Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06/11/2024, 21:19
General
-
Target
RedLine Stealer V20.2 CRACKED/RedLine_21_1_crack/Kurome.Builder/Kurome.Builder.exe
-
Size
473KB
-
MD5
a2dea5e5eae84e32bc4dc3c6789d7939
-
SHA1
d31ec0c15ca50e4663b39be351c8562269a065b2
-
SHA256
c747032f12707103c70dccd112c51eacb8151e4b401a54a2b6fed2a4aad800bd
-
SHA512
60dd889f5c3ed3a3fc1e42cd072590eeb344e34d6a2a693d45cac51914b75f1bda8931c7025b2366f4cdc4ecdad1fc6bf77eb0daf43e551e2f795e6b9f44ae1a
-
SSDEEP
12288:D5Hisa3jCsD6y0ch0C3wwILMeKSdlKHHV:DhijmWHphX3wyeK6Y1
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RedLine Stealer V20.2 CRACKED\RedLine_21_1_crack\Kurome.Builder\Kurome.Builder.exe"C:\Users\Admin\AppData\Local\Temp\RedLine Stealer V20.2 CRACKED\RedLine_21_1_crack\Kurome.Builder\Kurome.Builder.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe" VNPQv3WqEXQMTT7cY3RBbPK4HGD0vJ8J3uiSQoPAnqNA1T229I7q78dKRL6MpElVSA0qh91y3l166VOt1cuSUE3D1hB4NL5E10tUGemf4HtM4DcPBKOWvUWml11iWYSMQPMNh59LYohp1n3RPk7E3wWJLvLL2RHI1VV6K526UJ2J1lQgdUKNC4dU1I6EOCUOn43nXNCVNOOJ0jKA3PyNyCitTq9Rc5c9k2M8KJT2K5408OoT1oCTId9V29cCb6j343GU85LGY4B77u46EEvTjGkVaqIuMYyB0wX5CrwiiSWGMl436C7SO0w4NGUR9OAH4AC19RHHB9UsO4rASns6JLnE1050tERKO5m2J9quQHAOQ3lfdU7XsyKX9psJQMLd08L16Vn9xner2D7CGDBI5xxWdLSmgOvN08STpUhPfTnPJsWLmg0oBUA23HGMBCDSKYbDEPHSFHBGYA3C0H3ALXSgVGDgWn0PSkC8WHTjHY22TP5S5eCktuAJBNMW42Mxu6VQaXd93UF5C686to98uMMEs0GxEle6RvXTnY36NF8GUH9WlS2OSLoAQ1uP6aPWDNEK4MRDXA7kEUTIbg30AP2CD9UBM1Od9W1Ng5AANk48nVSj0vQP0XCF3BaHY1KoCW3PDikMKPSKI2h256pNkrOOgG198DU7Re18drFb4Ifd84EJQQuGSlfD4N615ODGI08GL1XE4B87MU0pDl7xNbMQDi3hVs6333U973cC0GC58UYxTiIBrJGdnDpLyNE445PL0s1ugXLPMEoqfQ1U8PQM6HwkqOXJaLW39bKPu955EJu2o2tDImH328IJa7Js5SBRo7h6v57YfB1yCJH92OoDT000NvYKcsOG348ps7HV2KB0AGKVVUYwqqX8OhYQHnIFE8vBGNTJ1Fr2P946cBdBCPWn5AwxMtCNX4X519GlwFE0KiU0njxOqST409Era3Qg9F8JGPKGjwjG8sLdFXmBJ0FAsAQ5PCnpW3k0Ls7I6I3aYal9LelYvB0wNO2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342B
MD57bd04e63bf40d01299cfbd343bf79ddf
SHA151526a91e44a974ff588affa6d90c476a2cef0c5
SHA256debe28671636a5e292105cdd5f9e12d04c20b3d4c6bdd6e84262736b31a37758
SHA512741189073aa96430382f17967b17d200f29dd7d5050ea0666d8b9860491e7f2a5dcdca96c5dd937c4462365e0f349069802f2ae0b7d937553fad3b39dd941986
-
Filesize
342B
MD58ad67d03c917846ac59ea7d1e6ba9aa1
SHA13ba57e9fb6bbac3d289e0408029b0533e6e75618
SHA256b12ec39df5e8aeb004e13a04e36bae84b41d35005ff17985abebf91cd3b54406
SHA5127a0d0aec66b5025e57cdcda961ad7701ab3c791db283ca486ac3042ae15f71f92945cdc002aca92bf69da2a2222cc0de7f2c3ad861918676dc98635ce0d7980f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
496KB
-
Filesize
464KB
-
Filesize
6.9MB
-
Filesize
136KB
-
Filesize
6.9MB
-
Filesize
160KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
6.9MB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
112KB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
376KB
-
Filesize
140KB
-
Filesize
6.9MB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
48KB