Analysis
- max time kernel
120s - max time network
130s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
- submitted
07/02/2025, 18:29
General
- Target Redline-Botnet-_ed--drcrypter.ru-/Redline Botnet Cracked [drcrypter.ru]/Kurome.Builder/Kurome.Builder.exe
- Size 137KB
- Sample250207-w4zb6askft
- SHA256 c47b78e566425fc4165a83b2661313e41ee8d66241f7bea7723304a6a751595e
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Redline-Botnet-_ed--drcrypter.ru-\Redline Botnet Cracked [drcrypter.ru]\Kurome.Builder\Kurome.Builder.exe"C:\Users\Admin\AppData\Local\Temp\Redline-Botnet-_ed--drcrypter.ru-\Redline Botnet Cracked [drcrypter.ru]\Kurome.Builder\Kurome.Builder.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1988-0-0x0000000073DCE000-0x0000000073DCF000-memory.dmp
memory/1988-1-0x0000000000940000-0x0000000000968000-memory.dmp
memory/1988-2-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/1988-3-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/1988-4-0x00000000005A0000-0x00000000005FE000-memory.dmp
memory/1988-5-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/1988-6-0x0000000073DCE000-0x0000000073DCF000-memory.dmp
memory/1988-7-0x0000000073DC0000-0x00000000744AE000-memory.dmp