redline | fa3680e959871a8b7880231d204a715261c82e9c37ba79c2298e16e05aa975e5

General

Target

ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe
Size

637KB
MD5

4aa0c7957da0e3a896ea83291b6e60ab
SHA1

88fabfa45c3d2c7db2096bee7a59479593e2bb90
SHA256

ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb
SHA512

300fb41e9563bef358d7db1543c8b2d966cbb2faf5b13d08bda04892fa9b11f65e0891734a62e77a60e3de1fe9ddff63acb3f42bcfd773946835ff1cbf7f4a6c
SSDEEP

12288:N4H3Z0scDTvtXTDK+sW9O2q2uU0Q4vWkJ:NucDTJnquk

Score

10^/10

redline sectoprat azure infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

azure

C2

68.219.104.74:56189

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE	family_redline
C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE	family_redline
C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE	family_redline
behavioral2/memory/3376-166-0x00000000004F0000-0x000000000050E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE	family_sectoprat
C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE	family_sectoprat
C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE	family_sectoprat
behavioral2/memory/3376-166-0x00000000004F0000-0x000000000050E000-memory.dmp	family_sectoprat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe

Executes dropped EXE 2 IoCs

Processes:

AZURECHECKER.EXEAZURE_AUTH.EXE

pid process

2120 AZURECHECKER.EXE
3376 AZURE_AUTH.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AZURECHECKER.EXEAZURE_AUTH.EXE

description pid process

Token: SeDebugPrivilege 2120 AZURECHECKER.EXE
Token: SeDebugPrivilege 3376 AZURE_AUTH.EXE

pid	process
2120	AZURECHECKER.EXE
3376	AZURE_AUTH.EXE

description	pid	process
Token: SeDebugPrivilege	2120	AZURECHECKER.EXE
Token: SeDebugPrivilege	3376	AZURE_AUTH.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe

description	pid	process	target process
PID 1176 wrote to memory of 2120	1176	ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe	AZURECHECKER.EXE
PID 1176 wrote to memory of 2120	1176	ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe	AZURECHECKER.EXE
PID 1176 wrote to memory of 3376	1176	ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe	AZURE_AUTH.EXE
PID 1176 wrote to memory of 3376	1176	ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe	AZURE_AUTH.EXE
PID 1176 wrote to memory of 3376	1176	ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe	AZURE_AUTH.EXE

C:\Users\Admin\AppData\Local\Temp\ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe
"C:\Users\Admin\AppData\Local\Temp\ddf82eaf2707ce522623efb8724ec4d3def245b7edff76245da2eb902b0773bb.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1176

C:\Users\Admin\AppData\Local\Temp\AZURECHECKER.EXE
"C:\Users\Admin\AppData\Local\Temp\AZURECHECKER.EXE"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2120

C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE
"C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3376

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AZURECHECKER.EXE
Filesize
270KB

MD5
e4fc6eb7c6a98f2d85bf5e31c1cac51c

SHA1
1f7332faf00464f5c991928b44ac92117f57ac33

SHA256
565e8772d4ea9d3690f82229ff186840641f9cdef8a99d51de04a077d5dc33c0

SHA512
f92279941ae0ac831cba84191c3d6efb903783784a9752e7e69a0075d059c0c00bd76ab9a376c7e52fc148ba0a59d2e1d6071815d51508d6a1340c140c2f7f6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZURECHECKER.EXE
Filesize
270KB

MD5
e4fc6eb7c6a98f2d85bf5e31c1cac51c

SHA1
1f7332faf00464f5c991928b44ac92117f57ac33

SHA256
565e8772d4ea9d3690f82229ff186840641f9cdef8a99d51de04a077d5dc33c0

SHA512
f92279941ae0ac831cba84191c3d6efb903783784a9752e7e69a0075d059c0c00bd76ab9a376c7e52fc148ba0a59d2e1d6071815d51508d6a1340c140c2f7f6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZURECHECKER.EXE
Filesize
270KB

MD5
e4fc6eb7c6a98f2d85bf5e31c1cac51c

SHA1
1f7332faf00464f5c991928b44ac92117f57ac33

SHA256
565e8772d4ea9d3690f82229ff186840641f9cdef8a99d51de04a077d5dc33c0

SHA512
f92279941ae0ac831cba84191c3d6efb903783784a9752e7e69a0075d059c0c00bd76ab9a376c7e52fc148ba0a59d2e1d6071815d51508d6a1340c140c2f7f6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE
Filesize
95KB

MD5
d0c17c2e05160a16be0c7f654328201e

SHA1
10c818208d97b36678c5013069e98545e85e4a69

SHA256
187e892db937a891f042c1b21e363c47481327e4895cfc7208904993b390d54f

SHA512
d2c83dd03a601fc764f4339da99e290b7d35b4426679a3591a44f0560cbe9e7a75c1f5f49979be6c45e62f51100504924b0b8d92745d52dd06ace81a64c7459c

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE
Filesize
95KB

MD5
d0c17c2e05160a16be0c7f654328201e

SHA1
10c818208d97b36678c5013069e98545e85e4a69

SHA256
187e892db937a891f042c1b21e363c47481327e4895cfc7208904993b390d54f

SHA512
d2c83dd03a601fc764f4339da99e290b7d35b4426679a3591a44f0560cbe9e7a75c1f5f49979be6c45e62f51100504924b0b8d92745d52dd06ace81a64c7459c

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZURE_AUTH.EXE
Filesize
95KB

MD5
d0c17c2e05160a16be0c7f654328201e

SHA1
10c818208d97b36678c5013069e98545e85e4a69

SHA256
187e892db937a891f042c1b21e363c47481327e4895cfc7208904993b390d54f

SHA512
d2c83dd03a601fc764f4339da99e290b7d35b4426679a3591a44f0560cbe9e7a75c1f5f49979be6c45e62f51100504924b0b8d92745d52dd06ace81a64c7459c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Colorful.Console.dll
Filesize
88KB

MD5
ac1a142f7f25b35c48d5b4fb04c3f821

SHA1
43587a1385a7e267c86e6eca47f88dab486cde07

SHA256
4f228ec1979076fda183d9b87045a79e5fc116bde28f931886f043fae2081b71

SHA512
f868b6c62572225e8bd80f4720d2591f47382edc4d028b46dcb8d85fd3606402d4368d9424bf92b8f490c58dd046f9f3f9bdc770177d86a531cb3d490df568ad

Download Submit
memory/2120-176-0x000001B92F600000-0x000001B92F610000-memory.dmp

Filesize
64KB

Download
memory/2120-156-0x000001B92F1A0000-0x000001B92F20C000-memory.dmp

Filesize
432KB

Download
memory/2120-158-0x000001B92F550000-0x000001B92F576000-memory.dmp

Filesize
152KB

Download
memory/2120-169-0x000001B92F5A0000-0x000001B92F5BC000-memory.dmp

Filesize
112KB

Download
memory/2120-170-0x000001B92F600000-0x000001B92F610000-memory.dmp

Filesize
64KB

Download
memory/3376-166-0x00000000004F0000-0x000000000050E000-memory.dmp

Filesize
120KB

Download
memory/3376-172-0x0000000004E80000-0x0000000004E92000-memory.dmp

Filesize
72KB

Download
memory/3376-173-0x0000000004EE0000-0x0000000004F1C000-memory.dmp

Filesize
240KB

Download
memory/3376-174-0x0000000004F50000-0x0000000004F60000-memory.dmp

Filesize
64KB

Download
memory/3376-175-0x0000000005190000-0x000000000529A000-memory.dmp

Filesize
1.0MB

Download
memory/3376-171-0x0000000005580000-0x0000000005B98000-memory.dmp

Filesize
6.1MB

Download
memory/3376-177-0x0000000004F50000-0x0000000004F60000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads