Analysis
-
max time kernel
147s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2023 20:01
Static task
static1
General
-
Target
a566943c73eb97e68552c542b3b1d52aaa47b56cdb55d6fbbf263d670251eec0.exe
-
Size
926KB
-
MD5
6ced761c7cd6eed7fdaa92c88e98bebf
-
SHA1
cbcd46dd0d70a42e8b089c5803e37ff269fd42c7
-
SHA256
a566943c73eb97e68552c542b3b1d52aaa47b56cdb55d6fbbf263d670251eec0
-
SHA512
a553d33b2988fd8f36b2f966f0086014427aa33d9be4a1b7d6c2a3d15ebdb6121e884ed2c4f67cda0302445f6f2f0b7a47d5a24d85d9096bc6d18d277b5d0a70
-
SSDEEP
24576:vy2DIOG0BrsyvtDSAhK8RQlQyNRHe/p0II1j28Z:6ZKsyvRSAhKmQhRHexK1j
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pr180164.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr180164.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr180164.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr180164.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr180164.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr180164.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr180164.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2092-198-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-203-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-201-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-205-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-199-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-207-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-209-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-211-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-213-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-215-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-217-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-219-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-221-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-223-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-225-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-227-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-229-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-231-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/2092-1122-0x0000000004A80000-0x0000000004A90000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
si608403.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation si608403.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
Processes:
un661268.exeun801282.exepr180164.exequ943127.exerk775822.exesi608403.exeoneetx.exeoneetx.exepid process 4184 un661268.exe 2456 un801282.exe 5040 pr180164.exe 2092 qu943127.exe 1580 rk775822.exe 3408 si608403.exe 4356 oneetx.exe 2068 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3116 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pr180164.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr180164.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr180164.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
a566943c73eb97e68552c542b3b1d52aaa47b56cdb55d6fbbf263d670251eec0.exeun661268.exeun801282.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a566943c73eb97e68552c542b3b1d52aaa47b56cdb55d6fbbf263d670251eec0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a566943c73eb97e68552c542b3b1d52aaa47b56cdb55d6fbbf263d670251eec0.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un661268.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un661268.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un801282.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un801282.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 28 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1920 5040 WerFault.exe pr180164.exe 3764 2092 WerFault.exe qu943127.exe 212 3408 WerFault.exe si608403.exe 3180 3408 WerFault.exe si608403.exe 5012 3408 WerFault.exe si608403.exe 3360 3408 WerFault.exe si608403.exe 3152 3408 WerFault.exe si608403.exe 3876 3408 WerFault.exe si608403.exe 2224 3408 WerFault.exe si608403.exe 3756 3408 WerFault.exe si608403.exe 2676 3408 WerFault.exe si608403.exe 5100 3408 WerFault.exe si608403.exe 1540 4356 WerFault.exe oneetx.exe 2172 4356 WerFault.exe oneetx.exe 3324 4356 WerFault.exe oneetx.exe 4332 4356 WerFault.exe oneetx.exe 3348 4356 WerFault.exe oneetx.exe 3828 4356 WerFault.exe oneetx.exe 4376 4356 WerFault.exe oneetx.exe 512 4356 WerFault.exe oneetx.exe 4728 4356 WerFault.exe oneetx.exe 4512 4356 WerFault.exe oneetx.exe 2456 4356 WerFault.exe oneetx.exe 1252 4356 WerFault.exe oneetx.exe 2232 2068 WerFault.exe oneetx.exe 5012 4356 WerFault.exe oneetx.exe 1380 4356 WerFault.exe oneetx.exe 3912 4356 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pr180164.exequ943127.exerk775822.exepid process 5040 pr180164.exe 5040 pr180164.exe 2092 qu943127.exe 2092 qu943127.exe 1580 rk775822.exe 1580 rk775822.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pr180164.exequ943127.exerk775822.exedescription pid process Token: SeDebugPrivilege 5040 pr180164.exe Token: SeDebugPrivilege 2092 qu943127.exe Token: SeDebugPrivilege 1580 rk775822.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
si608403.exepid process 3408 si608403.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
a566943c73eb97e68552c542b3b1d52aaa47b56cdb55d6fbbf263d670251eec0.exeun661268.exeun801282.exesi608403.exeoneetx.exedescription pid process target process PID 1860 wrote to memory of 4184 1860 a566943c73eb97e68552c542b3b1d52aaa47b56cdb55d6fbbf263d670251eec0.exe un661268.exe PID 1860 wrote to memory of 4184 1860 a566943c73eb97e68552c542b3b1d52aaa47b56cdb55d6fbbf263d670251eec0.exe un661268.exe PID 1860 wrote to memory of 4184 1860 a566943c73eb97e68552c542b3b1d52aaa47b56cdb55d6fbbf263d670251eec0.exe un661268.exe PID 4184 wrote to memory of 2456 4184 un661268.exe un801282.exe PID 4184 wrote to memory of 2456 4184 un661268.exe un801282.exe PID 4184 wrote to memory of 2456 4184 un661268.exe un801282.exe PID 2456 wrote to memory of 5040 2456 un801282.exe pr180164.exe PID 2456 wrote to memory of 5040 2456 un801282.exe pr180164.exe PID 2456 wrote to memory of 5040 2456 un801282.exe pr180164.exe PID 2456 wrote to memory of 2092 2456 un801282.exe qu943127.exe PID 2456 wrote to memory of 2092 2456 un801282.exe qu943127.exe PID 2456 wrote to memory of 2092 2456 un801282.exe qu943127.exe PID 4184 wrote to memory of 1580 4184 un661268.exe rk775822.exe PID 4184 wrote to memory of 1580 4184 un661268.exe rk775822.exe PID 4184 wrote to memory of 1580 4184 un661268.exe rk775822.exe PID 1860 wrote to memory of 3408 1860 a566943c73eb97e68552c542b3b1d52aaa47b56cdb55d6fbbf263d670251eec0.exe si608403.exe PID 1860 wrote to memory of 3408 1860 a566943c73eb97e68552c542b3b1d52aaa47b56cdb55d6fbbf263d670251eec0.exe si608403.exe PID 1860 wrote to memory of 3408 1860 a566943c73eb97e68552c542b3b1d52aaa47b56cdb55d6fbbf263d670251eec0.exe si608403.exe PID 3408 wrote to memory of 4356 3408 si608403.exe oneetx.exe PID 3408 wrote to memory of 4356 3408 si608403.exe oneetx.exe PID 3408 wrote to memory of 4356 3408 si608403.exe oneetx.exe PID 4356 wrote to memory of 756 4356 oneetx.exe schtasks.exe PID 4356 wrote to memory of 756 4356 oneetx.exe schtasks.exe PID 4356 wrote to memory of 756 4356 oneetx.exe schtasks.exe PID 4356 wrote to memory of 3116 4356 oneetx.exe rundll32.exe PID 4356 wrote to memory of 3116 4356 oneetx.exe rundll32.exe PID 4356 wrote to memory of 3116 4356 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a566943c73eb97e68552c542b3b1d52aaa47b56cdb55d6fbbf263d670251eec0.exe"C:\Users\Admin\AppData\Local\Temp\a566943c73eb97e68552c542b3b1d52aaa47b56cdb55d6fbbf263d670251eec0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un661268.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un661268.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un801282.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un801282.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr180164.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr180164.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 10365⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu943127.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu943127.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 15565⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk775822.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk775822.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si608403.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si608403.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 7803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 8643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 9883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 9603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 12163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 12323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 8924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 9204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 9284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 11284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 11284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 11844⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 10204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 7804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 8844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 7724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 12084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 16204⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 15884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 16284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 7483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5040 -ip 50401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2092 -ip 20921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3408 -ip 34081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3408 -ip 34081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3408 -ip 34081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3408 -ip 34081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3408 -ip 34081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3408 -ip 34081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3408 -ip 34081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3408 -ip 34081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3408 -ip 34081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 3408 -ip 34081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4356 -ip 43561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4356 -ip 43561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4356 -ip 43561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4356 -ip 43561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4356 -ip 43561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4356 -ip 43561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4356 -ip 43561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4356 -ip 43561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4356 -ip 43561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4356 -ip 43561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4356 -ip 43561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4356 -ip 43561⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 3162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2068 -ip 20681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4356 -ip 43561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4356 -ip 43561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4356 -ip 43561⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si608403.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si608403.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un661268.exeFilesize
662KB
MD5bb4fae37923375d35b561a544dd8564c
SHA1ab01782a6f639b27c4229714c223c130dca4e925
SHA256b2aa9e9d1f8ee7f6aeba5dc524f8acc664d987f9768e45dfc0d88de685ab72e3
SHA512edc7f430dd27e1025d77294831cc43d3c40bb87943171e026728589b7a14104c72608556e7a8290e939c8b6d1ccc86437f577b4bcc15dbc6194d859cf562f1a4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un661268.exeFilesize
662KB
MD5bb4fae37923375d35b561a544dd8564c
SHA1ab01782a6f639b27c4229714c223c130dca4e925
SHA256b2aa9e9d1f8ee7f6aeba5dc524f8acc664d987f9768e45dfc0d88de685ab72e3
SHA512edc7f430dd27e1025d77294831cc43d3c40bb87943171e026728589b7a14104c72608556e7a8290e939c8b6d1ccc86437f577b4bcc15dbc6194d859cf562f1a4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk775822.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk775822.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un801282.exeFilesize
520KB
MD5b21cf0a5de1e670af27f547b90a76a9e
SHA1d27ac802dc90adc982f0004a5b65cb40298b6b3d
SHA2564350da4ac96f279d5a822cbf389b4fce5afc708dbc8e0e4ca19873177394c533
SHA512414d7482a529791f0fa1cf489ebf3be7f9d53a5c0c3221ff7058445688ecf2870929240a71cab04de99eadc59cf143a303fa501090acef7e182ddf4c43954254
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un801282.exeFilesize
520KB
MD5b21cf0a5de1e670af27f547b90a76a9e
SHA1d27ac802dc90adc982f0004a5b65cb40298b6b3d
SHA2564350da4ac96f279d5a822cbf389b4fce5afc708dbc8e0e4ca19873177394c533
SHA512414d7482a529791f0fa1cf489ebf3be7f9d53a5c0c3221ff7058445688ecf2870929240a71cab04de99eadc59cf143a303fa501090acef7e182ddf4c43954254
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr180164.exeFilesize
235KB
MD59c30e5ce9770f4d545f21166bb7d39f6
SHA182d86f8e5a7d2f50a9c6193a053973b253c6a68b
SHA256eedecee8c2a6e1403b4f4bd03c316db150d6be942cbbdd8ed92947a3c9894700
SHA512ae4f77693ad1f93f108bf49eaee1e4521440ea90cbfa098a25cedae157ac025897d324173266cdd9ca0006af0e510f773baa4cd96ac89f17686de4f62956120f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr180164.exeFilesize
235KB
MD59c30e5ce9770f4d545f21166bb7d39f6
SHA182d86f8e5a7d2f50a9c6193a053973b253c6a68b
SHA256eedecee8c2a6e1403b4f4bd03c316db150d6be942cbbdd8ed92947a3c9894700
SHA512ae4f77693ad1f93f108bf49eaee1e4521440ea90cbfa098a25cedae157ac025897d324173266cdd9ca0006af0e510f773baa4cd96ac89f17686de4f62956120f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu943127.exeFilesize
292KB
MD5ca795f3553f70bfe3f8e796b52905501
SHA116b0c8775cc262294c8f2bb1901edcd174c6417a
SHA2565f3d64ca86af630ddf7b66d8d791e94b6ad7c5fe142ed3066cfd8bc0aa5cea8b
SHA512334b38d34c78595acbff6326aee23ff932f41bbc6d9ab725dbdcf1170d8dd73c993c21bc9ba9af5e391c13ba517385f0bcbe4e9ca4ec5f7c0a880ec497941906
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu943127.exeFilesize
292KB
MD5ca795f3553f70bfe3f8e796b52905501
SHA116b0c8775cc262294c8f2bb1901edcd174c6417a
SHA2565f3d64ca86af630ddf7b66d8d791e94b6ad7c5fe142ed3066cfd8bc0aa5cea8b
SHA512334b38d34c78595acbff6326aee23ff932f41bbc6d9ab725dbdcf1170d8dd73c993c21bc9ba9af5e391c13ba517385f0bcbe4e9ca4ec5f7c0a880ec497941906
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1580-1129-0x0000000000B30000-0x0000000000B62000-memory.dmpFilesize
200KB
-
memory/1580-1130-0x0000000005450000-0x0000000005460000-memory.dmpFilesize
64KB
-
memory/2092-1116-0x0000000006520000-0x0000000006570000-memory.dmpFilesize
320KB
-
memory/2092-250-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/2092-1123-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/2092-1122-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/2092-1121-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/2092-1120-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/2092-1119-0x0000000006760000-0x0000000006C8C000-memory.dmpFilesize
5.2MB
-
memory/2092-1118-0x0000000006590000-0x0000000006752000-memory.dmpFilesize
1.8MB
-
memory/2092-1115-0x0000000006480000-0x00000000064F6000-memory.dmpFilesize
472KB
-
memory/2092-1114-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/2092-1113-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/2092-198-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-203-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-201-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-205-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-199-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-207-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-209-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-211-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-213-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-215-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-217-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-219-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-221-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-223-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-225-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-227-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-229-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-231-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/2092-249-0x00000000004D0000-0x000000000051B000-memory.dmpFilesize
300KB
-
memory/2092-253-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/2092-1112-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/2092-254-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/2092-1108-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/2092-1109-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/2092-1110-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/2092-1111-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/3408-1136-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB
-
memory/5040-176-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/5040-192-0x0000000004CE0000-0x0000000004CF0000-memory.dmpFilesize
64KB
-
memory/5040-174-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/5040-180-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/5040-172-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/5040-191-0x0000000004CE0000-0x0000000004CF0000-memory.dmpFilesize
64KB
-
memory/5040-190-0x0000000004CE0000-0x0000000004CF0000-memory.dmpFilesize
64KB
-
memory/5040-170-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/5040-187-0x0000000004CE0000-0x0000000004CF0000-memory.dmpFilesize
64KB
-
memory/5040-186-0x0000000004CE0000-0x0000000004CF0000-memory.dmpFilesize
64KB
-
memory/5040-178-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/5040-185-0x0000000004CE0000-0x0000000004CF0000-memory.dmpFilesize
64KB
-
memory/5040-193-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/5040-184-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/5040-188-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/5040-168-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/5040-182-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/5040-166-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/5040-164-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/5040-162-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/5040-160-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/5040-158-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/5040-157-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/5040-156-0x0000000004CF0000-0x0000000005294000-memory.dmpFilesize
5.6MB
-
memory/5040-155-0x0000000000580000-0x00000000005AD000-memory.dmpFilesize
180KB