Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2023 20:04
Static task
static1
General
-
Target
41df19fad821bd3de6d45c1250e69ca123192964a4c989f30137efd97bd4d5ba.exe
-
Size
925KB
-
MD5
92aa9ff2a4e9e403fd218c6850bb5ecf
-
SHA1
1783873ba3296baa4254c227c3b67b1e2e921bad
-
SHA256
41df19fad821bd3de6d45c1250e69ca123192964a4c989f30137efd97bd4d5ba
-
SHA512
0ce376ada2a452861c3c7e43dea9d3c63e946fbbb3c264d291661e6f571cf461069cd836fc244ef9f5a19215a2d50b4fa1e76c730661652240041ada89af39a9
-
SSDEEP
24576:EyfXl5Ueb1wTJmIaeS5T+NOylhyv51LaCTP3fe:TfPWT5m+0yYPLXTP3f
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pr929669.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr929669.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr929669.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr929669.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr929669.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr929669.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr929669.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1928-197-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-198-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-200-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-202-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-204-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-206-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-208-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-210-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-212-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-214-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-216-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-218-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-220-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-222-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-224-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-226-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-228-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-230-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/1928-475-0x0000000004B90000-0x0000000004BA0000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
si031614.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation si031614.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
Processes:
un679950.exeun675023.exepr929669.exequ692481.exerk603629.exesi031614.exeoneetx.exeoneetx.exepid process 3388 un679950.exe 4588 un675023.exe 3764 pr929669.exe 1928 qu692481.exe 564 rk603629.exe 2536 si031614.exe 4244 oneetx.exe 4400 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4948 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pr929669.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr929669.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr929669.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
un675023.exe41df19fad821bd3de6d45c1250e69ca123192964a4c989f30137efd97bd4d5ba.exeun679950.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un675023.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un675023.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 41df19fad821bd3de6d45c1250e69ca123192964a4c989f30137efd97bd4d5ba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 41df19fad821bd3de6d45c1250e69ca123192964a4c989f30137efd97bd4d5ba.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un679950.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un679950.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4192 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 29 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 556 3764 WerFault.exe pr929669.exe 1440 1928 WerFault.exe qu692481.exe 3420 2536 WerFault.exe si031614.exe 796 2536 WerFault.exe si031614.exe 3700 2536 WerFault.exe si031614.exe 4876 2536 WerFault.exe si031614.exe 3944 2536 WerFault.exe si031614.exe 4988 2536 WerFault.exe si031614.exe 4660 2536 WerFault.exe si031614.exe 3572 2536 WerFault.exe si031614.exe 3096 2536 WerFault.exe si031614.exe 4220 2536 WerFault.exe si031614.exe 4832 4244 WerFault.exe oneetx.exe 2824 4244 WerFault.exe oneetx.exe 5084 4244 WerFault.exe oneetx.exe 1976 4244 WerFault.exe oneetx.exe 1300 4244 WerFault.exe oneetx.exe 4996 4244 WerFault.exe oneetx.exe 3428 4244 WerFault.exe oneetx.exe 1596 4244 WerFault.exe oneetx.exe 2112 4244 WerFault.exe oneetx.exe 5020 4244 WerFault.exe oneetx.exe 1928 4244 WerFault.exe oneetx.exe 4572 4244 WerFault.exe oneetx.exe 3388 4244 WerFault.exe oneetx.exe 208 4244 WerFault.exe oneetx.exe 4876 4244 WerFault.exe oneetx.exe 232 4400 WerFault.exe oneetx.exe 556 4244 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pr929669.exequ692481.exerk603629.exepid process 3764 pr929669.exe 3764 pr929669.exe 1928 qu692481.exe 1928 qu692481.exe 564 rk603629.exe 564 rk603629.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pr929669.exequ692481.exerk603629.exedescription pid process Token: SeDebugPrivilege 3764 pr929669.exe Token: SeDebugPrivilege 1928 qu692481.exe Token: SeDebugPrivilege 564 rk603629.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
si031614.exepid process 2536 si031614.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
41df19fad821bd3de6d45c1250e69ca123192964a4c989f30137efd97bd4d5ba.exeun679950.exeun675023.exesi031614.exeoneetx.exedescription pid process target process PID 4568 wrote to memory of 3388 4568 41df19fad821bd3de6d45c1250e69ca123192964a4c989f30137efd97bd4d5ba.exe un679950.exe PID 4568 wrote to memory of 3388 4568 41df19fad821bd3de6d45c1250e69ca123192964a4c989f30137efd97bd4d5ba.exe un679950.exe PID 4568 wrote to memory of 3388 4568 41df19fad821bd3de6d45c1250e69ca123192964a4c989f30137efd97bd4d5ba.exe un679950.exe PID 3388 wrote to memory of 4588 3388 un679950.exe un675023.exe PID 3388 wrote to memory of 4588 3388 un679950.exe un675023.exe PID 3388 wrote to memory of 4588 3388 un679950.exe un675023.exe PID 4588 wrote to memory of 3764 4588 un675023.exe pr929669.exe PID 4588 wrote to memory of 3764 4588 un675023.exe pr929669.exe PID 4588 wrote to memory of 3764 4588 un675023.exe pr929669.exe PID 4588 wrote to memory of 1928 4588 un675023.exe qu692481.exe PID 4588 wrote to memory of 1928 4588 un675023.exe qu692481.exe PID 4588 wrote to memory of 1928 4588 un675023.exe qu692481.exe PID 3388 wrote to memory of 564 3388 un679950.exe rk603629.exe PID 3388 wrote to memory of 564 3388 un679950.exe rk603629.exe PID 3388 wrote to memory of 564 3388 un679950.exe rk603629.exe PID 4568 wrote to memory of 2536 4568 41df19fad821bd3de6d45c1250e69ca123192964a4c989f30137efd97bd4d5ba.exe si031614.exe PID 4568 wrote to memory of 2536 4568 41df19fad821bd3de6d45c1250e69ca123192964a4c989f30137efd97bd4d5ba.exe si031614.exe PID 4568 wrote to memory of 2536 4568 41df19fad821bd3de6d45c1250e69ca123192964a4c989f30137efd97bd4d5ba.exe si031614.exe PID 2536 wrote to memory of 4244 2536 si031614.exe oneetx.exe PID 2536 wrote to memory of 4244 2536 si031614.exe oneetx.exe PID 2536 wrote to memory of 4244 2536 si031614.exe oneetx.exe PID 4244 wrote to memory of 4992 4244 oneetx.exe schtasks.exe PID 4244 wrote to memory of 4992 4244 oneetx.exe schtasks.exe PID 4244 wrote to memory of 4992 4244 oneetx.exe schtasks.exe PID 4244 wrote to memory of 4948 4244 oneetx.exe rundll32.exe PID 4244 wrote to memory of 4948 4244 oneetx.exe rundll32.exe PID 4244 wrote to memory of 4948 4244 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41df19fad821bd3de6d45c1250e69ca123192964a4c989f30137efd97bd4d5ba.exe"C:\Users\Admin\AppData\Local\Temp\41df19fad821bd3de6d45c1250e69ca123192964a4c989f30137efd97bd4d5ba.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un679950.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un679950.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un675023.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un675023.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr929669.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr929669.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 10805⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu692481.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu692481.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 14885⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk603629.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk603629.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si031614.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si031614.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 6723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 7643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 9723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 9483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 9483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 12043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 12403⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 13123⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 8444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 8404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 10604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 10604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 10764⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 7124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 9884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 7524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 14364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 11084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 16284⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 10604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 16444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 13603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3764 -ip 37641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1928 -ip 19281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4244 -ip 42441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4244 -ip 42441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4244 -ip 42441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4244 -ip 42441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4244 -ip 42441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4244 -ip 42441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4244 -ip 42441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4244 -ip 42441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4244 -ip 42441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4244 -ip 42441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4244 -ip 42441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4244 -ip 42441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4244 -ip 42441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4244 -ip 42441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4244 -ip 42441⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 3322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4400 -ip 44001⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4244 -ip 42441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si031614.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si031614.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un679950.exeFilesize
662KB
MD5174dfb87fee457f2daaa38741e5cd336
SHA1bc425cc299e677743f46ba8043cc9b27f873faa8
SHA256becd0548f502b52c56d18604008d3eab85405dd338dc658dd2fe6ee0dc2afde1
SHA51269a6e766fa8e5db7f65ca7c6b421a5433f14054dc4c158cbb04695a4e6289d26b2fd0ccd96b5d32088378b5074c55a94d0ee2ef809332c3dd9caa981d0f1afb7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un679950.exeFilesize
662KB
MD5174dfb87fee457f2daaa38741e5cd336
SHA1bc425cc299e677743f46ba8043cc9b27f873faa8
SHA256becd0548f502b52c56d18604008d3eab85405dd338dc658dd2fe6ee0dc2afde1
SHA51269a6e766fa8e5db7f65ca7c6b421a5433f14054dc4c158cbb04695a4e6289d26b2fd0ccd96b5d32088378b5074c55a94d0ee2ef809332c3dd9caa981d0f1afb7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk603629.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk603629.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un675023.exeFilesize
520KB
MD5e24826572a40173db794b5892503801f
SHA112aac03ba93490cc69dcc5910ed0e6acfa29deee
SHA2568342f89282cfdc59f5c955f2fa79642f9c09bcfe75720f00070227bae2a1babc
SHA51232b538e7c51195ce47643349a3a509fe329b232879fc027fbed0e1ea46dc29e435bbc47e781ce3b7efb81cd66c34946205248da4080d6aaab3e618b3c5196073
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un675023.exeFilesize
520KB
MD5e24826572a40173db794b5892503801f
SHA112aac03ba93490cc69dcc5910ed0e6acfa29deee
SHA2568342f89282cfdc59f5c955f2fa79642f9c09bcfe75720f00070227bae2a1babc
SHA51232b538e7c51195ce47643349a3a509fe329b232879fc027fbed0e1ea46dc29e435bbc47e781ce3b7efb81cd66c34946205248da4080d6aaab3e618b3c5196073
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr929669.exeFilesize
235KB
MD5bf757859cef452e49000b5630d66d159
SHA1ad85b929000e000d8463def452d2a481a2edce82
SHA25681ee0c4f2632ff0fe00c9ec99b099c4f6891a97e3d475031bd7517077e2d0ef1
SHA512ba1cea404f6f99309f997968790129f36156671465a0fffa1e6a850f388334334c1d3b06f8b8c00095364022d60559879d2c2c9c8d7fde480742c8660383ed0b
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr929669.exeFilesize
235KB
MD5bf757859cef452e49000b5630d66d159
SHA1ad85b929000e000d8463def452d2a481a2edce82
SHA25681ee0c4f2632ff0fe00c9ec99b099c4f6891a97e3d475031bd7517077e2d0ef1
SHA512ba1cea404f6f99309f997968790129f36156671465a0fffa1e6a850f388334334c1d3b06f8b8c00095364022d60559879d2c2c9c8d7fde480742c8660383ed0b
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu692481.exeFilesize
292KB
MD591f76c6a964770dd598b1d3b1240e743
SHA1969f2b318f88f1b267e85d501f9a6011e2e42cae
SHA256b9364e7cb120573071ee3c0ecb39b574bb0fc291ceb6e8feca5db8e6289149ca
SHA5125ceecd488e58e54969955e463085d8132f7bd4b33b07191c7fd6335ea061815ec310c0e11068253dd21b4783711077d14a51f1f282bdeb95a4674c98d318afb8
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu692481.exeFilesize
292KB
MD591f76c6a964770dd598b1d3b1240e743
SHA1969f2b318f88f1b267e85d501f9a6011e2e42cae
SHA256b9364e7cb120573071ee3c0ecb39b574bb0fc291ceb6e8feca5db8e6289149ca
SHA5125ceecd488e58e54969955e463085d8132f7bd4b33b07191c7fd6335ea061815ec310c0e11068253dd21b4783711077d14a51f1f282bdeb95a4674c98d318afb8
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/564-1128-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/564-1127-0x0000000000430000-0x0000000000462000-memory.dmpFilesize
200KB
-
memory/1928-1113-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/1928-478-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/1928-1121-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/1928-1118-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/1928-1119-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/1928-1120-0x0000000006770000-0x0000000006C9C000-memory.dmpFilesize
5.2MB
-
memory/1928-1117-0x0000000006590000-0x0000000006752000-memory.dmpFilesize
1.8MB
-
memory/1928-1115-0x00000000063E0000-0x0000000006430000-memory.dmpFilesize
320KB
-
memory/1928-1114-0x0000000006350000-0x00000000063C6000-memory.dmpFilesize
472KB
-
memory/1928-1112-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/1928-197-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-198-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-200-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-202-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-204-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-206-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-208-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-210-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-212-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-214-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-216-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-218-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-220-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-222-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-224-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-226-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-228-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-230-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/1928-473-0x00000000004C0000-0x000000000050B000-memory.dmpFilesize
300KB
-
memory/1928-476-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/1928-475-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/1928-1111-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/1928-1107-0x0000000005150000-0x0000000005768000-memory.dmpFilesize
6.1MB
-
memory/1928-1108-0x0000000005770000-0x000000000587A000-memory.dmpFilesize
1.0MB
-
memory/1928-1109-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/1928-1110-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/2536-1134-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB
-
memory/3764-172-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/3764-157-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/3764-182-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/3764-192-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/3764-190-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/3764-189-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/3764-188-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/3764-187-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/3764-186-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/3764-176-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/3764-155-0x0000000004CE0000-0x0000000005284000-memory.dmpFilesize
5.6MB
-
memory/3764-178-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/3764-166-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/3764-168-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/3764-170-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/3764-180-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/3764-164-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/3764-162-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/3764-160-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/3764-159-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/3764-158-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/3764-184-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/3764-156-0x00000000004B0000-0x00000000004DD000-memory.dmpFilesize
180KB
-
memory/3764-174-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB