Analysis
- max time kernel
135s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
01/11/2024, 21:32
General
- Target Redline-crack-by-rzt/Kurome.Builder/Kurome.Builder.exe
- Size 137KB
- Sample241101-1d3dcawdlr
- SHA256 c47b78e566425fc4165a83b2661313e41ee8d66241f7bea7723304a6a751595e
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe"C:\Users\Admin\AppData\Local\Temp\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1956-0-0x00000000747AE000-0x00000000747AF000-memory.dmp
memory/1956-1-0x0000000000910000-0x0000000000938000-memory.dmp
memory/1956-2-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/1956-4-0x00000000059D0000-0x0000000005F74000-memory.dmp
memory/1956-5-0x0000000005420000-0x00000000054B2000-memory.dmp
memory/1956-3-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/1956-6-0x00000000053A0000-0x00000000053AA000-memory.dmp
memory/1956-7-0x00000000069F0000-0x0000000006A4E000-memory.dmp
memory/1956-8-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/1956-10-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/1956-9-0x00000000747AE000-0x00000000747AF000-memory.dmp