Analysis
-
max time kernel
147s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 23:01
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
General
-
Target
file.exe
-
Size
323KB
-
MD5
d915386b9f157bed5fb89d1fa6fa6814
-
SHA1
1a62d4df4127ed31070e49ad00797b886b56eb98
-
SHA256
15e5d0f3035ddeb19ab45120c125c41d02a4317757d8a67c8545a31826d4b5a9
-
SHA512
483ceb075b4d42f405cd73797061821a8980c01b64d5d11321f8ee2bded708a9f4c7e081d1dfd407ffeea75d67e6a12a902cd27a4fd1bb1946bb5e2b8fcefacd
-
SSDEEP
6144:NNONJMM5+mcXt9ACfqadlJWzOPlQyJETGquGwwqVva:7ONJMi+mcXsCiazPwyqOz8
Malware Config
Extracted
amadey
3.68
88.218.60.230/7vzZwkv2/index.php
Extracted
redline
7
89.22.237.107:44745
-
auth_value
9fb4a4a8b5764119b91a5d9c6a94b401
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
7.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
7.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
file.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 4 IoCs
Processes:
oneetx.exe7.exeoneetx.exeoneetx.exepid process 4060 oneetx.exe 5028 7.exe 4836 oneetx.exe 3564 oneetx.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
7.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Wine 7.exe -
Loads dropped DLL 3 IoCs
Processes:
rundll32.exerundll32.exerundll32.exepid process 4104 rundll32.exe 2304 rundll32.exe 1968 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
7.exepid process 5028 7.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7.exedescription pid process target process PID 5028 set thread context of 2224 5028 7.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 40 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3604 5028 WerFault.exe file.exe 4732 5028 WerFault.exe file.exe 5016 5028 WerFault.exe file.exe 1272 5028 WerFault.exe file.exe 772 5028 WerFault.exe file.exe 4032 5028 WerFault.exe file.exe 2684 5028 WerFault.exe file.exe 892 5028 WerFault.exe file.exe 4440 4060 WerFault.exe oneetx.exe 4756 4060 WerFault.exe oneetx.exe 588 4060 WerFault.exe oneetx.exe 4168 4060 WerFault.exe oneetx.exe 4544 4060 WerFault.exe oneetx.exe 4788 4060 WerFault.exe oneetx.exe 676 4060 WerFault.exe oneetx.exe 784 4060 WerFault.exe oneetx.exe 3568 4060 WerFault.exe oneetx.exe 4012 4060 WerFault.exe oneetx.exe 4228 4060 WerFault.exe oneetx.exe 2428 4060 WerFault.exe oneetx.exe 1220 4060 WerFault.exe oneetx.exe 1668 4060 WerFault.exe oneetx.exe 2996 4060 WerFault.exe oneetx.exe 1980 4060 WerFault.exe oneetx.exe 2272 4060 WerFault.exe oneetx.exe 3304 4060 WerFault.exe oneetx.exe 4344 4060 WerFault.exe oneetx.exe 4620 4060 WerFault.exe oneetx.exe 1452 4060 WerFault.exe oneetx.exe 4584 4060 WerFault.exe oneetx.exe 1924 4060 WerFault.exe oneetx.exe 1876 4060 WerFault.exe oneetx.exe 3056 4060 WerFault.exe oneetx.exe 4904 4060 WerFault.exe oneetx.exe 2768 4060 WerFault.exe oneetx.exe 2840 4060 WerFault.exe oneetx.exe 4884 2304 WerFault.exe rundll32.exe 3964 4836 WerFault.exe oneetx.exe 4624 4060 WerFault.exe oneetx.exe 5024 3564 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
7.exeAppLaunch.exepid process 5028 7.exe 5028 7.exe 2224 AppLaunch.exe 2224 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 2224 AppLaunch.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
file.exeoneetx.execmd.exe7.exerundll32.exedescription pid process target process PID 5028 wrote to memory of 4060 5028 file.exe oneetx.exe PID 5028 wrote to memory of 4060 5028 file.exe oneetx.exe PID 5028 wrote to memory of 4060 5028 file.exe oneetx.exe PID 4060 wrote to memory of 4268 4060 oneetx.exe schtasks.exe PID 4060 wrote to memory of 4268 4060 oneetx.exe schtasks.exe PID 4060 wrote to memory of 4268 4060 oneetx.exe schtasks.exe PID 4060 wrote to memory of 2468 4060 oneetx.exe cmd.exe PID 4060 wrote to memory of 2468 4060 oneetx.exe cmd.exe PID 4060 wrote to memory of 2468 4060 oneetx.exe cmd.exe PID 2468 wrote to memory of 5088 2468 cmd.exe cmd.exe PID 2468 wrote to memory of 5088 2468 cmd.exe cmd.exe PID 2468 wrote to memory of 5088 2468 cmd.exe cmd.exe PID 2468 wrote to memory of 3204 2468 cmd.exe cacls.exe PID 2468 wrote to memory of 3204 2468 cmd.exe cacls.exe PID 2468 wrote to memory of 3204 2468 cmd.exe cacls.exe PID 2468 wrote to memory of 4196 2468 cmd.exe cacls.exe PID 2468 wrote to memory of 4196 2468 cmd.exe cacls.exe PID 2468 wrote to memory of 4196 2468 cmd.exe cacls.exe PID 2468 wrote to memory of 228 2468 cmd.exe cmd.exe PID 2468 wrote to memory of 228 2468 cmd.exe cmd.exe PID 2468 wrote to memory of 228 2468 cmd.exe cmd.exe PID 2468 wrote to memory of 1908 2468 cmd.exe cacls.exe PID 2468 wrote to memory of 1908 2468 cmd.exe cacls.exe PID 2468 wrote to memory of 1908 2468 cmd.exe cacls.exe PID 2468 wrote to memory of 1256 2468 cmd.exe cacls.exe PID 2468 wrote to memory of 1256 2468 cmd.exe cacls.exe PID 2468 wrote to memory of 1256 2468 cmd.exe cacls.exe PID 4060 wrote to memory of 5028 4060 oneetx.exe 7.exe PID 4060 wrote to memory of 5028 4060 oneetx.exe 7.exe PID 4060 wrote to memory of 5028 4060 oneetx.exe 7.exe PID 5028 wrote to memory of 2224 5028 7.exe AppLaunch.exe PID 5028 wrote to memory of 2224 5028 7.exe AppLaunch.exe PID 5028 wrote to memory of 2224 5028 7.exe AppLaunch.exe PID 5028 wrote to memory of 2224 5028 7.exe AppLaunch.exe PID 5028 wrote to memory of 2224 5028 7.exe AppLaunch.exe PID 4060 wrote to memory of 4104 4060 oneetx.exe rundll32.exe PID 4060 wrote to memory of 4104 4060 oneetx.exe rundll32.exe PID 4060 wrote to memory of 4104 4060 oneetx.exe rundll32.exe PID 4104 wrote to memory of 2304 4104 rundll32.exe rundll32.exe PID 4104 wrote to memory of 2304 4104 rundll32.exe rundll32.exe PID 4060 wrote to memory of 1968 4060 oneetx.exe rundll32.exe PID 4060 wrote to memory of 1968 4060 oneetx.exe rundll32.exe PID 4060 wrote to memory of 1968 4060 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 8962⤵
- Program crash
PID:3604 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 9122⤵
- Program crash
PID:4732 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 10962⤵
- Program crash
PID:5016 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 11282⤵
- Program crash
PID:1272 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 11362⤵
- Program crash
PID:772 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 11682⤵
- Program crash
PID:4032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 11122⤵
- Program crash
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\a7fa1426ba\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\a7fa1426ba\oneetx.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 5843⤵
- Program crash
PID:4440 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 7363⤵
- Program crash
PID:4756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 7363⤵
- Program crash
PID:588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 9523⤵
- Program crash
PID:4168 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 9483⤵
- Program crash
PID:4544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 9883⤵
- Program crash
PID:4788 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 9483⤵
- Program crash
PID:676 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\a7fa1426ba\oneetx.exe" /F3⤵
- Creates scheduled task(s)
PID:4268 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 8923⤵
- Program crash
PID:784 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 6683⤵
- Program crash
PID:3568 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a7fa1426ba" /P "Admin:N"&&CACLS "..\a7fa1426ba" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:5088
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"4⤵PID:3204
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E4⤵PID:4196
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:228
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\a7fa1426ba" /P "Admin:N"4⤵PID:1908
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\a7fa1426ba" /P "Admin:R" /E4⤵PID:1256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 11683⤵
- Program crash
PID:4012 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 11443⤵
- Program crash
PID:4228 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 8003⤵
- Program crash
PID:2428 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 7803⤵
- Program crash
PID:1220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 13323⤵
- Program crash
PID:1668 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 17443⤵
- Program crash
PID:2996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 17603⤵
- Program crash
PID:1980 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 18163⤵
- Program crash
PID:2272 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 17883⤵
- Program crash
PID:3304 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 18123⤵
- Program crash
PID:4344 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 17883⤵
- Program crash
PID:4620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 18603⤵
- Program crash
PID:1452 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 18683⤵
- Program crash
PID:4584 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 20723⤵
- Program crash
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\1000037001\7.exe"C:\Users\Admin\AppData\Local\Temp\1000037001\7.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 21723⤵
- Program crash
PID:1876 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 20363⤵
- Program crash
PID:3056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 9803⤵
- Program crash
PID:4904 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 9963⤵
- Program crash
PID:2768 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\eac7b2a78f3eb6\cred64.dll, Main3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\eac7b2a78f3eb6\cred64.dll, Main4⤵
- Loads dropped DLL
PID:2304 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2304 -s 6485⤵
- Program crash
PID:4884 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\eac7b2a78f3eb6\clip64.dll, Main3⤵
- Loads dropped DLL
PID:1968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 21803⤵
- Program crash
PID:2840 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 22603⤵
- Program crash
PID:4624 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 12482⤵
- Program crash
PID:892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5028 -ip 50281⤵PID:1912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5028 -ip 50281⤵PID:1436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5028 -ip 50281⤵PID:220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5028 -ip 50281⤵PID:5064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5028 -ip 50281⤵PID:1848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5028 -ip 50281⤵PID:1860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5028 -ip 50281⤵PID:2192
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5028 -ip 50281⤵PID:672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4060 -ip 40601⤵PID:4480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4060 -ip 40601⤵PID:528
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4060 -ip 40601⤵PID:3576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4060 -ip 40601⤵PID:3572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4060 -ip 40601⤵PID:3904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4060 -ip 40601⤵PID:2880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4060 -ip 40601⤵PID:1884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4060 -ip 40601⤵PID:4200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4060 -ip 40601⤵PID:4580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4060 -ip 40601⤵PID:2580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4060 -ip 40601⤵PID:2504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4060 -ip 40601⤵PID:636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4060 -ip 40601⤵PID:2596
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4060 -ip 40601⤵PID:4368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4060 -ip 40601⤵PID:2040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4060 -ip 40601⤵PID:3772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4060 -ip 40601⤵PID:1532
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4060 -ip 40601⤵PID:3932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4060 -ip 40601⤵PID:5064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4060 -ip 40601⤵PID:2348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4060 -ip 40601⤵PID:4624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4060 -ip 40601⤵PID:3860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4060 -ip 40601⤵PID:4116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4060 -ip 40601⤵PID:2516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4060 -ip 40601⤵PID:2684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4060 -ip 40601⤵PID:4780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4060 -ip 40601⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\a7fa1426ba\oneetx.exeC:\Users\Admin\AppData\Local\Temp\a7fa1426ba\oneetx.exe1⤵
- Executes dropped EXE
PID:4836 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 3122⤵
- Program crash
PID:3964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4060 -ip 40601⤵PID:944
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 656 -p 2304 -ip 23041⤵PID:1676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4836 -ip 48361⤵PID:3592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4060 -ip 40601⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\a7fa1426ba\oneetx.exeC:\Users\Admin\AppData\Local\Temp\a7fa1426ba\oneetx.exe1⤵
- Executes dropped EXE
PID:3564 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 3202⤵
- Program crash
PID:5024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3564 -ip 35641⤵PID:4268
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000037001\7.exeFilesize
2.6MB
MD5aa1340e6de19d9206466a3e46505637a
SHA1cf2c701eaa0b3d4bb9ee758fe0070a5fdea4f199
SHA25641d1e68ca8ce71c9900d8e02c93a9e23a1f7ae02aec9b3b61b39fc410262fdad
SHA512d63ba471591e20cd9d8cd3467ecb7979f262444550288d07b2027ab67fb9147848ce60098a2cd0606e5ba01315e8339abd2a9ebbd014fc446822b3b184f10e90
-
C:\Users\Admin\AppData\Local\Temp\1000037001\7.exeFilesize
2.6MB
MD5aa1340e6de19d9206466a3e46505637a
SHA1cf2c701eaa0b3d4bb9ee758fe0070a5fdea4f199
SHA25641d1e68ca8ce71c9900d8e02c93a9e23a1f7ae02aec9b3b61b39fc410262fdad
SHA512d63ba471591e20cd9d8cd3467ecb7979f262444550288d07b2027ab67fb9147848ce60098a2cd0606e5ba01315e8339abd2a9ebbd014fc446822b3b184f10e90
-
C:\Users\Admin\AppData\Local\Temp\1000037001\7.exeFilesize
2.6MB
MD5aa1340e6de19d9206466a3e46505637a
SHA1cf2c701eaa0b3d4bb9ee758fe0070a5fdea4f199
SHA25641d1e68ca8ce71c9900d8e02c93a9e23a1f7ae02aec9b3b61b39fc410262fdad
SHA512d63ba471591e20cd9d8cd3467ecb7979f262444550288d07b2027ab67fb9147848ce60098a2cd0606e5ba01315e8339abd2a9ebbd014fc446822b3b184f10e90
-
C:\Users\Admin\AppData\Local\Temp\a7fa1426ba\oneetx.exeFilesize
323KB
MD5d915386b9f157bed5fb89d1fa6fa6814
SHA11a62d4df4127ed31070e49ad00797b886b56eb98
SHA25615e5d0f3035ddeb19ab45120c125c41d02a4317757d8a67c8545a31826d4b5a9
SHA512483ceb075b4d42f405cd73797061821a8980c01b64d5d11321f8ee2bded708a9f4c7e081d1dfd407ffeea75d67e6a12a902cd27a4fd1bb1946bb5e2b8fcefacd
-
C:\Users\Admin\AppData\Local\Temp\a7fa1426ba\oneetx.exeFilesize
323KB
MD5d915386b9f157bed5fb89d1fa6fa6814
SHA11a62d4df4127ed31070e49ad00797b886b56eb98
SHA25615e5d0f3035ddeb19ab45120c125c41d02a4317757d8a67c8545a31826d4b5a9
SHA512483ceb075b4d42f405cd73797061821a8980c01b64d5d11321f8ee2bded708a9f4c7e081d1dfd407ffeea75d67e6a12a902cd27a4fd1bb1946bb5e2b8fcefacd
-
C:\Users\Admin\AppData\Local\Temp\a7fa1426ba\oneetx.exeFilesize
323KB
MD5d915386b9f157bed5fb89d1fa6fa6814
SHA11a62d4df4127ed31070e49ad00797b886b56eb98
SHA25615e5d0f3035ddeb19ab45120c125c41d02a4317757d8a67c8545a31826d4b5a9
SHA512483ceb075b4d42f405cd73797061821a8980c01b64d5d11321f8ee2bded708a9f4c7e081d1dfd407ffeea75d67e6a12a902cd27a4fd1bb1946bb5e2b8fcefacd
-
C:\Users\Admin\AppData\Local\Temp\a7fa1426ba\oneetx.exeFilesize
323KB
MD5d915386b9f157bed5fb89d1fa6fa6814
SHA11a62d4df4127ed31070e49ad00797b886b56eb98
SHA25615e5d0f3035ddeb19ab45120c125c41d02a4317757d8a67c8545a31826d4b5a9
SHA512483ceb075b4d42f405cd73797061821a8980c01b64d5d11321f8ee2bded708a9f4c7e081d1dfd407ffeea75d67e6a12a902cd27a4fd1bb1946bb5e2b8fcefacd
-
C:\Users\Admin\AppData\Local\Temp\a7fa1426ba\oneetx.exeFilesize
323KB
MD5d915386b9f157bed5fb89d1fa6fa6814
SHA11a62d4df4127ed31070e49ad00797b886b56eb98
SHA25615e5d0f3035ddeb19ab45120c125c41d02a4317757d8a67c8545a31826d4b5a9
SHA512483ceb075b4d42f405cd73797061821a8980c01b64d5d11321f8ee2bded708a9f4c7e081d1dfd407ffeea75d67e6a12a902cd27a4fd1bb1946bb5e2b8fcefacd
-
C:\Users\Admin\AppData\Roaming\eac7b2a78f3eb6\clip64.dllFilesize
89KB
MD5bbf1ad7a265522ec74752391dc461a7f
SHA1884822fed00eb47b86009d468536a48774f15151
SHA256b89981371e7ac4c1f9dfb4be56158d769a8b2d3dfeb7168df57b51e2d2e6df06
SHA51244fdfcc1b2d18019b72867b7af5fc7a2935a84fc414b3c26d4d5f959b9a64b948303ceae4d4977d41a4685897fb7919221a8a0de9c3f916c13810a47ed24f1ed
-
C:\Users\Admin\AppData\Roaming\eac7b2a78f3eb6\clip64.dllFilesize
89KB
MD5bbf1ad7a265522ec74752391dc461a7f
SHA1884822fed00eb47b86009d468536a48774f15151
SHA256b89981371e7ac4c1f9dfb4be56158d769a8b2d3dfeb7168df57b51e2d2e6df06
SHA51244fdfcc1b2d18019b72867b7af5fc7a2935a84fc414b3c26d4d5f959b9a64b948303ceae4d4977d41a4685897fb7919221a8a0de9c3f916c13810a47ed24f1ed
-
C:\Users\Admin\AppData\Roaming\eac7b2a78f3eb6\clip64.dllFilesize
89KB
MD5bbf1ad7a265522ec74752391dc461a7f
SHA1884822fed00eb47b86009d468536a48774f15151
SHA256b89981371e7ac4c1f9dfb4be56158d769a8b2d3dfeb7168df57b51e2d2e6df06
SHA51244fdfcc1b2d18019b72867b7af5fc7a2935a84fc414b3c26d4d5f959b9a64b948303ceae4d4977d41a4685897fb7919221a8a0de9c3f916c13810a47ed24f1ed
-
C:\Users\Admin\AppData\Roaming\eac7b2a78f3eb6\cred64.dllFilesize
1.0MB
MD59ec3ce277f1d46b821f83afbc099f5d0
SHA14157370f34a1e24674555376ad14e9a59c49e1b4
SHA2566ebb4b08f0add9dfb5edcaa0160c0be0685832eb5d5b51c344a4dc82f0230082
SHA51224f25463f472bfdd6222bd34006a8662703288a4f8ee8a6c91de3df2fdcb6286d7bb3e58d33986c461cbebbb806af3ece80b752fc4b958c6d8528727d80db1a4
-
C:\Users\Admin\AppData\Roaming\eac7b2a78f3eb6\cred64.dllFilesize
1.0MB
MD59ec3ce277f1d46b821f83afbc099f5d0
SHA14157370f34a1e24674555376ad14e9a59c49e1b4
SHA2566ebb4b08f0add9dfb5edcaa0160c0be0685832eb5d5b51c344a4dc82f0230082
SHA51224f25463f472bfdd6222bd34006a8662703288a4f8ee8a6c91de3df2fdcb6286d7bb3e58d33986c461cbebbb806af3ece80b752fc4b958c6d8528727d80db1a4
-
C:\Users\Admin\AppData\Roaming\eac7b2a78f3eb6\cred64.dllFilesize
1.0MB
MD59ec3ce277f1d46b821f83afbc099f5d0
SHA14157370f34a1e24674555376ad14e9a59c49e1b4
SHA2566ebb4b08f0add9dfb5edcaa0160c0be0685832eb5d5b51c344a4dc82f0230082
SHA51224f25463f472bfdd6222bd34006a8662703288a4f8ee8a6c91de3df2fdcb6286d7bb3e58d33986c461cbebbb806af3ece80b752fc4b958c6d8528727d80db1a4
-
C:\Users\Admin\AppData\Roaming\eac7b2a78f3eb6\cred64.dllFilesize
1.0MB
MD59ec3ce277f1d46b821f83afbc099f5d0
SHA14157370f34a1e24674555376ad14e9a59c49e1b4
SHA2566ebb4b08f0add9dfb5edcaa0160c0be0685832eb5d5b51c344a4dc82f0230082
SHA51224f25463f472bfdd6222bd34006a8662703288a4f8ee8a6c91de3df2fdcb6286d7bb3e58d33986c461cbebbb806af3ece80b752fc4b958c6d8528727d80db1a4
-
memory/2224-190-0x0000000004CE0000-0x0000000004D1C000-memory.dmpFilesize
240KB
-
memory/2224-199-0x0000000007E90000-0x00000000083BC000-memory.dmpFilesize
5.2MB
-
memory/2224-187-0x00000000051E0000-0x00000000057F8000-memory.dmpFilesize
6.1MB
-
memory/2224-188-0x0000000004D50000-0x0000000004E5A000-memory.dmpFilesize
1.0MB
-
memory/2224-189-0x0000000004C80000-0x0000000004C92000-memory.dmpFilesize
72KB
-
memory/2224-181-0x0000000000350000-0x0000000000382000-memory.dmpFilesize
200KB
-
memory/2224-198-0x0000000007790000-0x0000000007952000-memory.dmpFilesize
1.8MB
-
memory/2224-192-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/2224-193-0x0000000005DB0000-0x0000000006354000-memory.dmpFilesize
5.6MB
-
memory/2224-194-0x0000000005800000-0x0000000005892000-memory.dmpFilesize
584KB
-
memory/2224-195-0x0000000005130000-0x0000000005196000-memory.dmpFilesize
408KB
-
memory/2224-197-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/3564-237-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/4060-146-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/4060-191-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/4060-227-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/4836-229-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/5028-179-0x0000000004A90000-0x0000000004A92000-memory.dmpFilesize
8KB
-
memory/5028-178-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/5028-177-0x0000000004A70000-0x0000000004A71000-memory.dmpFilesize
4KB
-
memory/5028-175-0x0000000000400000-0x00000000009E0000-memory.dmpFilesize
5.9MB
-
memory/5028-176-0x0000000004AA0000-0x0000000004AA1000-memory.dmpFilesize
4KB
-
memory/5028-180-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/5028-136-0x0000000002CC0000-0x0000000002CFC000-memory.dmpFilesize
240KB
-
memory/5028-144-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/5028-186-0x0000000000400000-0x00000000009E0000-memory.dmpFilesize
5.9MB