Analysis
-
max time kernel
210s -
max time network
205s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system -
submitted
09-07-2024 06:09
Behavioral task
behavioral1
Sample
Kurome.Builder/Kurome.Builder.exe
Resource
win11-20240704-en
Behavioral task
behavioral2
Sample
Kurome.Host/Kurome.Host.exe
Resource
win11-20240704-en
Behavioral task
behavioral3
Sample
Kurome.Loader/Kurome.Loader.exe
Resource
win11-20240704-en
Behavioral task
behavioral4
Sample
Panel/RedLine_20_2/Panel/Panel.exe
Resource
win11-20240704-en
General
-
Target
Panel/RedLine_20_2/Panel/Panel.exe
-
Size
9.3MB
-
MD5
f4e19b67ef27af1434151a512860574e
-
SHA1
56304fc2729974124341e697f3b21c84a8dd242a
-
SHA256
c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a
-
SHA512
a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77
-
SSDEEP
196608:mJQaPHrQqXs140qMhu8369sV+HLz9SKUeNdDhHidVI1SM52n3iWuUZ/c1sxXoP3p:mJQaPHrQqXs140qMhu8369sV+HLz9SKI
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral4/memory/1116-3893-0x00000000200A0000-0x00000000200BA000-memory.dmp family_redline -
Suspicious use of NtSetInformationThreadHideFromDebugger 61 IoCs
Processes:
Panel.exePanel.exepid process 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe 1116 Panel.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
MiniSearchHost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1136334635-2482839916-910800802-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Panel.exePanel.exepid process 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe 1116 Panel.exe 2332 Panel.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Panel.exePanel.exedescription pid process Token: SeDebugPrivilege 2332 Panel.exe Token: SeDebugPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe Token: 33 1116 Panel.exe Token: SeIncBasePriorityPrivilege 1116 Panel.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MiniSearchHost.exepid process 2840 MiniSearchHost.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
Panel.exedescription pid process target process PID 2332 wrote to memory of 1116 2332 Panel.exe Panel.exe PID 2332 wrote to memory of 1116 2332 Panel.exe Panel.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Panel\RedLine_20_2\Panel\Panel.exe"C:\Users\Admin\AppData\Local\Temp\Panel\RedLine_20_2\Panel\Panel.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Panel\RedLine_20_2\Panel\Panel.exe"C:\Users\Admin\AppData\Local\Temp\Panel\RedLine_20_2\Panel\Panel.exe" "--monitor"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.datFilesize
10KB
MD58199b632541a5a500e092ee0123010f0
SHA1f14f3e303cfc3420baf619deba97520de0bc6086
SHA256d1d7132b6bbe14c94d22beae15db94a3a78b38ecabe3076f80538d92d788e948
SHA512cc68531bb5638071aff9b652b11f15c04757cca4ea52048266e7772e2b5cc10e8fe6d03aec9bdb608b5d8e129ba1bc20b400f1a024f74a70310474208c3643b4
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.datFilesize
10KB
MD5215fe319f0c3b442c336bd5e86b0233c
SHA1f52ecbbd056f85b73074c480245e6f1e4f139907
SHA256a2b092f103ee40de3fe6e627dc6d88673afb6a87ddc55329a8b5b464bf3766c6
SHA512e597ff9ec229e34015d17f37199983481ef9382f2d43e20f1f4d2ce129eb4972f60f57038e228aa9223be81bc0d9ede96b4830ad9e685da264aa65c511905d3b
-
memory/1116-3893-0x00000000200A0000-0x00000000200BA000-memory.dmpFilesize
104KB
-
memory/1116-4034-0x00000000007B0000-0x00000000007EC000-memory.dmpFilesize
240KB
-
memory/1116-4033-0x0000000000790000-0x00000000007A2000-memory.dmpFilesize
72KB
-
memory/1116-3987-0x0000000024220000-0x0000000024270000-memory.dmpFilesize
320KB
-
memory/1116-3986-0x0000000024270000-0x00000000242BA000-memory.dmpFilesize
296KB
-
memory/1116-3970-0x00000000205D0000-0x0000000020644000-memory.dmpFilesize
464KB
-
memory/1116-3921-0x0000000020340000-0x000000002037A000-memory.dmpFilesize
232KB
-
memory/1116-3936-0x0000000020430000-0x00000000204E0000-memory.dmpFilesize
704KB
-
memory/1116-3907-0x00000000202E0000-0x00000000202F2000-memory.dmpFilesize
72KB
-
memory/2332-62-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-718-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-31-0x000000001DAC0000-0x000000001DC02000-memory.dmpFilesize
1.3MB
-
memory/2332-16-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/2332-79-0x000000001DBE0000-0x000000001DBEA000-memory.dmpFilesize
40KB
-
memory/2332-65-0x000000001DBD0000-0x000000001DBDA000-memory.dmpFilesize
40KB
-
memory/2332-63-0x000000001DBD0000-0x000000001DBDA000-memory.dmpFilesize
40KB
-
memory/2332-14-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/2332-93-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-106-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-107-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-108-0x000000001FA00000-0x000000001FA1C000-memory.dmpFilesize
112KB
-
memory/2332-119-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-120-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-121-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-137-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-186-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-549-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-698-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-1-0x00007FFD068F3000-0x00007FFD068F5000-memory.dmpFilesize
8KB
-
memory/2332-867-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-1050-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-45-0x000000001DE90000-0x000000001DFD2000-memory.dmpFilesize
1.3MB
-
memory/2332-29-0x000000001DAC0000-0x000000001DC02000-memory.dmpFilesize
1.3MB
-
memory/2332-37-0x000000001DAC0000-0x000000001DC02000-memory.dmpFilesize
1.3MB
-
memory/2332-19-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/2332-22-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/2332-25-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/2332-13-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-3993-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-3995-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-3996-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-3999-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB
-
memory/2332-3-0x000000001ACF0000-0x000000001AE90000-memory.dmpFilesize
1.6MB
-
memory/2332-5-0x000000001ACF0000-0x000000001AE90000-memory.dmpFilesize
1.6MB
-
memory/2332-2-0x000000001ACF0000-0x000000001AE90000-memory.dmpFilesize
1.6MB
-
memory/2332-0-0x00007FFD068F0000-0x00007FFD073B2000-memory.dmpFilesize
10.8MB