Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2023 20:16
Static task
static1
General
-
Target
949726bdc30176f85edfad49dafad7a608995c159de963d7c34b258a0aee73e5.exe
-
Size
785KB
-
MD5
665fe1043d35de559f38dc631684d493
-
SHA1
1291f3fe42b68397c5f2e868178b97fb1359aea5
-
SHA256
949726bdc30176f85edfad49dafad7a608995c159de963d7c34b258a0aee73e5
-
SHA512
0f4f9098fd0a2493f5a3bb31c114b825b2a48348ec6f63b3c71b74b8d5adaa63a1547ecd5e5d920e37010c9a5f3548eda2a0defd3ff877d10663c4a28a98986a
-
SSDEEP
24576:tyChY/zgh/HF8qGcM6xiWAmyZnMWNsmbTcI7m:IZ/8lWqK64WwME5kI7
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
it513060.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it513060.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it513060.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it513060.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it513060.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it513060.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it513060.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4804-166-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-164-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-168-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-170-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-172-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-174-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-176-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-178-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-180-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-182-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-184-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-186-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-188-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-190-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-192-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-194-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-196-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-198-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-200-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-202-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-204-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-206-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-208-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-210-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-212-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-214-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-216-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-218-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-220-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-222-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-224-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-226-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/4804-228-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr304815.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation lr304815.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
zirr1653.exeziaU9805.exeit513060.exejr074017.exekp260104.exelr304815.exeoneetx.exeoneetx.exeoneetx.exepid process 2668 zirr1653.exe 824 ziaU9805.exe 3284 it513060.exe 4804 jr074017.exe 4236 kp260104.exe 3932 lr304815.exe 1332 oneetx.exe 2248 oneetx.exe 4376 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 232 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it513060.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it513060.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
ziaU9805.exe949726bdc30176f85edfad49dafad7a608995c159de963d7c34b258a0aee73e5.exezirr1653.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ziaU9805.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 949726bdc30176f85edfad49dafad7a608995c159de963d7c34b258a0aee73e5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 949726bdc30176f85edfad49dafad7a608995c159de963d7c34b258a0aee73e5.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zirr1653.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zirr1653.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziaU9805.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 28 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4472 4804 WerFault.exe jr074017.exe 2200 3932 WerFault.exe lr304815.exe 3668 3932 WerFault.exe lr304815.exe 4424 3932 WerFault.exe lr304815.exe 908 3932 WerFault.exe lr304815.exe 1896 3932 WerFault.exe lr304815.exe 3532 3932 WerFault.exe lr304815.exe 1124 3932 WerFault.exe lr304815.exe 3876 3932 WerFault.exe lr304815.exe 4724 3932 WerFault.exe lr304815.exe 4768 3932 WerFault.exe lr304815.exe 4696 1332 WerFault.exe oneetx.exe 2636 1332 WerFault.exe oneetx.exe 4904 1332 WerFault.exe oneetx.exe 3816 1332 WerFault.exe oneetx.exe 1924 1332 WerFault.exe oneetx.exe 2976 1332 WerFault.exe oneetx.exe 1388 1332 WerFault.exe oneetx.exe 1676 1332 WerFault.exe oneetx.exe 4624 1332 WerFault.exe oneetx.exe 732 1332 WerFault.exe oneetx.exe 460 1332 WerFault.exe oneetx.exe 3632 2248 WerFault.exe oneetx.exe 3336 1332 WerFault.exe oneetx.exe 3748 1332 WerFault.exe oneetx.exe 4324 1332 WerFault.exe oneetx.exe 5028 4376 WerFault.exe oneetx.exe 4392 1332 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it513060.exejr074017.exekp260104.exepid process 3284 it513060.exe 3284 it513060.exe 4804 jr074017.exe 4804 jr074017.exe 4236 kp260104.exe 4236 kp260104.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it513060.exejr074017.exekp260104.exedescription pid process Token: SeDebugPrivilege 3284 it513060.exe Token: SeDebugPrivilege 4804 jr074017.exe Token: SeDebugPrivilege 4236 kp260104.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr304815.exepid process 3932 lr304815.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
949726bdc30176f85edfad49dafad7a608995c159de963d7c34b258a0aee73e5.exezirr1653.exeziaU9805.exelr304815.exeoneetx.exedescription pid process target process PID 4920 wrote to memory of 2668 4920 949726bdc30176f85edfad49dafad7a608995c159de963d7c34b258a0aee73e5.exe zirr1653.exe PID 4920 wrote to memory of 2668 4920 949726bdc30176f85edfad49dafad7a608995c159de963d7c34b258a0aee73e5.exe zirr1653.exe PID 4920 wrote to memory of 2668 4920 949726bdc30176f85edfad49dafad7a608995c159de963d7c34b258a0aee73e5.exe zirr1653.exe PID 2668 wrote to memory of 824 2668 zirr1653.exe ziaU9805.exe PID 2668 wrote to memory of 824 2668 zirr1653.exe ziaU9805.exe PID 2668 wrote to memory of 824 2668 zirr1653.exe ziaU9805.exe PID 824 wrote to memory of 3284 824 ziaU9805.exe it513060.exe PID 824 wrote to memory of 3284 824 ziaU9805.exe it513060.exe PID 824 wrote to memory of 4804 824 ziaU9805.exe jr074017.exe PID 824 wrote to memory of 4804 824 ziaU9805.exe jr074017.exe PID 824 wrote to memory of 4804 824 ziaU9805.exe jr074017.exe PID 2668 wrote to memory of 4236 2668 zirr1653.exe kp260104.exe PID 2668 wrote to memory of 4236 2668 zirr1653.exe kp260104.exe PID 2668 wrote to memory of 4236 2668 zirr1653.exe kp260104.exe PID 4920 wrote to memory of 3932 4920 949726bdc30176f85edfad49dafad7a608995c159de963d7c34b258a0aee73e5.exe lr304815.exe PID 4920 wrote to memory of 3932 4920 949726bdc30176f85edfad49dafad7a608995c159de963d7c34b258a0aee73e5.exe lr304815.exe PID 4920 wrote to memory of 3932 4920 949726bdc30176f85edfad49dafad7a608995c159de963d7c34b258a0aee73e5.exe lr304815.exe PID 3932 wrote to memory of 1332 3932 lr304815.exe oneetx.exe PID 3932 wrote to memory of 1332 3932 lr304815.exe oneetx.exe PID 3932 wrote to memory of 1332 3932 lr304815.exe oneetx.exe PID 1332 wrote to memory of 2996 1332 oneetx.exe schtasks.exe PID 1332 wrote to memory of 2996 1332 oneetx.exe schtasks.exe PID 1332 wrote to memory of 2996 1332 oneetx.exe schtasks.exe PID 1332 wrote to memory of 232 1332 oneetx.exe rundll32.exe PID 1332 wrote to memory of 232 1332 oneetx.exe rundll32.exe PID 1332 wrote to memory of 232 1332 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\949726bdc30176f85edfad49dafad7a608995c159de963d7c34b258a0aee73e5.exe"C:\Users\Admin\AppData\Local\Temp\949726bdc30176f85edfad49dafad7a608995c159de963d7c34b258a0aee73e5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirr1653.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirr1653.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziaU9805.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziaU9805.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it513060.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it513060.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr074017.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr074017.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 13365⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp260104.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp260104.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr304815.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr304815.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 7803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 8643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 9643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 9643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 12163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 12043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 8284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 9044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 10884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 11004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 11284⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 6844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 13164⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 12884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 10884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 16004⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 15604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 16284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 13563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4804 -ip 48041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3932 -ip 39321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3932 -ip 39321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3932 -ip 39321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3932 -ip 39321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3932 -ip 39321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3932 -ip 39321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3932 -ip 39321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3932 -ip 39321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3932 -ip 39321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3932 -ip 39321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1332 -ip 13321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1332 -ip 13321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1332 -ip 13321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1332 -ip 13321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1332 -ip 13321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1332 -ip 13321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1332 -ip 13321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1332 -ip 13321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1332 -ip 13321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1332 -ip 13321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1332 -ip 13321⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2248 -ip 22481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1332 -ip 13321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1332 -ip 13321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1332 -ip 13321⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 2162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4376 -ip 43761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1332 -ip 13321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr304815.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr304815.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirr1653.exeFilesize
522KB
MD5b6abb8a005d49c51624645c2fa959e20
SHA16ce8aa169cc3dc5b203b9e0f35efac881b545989
SHA2568b29cec0694c6e1038ebdaf6f03aa66d3d2edd52d1aadae1792c995204414d75
SHA512c2099d6237c27bd0bc50089bdb51104a010952318ccaf49603e8fa8cc7ffe10c82da22b64d8202e03b4ac376e6c2fa1e38e68ab84e5c3d14ad35f33afa664c65
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirr1653.exeFilesize
522KB
MD5b6abb8a005d49c51624645c2fa959e20
SHA16ce8aa169cc3dc5b203b9e0f35efac881b545989
SHA2568b29cec0694c6e1038ebdaf6f03aa66d3d2edd52d1aadae1792c995204414d75
SHA512c2099d6237c27bd0bc50089bdb51104a010952318ccaf49603e8fa8cc7ffe10c82da22b64d8202e03b4ac376e6c2fa1e38e68ab84e5c3d14ad35f33afa664c65
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp260104.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp260104.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziaU9805.exeFilesize
379KB
MD566b65aae9cb59f6fb8856b8b7559d9f8
SHA13ceb87c4f4951ec64d1e068ee3dae321329b927f
SHA256f76e249d29ddf048702e5683ca58f5020e8bfba5ff22548a493efcaf6ed959ae
SHA512e4a71ba385c0b324827f9e29258436a3d37cf64f265fa1aade750ebf12bed22ee0b41a573b8335ab1d81bf9ebbe7a4575f80781f768ad9873965967e3b47fb18
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziaU9805.exeFilesize
379KB
MD566b65aae9cb59f6fb8856b8b7559d9f8
SHA13ceb87c4f4951ec64d1e068ee3dae321329b927f
SHA256f76e249d29ddf048702e5683ca58f5020e8bfba5ff22548a493efcaf6ed959ae
SHA512e4a71ba385c0b324827f9e29258436a3d37cf64f265fa1aade750ebf12bed22ee0b41a573b8335ab1d81bf9ebbe7a4575f80781f768ad9873965967e3b47fb18
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it513060.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it513060.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr074017.exeFilesize
292KB
MD5411c5a907b30d768f8dc25883c5cb9a9
SHA18de887dfe634151b0d0b551e07edc9ab29d173ce
SHA256d6a4280be92fa26ea430615845b31d3fc6225b6f1b750ff955372ce6c8fe0ba8
SHA5120ba7a713aab38d6eae78a891305ea5cd125e475857eb757f3561754654d8c4bb589e0e31ea9142888016ce04826d5fd56ab3fedecbdedb372ccae1a9d2a5696d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr074017.exeFilesize
292KB
MD5411c5a907b30d768f8dc25883c5cb9a9
SHA18de887dfe634151b0d0b551e07edc9ab29d173ce
SHA256d6a4280be92fa26ea430615845b31d3fc6225b6f1b750ff955372ce6c8fe0ba8
SHA5120ba7a713aab38d6eae78a891305ea5cd125e475857eb757f3561754654d8c4bb589e0e31ea9142888016ce04826d5fd56ab3fedecbdedb372ccae1a9d2a5696d
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/3284-154-0x0000000000110000-0x000000000011A000-memory.dmpFilesize
40KB
-
memory/3932-1101-0x0000000000590000-0x00000000005CB000-memory.dmpFilesize
236KB
-
memory/4236-1093-0x0000000000360000-0x0000000000392000-memory.dmpFilesize
200KB
-
memory/4236-1095-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/4236-1094-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/4804-206-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-1074-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/4804-186-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-188-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-190-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-192-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-194-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-196-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-198-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-200-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-202-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-204-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-182-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-208-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-210-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-212-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-214-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-216-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-218-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-220-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-222-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-224-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-226-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-228-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-1071-0x0000000005270000-0x0000000005888000-memory.dmpFilesize
6.1MB
-
memory/4804-1072-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/4804-1073-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/4804-184-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-1075-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4804-1077-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/4804-1078-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/4804-1079-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4804-1080-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4804-1081-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4804-1082-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4804-1083-0x00000000066F0000-0x0000000006766000-memory.dmpFilesize
472KB
-
memory/4804-180-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-178-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-176-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-174-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-172-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-170-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-168-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-164-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-166-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4804-165-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4804-163-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4804-162-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4804-161-0x00000000005E0000-0x000000000062B000-memory.dmpFilesize
300KB
-
memory/4804-160-0x0000000004CC0000-0x0000000005264000-memory.dmpFilesize
5.6MB
-
memory/4804-1084-0x0000000006790000-0x00000000067E0000-memory.dmpFilesize
320KB
-
memory/4804-1085-0x0000000006A10000-0x0000000006BD2000-memory.dmpFilesize
1.8MB
-
memory/4804-1086-0x0000000006BE0000-0x000000000710C000-memory.dmpFilesize
5.2MB