
Redline Stealer v24.2 cracked [XT_CH]/Kurome.Loader/Kurome.Loader_crack.exe
-
Size
1.4MB
-
MD5
caeeb7b39d19fb9ae4209d5b82580454
-
SHA1
5e8e38685c130250b1e6a132302549be4e1a1952
-
SHA256
d94103367cd58a86f60f0f1560084fb30e3fe137f03eb8a49adf600d31dfacf5
-
SHA512
6093ea192a677d7632b0f716dcf7a051e1f055334deb9d56acb4f921d08eadfa79ef58477400328a9e3ee6e64043d15c658c4b335cc2f9b6f91a44ce8dd4b46c
-
SSDEEP
24576:/oJEKZ6IEGTMxapRl2PSwHTehy6BP+pXShToJEKZ6IEGTMxapRl2PSwHTehy6BPF:/ouKZ6iMqRl2PSwzehy6cpXShTouKZ6E
Malware Config
Extracted
pandastealer
1.11
http://thisisgenk.temp.swtest.ru
Extracted
pandastealer
�
http://�
Signatures
-
Panda Stealer payload 8 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\build.exe family_pandastealer C:\Users\Admin\AppData\Local\Temp\build.exe family_pandastealer C:\Users\Admin\AppData\Local\Temp\build.exe family_pandastealer C:\Users\Admin\AppData\Local\Temp\Kurome.Loader.exe family_pandastealer behavioral8/memory/2276-150-0x0000000000400000-0x0000000000561000-memory.dmp family_pandastealer behavioral8/memory/3612-154-0x0000000000400000-0x00000000004B4000-memory.dmp family_pandastealer C:\Users\Admin\AppData\Local\Temp\Kurome.Loader.exe family_pandastealer C:\Users\Admin\AppData\Local\Temp\Kurome.Loader.exe family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Kurome.Loader_crack.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation Kurome.Loader_crack.exe -
Executes dropped EXE 2 IoCs
Processes:
build.exeKurome.Loader.exepid process 2108 build.exe 3612 Kurome.Loader.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
build.exepid process 2108 build.exe 2108 build.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Kurome.Loader_crack.exedescription pid process target process PID 2276 wrote to memory of 2108 2276 Kurome.Loader_crack.exe build.exe PID 2276 wrote to memory of 2108 2276 Kurome.Loader_crack.exe build.exe PID 2276 wrote to memory of 2108 2276 Kurome.Loader_crack.exe build.exe PID 2276 wrote to memory of 3612 2276 Kurome.Loader_crack.exe Kurome.Loader.exe PID 2276 wrote to memory of 3612 2276 Kurome.Loader_crack.exe Kurome.Loader.exe PID 2276 wrote to memory of 3612 2276 Kurome.Loader_crack.exe Kurome.Loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Redline Stealer v24.2 cracked [XT_CH]\Kurome.Loader\Kurome.Loader_crack.exe"C:\Users\Admin\AppData\Local\Temp\Redline Stealer v24.2 cracked [XT_CH]\Kurome.Loader\Kurome.Loader_crack.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Kurome.Loader.exe"C:\Users\Admin\AppData\Local\Temp\Kurome.Loader.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Kurome.Loader.exeFilesize
691KB
MD5d012f21f743803781c23443cae5af637
SHA1a6d20e4e85951090c262f29d7159123a4e4c0cba
SHA2569d005ef806af176d0c715b2ee6f79a7ca5ef1aacd2529d75bf05911522b5bb2b
SHA512dcde9865e1a52b18906cacc38ef8df2e3148819c0217a168df6ee58acb4094ae7e6be52cdffed0e3844c4b7929f375c09ffa7629018f05a1d88fed2be7f5f0fb
-
C:\Users\Admin\AppData\Local\Temp\Kurome.Loader.exeFilesize
691KB
MD5d012f21f743803781c23443cae5af637
SHA1a6d20e4e85951090c262f29d7159123a4e4c0cba
SHA2569d005ef806af176d0c715b2ee6f79a7ca5ef1aacd2529d75bf05911522b5bb2b
SHA512dcde9865e1a52b18906cacc38ef8df2e3148819c0217a168df6ee58acb4094ae7e6be52cdffed0e3844c4b7929f375c09ffa7629018f05a1d88fed2be7f5f0fb
-
C:\Users\Admin\AppData\Local\Temp\Kurome.Loader.exeFilesize
691KB
MD5d012f21f743803781c23443cae5af637
SHA1a6d20e4e85951090c262f29d7159123a4e4c0cba
SHA2569d005ef806af176d0c715b2ee6f79a7ca5ef1aacd2529d75bf05911522b5bb2b
SHA512dcde9865e1a52b18906cacc38ef8df2e3148819c0217a168df6ee58acb4094ae7e6be52cdffed0e3844c4b7929f375c09ffa7629018f05a1d88fed2be7f5f0fb
-
C:\Users\Admin\AppData\Local\Temp\build.exeFilesize
681KB
MD543aa2880830859585b3c6a15e915b8db
SHA16780b3f4d54a43b22223629e14c676addb3ac400
SHA256378f2b1055dd7f1a150e0d86889b9bd3336225e38fc3c8cafb390ebf347ad46d
SHA5126d35bd792aefe5c1b42caae9e50ed66967a74bb476985e17d3a5bc8d6b87111b7bb1af56cb216bff24f056da33bc14c4bddc81fabbfa07d569bab98ec679289d
-
C:\Users\Admin\AppData\Local\Temp\build.exeFilesize
681KB
MD543aa2880830859585b3c6a15e915b8db
SHA16780b3f4d54a43b22223629e14c676addb3ac400
SHA256378f2b1055dd7f1a150e0d86889b9bd3336225e38fc3c8cafb390ebf347ad46d
SHA5126d35bd792aefe5c1b42caae9e50ed66967a74bb476985e17d3a5bc8d6b87111b7bb1af56cb216bff24f056da33bc14c4bddc81fabbfa07d569bab98ec679289d
-
C:\Users\Admin\AppData\Local\Temp\build.exeFilesize
681KB
MD543aa2880830859585b3c6a15e915b8db
SHA16780b3f4d54a43b22223629e14c676addb3ac400
SHA256378f2b1055dd7f1a150e0d86889b9bd3336225e38fc3c8cafb390ebf347ad46d
SHA5126d35bd792aefe5c1b42caae9e50ed66967a74bb476985e17d3a5bc8d6b87111b7bb1af56cb216bff24f056da33bc14c4bddc81fabbfa07d569bab98ec679289d
-
memory/2276-150-0x0000000000400000-0x0000000000561000-memory.dmpFilesize
1.4MB
-
memory/3612-154-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB