Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2022 19:16
Static task
static1
Behavioral task
behavioral1
Sample
f4e5632d43b44aa7d7367ae576064cc53ad33d402104378eba4fa5e45150becc.exe
Resource
win10v2004-20220812-en
General
-
Target
f4e5632d43b44aa7d7367ae576064cc53ad33d402104378eba4fa5e45150becc.exe
-
Size
296KB
-
MD5
91fab56e64780a2d7929dacf86d108e1
-
SHA1
52a401cd8914e6469edd700add9d48b65b79ddcd
-
SHA256
f4e5632d43b44aa7d7367ae576064cc53ad33d402104378eba4fa5e45150becc
-
SHA512
3a890af6901b6b325efb7e03dd63e99f65b8b3fb3d3a73b3943eba0bba6066f17589359a0e4cb6ad38f736e5fb135a71046018adf6ced8cbc816f8db8080a2f8
-
SSDEEP
6144:G7N3L1iOlKlzhTAunLLTvALqkeU9EndTQ:G75ZiOlSP6qQ9UdT
Malware Config
Extracted
redline
@REDLINEVIP Cloud (TG: @FATHEROFCARDERS)
151.80.89.233:13553
-
auth_value
fbee175162920530e6bf470c8003fa1a
Extracted
redline
45.15.156.37:110
-
auth_value
19cd76dae6d01d9649fd29624fa61e51
Extracted
redline
rozena1114
jalocliche.xyz:81
chardhesha.xyz:81
-
auth_value
9fefd743a3b62bcd7c3e17a70fbdb3a8
Signatures
-
Detect Amadey credential stealer module 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll amadey_cred_module C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll amadey_cred_module -
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2476-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000086001\40K.exe family_redline behavioral1/memory/1260-197-0x0000000000BD0000-0x0000000000BF8000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000086001\40K.exe family_redline behavioral1/memory/2548-224-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
4F0C.exedescription pid process target process PID 3940 created 2512 3940 4F0C.exe taskhostw.exe -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 116 4424 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 10 IoCs
Processes:
44E8.exe4BBF.exe4F0C.exe515F.exerovwer.exe40K.exe14-11.exerovwer.exesvchost.exerovwer.exepid process 4644 44E8.exe 3824 4BBF.exe 3940 4F0C.exe 4628 515F.exe 4236 rovwer.exe 1260 40K.exe 3820 14-11.exe 3480 rovwer.exe 3268 svchost.exe 3232 rovwer.exe -
Processes:
resource yara_rule behavioral1/memory/2624-248-0x0000000000400000-0x0000000000BEB000-memory.dmp upx behavioral1/memory/2624-250-0x0000000000400000-0x0000000000BEB000-memory.dmp upx behavioral1/memory/2624-251-0x0000000000400000-0x0000000000BEB000-memory.dmp upx behavioral1/memory/2624-253-0x0000000000400000-0x0000000000BEB000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
515F.exerovwer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 515F.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation rovwer.exe -
Loads dropped DLL 2 IoCs
Processes:
4F0C.exerundll32.exepid process 3940 4F0C.exe 4424 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
rovwer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\40K.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000086001\\40K.exe" rovwer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\14-11.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000087001\\14-11.exe" rovwer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
4F0C.exe4BBF.exedescription pid process target process PID 3940 set thread context of 2548 3940 4F0C.exe ngentask.exe PID 3824 set thread context of 2624 3824 4BBF.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4432 4628 WerFault.exe 515F.exe 4928 4644 WerFault.exe 44E8.exe 2336 3480 WerFault.exe rovwer.exe 4628 3232 WerFault.exe rovwer.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f4e5632d43b44aa7d7367ae576064cc53ad33d402104378eba4fa5e45150becc.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f4e5632d43b44aa7d7367ae576064cc53ad33d402104378eba4fa5e45150becc.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f4e5632d43b44aa7d7367ae576064cc53ad33d402104378eba4fa5e45150becc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f4e5632d43b44aa7d7367ae576064cc53ad33d402104378eba4fa5e45150becc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 114 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f4e5632d43b44aa7d7367ae576064cc53ad33d402104378eba4fa5e45150becc.exepid process 2476 f4e5632d43b44aa7d7367ae576064cc53ad33d402104378eba4fa5e45150becc.exe 2476 f4e5632d43b44aa7d7367ae576064cc53ad33d402104378eba4fa5e45150becc.exe 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2644 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
f4e5632d43b44aa7d7367ae576064cc53ad33d402104378eba4fa5e45150becc.exepid process 2476 f4e5632d43b44aa7d7367ae576064cc53ad33d402104378eba4fa5e45150becc.exe 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 -
Suspicious use of AdjustPrivilegeToken 56 IoCs
Processes:
44E8.exe40K.exe14-11.exengentask.exedescription pid process Token: SeDebugPrivilege 4644 44E8.exe Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeDebugPrivilege 1260 40K.exe Token: SeDebugPrivilege 3820 14-11.exe Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeDebugPrivilege 2548 ngentask.exe Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
515F.exerovwer.execmd.exedescription pid process target process PID 2644 wrote to memory of 4644 2644 44E8.exe PID 2644 wrote to memory of 4644 2644 44E8.exe PID 2644 wrote to memory of 4644 2644 44E8.exe PID 2644 wrote to memory of 3824 2644 4BBF.exe PID 2644 wrote to memory of 3824 2644 4BBF.exe PID 2644 wrote to memory of 3940 2644 4F0C.exe PID 2644 wrote to memory of 3940 2644 4F0C.exe PID 2644 wrote to memory of 3940 2644 4F0C.exe PID 2644 wrote to memory of 4628 2644 515F.exe PID 2644 wrote to memory of 4628 2644 515F.exe PID 2644 wrote to memory of 4628 2644 515F.exe PID 2644 wrote to memory of 2308 2644 explorer.exe PID 2644 wrote to memory of 2308 2644 explorer.exe PID 2644 wrote to memory of 2308 2644 explorer.exe PID 2644 wrote to memory of 2308 2644 explorer.exe PID 2644 wrote to memory of 388 2644 explorer.exe PID 2644 wrote to memory of 388 2644 explorer.exe PID 2644 wrote to memory of 388 2644 explorer.exe PID 2644 wrote to memory of 5100 2644 explorer.exe PID 2644 wrote to memory of 5100 2644 explorer.exe PID 2644 wrote to memory of 5100 2644 explorer.exe PID 2644 wrote to memory of 5100 2644 explorer.exe PID 4628 wrote to memory of 4236 4628 515F.exe rovwer.exe PID 4628 wrote to memory of 4236 4628 515F.exe rovwer.exe PID 4628 wrote to memory of 4236 4628 515F.exe rovwer.exe PID 2644 wrote to memory of 4724 2644 explorer.exe PID 2644 wrote to memory of 4724 2644 explorer.exe PID 2644 wrote to memory of 4724 2644 explorer.exe PID 2644 wrote to memory of 3604 2644 explorer.exe PID 2644 wrote to memory of 3604 2644 explorer.exe PID 2644 wrote to memory of 3604 2644 explorer.exe PID 2644 wrote to memory of 3604 2644 explorer.exe PID 2644 wrote to memory of 4312 2644 explorer.exe PID 2644 wrote to memory of 4312 2644 explorer.exe PID 2644 wrote to memory of 4312 2644 explorer.exe PID 2644 wrote to memory of 4312 2644 explorer.exe PID 4236 wrote to memory of 1012 4236 rovwer.exe schtasks.exe PID 4236 wrote to memory of 1012 4236 rovwer.exe schtasks.exe PID 4236 wrote to memory of 1012 4236 rovwer.exe schtasks.exe PID 4236 wrote to memory of 4520 4236 rovwer.exe cmd.exe PID 4236 wrote to memory of 4520 4236 rovwer.exe cmd.exe PID 4236 wrote to memory of 4520 4236 rovwer.exe cmd.exe PID 4520 wrote to memory of 4360 4520 cmd.exe cmd.exe PID 4520 wrote to memory of 4360 4520 cmd.exe cmd.exe PID 4520 wrote to memory of 4360 4520 cmd.exe cmd.exe PID 4520 wrote to memory of 3980 4520 cmd.exe cacls.exe PID 4520 wrote to memory of 3980 4520 cmd.exe cacls.exe PID 4520 wrote to memory of 3980 4520 cmd.exe cacls.exe PID 2644 wrote to memory of 1356 2644 explorer.exe PID 2644 wrote to memory of 1356 2644 explorer.exe PID 2644 wrote to memory of 1356 2644 explorer.exe PID 2644 wrote to memory of 1356 2644 explorer.exe PID 4520 wrote to memory of 2776 4520 cmd.exe cacls.exe PID 4520 wrote to memory of 2776 4520 cmd.exe cacls.exe PID 4520 wrote to memory of 2776 4520 cmd.exe cacls.exe PID 2644 wrote to memory of 4160 2644 explorer.exe PID 2644 wrote to memory of 4160 2644 explorer.exe PID 2644 wrote to memory of 4160 2644 explorer.exe PID 4520 wrote to memory of 2132 4520 cmd.exe cmd.exe PID 4520 wrote to memory of 2132 4520 cmd.exe cmd.exe PID 4520 wrote to memory of 2132 4520 cmd.exe cmd.exe PID 4236 wrote to memory of 1260 4236 rovwer.exe 40K.exe PID 4236 wrote to memory of 1260 4236 rovwer.exe 40K.exe PID 4236 wrote to memory of 1260 4236 rovwer.exe 40K.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
PID:3268
-
C:\Users\Admin\AppData\Local\Temp\f4e5632d43b44aa7d7367ae576064cc53ad33d402104378eba4fa5e45150becc.exe"C:\Users\Admin\AppData\Local\Temp\f4e5632d43b44aa7d7367ae576064cc53ad33d402104378eba4fa5e45150becc.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2476
-
C:\Users\Admin\AppData\Local\Temp\44E8.exeC:\Users\Admin\AppData\Local\Temp\44E8.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4644 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 19482⤵
- Program crash
PID:4928
-
C:\Users\Admin\AppData\Local\Temp\4BBF.exeC:\Users\Admin\AppData\Local\Temp\4BBF.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3824 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe2⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\4F0C.exeC:\Users\Admin\AppData\Local\Temp\4F0C.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:3940 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
C:\Users\Admin\AppData\Local\Temp\515F.exeC:\Users\Admin\AppData\Local\Temp\515F.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe" /F3⤵
- Creates scheduled task(s)
PID:1012 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rovwer.exe" /P "Admin:N"&&CACLS "rovwer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\99e342142d" /P "Admin:N"&&CACLS "..\99e342142d" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:4360
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:N"4⤵PID:3980
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:R" /E4⤵PID:2776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2132
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:N"4⤵PID:4036
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:R" /E4⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\1000086001\40K.exe"C:\Users\Admin\AppData\Local\Temp\1000086001\40K.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\1000087001\14-11.exe"C:\Users\Admin\AppData\Local\Temp\1000087001\14-11.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3820 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- outlook_win_path
PID:4424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 12842⤵
- Program crash
PID:4432
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2308
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:388
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5100
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4628 -ip 46281⤵PID:2116
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3604
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4312
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1356
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4160
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe1⤵
- Executes dropped EXE
PID:3480 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 4202⤵
- Program crash
PID:2336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4644 -ip 46441⤵PID:4720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3480 -ip 34801⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe1⤵
- Executes dropped EXE
PID:3232 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 4242⤵
- Program crash
PID:4628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3232 -ip 32321⤵PID:544
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000086001\40K.exeFilesize
137KB
MD587ef06885fd221a86bba9e5b86a7ea7d
SHA16644db86f2d557167f442a5fe72a82de3fe943ba
SHA256ab5026bf6fe5d692faaf86752b4c9fa226ec49ba54cfb625579287b498eab20f
SHA512c65b38856d4995b01454754044ae7373363a02b8e228c249fee3c1c2222f2348473f0bba5a5f2e4a280cd183e57dc13423bb09f86919ccb8968c8229310c5ad0
-
C:\Users\Admin\AppData\Local\Temp\1000086001\40K.exeFilesize
137KB
MD587ef06885fd221a86bba9e5b86a7ea7d
SHA16644db86f2d557167f442a5fe72a82de3fe943ba
SHA256ab5026bf6fe5d692faaf86752b4c9fa226ec49ba54cfb625579287b498eab20f
SHA512c65b38856d4995b01454754044ae7373363a02b8e228c249fee3c1c2222f2348473f0bba5a5f2e4a280cd183e57dc13423bb09f86919ccb8968c8229310c5ad0
-
C:\Users\Admin\AppData\Local\Temp\1000087001\14-11.exeFilesize
199KB
MD50385f088162ba40f42567b2547a50b2f
SHA1253097adc89941518d5d40dc5ea0e2f954a323e2
SHA2569959b77737dd53be31eabcb7333bde782dc4a53496d4e5c448b5aafdca4dce56
SHA51289f39cb1919f070282a00c128a908c425d37e0c4c10757e65836189f1b215f6859bab6513d4aaac75119bb5d863e5a22c1fba622898c451bde5479449edc57eb
-
C:\Users\Admin\AppData\Local\Temp\1000087001\14-11.exeFilesize
199KB
MD50385f088162ba40f42567b2547a50b2f
SHA1253097adc89941518d5d40dc5ea0e2f954a323e2
SHA2569959b77737dd53be31eabcb7333bde782dc4a53496d4e5c448b5aafdca4dce56
SHA51289f39cb1919f070282a00c128a908c425d37e0c4c10757e65836189f1b215f6859bab6513d4aaac75119bb5d863e5a22c1fba622898c451bde5479449edc57eb
-
C:\Users\Admin\AppData\Local\Temp\44E8.exeFilesize
318KB
MD5a00269b75b7279f9ecfd3facdb53a778
SHA1c503a8e8ff2d00e3c813b9d5f814725fff52a8ef
SHA256f0241716bd122221b3fb01bf870373514cf8aab54a10a0f01090ea9d789c30eb
SHA512786a79d4095f42084e921d835eab34cc8bb43862e1b19b0672fc9ba4369dada63d3aa4936e63d6d10bd125a504217e06413a2d4a761d4af30a7b4edc2b8471b3
-
C:\Users\Admin\AppData\Local\Temp\44E8.exeFilesize
318KB
MD5a00269b75b7279f9ecfd3facdb53a778
SHA1c503a8e8ff2d00e3c813b9d5f814725fff52a8ef
SHA256f0241716bd122221b3fb01bf870373514cf8aab54a10a0f01090ea9d789c30eb
SHA512786a79d4095f42084e921d835eab34cc8bb43862e1b19b0672fc9ba4369dada63d3aa4936e63d6d10bd125a504217e06413a2d4a761d4af30a7b4edc2b8471b3
-
C:\Users\Admin\AppData\Local\Temp\4BBF.exeFilesize
3.0MB
MD572efc55b476245e5955a405c50c3574f
SHA182cc77bb5e47520209e6564513e45c7d39573115
SHA256899d0f9e8343dab899e302fa6bda0ec1bc4133f00fbb6d9215eea4b79ccf4ecb
SHA51201e2eec8c951815b0cd98904ad5758a6c7c73f8b3e4cb4fcaeb80d8cb4f68366d06b2a309b3349d2a22f8904ec815feaf33f7a599bf7d56b3ec38188071604b8
-
C:\Users\Admin\AppData\Local\Temp\4BBF.exeFilesize
3.0MB
MD572efc55b476245e5955a405c50c3574f
SHA182cc77bb5e47520209e6564513e45c7d39573115
SHA256899d0f9e8343dab899e302fa6bda0ec1bc4133f00fbb6d9215eea4b79ccf4ecb
SHA51201e2eec8c951815b0cd98904ad5758a6c7c73f8b3e4cb4fcaeb80d8cb4f68366d06b2a309b3349d2a22f8904ec815feaf33f7a599bf7d56b3ec38188071604b8
-
C:\Users\Admin\AppData\Local\Temp\4F0C.exeFilesize
1.1MB
MD55e7c07b9aa0668fa2971747bb4fade1e
SHA17fae544f73f2a8fb7a340a20ec47f76370fbd487
SHA256431a1c4ceae3411f5476eed27fc30ebd55138afb4c4e9dac3db9d4b8addbb361
SHA5125c9c65c99f0c8a5aaa2beac1a0c4304a1cb2ea808eeb6bbe11c2852d6e9fbad8bb68faa5f778848dade617e1c5ee1fb9dae566d7a064b05fdaa30a03019b868f
-
C:\Users\Admin\AppData\Local\Temp\4F0C.exeFilesize
1.1MB
MD55e7c07b9aa0668fa2971747bb4fade1e
SHA17fae544f73f2a8fb7a340a20ec47f76370fbd487
SHA256431a1c4ceae3411f5476eed27fc30ebd55138afb4c4e9dac3db9d4b8addbb361
SHA5125c9c65c99f0c8a5aaa2beac1a0c4304a1cb2ea808eeb6bbe11c2852d6e9fbad8bb68faa5f778848dade617e1c5ee1fb9dae566d7a064b05fdaa30a03019b868f
-
C:\Users\Admin\AppData\Local\Temp\515F.exeFilesize
335KB
MD52714d8595163913ef567a599366c1064
SHA1c6ba817e47768709242cc4057f372ba50484abf4
SHA256bfd68b428d7401ece09a3aff4a699f318525c839819f5195f15607e9cb374878
SHA51233322214caa3ef0bb5c10de71be0bb9f8d3322e128b2930fa1569b4823b87a00302c9efd1b87812e86b3252f53fe2d0b9984889a7e96eb639206300446a79658
-
C:\Users\Admin\AppData\Local\Temp\515F.exeFilesize
335KB
MD52714d8595163913ef567a599366c1064
SHA1c6ba817e47768709242cc4057f372ba50484abf4
SHA256bfd68b428d7401ece09a3aff4a699f318525c839819f5195f15607e9cb374878
SHA51233322214caa3ef0bb5c10de71be0bb9f8d3322e128b2930fa1569b4823b87a00302c9efd1b87812e86b3252f53fe2d0b9984889a7e96eb639206300446a79658
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
335KB
MD52714d8595163913ef567a599366c1064
SHA1c6ba817e47768709242cc4057f372ba50484abf4
SHA256bfd68b428d7401ece09a3aff4a699f318525c839819f5195f15607e9cb374878
SHA51233322214caa3ef0bb5c10de71be0bb9f8d3322e128b2930fa1569b4823b87a00302c9efd1b87812e86b3252f53fe2d0b9984889a7e96eb639206300446a79658
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
335KB
MD52714d8595163913ef567a599366c1064
SHA1c6ba817e47768709242cc4057f372ba50484abf4
SHA256bfd68b428d7401ece09a3aff4a699f318525c839819f5195f15607e9cb374878
SHA51233322214caa3ef0bb5c10de71be0bb9f8d3322e128b2930fa1569b4823b87a00302c9efd1b87812e86b3252f53fe2d0b9984889a7e96eb639206300446a79658
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
335KB
MD52714d8595163913ef567a599366c1064
SHA1c6ba817e47768709242cc4057f372ba50484abf4
SHA256bfd68b428d7401ece09a3aff4a699f318525c839819f5195f15607e9cb374878
SHA51233322214caa3ef0bb5c10de71be0bb9f8d3322e128b2930fa1569b4823b87a00302c9efd1b87812e86b3252f53fe2d0b9984889a7e96eb639206300446a79658
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
335KB
MD52714d8595163913ef567a599366c1064
SHA1c6ba817e47768709242cc4057f372ba50484abf4
SHA256bfd68b428d7401ece09a3aff4a699f318525c839819f5195f15607e9cb374878
SHA51233322214caa3ef0bb5c10de71be0bb9f8d3322e128b2930fa1569b4823b87a00302c9efd1b87812e86b3252f53fe2d0b9984889a7e96eb639206300446a79658
-
C:\Users\Admin\AppData\Local\Temp\advapi32.dllFilesize
422KB
MD56a88864e46a99fc80ed605a8674aea68
SHA15290388ef67f658c31f5a99f4bbd9ca557bc3ab7
SHA256f292fb7fefcd5c7815955ea5a691fd91160884e2a79ebe3ff6458fe7fea79448
SHA512c2cd9b9bbbe7661e9ec7c235f1dde9976ee79c02a5fd049b043b4a048e05692d16b53dd1206537a192199d829a4e4622758edb12ac46c14475edeea897fccdc5
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
1.0MB
MD57ec1bacdf3a5c0a88cd4c9eda3897530
SHA1ea904b3216abf9cd814e1c13507a543cf362ef01
SHA256999cb113f2d60760cdeba5d537ced0d305dfff7e527edf5ff441f147371c92a3
SHA51211cc364492540c501ae2af50f3a9ef0ebc92f8cd917fa89a69335fb550df8625d1047e6ef2f0a98735195e268cf398521a1a94efcbe1f7e4a3049d9c461905a3
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
1.0MB
MD57ec1bacdf3a5c0a88cd4c9eda3897530
SHA1ea904b3216abf9cd814e1c13507a543cf362ef01
SHA256999cb113f2d60760cdeba5d537ced0d305dfff7e527edf5ff441f147371c92a3
SHA51211cc364492540c501ae2af50f3a9ef0ebc92f8cd917fa89a69335fb550df8625d1047e6ef2f0a98735195e268cf398521a1a94efcbe1f7e4a3049d9c461905a3
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
126KB
MD5507e9dc7b9c42f535b6df96d79179835
SHA1acf41fb549750023115f060071aa5ca8c33f249e
SHA2563b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af
SHA51270907ec4c395b0d2219bfe98907ec130bfcbc6d4bec7bd73965a9b1e422553e27daaead3d6647620fcf5392d85a2e975bce0f7c79c0bc665dd33ce65f7d44302
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
126KB
MD5507e9dc7b9c42f535b6df96d79179835
SHA1acf41fb549750023115f060071aa5ca8c33f249e
SHA2563b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af
SHA51270907ec4c395b0d2219bfe98907ec130bfcbc6d4bec7bd73965a9b1e422553e27daaead3d6647620fcf5392d85a2e975bce0f7c79c0bc665dd33ce65f7d44302
-
memory/388-216-0x00000000006F0000-0x00000000006F9000-memory.dmpFilesize
36KB
-
memory/388-162-0x00000000006F0000-0x00000000006F9000-memory.dmpFilesize
36KB
-
memory/388-159-0x0000000000000000-mapping.dmp
-
memory/388-163-0x00000000006E0000-0x00000000006EF000-memory.dmpFilesize
60KB
-
memory/1012-179-0x0000000000000000-mapping.dmp
-
memory/1260-222-0x00000000086B0000-0x0000000008700000-memory.dmpFilesize
320KB
-
memory/1260-220-0x0000000008A60000-0x0000000008AD6000-memory.dmpFilesize
472KB
-
memory/1260-197-0x0000000000BD0000-0x0000000000BF8000-memory.dmpFilesize
160KB
-
memory/1260-194-0x0000000000000000-mapping.dmp
-
memory/1356-191-0x0000000000B30000-0x0000000000B3B000-memory.dmpFilesize
44KB
-
memory/1356-188-0x0000000000000000-mapping.dmp
-
memory/1356-238-0x0000000000B40000-0x0000000000B46000-memory.dmpFilesize
24KB
-
memory/1356-190-0x0000000000B40000-0x0000000000B46000-memory.dmpFilesize
24KB
-
memory/2132-193-0x0000000000000000-mapping.dmp
-
memory/2280-203-0x0000000000000000-mapping.dmp
-
memory/2308-215-0x0000000000940000-0x0000000000947000-memory.dmpFilesize
28KB
-
memory/2308-160-0x0000000000940000-0x0000000000947000-memory.dmpFilesize
28KB
-
memory/2308-161-0x0000000000930000-0x000000000093B000-memory.dmpFilesize
44KB
-
memory/2308-155-0x0000000000000000-mapping.dmp
-
memory/2476-135-0x0000000000400000-0x000000000084D000-memory.dmpFilesize
4.3MB
-
memory/2476-132-0x0000000000942000-0x0000000000957000-memory.dmpFilesize
84KB
-
memory/2476-134-0x0000000000400000-0x000000000084D000-memory.dmpFilesize
4.3MB
-
memory/2476-133-0x00000000001F0000-0x00000000001F9000-memory.dmpFilesize
36KB
-
memory/2548-219-0x0000000000000000-mapping.dmp
-
memory/2548-221-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2548-224-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2624-248-0x0000000000400000-0x0000000000BEB000-memory.dmpFilesize
7.9MB
-
memory/2624-249-0x0000000000BE8EA0-mapping.dmp
-
memory/2624-250-0x0000000000400000-0x0000000000BEB000-memory.dmpFilesize
7.9MB
-
memory/2624-251-0x0000000000400000-0x0000000000BEB000-memory.dmpFilesize
7.9MB
-
memory/2624-253-0x0000000000400000-0x0000000000BEB000-memory.dmpFilesize
7.9MB
-
memory/2776-189-0x0000000000000000-mapping.dmp
-
memory/2932-201-0x0000000000000000-mapping.dmp
-
memory/2932-206-0x0000000000360000-0x000000000036B000-memory.dmpFilesize
44KB
-
memory/2932-205-0x0000000000370000-0x0000000000378000-memory.dmpFilesize
32KB
-
memory/3268-237-0x0000000000240000-0x00000000003A9000-memory.dmpFilesize
1.4MB
-
memory/3268-242-0x0000000000ED0000-0x00000000010BA000-memory.dmpFilesize
1.9MB
-
memory/3268-234-0x0000000000000000-mapping.dmp
-
memory/3268-243-0x00000000010C0000-0x00000000010C4000-memory.dmpFilesize
16KB
-
memory/3604-181-0x00000000009D0000-0x00000000009F2000-memory.dmpFilesize
136KB
-
memory/3604-229-0x00000000009D0000-0x00000000009F2000-memory.dmpFilesize
136KB
-
memory/3604-177-0x00000000009A0000-0x00000000009C7000-memory.dmpFilesize
156KB
-
memory/3604-174-0x0000000000000000-mapping.dmp
-
memory/3820-212-0x0000000000C90000-0x0000000000CC8000-memory.dmpFilesize
224KB
-
memory/3820-240-0x0000000007190000-0x00000000071AE000-memory.dmpFilesize
120KB
-
memory/3820-209-0x0000000000000000-mapping.dmp
-
memory/3824-142-0x0000000000000000-mapping.dmp
-
memory/3940-208-0x000000000FAC0000-0x000000000FC3F000-memory.dmpFilesize
1.5MB
-
memory/3940-147-0x0000000000000000-mapping.dmp
-
memory/3940-213-0x000000000276A000-0x0000000002C78000-memory.dmpFilesize
5.1MB
-
memory/3940-153-0x000000000276A000-0x0000000002C78000-memory.dmpFilesize
5.1MB
-
memory/3940-214-0x000000000FAC0000-0x000000000FC3F000-memory.dmpFilesize
1.5MB
-
memory/3940-239-0x0000000002D81000-0x0000000002E7F000-memory.dmpFilesize
1016KB
-
memory/3940-207-0x0000000002D81000-0x0000000002E7F000-memory.dmpFilesize
1016KB
-
memory/3980-187-0x0000000000000000-mapping.dmp
-
memory/4036-199-0x0000000000000000-mapping.dmp
-
memory/4160-192-0x0000000000000000-mapping.dmp
-
memory/4160-241-0x00000000001E0000-0x00000000001E7000-memory.dmpFilesize
28KB
-
memory/4160-200-0x00000000001E0000-0x00000000001E7000-memory.dmpFilesize
28KB
-
memory/4160-202-0x00000000001D0000-0x00000000001DD000-memory.dmpFilesize
52KB
-
memory/4236-230-0x0000000000400000-0x0000000000856000-memory.dmpFilesize
4.3MB
-
memory/4236-166-0x0000000000000000-mapping.dmp
-
memory/4236-182-0x0000000000A13000-0x0000000000A32000-memory.dmpFilesize
124KB
-
memory/4236-183-0x0000000000400000-0x0000000000856000-memory.dmpFilesize
4.3MB
-
memory/4312-231-0x0000000000D50000-0x0000000000D55000-memory.dmpFilesize
20KB
-
memory/4312-184-0x0000000000D50000-0x0000000000D55000-memory.dmpFilesize
20KB
-
memory/4312-178-0x0000000000000000-mapping.dmp
-
memory/4312-185-0x0000000000D40000-0x0000000000D49000-memory.dmpFilesize
36KB
-
memory/4360-186-0x0000000000000000-mapping.dmp
-
memory/4424-255-0x0000000000000000-mapping.dmp
-
memory/4520-180-0x0000000000000000-mapping.dmp
-
memory/4628-170-0x0000000000400000-0x0000000000856000-memory.dmpFilesize
4.3MB
-
memory/4628-150-0x0000000000000000-mapping.dmp
-
memory/4628-169-0x0000000000B63000-0x0000000000B82000-memory.dmpFilesize
124KB
-
memory/4628-164-0x0000000000980000-0x00000000009BE000-memory.dmpFilesize
248KB
-
memory/4644-233-0x0000000000400000-0x00000000005A8000-memory.dmpFilesize
1.7MB
-
memory/4644-157-0x0000000005540000-0x0000000005552000-memory.dmpFilesize
72KB
-
memory/4644-141-0x0000000000400000-0x00000000005A8000-memory.dmpFilesize
1.7MB
-
memory/4644-232-0x0000000000949000-0x000000000097A000-memory.dmpFilesize
196KB
-
memory/4644-204-0x0000000000949000-0x000000000097A000-memory.dmpFilesize
196KB
-
memory/4644-158-0x0000000005560000-0x000000000559C000-memory.dmpFilesize
240KB
-
memory/4644-139-0x0000000000949000-0x000000000097A000-memory.dmpFilesize
196KB
-
memory/4644-136-0x0000000000000000-mapping.dmp
-
memory/4644-156-0x0000000005410000-0x000000000551A000-memory.dmpFilesize
1.0MB
-
memory/4644-145-0x0000000004DF0000-0x0000000005394000-memory.dmpFilesize
5.6MB
-
memory/4644-154-0x00000000055E0000-0x0000000005BF8000-memory.dmpFilesize
6.1MB
-
memory/4644-140-0x00000000006F0000-0x000000000072E000-memory.dmpFilesize
248KB
-
memory/4644-198-0x0000000005E80000-0x0000000005EE6000-memory.dmpFilesize
408KB
-
memory/4644-146-0x0000000004D00000-0x0000000004D92000-memory.dmpFilesize
584KB
-
memory/4644-217-0x0000000006F50000-0x0000000007112000-memory.dmpFilesize
1.8MB
-
memory/4644-218-0x00000000074D0000-0x00000000079FC000-memory.dmpFilesize
5.2MB
-
memory/4724-172-0x0000000000000000-mapping.dmp
-
memory/4724-175-0x0000000000ED0000-0x0000000000ED6000-memory.dmpFilesize
24KB
-
memory/4724-176-0x0000000000EC0000-0x0000000000ECC000-memory.dmpFilesize
48KB
-
memory/4724-226-0x0000000000ED0000-0x0000000000ED6000-memory.dmpFilesize
24KB
-
memory/5100-173-0x0000000000640000-0x0000000000649000-memory.dmpFilesize
36KB
-
memory/5100-171-0x0000000000650000-0x0000000000655000-memory.dmpFilesize
20KB
-
memory/5100-225-0x0000000000650000-0x0000000000655000-memory.dmpFilesize
20KB
-
memory/5100-165-0x0000000000000000-mapping.dmp