Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    04-08-2024 09:50

General

  • Target

    REDLINE STEALER V20.2 - Edition 2022/Kurome.Host/Kurome.Host.exe.config

  • Size

    189B

  • MD5

    5a7f52d69e6fca128023469ae760c6d5

  • SHA1

    9d7f75734a533615042f510934402c035ac492f7

  • SHA256

    498c7f8e872f9cef0cf04f7d290cf3804c82a007202c9b484128c94d03040fd0

  • SHA512

    4dc8ae80ae9e61d2801441b6928a85dcf9d6d73656d064ffbc0ce9ee3ad531bfb140e9f802e39da2a83af6de606b115e5ccd3da35d9078b413b1d1846cbd1b4f

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\REDLINE STEALER V20.2 - Edition 2022\Kurome.Host\Kurome.Host.exe.config"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\REDLINE STEALER V20.2 - Edition 2022\Kurome.Host\Kurome.Host.exe.config"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2768

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    114dc23827b1fe664e2b177d0fa6212f

    SHA1

    2c802ca0967e198510acc7e832a1ffc0b5281acc

    SHA256

    50dc1060287d6c262ebeb2000566f6f937fe6b03080dd55ae37a93a2d91bbaf9

    SHA512

    7b17ffc71cad3b288f37f11a4501d530f069d5652be45e125628e90e80a723cf26b7ee4ee29ed11632ae70db5906ba3b886ae3fd6907646b477ba2a66de26290