Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-12-2024 22:35
General
-
Target
RedLine Stealer V20.2 CRACKED/RedLine_21_1_crack/Kurome.Builder/Kurome.Builder.exe
-
Size
473KB
-
MD5
a2dea5e5eae84e32bc4dc3c6789d7939
-
SHA1
d31ec0c15ca50e4663b39be351c8562269a065b2
-
SHA256
c747032f12707103c70dccd112c51eacb8151e4b401a54a2b6fed2a4aad800bd
-
SHA512
60dd889f5c3ed3a3fc1e42cd072590eeb344e34d6a2a693d45cac51914b75f1bda8931c7025b2366f4cdc4ecdad1fc6bf77eb0daf43e551e2f795e6b9f44ae1a
-
SSDEEP
12288:D5Hisa3jCsD6y0ch0C3wwILMeKSdlKHHV:DhijmWHphX3wyeK6Y1
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RedLine Stealer V20.2 CRACKED\RedLine_21_1_crack\Kurome.Builder\Kurome.Builder.exe"C:\Users\Admin\AppData\Local\Temp\RedLine Stealer V20.2 CRACKED\RedLine_21_1_crack\Kurome.Builder\Kurome.Builder.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe" VNPQv3WqEXQMTT7cY3RBbPK4HGD0vJ8J3uiSQoPAnqNA1T229I7q78dKRL6MpElVSA0qh91y3l166VOt1cuSUE3D1hB4NL5E10tUGemf4HtM4DcPBKOWvUWml11iWYSMQPMNh59LYohp1n3RPk7E3wWJLvLL2RHI1VV6K526UJ2J1lQgdUKNC4dU1I6EOCUOn43nXNCVNOOJ0jKA3PyNyCitTq9Rc5c9k2M8KJT2K5408OoT1oCTId9V29cCb6j343GU85LGY4B77u46EEvTjGkVaqIuMYyB0wX5CrwiiSWGMl436C7SO0w4NGUR9OAH4AC19RHHB9UsO4rASns6JLnE1050tERKO5m2J9quQHAOQ3lfdU7XsyKX9psJQMLd08L16Vn9xner2D7CGDBI5xxWdLSmgOvN08STpUhPfTnPJsWLmg0oBUA23HGMBCDSKYbDEPHSFHBGYA3C0H3ALXSgVGDgWn0PSkC8WHTjHY22TP5S5eCktuAJBNMW42Mxu6VQaXd93UF5C686to98uMMEs0GxEle6RvXTnY36NF8GUH9WlS2OSLoAQ1uP6aPWDNEK4MRDXA7kEUTIbg30AP2CD9UBM1Od9W1Ng5AANk48nVSj0vQP0XCF3BaHY1KoCW3PDikMKPSKI2h256pNkrOOgG198DU7Re18drFb4Ifd84EJQQuGSlfD4N615ODGI08GL1XE4B87MU0pDl7xNbMQDi3hVs6333U973cC0GC58UYxTiIBrJGdnDpLyNE445PL0s1ugXLPMEoqfQ1U8PQM6HwkqOXJaLW39bKPu955EJu2o2tDImH328IJa7Js5SBRo7h6v57YfB1yCJH92OoDT000NvYKcsOG348ps7HV2KB0AGKVVUYwqqX8OhYQHnIFE8vBGNTJ1Fr2P946cBdBCPWn5AwxMtCNX4X519GlwFE0KiU0njxOqST409Era3Qg9F8JGPKGjwjG8sLdFXmBJ0FAsAQ5PCnpW3k0Ls7I6I3aYal9LelYvB0wNO2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
160KB
-
Filesize
136KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
464KB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
376KB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
112KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
496KB