redline | fa3680e959871a8b7880231d204a715261c82e9c37ba79c2298e16e05aa975e5

General

Target

ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe
Size

637KB
MD5

4aa0c7957da0e3a896ea83291b6e60ab
SHA1

88fabfa45c3d2c7db2096bee7a59479593e2bb90
SHA256

ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb
SHA512

300fb41e9563bef358d7db1543c8b2d966cbb2faf5b13d08bda04892fa9b11f65e0891734a62e77a60e3de1fe9ddff63acb3f42bcfd773946835ff1cbf7f4a6c
SSDEEP

12288:N4H3Z0scDTvtXTDK+sW9O2q2uU0Q4vWkJ:NucDTJnquk

Score

10^/10

redline sectoprat azure infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

azure

C2

68.219.104.74:56189

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE	family_redline
\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE	family_redline
C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE	family_redline
behavioral1/memory/1496-71-0x0000000001390000-0x00000000013AE000-memory.dmp	family_redline
behavioral1/memory/932-72-0x000000001B5F0000-0x000000001B670000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE	family_sectoprat
\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE	family_sectoprat
C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE	family_sectoprat
behavioral1/memory/1496-71-0x0000000001390000-0x00000000013AE000-memory.dmp	family_sectoprat
behavioral1/memory/932-72-0x000000001B5F0000-0x000000001B670000-memory.dmp	family_sectoprat

Executes dropped EXE 2 IoCs

Processes:

AZURE_AUTH.EXEAZURECHECKER.EXE

pid process

1496 AZURE_AUTH.EXE
932 AZURECHECKER.EXE

pid	process
1496	AZURE_AUTH.EXE
932	AZURECHECKER.EXE

Loads dropped DLL 3 IoCs

Processes:

ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe

pid	process
1484	ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe
1484	ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe
1400

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AZURECHECKER.EXEAZURE_AUTH.EXE

description pid process

Token: SeDebugPrivilege 932 AZURECHECKER.EXE
Token: SeDebugPrivilege 1496 AZURE_AUTH.EXE

description	pid	process
Token: SeDebugPrivilege	932	AZURECHECKER.EXE
Token: SeDebugPrivilege	1496	AZURE_AUTH.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe

description	pid	process	target process
PID 1484 wrote to memory of 932	1484	ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe	AZURECHECKER.EXE
PID 1484 wrote to memory of 932	1484	ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe	AZURECHECKER.EXE
PID 1484 wrote to memory of 932	1484	ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe	AZURECHECKER.EXE
PID 1484 wrote to memory of 932	1484	ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe	AZURECHECKER.EXE
PID 1484 wrote to memory of 1496	1484	ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe	AZURE_AUTH.EXE
PID 1484 wrote to memory of 1496	1484	ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe	AZURE_AUTH.EXE
PID 1484 wrote to memory of 1496	1484	ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe	AZURE_AUTH.EXE
PID 1484 wrote to memory of 1496	1484	ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe	AZURE_AUTH.EXE

C:\Users\Admin\AppData\Local\Temp\ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe
"C:\Users\Admin\AppData\Local\Temp\ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1484

C:\Users\Admin\AppData\Local\Temp\AZURECHECKER.EXE
"C:\Users\Admin\AppData\Local\Temp\AZURECHECKER.EXE"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:932

C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE
"C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1496

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AZURECHECKER.EXE
Filesize
270KB

MD5
e4fc6eb7c6a98f2d85bf5e31c1cac51c

SHA1
1f7332faf00464f5c991928b44ac92117f57ac33

SHA256
565e8772d4ea9d3690f82229ff186840641f9cdef8a99d51de04a077d5dc33c0

SHA512
f92279941ae0ac831cba84191c3d6efb903783784a9752e7e69a0075d059c0c00bd76ab9a376c7e52fc148ba0a59d2e1d6071815d51508d6a1340c140c2f7f6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZURECHECKER.EXE
Filesize
270KB

MD5
e4fc6eb7c6a98f2d85bf5e31c1cac51c

SHA1
1f7332faf00464f5c991928b44ac92117f57ac33

SHA256
565e8772d4ea9d3690f82229ff186840641f9cdef8a99d51de04a077d5dc33c0

SHA512
f92279941ae0ac831cba84191c3d6efb903783784a9752e7e69a0075d059c0c00bd76ab9a376c7e52fc148ba0a59d2e1d6071815d51508d6a1340c140c2f7f6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE
Filesize
95KB

MD5
d0c17c2e05160a16be0c7f654328201e

SHA1
10c818208d97b36678c5013069e98545e85e4a69

SHA256
187e892db937a891f042c1b21e363c47481327e4895cfc7208904993b390d54f

SHA512
d2c83dd03a601fc764f4339da99e290b7d35b4426679a3591a44f0560cbe9e7a75c1f5f49979be6c45e62f51100504924b0b8d92745d52dd06ace81a64c7459c

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE
Filesize
95KB

MD5
d0c17c2e05160a16be0c7f654328201e

SHA1
10c818208d97b36678c5013069e98545e85e4a69

SHA256
187e892db937a891f042c1b21e363c47481327e4895cfc7208904993b390d54f

SHA512
d2c83dd03a601fc764f4339da99e290b7d35b4426679a3591a44f0560cbe9e7a75c1f5f49979be6c45e62f51100504924b0b8d92745d52dd06ace81a64c7459c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Colorful.Console.dll
Filesize
88KB

MD5
ac1a142f7f25b35c48d5b4fb04c3f821

SHA1
43587a1385a7e267c86e6eca47f88dab486cde07

SHA256
4f228ec1979076fda183d9b87045a79e5fc116bde28f931886f043fae2081b71

SHA512
f868b6c62572225e8bd80f4720d2591f47382edc4d028b46dcb8d85fd3606402d4368d9424bf92b8f490c58dd046f9f3f9bdc770177d86a531cb3d490df568ad

Download Submit
\Users\Admin\AppData\Local\Temp\AZURECHECKER.EXE
Filesize
270KB

MD5
e4fc6eb7c6a98f2d85bf5e31c1cac51c

SHA1
1f7332faf00464f5c991928b44ac92117f57ac33

SHA256
565e8772d4ea9d3690f82229ff186840641f9cdef8a99d51de04a077d5dc33c0

SHA512
f92279941ae0ac831cba84191c3d6efb903783784a9752e7e69a0075d059c0c00bd76ab9a376c7e52fc148ba0a59d2e1d6071815d51508d6a1340c140c2f7f6a

Download Submit
\Users\Admin\AppData\Local\Temp\AZURECHECKER.EXE
Filesize
270KB

MD5
e4fc6eb7c6a98f2d85bf5e31c1cac51c

SHA1
1f7332faf00464f5c991928b44ac92117f57ac33

SHA256
565e8772d4ea9d3690f82229ff186840641f9cdef8a99d51de04a077d5dc33c0

SHA512
f92279941ae0ac831cba84191c3d6efb903783784a9752e7e69a0075d059c0c00bd76ab9a376c7e52fc148ba0a59d2e1d6071815d51508d6a1340c140c2f7f6a

Download Submit
\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE
Filesize
95KB

MD5
d0c17c2e05160a16be0c7f654328201e

SHA1
10c818208d97b36678c5013069e98545e85e4a69

SHA256
187e892db937a891f042c1b21e363c47481327e4895cfc7208904993b390d54f

SHA512
d2c83dd03a601fc764f4339da99e290b7d35b4426679a3591a44f0560cbe9e7a75c1f5f49979be6c45e62f51100504924b0b8d92745d52dd06ace81a64c7459c

Download Submit
memory/932-70-0x000000013FA80000-0x000000013FAEC000-memory.dmp

Filesize
432KB

Download
memory/932-72-0x000000001B5F0000-0x000000001B670000-memory.dmp

Filesize
512KB

Download
memory/932-73-0x00000000007B0000-0x00000000007D6000-memory.dmp

Filesize
152KB

Download
memory/932-83-0x00000000007E0000-0x00000000007FC000-memory.dmp

Filesize
112KB

Download
memory/932-85-0x000000001B5F0000-0x000000001B670000-memory.dmp

Filesize
512KB

Download
memory/1496-71-0x0000000001390000-0x00000000013AE000-memory.dmp

Filesize
120KB

Download
memory/1496-84-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/1496-86-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads