Analysis
-
max time kernel
147s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2023 20:02
Static task
static1
General
-
Target
002caab1870821957f33609e35583002dfb907123e6a7b59cf21c0862c3e83ef.exe
-
Size
785KB
-
MD5
b09dac4a6f6a2736170317dec5802be3
-
SHA1
03eb91b0bf0079770a7f5d94bc2b07aee77e8eb1
-
SHA256
002caab1870821957f33609e35583002dfb907123e6a7b59cf21c0862c3e83ef
-
SHA512
80e636c11db53530ee55d26d7e9de94d2c0a7ed8e09d1bd71d5e8d3f3bceced6888f6d4380b8aa9969f3c443b436990f93b580469b0faa543b16745a79f201f1
-
SSDEEP
12288:pMrfy90zELwg+/tEj2tw5hOOjjp+Prvc7IV+npXRNkMYxC4+fgFB+H+BA0G8:iynEJy5hOqEPrvckwnpXRGMYcg7++xv
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
it074094.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it074094.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it074094.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it074094.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it074094.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it074094.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it074094.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/3268-165-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-164-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-168-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-170-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-172-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-174-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-176-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-178-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-180-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-182-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-184-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-186-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-188-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-190-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-192-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-194-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-196-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-198-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-200-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-202-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-204-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-206-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-208-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-210-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-212-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-214-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-216-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-218-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-220-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-222-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-224-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-226-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline behavioral1/memory/3268-228-0x0000000002690000-0x00000000026CF000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr569113.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation lr569113.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
Processes:
ziPO5909.exeziSz7279.exeit074094.exejr225306.exekp896419.exelr569113.exeoneetx.exeoneetx.exepid process 2064 ziPO5909.exe 5108 ziSz7279.exe 4008 it074094.exe 3268 jr225306.exe 2536 kp896419.exe 4172 lr569113.exe 4332 oneetx.exe 1728 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3412 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it074094.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it074094.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
002caab1870821957f33609e35583002dfb907123e6a7b59cf21c0862c3e83ef.exeziPO5909.exeziSz7279.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 002caab1870821957f33609e35583002dfb907123e6a7b59cf21c0862c3e83ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 002caab1870821957f33609e35583002dfb907123e6a7b59cf21c0862c3e83ef.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziPO5909.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziPO5909.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziSz7279.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ziSz7279.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 28 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4012 3268 WerFault.exe jr225306.exe 1544 4172 WerFault.exe lr569113.exe 3412 4172 WerFault.exe lr569113.exe 4140 4172 WerFault.exe lr569113.exe 3784 4172 WerFault.exe lr569113.exe 408 4172 WerFault.exe lr569113.exe 396 4172 WerFault.exe lr569113.exe 728 4172 WerFault.exe lr569113.exe 4456 4172 WerFault.exe lr569113.exe 400 4172 WerFault.exe lr569113.exe 3808 4172 WerFault.exe lr569113.exe 3824 4172 WerFault.exe lr569113.exe 5048 4332 WerFault.exe oneetx.exe 668 4332 WerFault.exe oneetx.exe 2060 4332 WerFault.exe oneetx.exe 1292 4332 WerFault.exe oneetx.exe 3048 4332 WerFault.exe oneetx.exe 5040 4332 WerFault.exe oneetx.exe 2092 4332 WerFault.exe oneetx.exe 4624 4332 WerFault.exe oneetx.exe 3832 4332 WerFault.exe oneetx.exe 4020 4332 WerFault.exe oneetx.exe 2336 4332 WerFault.exe oneetx.exe 2784 4332 WerFault.exe oneetx.exe 3880 4332 WerFault.exe oneetx.exe 3916 4332 WerFault.exe oneetx.exe 1496 1728 WerFault.exe oneetx.exe 3016 4332 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it074094.exejr225306.exekp896419.exepid process 4008 it074094.exe 4008 it074094.exe 3268 jr225306.exe 3268 jr225306.exe 2536 kp896419.exe 2536 kp896419.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it074094.exejr225306.exekp896419.exedescription pid process Token: SeDebugPrivilege 4008 it074094.exe Token: SeDebugPrivilege 3268 jr225306.exe Token: SeDebugPrivilege 2536 kp896419.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr569113.exepid process 4172 lr569113.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
002caab1870821957f33609e35583002dfb907123e6a7b59cf21c0862c3e83ef.exeziPO5909.exeziSz7279.exelr569113.exeoneetx.exedescription pid process target process PID 2532 wrote to memory of 2064 2532 002caab1870821957f33609e35583002dfb907123e6a7b59cf21c0862c3e83ef.exe ziPO5909.exe PID 2532 wrote to memory of 2064 2532 002caab1870821957f33609e35583002dfb907123e6a7b59cf21c0862c3e83ef.exe ziPO5909.exe PID 2532 wrote to memory of 2064 2532 002caab1870821957f33609e35583002dfb907123e6a7b59cf21c0862c3e83ef.exe ziPO5909.exe PID 2064 wrote to memory of 5108 2064 ziPO5909.exe ziSz7279.exe PID 2064 wrote to memory of 5108 2064 ziPO5909.exe ziSz7279.exe PID 2064 wrote to memory of 5108 2064 ziPO5909.exe ziSz7279.exe PID 5108 wrote to memory of 4008 5108 ziSz7279.exe it074094.exe PID 5108 wrote to memory of 4008 5108 ziSz7279.exe it074094.exe PID 5108 wrote to memory of 3268 5108 ziSz7279.exe jr225306.exe PID 5108 wrote to memory of 3268 5108 ziSz7279.exe jr225306.exe PID 5108 wrote to memory of 3268 5108 ziSz7279.exe jr225306.exe PID 2064 wrote to memory of 2536 2064 ziPO5909.exe kp896419.exe PID 2064 wrote to memory of 2536 2064 ziPO5909.exe kp896419.exe PID 2064 wrote to memory of 2536 2064 ziPO5909.exe kp896419.exe PID 2532 wrote to memory of 4172 2532 002caab1870821957f33609e35583002dfb907123e6a7b59cf21c0862c3e83ef.exe lr569113.exe PID 2532 wrote to memory of 4172 2532 002caab1870821957f33609e35583002dfb907123e6a7b59cf21c0862c3e83ef.exe lr569113.exe PID 2532 wrote to memory of 4172 2532 002caab1870821957f33609e35583002dfb907123e6a7b59cf21c0862c3e83ef.exe lr569113.exe PID 4172 wrote to memory of 4332 4172 lr569113.exe oneetx.exe PID 4172 wrote to memory of 4332 4172 lr569113.exe oneetx.exe PID 4172 wrote to memory of 4332 4172 lr569113.exe oneetx.exe PID 4332 wrote to memory of 1532 4332 oneetx.exe schtasks.exe PID 4332 wrote to memory of 1532 4332 oneetx.exe schtasks.exe PID 4332 wrote to memory of 1532 4332 oneetx.exe schtasks.exe PID 4332 wrote to memory of 3412 4332 oneetx.exe rundll32.exe PID 4332 wrote to memory of 3412 4332 oneetx.exe rundll32.exe PID 4332 wrote to memory of 3412 4332 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\002caab1870821957f33609e35583002dfb907123e6a7b59cf21c0862c3e83ef.exe"C:\Users\Admin\AppData\Local\Temp\002caab1870821957f33609e35583002dfb907123e6a7b59cf21c0862c3e83ef.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPO5909.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPO5909.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziSz7279.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziSz7279.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it074094.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it074094.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr225306.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr225306.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 13245⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp896419.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp896419.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr569113.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr569113.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 7843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 7723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 8643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 8603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 8603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 12203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 12643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 13203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 13603⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 8164⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 8924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 10604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 11084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 11284⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 7724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 7004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 7804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 11124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 16044⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 16284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 14083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3268 -ip 32681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4172 -ip 41721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4172 -ip 41721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4172 -ip 41721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4172 -ip 41721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4172 -ip 41721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4172 -ip 41721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4172 -ip 41721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4172 -ip 41721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4172 -ip 41721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4172 -ip 41721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4172 -ip 41721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4332 -ip 43321⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 3162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1728 -ip 17281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4332 -ip 43321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr569113.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr569113.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPO5909.exeFilesize
522KB
MD58b6a2698bbf0294c45ac8a295b79935f
SHA1349e8d563e23afc4ecdda7e0274a149cc75829ec
SHA25613d17d7e501e965132b6853f494917c2c8dcffeaeb841f48cb1080470da082e3
SHA512d9c17b808d58f110a3c709235dad177cee31359ddd93334ee5a83b4e3d3f7423188bd420dcfb2ebc584677cf0ec16ad426e7dae4c4f70a1c55f85428793c62ee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPO5909.exeFilesize
522KB
MD58b6a2698bbf0294c45ac8a295b79935f
SHA1349e8d563e23afc4ecdda7e0274a149cc75829ec
SHA25613d17d7e501e965132b6853f494917c2c8dcffeaeb841f48cb1080470da082e3
SHA512d9c17b808d58f110a3c709235dad177cee31359ddd93334ee5a83b4e3d3f7423188bd420dcfb2ebc584677cf0ec16ad426e7dae4c4f70a1c55f85428793c62ee
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp896419.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp896419.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziSz7279.exeFilesize
379KB
MD515d3d9a3c44fd75a2fb85b6602443ce6
SHA15865f4134608be269d6ebc09ba9a0f12795f55e5
SHA2566dfe4b4f2dfdceca89e2dfe47c46c8127cf1263f8254d9c61d5903d1b45190c5
SHA512602e0d5a16f1d59903c554d58eb08d66e2010bfb666c4803a31a51e1d187e975dff7a9e5c5ec6d313218aa03f0c91f5a183ff69af5792fe21388c613b9973d4e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziSz7279.exeFilesize
379KB
MD515d3d9a3c44fd75a2fb85b6602443ce6
SHA15865f4134608be269d6ebc09ba9a0f12795f55e5
SHA2566dfe4b4f2dfdceca89e2dfe47c46c8127cf1263f8254d9c61d5903d1b45190c5
SHA512602e0d5a16f1d59903c554d58eb08d66e2010bfb666c4803a31a51e1d187e975dff7a9e5c5ec6d313218aa03f0c91f5a183ff69af5792fe21388c613b9973d4e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it074094.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it074094.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr225306.exeFilesize
292KB
MD512294f3aee4ce7c4ecdd352b5adf67f1
SHA16e55eac13fa35e22b70820e33b8ad0793c5608c5
SHA256593b9a2b5e07f3e86c99381b01539c4226c9aa087572c2d84f3bcbc6ec83c7d0
SHA5120845f0922c24111f94c570107570783a8832e7938d3c393123ab9e34baa71d5ace1d096cb9460c7a7973065f8674d544cc78a06a599e0524a788afdebbfea1fa
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr225306.exeFilesize
292KB
MD512294f3aee4ce7c4ecdd352b5adf67f1
SHA16e55eac13fa35e22b70820e33b8ad0793c5608c5
SHA256593b9a2b5e07f3e86c99381b01539c4226c9aa087572c2d84f3bcbc6ec83c7d0
SHA5120845f0922c24111f94c570107570783a8832e7938d3c393123ab9e34baa71d5ace1d096cb9460c7a7973065f8674d544cc78a06a599e0524a788afdebbfea1fa
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/2536-1093-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB
-
memory/2536-1092-0x0000000000BB0000-0x0000000000BE2000-memory.dmpFilesize
200KB
-
memory/2536-1094-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB
-
memory/3268-206-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-1071-0x0000000005330000-0x0000000005948000-memory.dmpFilesize
6.1MB
-
memory/3268-180-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-182-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-184-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-186-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-188-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-190-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-192-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-194-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-196-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-198-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-200-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-202-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-204-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-176-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-208-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-210-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-212-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-214-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-216-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-218-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-220-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-222-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-224-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-226-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-228-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-178-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-1072-0x0000000005950000-0x0000000005A5A000-memory.dmpFilesize
1.0MB
-
memory/3268-1073-0x0000000004BF0000-0x0000000004C02000-memory.dmpFilesize
72KB
-
memory/3268-1074-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3268-1075-0x0000000004C10000-0x0000000004C4C000-memory.dmpFilesize
240KB
-
memory/3268-1077-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3268-1078-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3268-1079-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3268-1080-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/3268-1081-0x00000000063C0000-0x0000000006452000-memory.dmpFilesize
584KB
-
memory/3268-1082-0x0000000006490000-0x0000000006506000-memory.dmpFilesize
472KB
-
memory/3268-174-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-172-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-170-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-1083-0x0000000006520000-0x0000000006570000-memory.dmpFilesize
320KB
-
memory/3268-1084-0x0000000007850000-0x0000000007A12000-memory.dmpFilesize
1.8MB
-
memory/3268-1085-0x0000000007A20000-0x0000000007F4C000-memory.dmpFilesize
5.2MB
-
memory/3268-1086-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3268-160-0x00000000005A0000-0x00000000005EB000-memory.dmpFilesize
300KB
-
memory/3268-161-0x0000000004C80000-0x0000000005224000-memory.dmpFilesize
5.6MB
-
memory/3268-168-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-163-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3268-164-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-166-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3268-165-0x0000000002690000-0x00000000026CF000-memory.dmpFilesize
252KB
-
memory/3268-162-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/4008-154-0x0000000000900000-0x000000000090A000-memory.dmpFilesize
40KB
-
memory/4172-1100-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB