sectoprat | hxxps://mega[.]nz/folder/cXdH3JjK#gvZibu9MbYFG5Qt0h6XALA

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/folder/cXdH3JjK#gvZibu9MbYFG5Qt0h6XALA

Score

10^/10

sectoprat agilenet rat trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat
SectopRAT payload 1 IoCs

Processes:

resource yara_rule

C:\Users\Admin\Downloads\Redline_20_2.zip family_sectoprat
Loads dropped DLL 8 IoCs

Processes:

Kurome.Host.exeKurome.Builder.exe

pid process

1576 Kurome.Host.exe
1576 Kurome.Host.exe
1576 Kurome.Host.exe
1576 Kurome.Host.exe
2344 Kurome.Builder.exe
2344 Kurome.Builder.exe
2344 Kurome.Builder.exe
2344 Kurome.Builder.exe
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
agilenet

Processes:

resource yara_rule

C:\Users\Admin\Downloads\Redline_20_2.zip agile_net
Drops file in Windows directory 1 IoCs

Processes:

Kurome.Loader.exe

description ioc process

File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll Kurome.Loader.exe

resource	yara_rule
C:\Users\Admin\Downloads\Redline_20_2.zip	family_sectoprat

pid	process
1576	Kurome.Host.exe
1576	Kurome.Host.exe
1576	Kurome.Host.exe
1576	Kurome.Host.exe
2344	Kurome.Builder.exe
2344	Kurome.Builder.exe
2344	Kurome.Builder.exe
2344	Kurome.Builder.exe

resource	yara_rule
C:\Users\Admin\Downloads\Redline_20_2.zip	agile_net

description	ioc	process
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll	Kurome.Loader.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings msedge.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

5832 NOTEPAD.EXE
Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid process

520 msedge.exe
520 msedge.exe
3200 msedge.exe
3200 msedge.exe
964 identity_helper.exe
964 identity_helper.exe
5196 msedge.exe
5196 msedge.exe
5460 msedge.exe
5460 msedge.exe
5460 msedge.exe
5460 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3200 msedge.exe
3200 msedge.exe
3200 msedge.exe
3200 msedge.exe
3200 msedge.exe
3200 msedge.exe
3200 msedge.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Kurome.Loader.exeKurome.Host.exeKurome.Builder.exe

description pid process

Token: SeDebugPrivilege 5836 Kurome.Loader.exe
Token: SeDebugPrivilege 1576 Kurome.Host.exe
Token: SeDebugPrivilege 2344 Kurome.Builder.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	msedge.exe

pid	process
5832	NOTEPAD.EXE

pid	process
520	msedge.exe
520	msedge.exe
3200	msedge.exe
3200	msedge.exe
964	identity_helper.exe
964	identity_helper.exe
5196	msedge.exe
5196	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe

description	pid	process
Token: SeDebugPrivilege	5836	Kurome.Loader.exe
Token: SeDebugPrivilege	1576	Kurome.Host.exe
Token: SeDebugPrivilege	2344	Kurome.Builder.exe

Suspicious use of FindShellTrayWindow 36 IoCs

Processes:

msedge.exeNOTEPAD.EXEKurome.Builder.exe

pid	process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
5832	NOTEPAD.EXE
2344	Kurome.Builder.exe
2344	Kurome.Builder.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3200 wrote to memory of 1852	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1852	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 2488	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 520	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 520	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 3612	3200	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/folder/cXdH3JjK#gvZibu9MbYFG5Qt0h6XALA
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdabb846f8,0x7ffdabb84708,0x7ffdabb84718
2⤵
PID:1852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,14251578335029724024,14105528385939411296,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
2⤵
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,14251578335029724024,14105528385939411296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,14251578335029724024,14105528385939411296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
2⤵
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14251578335029724024,14105528385939411296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:3652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14251578335029724024,14105528385939411296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14251578335029724024,14105528385939411296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
2⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14251578335029724024,14105528385939411296,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
2⤵
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,14251578335029724024,14105528385939411296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
2⤵
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,14251578335029724024,14105528385939411296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,14251578335029724024,14105528385939411296,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4780 /prefetch:8
2⤵
PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14251578335029724024,14105528385939411296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
2⤵
PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14251578335029724024,14105528385939411296,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
2⤵
PID:5236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,14251578335029724024,14105528385939411296,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6024 /prefetch:8
2⤵
PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14251578335029724024,14105528385939411296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
2⤵
PID:6140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,14251578335029724024,14105528385939411296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6148 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,14251578335029724024,14105528385939411296,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1052 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4412

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x40c 0x51c
1⤵
PID:4076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5500

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Redline_20_2.zip\Redline_20_2\Redline_20_2_stealer-main\ReadMe.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:5832

C:\Users\Admin\Downloads\Redline_20_2\Redline_20_2\Redline_20_2_stealer-main\Kurome.Loader\Kurome.Loader.exe
"C:\Users\Admin\Downloads\Redline_20_2\Redline_20_2\Redline_20_2_stealer-main\Kurome.Loader\Kurome.Loader.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5836

C:\Users\Admin\Downloads\Redline_20_2\Redline_20_2\Redline_20_2_stealer-main\Kurome.Host\Kurome.Host.exe
"C:\Users\Admin\Downloads\Redline_20_2\Redline_20_2\Redline_20_2_stealer-main\Kurome.Host\Kurome.Host.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Users\Admin\Downloads\Redline_20_2\Redline_20_2\Redline_20_2_stealer-main\Kurome.Builder\Kurome.Builder.exe
"C:\Users\Admin\Downloads\Redline_20_2\Redline_20_2\Redline_20_2_stealer-main\Kurome.Builder\Kurome.Builder.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2344

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
477462b6ad8eaaf8d38f5e3a4daf17b0

SHA1
86174e670c44767c08a39cc2a53c09c318326201

SHA256
e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

SHA512
a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b704c9ca0493bd4548ac9c69dc4a4f27

SHA1
a3e5e54e630dabe55ca18a798d9f5681e0620ba7

SHA256
2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

SHA512
69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026
Filesize
17KB

MD5
950eca48e414acbe2c3b5d046dcb8521

SHA1
1731f264e979f18cdf08c405c7b7d32789a6fb59

SHA256
c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2

SHA512
27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
72B

MD5
db0fc21642645d757ea366b842ef7820

SHA1
ac8c0ab8f3da67beb8fc40e0c4839aee0a6eb98a

SHA256
ebf9e4541cee72f6884706d05fb6084c6ce4babf149e8933de75690ade955659

SHA512
3f4a47757a92a4c3642508622780e393870509cf5903018cdd0d54d1406543bd5f9602f2eee42cecc457db305b548c9f67ba8ad633a3ce0d7e4432e8309a7133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
801099495547ee588c19c98524a3e23d

SHA1
b767ec208285d19ae7d1f9bdf67252580e9ac5c0

SHA256
a556ef2af8aac8380c3c2b9b0ae5fffc3ba3f0cbe3c5a1650b250aeb9478732e

SHA512
a606f87166093fd7d64a40b5ee9182f8c99bad00a10145c6621a19bde29fad59b23bb3451226c983bab5c9204b4bd52e18ad5e81b83d9851a439899401d2aed9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
4a4a4971feb776a44a4502bf87d0a77a

SHA1
36c4b44f28c70e023fdf20ae55df520029e6f77a

SHA256
25ccd9ae8e6ad5712af1c2eb43936d0a0f7854fb263cb86bff8b890558668315

SHA512
6dda1aa5ad3101fe6696c83f219c4923a5b64eebd7291f00faea592e2eb862d8fb35e47bef0327fb5157ec5a3770355f6502bb53e7664de0bd8718a3c2af3ce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6e404f7968895584cdbd2f6815ab1c26

SHA1
db1e5c8003d4b9af1f22a842580c0d40a30923f7

SHA256
08a53602c0ce488ca7d1a4134c7b9121334c9194a43d2faa8dbd62e18ceab95c

SHA512
f3c94ec1439c68e3c8c0d8c51baa2534339b18084eca4963f854b63bdf6eea8de06af7323146c32dd24f3b59ad96b42e203f54075b1f825e0fc2dcdb11f135bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
9d044b81dd13ca81487f896b3984ad58

SHA1
933b04dbeaff135713ab9004cafc21d122a8052d

SHA256
0b9960ffa12f8c9477910e0d2297d996a51e79f92171dcb72f8cada18c15c8ac

SHA512
6e7286d105c736988f85ded2b0304f381c19770182b0b6018ef960683718cfe6a377b9f8250df19ccfe7134e476a3010afc3cdaba090469817a9c72f9376dce4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57955a.TMP
Filesize
48B

MD5
a16cc6a4ab79d95317042e0bd5c61a12

SHA1
d41c8c49858b5ceb9eab76a4e2721f3ab8dd128a

SHA256
b27394a1cb56def99bb941b3a61acb5fe9d7c3c462aa2571b8aed4a2ca311067

SHA512
d6214976decb523f2161505aab2e6dd984ea8f2b52cddab3a66a65cc56849b4e2236ed18dc0a9f9844645ad185d22920eebf26a8b26b13de3a9bd357f70d2081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d2fa6f08e29b3724d4209d5a8c54627a

SHA1
ba668a06a28f7049dbd116aa356c732fa5b18da7

SHA256
3ff7fc168c65ecc0d108d6423f58b5958b0bfda4ee59e4d41b017815e193012c

SHA512
2eb5406e7613bacb7be309d989d31ea8ef1d1e08a574a587fa02ce46a562c2de7c0697d296fd885920d821ecbd1bdbb551238d87a7f751e824ca77ba17c220e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
db8a58e64ab0d8cfd4f140d00337d319

SHA1
642ebb969e238300a431d0b9ce0d4e43221be50e

SHA256
6ec6e83188a86043d70ab634ae031dc601d7c815f76d8c56a6691c62bb471522

SHA512
0dead92bf6c713818a38667221ba8c43dcf6cd01023e1dde02f10c3ff61e9fc6f98dec2796f27687754a09ad30d49c23e23613b285125e133894562e81f61b29

Download Submit
C:\Users\Admin\Downloads\Redline_20_2.zip
Filesize
24.7MB

MD5
76dfff9ca583e5f6375137d2093467b9

SHA1
b5688c7f4cdc0a1b9cef12f0e7290f490ea5d82d

SHA256
f1bfec7c5ab45c524ece7dfdb79bcf5d88ef5654523d2fb51a2d91eadc545663

SHA512
9c2474377a882cac31bec79a516621918cdfa36949cbe29a5405c56644f11df263c35e021fab45f98fb3cef60ecc3f5b7c59f62d173c5843334d22d5a4159472

Download Submit
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
Filesize
3.4MB

MD5
059d51f43f1a774bc5aa76d19c614670

SHA1
171329bf0f48190cf4d59ce106b139e63507457d

SHA256
2eaf3d548927ebd243362f7bcb906bb1bbff3961223fb9521cb2846b6b8d523d

SHA512
a299cb18c8a47fc27c46db0011266b7fa273852b302374eb98a54034e1281150af8e54e58f76a384d3b92fbcb1a67fc0452cabe592a379e15cce2c5f9a4b6cb7

Download Submit
\??\pipe\LOCAL\crashpad_3200_RBGLDTRRKLDYXSSN
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1576-555-0x0000000005100000-0x000000000514C000-memory.dmp

Filesize
304KB

Download
memory/1576-560-0x0000000005F60000-0x0000000006060000-memory.dmp

Filesize
1024KB

Download
memory/1576-554-0x0000000005390000-0x0000000005616000-memory.dmp

Filesize
2.5MB

Download
memory/1576-547-0x0000000004C10000-0x0000000004F72000-memory.dmp

Filesize
3.4MB

Download
memory/1576-548-0x0000000004F80000-0x00000000050FC000-memory.dmp

Filesize
1.5MB

Download
memory/1576-549-0x0000000004950000-0x0000000004976000-memory.dmp

Filesize
152KB

Download
memory/1576-550-0x0000000005720000-0x0000000005D38000-memory.dmp

Filesize
6.1MB

Download
memory/1576-551-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/1576-552-0x0000000004AE0000-0x0000000004B1C000-memory.dmp

Filesize
240KB

Download
memory/1576-556-0x0000000005220000-0x00000000052EE000-memory.dmp

Filesize
824KB

Download
memory/1576-561-0x0000000005D50000-0x0000000005D80000-memory.dmp

Filesize
192KB

Download
memory/1576-541-0x0000000000080000-0x00000000000A4000-memory.dmp

Filesize
144KB

Download
memory/1576-553-0x0000000004B90000-0x0000000004BF6000-memory.dmp

Filesize
408KB

Download
memory/1576-557-0x0000000005E50000-0x0000000005F5A000-memory.dmp

Filesize
1.0MB

Download
memory/1576-558-0x00000000051B0000-0x00000000051D8000-memory.dmp

Filesize
160KB

Download
memory/1576-559-0x0000000005340000-0x0000000005390000-memory.dmp

Filesize
320KB

Download
memory/2344-570-0x0000000005B70000-0x0000000005BCE000-memory.dmp

Filesize
376KB

Download
memory/2344-562-0x0000000000410000-0x0000000000438000-memory.dmp

Filesize
160KB

Download
memory/2344-567-0x0000000005C00000-0x00000000061A4000-memory.dmp

Filesize
5.6MB

Download
memory/2344-568-0x0000000004EE0000-0x0000000004F72000-memory.dmp

Filesize
584KB

Download
memory/2344-569-0x0000000005070000-0x000000000507A000-memory.dmp

Filesize
40KB

Download
memory/5836-514-0x0000000000420000-0x0000000000656000-memory.dmp

Filesize
2.2MB

Download
memory/5836-515-0x0000000007600000-0x0000000007C10000-memory.dmp

Filesize
6.1MB

Download