77b9f0c79ae8a64eb8d2f6ad82089b44ceda4144a96840d47371548ead61a763

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 08:24

Target

Redline_20_2/Redline_20_2_stealer-main/Kurome.Host/Kurome.Host.exe
Size

119KB
MD5

4fde0f80c408af27a8d3ddeffea12251
SHA1

e834291127af150ce287443c5ea607a7ae337484
SHA256

1b644cdb1c7247c07d810c0ea10bec34dc5600f3645589690a219de08cf2dedb
SHA512

3693aeaa2cc276060b899f21f6f57f435b75fec5bcd7725b2dd79043b341c12ebc29bd43b287eb22a3e31fd2b50c4fa36bf020f9f3db5e2f75fe8cc747eca5f5
SSDEEP

3072:KEdjrOO8+K46SgVE+mxzqT67iLRi/Gj81GUpYb:KjQjgPmxzq27iLRiuAPp

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Kurome.Host.exe

description pid process

Token: SeDebugPrivilege 2200 Kurome.Host.exe

description	pid	process
Token: SeDebugPrivilege	2200	Kurome.Host.exe

C:\Users\Admin\AppData\Local\Temp\Redline_20_2\Redline_20_2_stealer-main\Kurome.Host\Kurome.Host.exe
"C:\Users\Admin\AppData\Local\Temp\Redline_20_2\Redline_20_2_stealer-main\Kurome.Host\Kurome.Host.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2200

memory/2200-0-0x000000007451E000-0x000000007451F000-memory.dmp

Filesize
4KB

Download
memory/2200-1-0x00000000012A0000-0x00000000012C4000-memory.dmp

Filesize
144KB

Download
memory/2200-2-0x0000000074510000-0x0000000074BFE000-memory.dmp

Filesize
6.9MB

Download
memory/2200-3-0x0000000074510000-0x0000000074BFE000-memory.dmp

Filesize
6.9MB

Download
memory/2200-4-0x0000000000550000-0x0000000000576000-memory.dmp

Filesize
152KB

Download
memory/2200-5-0x0000000074510000-0x0000000074BFE000-memory.dmp

Filesize
6.9MB

Download
memory/2200-6-0x000000007451E000-0x000000007451F000-memory.dmp

Filesize
4KB

Download
memory/2200-7-0x0000000074510000-0x0000000074BFE000-memory.dmp

Filesize
6.9MB

Download
memory/2200-8-0x0000000074510000-0x0000000074BFE000-memory.dmp

Filesize
6.9MB

Download