392cbc3fb00a0db2060d65c5c993cb32fa747d6f5a78ba89348b4edf269e865b

Analysis

max time kernel
102s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04-08-2024 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

REDLINE STEALER V20.2 - Edition 2022/Kurome.Builder/Kurome.Builder.pdb
Size

19KB
MD5

e0468434c2489d74199641856a9c2265
SHA1

8dc34b96ba7378f93dad3e731fc438a92685b13a
SHA256

713276677bcfb9fed27d545ab0b3591bf11fa9d6dd22739a00d43cb916a1a73f
SHA512

6a0f31354b42234f6878ea0d67eb5a012676c4c052817fb5936fee5cf31c43d065820cd6be2f20cf5361d4f5020e2dfdc6368a37bff3f958b6637689d2ca1e68
SSDEEP

192:eYVAiAiAiAiAiAiwpR0kxEOkYooaf/Uw/BEAXEmYtgZ8HQock:eYWMkOXoafsPck

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\pdb_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.pdb\ = "pdb_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\pdb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\pdb_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\pdb_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.pdb	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\pdb_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2716 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2716 AcroRd32.exe
2716 AcroRd32.exe

pid	process
2716	AcroRd32.exe

pid	process
2716	AcroRd32.exe
2716	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1660 wrote to memory of 2912	1660	cmd.exe	rundll32.exe
PID 1660 wrote to memory of 2912	1660	cmd.exe	rundll32.exe
PID 1660 wrote to memory of 2912	1660	cmd.exe	rundll32.exe
PID 2912 wrote to memory of 2716	2912	rundll32.exe	AcroRd32.exe
PID 2912 wrote to memory of 2716	2912	rundll32.exe	AcroRd32.exe
PID 2912 wrote to memory of 2716	2912	rundll32.exe	AcroRd32.exe
PID 2912 wrote to memory of 2716	2912	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\REDLINE STEALER V20.2 - Edition 2022\Kurome.Builder\Kurome.Builder.pdb"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\REDLINE STEALER V20.2 - Edition 2022\Kurome.Builder\Kurome.Builder.pdb
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2912

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\REDLINE STEALER V20.2 - Edition 2022\Kurome.Builder\Kurome.Builder.pdb"
3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3e9c3947eea5a62cb270f29b982b74f0

SHA1
bd30212e4fd41d10131e4104dc910341aff52c36

SHA256
6a81514bc97c1bc609b5c750aebcdbeeacd7b5d555424625ec9cdb963af2f3a9

SHA512
92fd6906729c73f4b13d284b5e9d471088c0c0b06ef02709df690f610107634049dd5a414aa03d91959205f9d664080223cd606c880764f68e084c1a2ca459e6

Download Submit