Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2023 20:08
Static task
static1
General
-
Target
6b3f76ccba0f0923ea283ba85e2a861a8af3c1bba7650382f206912d365fb756.exe
-
Size
925KB
-
MD5
366702117c029d51023db4cf9bd119ad
-
SHA1
2074abb3ed4a6612951078a161cd1adce5a49403
-
SHA256
6b3f76ccba0f0923ea283ba85e2a861a8af3c1bba7650382f206912d365fb756
-
SHA512
10c7da973531a7259344f25cf5e40769a3d13baecdea066845062e90b27f04d1a1453c566677916f71647986c5d9d4df429a91b36be8214d18764919f743b7dc
-
SSDEEP
24576:ly0Z9jVuWEwmrWrFaujhUjhVIlGy+NoqEE+sw5:A0Tj07rAaujCjvI8NorE+x
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pr189887.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr189887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr189887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr189887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr189887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr189887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr189887.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/216-198-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/216-200-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/216-197-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/216-202-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/216-204-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/216-206-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/216-208-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/216-210-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/216-212-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/216-214-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/216-216-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/216-218-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/216-220-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/216-222-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/216-224-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/216-226-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/216-228-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/216-230-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
si357690.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation si357690.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
un452835.exeun189636.exepr189887.exequ418592.exerk863221.exesi357690.exeoneetx.exeoneetx.exeoneetx.exepid process 4584 un452835.exe 4272 un189636.exe 2812 pr189887.exe 216 qu418592.exe 5016 rk863221.exe 4988 si357690.exe 3880 oneetx.exe 2136 oneetx.exe 2808 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2452 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pr189887.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr189887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr189887.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
6b3f76ccba0f0923ea283ba85e2a861a8af3c1bba7650382f206912d365fb756.exeun452835.exeun189636.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6b3f76ccba0f0923ea283ba85e2a861a8af3c1bba7650382f206912d365fb756.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un452835.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un452835.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un189636.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un189636.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6b3f76ccba0f0923ea283ba85e2a861a8af3c1bba7650382f206912d365fb756.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 29 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3212 2812 WerFault.exe pr189887.exe 4528 216 WerFault.exe qu418592.exe 3716 4988 WerFault.exe si357690.exe 1304 4988 WerFault.exe si357690.exe 4224 4988 WerFault.exe si357690.exe 3632 4988 WerFault.exe si357690.exe 3592 4988 WerFault.exe si357690.exe 1920 4988 WerFault.exe si357690.exe 3804 4988 WerFault.exe si357690.exe 3188 4988 WerFault.exe si357690.exe 4804 4988 WerFault.exe si357690.exe 4140 4988 WerFault.exe si357690.exe 3932 3880 WerFault.exe oneetx.exe 3076 3880 WerFault.exe oneetx.exe 1736 3880 WerFault.exe oneetx.exe 3392 3880 WerFault.exe oneetx.exe 4288 3880 WerFault.exe oneetx.exe 1900 3880 WerFault.exe oneetx.exe 4844 3880 WerFault.exe oneetx.exe 3260 3880 WerFault.exe oneetx.exe 3296 3880 WerFault.exe oneetx.exe 1264 3880 WerFault.exe oneetx.exe 2988 3880 WerFault.exe oneetx.exe 1980 2136 WerFault.exe oneetx.exe 2672 3880 WerFault.exe oneetx.exe 960 3880 WerFault.exe oneetx.exe 4984 3880 WerFault.exe oneetx.exe 2208 3880 WerFault.exe oneetx.exe 2984 2808 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pr189887.exequ418592.exerk863221.exepid process 2812 pr189887.exe 2812 pr189887.exe 216 qu418592.exe 216 qu418592.exe 5016 rk863221.exe 5016 rk863221.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pr189887.exequ418592.exerk863221.exedescription pid process Token: SeDebugPrivilege 2812 pr189887.exe Token: SeDebugPrivilege 216 qu418592.exe Token: SeDebugPrivilege 5016 rk863221.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
si357690.exepid process 4988 si357690.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
6b3f76ccba0f0923ea283ba85e2a861a8af3c1bba7650382f206912d365fb756.exeun452835.exeun189636.exesi357690.exeoneetx.exedescription pid process target process PID 3648 wrote to memory of 4584 3648 6b3f76ccba0f0923ea283ba85e2a861a8af3c1bba7650382f206912d365fb756.exe un452835.exe PID 3648 wrote to memory of 4584 3648 6b3f76ccba0f0923ea283ba85e2a861a8af3c1bba7650382f206912d365fb756.exe un452835.exe PID 3648 wrote to memory of 4584 3648 6b3f76ccba0f0923ea283ba85e2a861a8af3c1bba7650382f206912d365fb756.exe un452835.exe PID 4584 wrote to memory of 4272 4584 un452835.exe un189636.exe PID 4584 wrote to memory of 4272 4584 un452835.exe un189636.exe PID 4584 wrote to memory of 4272 4584 un452835.exe un189636.exe PID 4272 wrote to memory of 2812 4272 un189636.exe pr189887.exe PID 4272 wrote to memory of 2812 4272 un189636.exe pr189887.exe PID 4272 wrote to memory of 2812 4272 un189636.exe pr189887.exe PID 4272 wrote to memory of 216 4272 un189636.exe qu418592.exe PID 4272 wrote to memory of 216 4272 un189636.exe qu418592.exe PID 4272 wrote to memory of 216 4272 un189636.exe qu418592.exe PID 4584 wrote to memory of 5016 4584 un452835.exe rk863221.exe PID 4584 wrote to memory of 5016 4584 un452835.exe rk863221.exe PID 4584 wrote to memory of 5016 4584 un452835.exe rk863221.exe PID 3648 wrote to memory of 4988 3648 6b3f76ccba0f0923ea283ba85e2a861a8af3c1bba7650382f206912d365fb756.exe si357690.exe PID 3648 wrote to memory of 4988 3648 6b3f76ccba0f0923ea283ba85e2a861a8af3c1bba7650382f206912d365fb756.exe si357690.exe PID 3648 wrote to memory of 4988 3648 6b3f76ccba0f0923ea283ba85e2a861a8af3c1bba7650382f206912d365fb756.exe si357690.exe PID 4988 wrote to memory of 3880 4988 si357690.exe oneetx.exe PID 4988 wrote to memory of 3880 4988 si357690.exe oneetx.exe PID 4988 wrote to memory of 3880 4988 si357690.exe oneetx.exe PID 3880 wrote to memory of 3580 3880 oneetx.exe schtasks.exe PID 3880 wrote to memory of 3580 3880 oneetx.exe schtasks.exe PID 3880 wrote to memory of 3580 3880 oneetx.exe schtasks.exe PID 3880 wrote to memory of 2452 3880 oneetx.exe rundll32.exe PID 3880 wrote to memory of 2452 3880 oneetx.exe rundll32.exe PID 3880 wrote to memory of 2452 3880 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b3f76ccba0f0923ea283ba85e2a861a8af3c1bba7650382f206912d365fb756.exe"C:\Users\Admin\AppData\Local\Temp\6b3f76ccba0f0923ea283ba85e2a861a8af3c1bba7650382f206912d365fb756.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un452835.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un452835.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un189636.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un189636.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr189887.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr189887.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 10925⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu418592.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu418592.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 13285⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk863221.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk863221.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si357690.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si357690.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 7723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 9523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 9763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 9763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 11963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 12443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 8444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 8524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 10844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 10924⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 7764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 6764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 6844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 11524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 16204⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 11524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 15924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 14163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2812 -ip 28121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 216 -ip 2161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4988 -ip 49881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4988 -ip 49881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4988 -ip 49881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4988 -ip 49881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4988 -ip 49881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4988 -ip 49881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4988 -ip 49881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4988 -ip 49881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4988 -ip 49881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4988 -ip 49881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3880 -ip 38801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3880 -ip 38801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3880 -ip 38801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3880 -ip 38801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3880 -ip 38801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3880 -ip 38801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3880 -ip 38801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3880 -ip 38801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3880 -ip 38801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3880 -ip 38801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3880 -ip 38801⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 3322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2136 -ip 21361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3880 -ip 38801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3880 -ip 38801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3880 -ip 38801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3880 -ip 38801⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 3162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2808 -ip 28081⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si357690.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si357690.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un452835.exeFilesize
662KB
MD5df4721d86baa04658e81b4dda6219c3b
SHA1a1432edf2d59fb4d287ada9905b200416151535e
SHA256f0010cccea9d5db21851cee193dd46a8c3fceab95e21a8b594bae03f182cb1cd
SHA51264014d9d6cec3c66c25921f029092a16be3c351dd6817aa14262b5054bd1821a9e842c33c258e70e4b62bb5168e9e23e21e871d5c59cb2fefc00e3ce5cbc010b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un452835.exeFilesize
662KB
MD5df4721d86baa04658e81b4dda6219c3b
SHA1a1432edf2d59fb4d287ada9905b200416151535e
SHA256f0010cccea9d5db21851cee193dd46a8c3fceab95e21a8b594bae03f182cb1cd
SHA51264014d9d6cec3c66c25921f029092a16be3c351dd6817aa14262b5054bd1821a9e842c33c258e70e4b62bb5168e9e23e21e871d5c59cb2fefc00e3ce5cbc010b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk863221.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk863221.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un189636.exeFilesize
520KB
MD50719f60c54229367f45973c24f22a9e0
SHA1dcb87a707a55eca2b1e062d4a34c170bbc70ee02
SHA2566138bfe9fdca974b637a9ab367cc01f13df31f53a4cbc0577000b383f3f338f1
SHA51228882bc29e9a3c6214deea8eb1876447bbbb4013ce75f1a0f49a4738404fd40db580d2d4fa930eb8c2b2362e23b97f3a7442ae4f5eee2b4710a53f22000879ee
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un189636.exeFilesize
520KB
MD50719f60c54229367f45973c24f22a9e0
SHA1dcb87a707a55eca2b1e062d4a34c170bbc70ee02
SHA2566138bfe9fdca974b637a9ab367cc01f13df31f53a4cbc0577000b383f3f338f1
SHA51228882bc29e9a3c6214deea8eb1876447bbbb4013ce75f1a0f49a4738404fd40db580d2d4fa930eb8c2b2362e23b97f3a7442ae4f5eee2b4710a53f22000879ee
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr189887.exeFilesize
235KB
MD5444ef7b93485077e0f19992fceba3e2d
SHA16235249b74ad7e018abc1a7e9356623f7c79ac03
SHA25605287e67a3a8fd2ce313a9c5b99bfa8d2d2cdbd13bdce727cd6a7bad2ef96f53
SHA512aa7865ddfab87f2877cf665a0aa39a3a6e508a9c0e96816cf716948c66ad21af02ab446b683a1929c0e3dceffb1c39546cfabbc3692952b188566d29a45754ea
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr189887.exeFilesize
235KB
MD5444ef7b93485077e0f19992fceba3e2d
SHA16235249b74ad7e018abc1a7e9356623f7c79ac03
SHA25605287e67a3a8fd2ce313a9c5b99bfa8d2d2cdbd13bdce727cd6a7bad2ef96f53
SHA512aa7865ddfab87f2877cf665a0aa39a3a6e508a9c0e96816cf716948c66ad21af02ab446b683a1929c0e3dceffb1c39546cfabbc3692952b188566d29a45754ea
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu418592.exeFilesize
292KB
MD5a3938d82598270b4b0eeb2398b374e0c
SHA18cc466eb5f383f3b89df2421bf9f2e104c011db5
SHA256141e92d32aa1a2f9cbc967b216fa9002881f42c4c5ff154dddc75da4b8a25d2f
SHA512495e505dbaf71879ebd8a564923c81f076ab045605c71cc473f8467ff5f559a2e26f36ebf092293e6acf21c0861a2093ad038b991d2aa401e3d73eaf00fa0193
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu418592.exeFilesize
292KB
MD5a3938d82598270b4b0eeb2398b374e0c
SHA18cc466eb5f383f3b89df2421bf9f2e104c011db5
SHA256141e92d32aa1a2f9cbc967b216fa9002881f42c4c5ff154dddc75da4b8a25d2f
SHA512495e505dbaf71879ebd8a564923c81f076ab045605c71cc473f8467ff5f559a2e26f36ebf092293e6acf21c0861a2093ad038b991d2aa401e3d73eaf00fa0193
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/216-1117-0x0000000004970000-0x0000000004980000-memory.dmpFilesize
64KB
-
memory/216-361-0x0000000004970000-0x0000000004980000-memory.dmpFilesize
64KB
-
memory/216-1122-0x0000000007E80000-0x0000000007ED0000-memory.dmpFilesize
320KB
-
memory/216-1121-0x0000000002440000-0x00000000024B6000-memory.dmpFilesize
472KB
-
memory/216-1120-0x0000000006690000-0x0000000006BBC000-memory.dmpFilesize
5.2MB
-
memory/216-1119-0x00000000064B0000-0x0000000006672000-memory.dmpFilesize
1.8MB
-
memory/216-1118-0x0000000004970000-0x0000000004980000-memory.dmpFilesize
64KB
-
memory/216-1116-0x0000000004970000-0x0000000004980000-memory.dmpFilesize
64KB
-
memory/216-1115-0x0000000004970000-0x0000000004980000-memory.dmpFilesize
64KB
-
memory/216-1113-0x0000000006260000-0x00000000062F2000-memory.dmpFilesize
584KB
-
memory/216-1112-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/216-198-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-200-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-197-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-202-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-204-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-206-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-208-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-210-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-212-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-214-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-216-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-218-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-220-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-222-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-224-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-226-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-228-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-230-0x00000000050B0000-0x00000000050EF000-memory.dmpFilesize
252KB
-
memory/216-359-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/216-363-0x0000000004970000-0x0000000004980000-memory.dmpFilesize
64KB
-
memory/216-1111-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/216-364-0x0000000004970000-0x0000000004980000-memory.dmpFilesize
64KB
-
memory/216-1107-0x00000000050F0000-0x0000000005708000-memory.dmpFilesize
6.1MB
-
memory/216-1108-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/216-1109-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/216-1110-0x0000000004970000-0x0000000004980000-memory.dmpFilesize
64KB
-
memory/2812-171-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2812-155-0x0000000000580000-0x00000000005AD000-memory.dmpFilesize
180KB
-
memory/2812-181-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2812-192-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/2812-190-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/2812-175-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2812-189-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/2812-188-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/2812-187-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2812-185-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2812-183-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2812-173-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2812-179-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2812-177-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2812-160-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2812-169-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2812-167-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2812-157-0x0000000004CB0000-0x0000000005254000-memory.dmpFilesize
5.6MB
-
memory/2812-165-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2812-163-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2812-161-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2812-156-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/2812-158-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/2812-159-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/4988-1135-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB
-
memory/5016-1129-0x0000000005A70000-0x0000000005A80000-memory.dmpFilesize
64KB
-
memory/5016-1128-0x0000000000E30000-0x0000000000E62000-memory.dmpFilesize
200KB