Analysis
-
max time kernel
140s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2023 20:09
Static task
static1
General
-
Target
921dafc185e35aa8f9f43c82544a82dceb7b482070ec293113da6a7080862b14.exe
-
Size
785KB
-
MD5
a4c74ef7d9ca8621cce4d81bc5d335c5
-
SHA1
c05d98513e9b9f8f6cb8a4f67e4bd0261dca1bca
-
SHA256
921dafc185e35aa8f9f43c82544a82dceb7b482070ec293113da6a7080862b14
-
SHA512
d02a242ccd6c20f683742f43206d92dff0b8d6374649dd515f80b6d2a77d0b9f5192acff20d686a247a875403ead4ba10205fc38efff1ff2cb2a6443e0681dad
-
SSDEEP
24576:GylEPaHQjHrWh3Q0YHHDlMyZs9KmezCyWci3X:VlEPaHQjKQ0YnDZsVejWh3
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
it295213.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it295213.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it295213.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it295213.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it295213.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it295213.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it295213.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/3120-164-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-165-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-167-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-169-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-171-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-173-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-175-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-177-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-179-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-181-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-183-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-185-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-187-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-189-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-191-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-193-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-195-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-197-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-199-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-201-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-205-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-203-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-207-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-209-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-213-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-211-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-215-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-217-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-219-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-221-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-223-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-225-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/3120-227-0x0000000002610000-0x000000000264F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr620334.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation lr620334.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
zinZ3520.exezipy4433.exeit295213.exejr270913.exekp721264.exelr620334.exeoneetx.exeoneetx.exeoneetx.exepid process 3432 zinZ3520.exe 4512 zipy4433.exe 3412 it295213.exe 3120 jr270913.exe 2732 kp721264.exe 1384 lr620334.exe 5060 oneetx.exe 4292 oneetx.exe 3692 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1040 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it295213.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it295213.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
zinZ3520.exezipy4433.exe921dafc185e35aa8f9f43c82544a82dceb7b482070ec293113da6a7080862b14.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zinZ3520.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zipy4433.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zipy4433.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 921dafc185e35aa8f9f43c82544a82dceb7b482070ec293113da6a7080862b14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 921dafc185e35aa8f9f43c82544a82dceb7b482070ec293113da6a7080862b14.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zinZ3520.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 28 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1804 3120 WerFault.exe jr270913.exe 1320 1384 WerFault.exe lr620334.exe 1268 1384 WerFault.exe lr620334.exe 3060 1384 WerFault.exe lr620334.exe 2404 1384 WerFault.exe lr620334.exe 2148 1384 WerFault.exe lr620334.exe 4264 1384 WerFault.exe lr620334.exe 3856 1384 WerFault.exe lr620334.exe 3560 1384 WerFault.exe lr620334.exe 2756 1384 WerFault.exe lr620334.exe 1484 1384 WerFault.exe lr620334.exe 1760 5060 WerFault.exe oneetx.exe 4392 5060 WerFault.exe oneetx.exe 1712 5060 WerFault.exe oneetx.exe 4316 5060 WerFault.exe oneetx.exe 4764 5060 WerFault.exe oneetx.exe 472 5060 WerFault.exe oneetx.exe 3064 5060 WerFault.exe oneetx.exe 556 5060 WerFault.exe oneetx.exe 3152 5060 WerFault.exe oneetx.exe 4572 5060 WerFault.exe oneetx.exe 932 5060 WerFault.exe oneetx.exe 1540 4292 WerFault.exe oneetx.exe 340 5060 WerFault.exe oneetx.exe 3900 5060 WerFault.exe oneetx.exe 3540 5060 WerFault.exe oneetx.exe 2216 3692 WerFault.exe oneetx.exe 1092 5060 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it295213.exejr270913.exekp721264.exepid process 3412 it295213.exe 3412 it295213.exe 3120 jr270913.exe 3120 jr270913.exe 2732 kp721264.exe 2732 kp721264.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it295213.exejr270913.exekp721264.exedescription pid process Token: SeDebugPrivilege 3412 it295213.exe Token: SeDebugPrivilege 3120 jr270913.exe Token: SeDebugPrivilege 2732 kp721264.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr620334.exepid process 1384 lr620334.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
921dafc185e35aa8f9f43c82544a82dceb7b482070ec293113da6a7080862b14.exezinZ3520.exezipy4433.exelr620334.exeoneetx.exedescription pid process target process PID 2988 wrote to memory of 3432 2988 921dafc185e35aa8f9f43c82544a82dceb7b482070ec293113da6a7080862b14.exe zinZ3520.exe PID 2988 wrote to memory of 3432 2988 921dafc185e35aa8f9f43c82544a82dceb7b482070ec293113da6a7080862b14.exe zinZ3520.exe PID 2988 wrote to memory of 3432 2988 921dafc185e35aa8f9f43c82544a82dceb7b482070ec293113da6a7080862b14.exe zinZ3520.exe PID 3432 wrote to memory of 4512 3432 zinZ3520.exe zipy4433.exe PID 3432 wrote to memory of 4512 3432 zinZ3520.exe zipy4433.exe PID 3432 wrote to memory of 4512 3432 zinZ3520.exe zipy4433.exe PID 4512 wrote to memory of 3412 4512 zipy4433.exe it295213.exe PID 4512 wrote to memory of 3412 4512 zipy4433.exe it295213.exe PID 4512 wrote to memory of 3120 4512 zipy4433.exe jr270913.exe PID 4512 wrote to memory of 3120 4512 zipy4433.exe jr270913.exe PID 4512 wrote to memory of 3120 4512 zipy4433.exe jr270913.exe PID 3432 wrote to memory of 2732 3432 zinZ3520.exe kp721264.exe PID 3432 wrote to memory of 2732 3432 zinZ3520.exe kp721264.exe PID 3432 wrote to memory of 2732 3432 zinZ3520.exe kp721264.exe PID 2988 wrote to memory of 1384 2988 921dafc185e35aa8f9f43c82544a82dceb7b482070ec293113da6a7080862b14.exe lr620334.exe PID 2988 wrote to memory of 1384 2988 921dafc185e35aa8f9f43c82544a82dceb7b482070ec293113da6a7080862b14.exe lr620334.exe PID 2988 wrote to memory of 1384 2988 921dafc185e35aa8f9f43c82544a82dceb7b482070ec293113da6a7080862b14.exe lr620334.exe PID 1384 wrote to memory of 5060 1384 lr620334.exe oneetx.exe PID 1384 wrote to memory of 5060 1384 lr620334.exe oneetx.exe PID 1384 wrote to memory of 5060 1384 lr620334.exe oneetx.exe PID 5060 wrote to memory of 2104 5060 oneetx.exe schtasks.exe PID 5060 wrote to memory of 2104 5060 oneetx.exe schtasks.exe PID 5060 wrote to memory of 2104 5060 oneetx.exe schtasks.exe PID 5060 wrote to memory of 1040 5060 oneetx.exe rundll32.exe PID 5060 wrote to memory of 1040 5060 oneetx.exe rundll32.exe PID 5060 wrote to memory of 1040 5060 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\921dafc185e35aa8f9f43c82544a82dceb7b482070ec293113da6a7080862b14.exe"C:\Users\Admin\AppData\Local\Temp\921dafc185e35aa8f9f43c82544a82dceb7b482070ec293113da6a7080862b14.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinZ3520.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinZ3520.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zipy4433.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zipy4433.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it295213.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it295213.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr270913.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr270913.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 13365⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp721264.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp721264.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr620334.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr620334.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 7723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 9523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 9763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 9763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 12163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 12443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 8844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 9164⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 10924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 11324⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 12924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 13004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 12644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 11724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 16044⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 10844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 16204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 7523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3120 -ip 31201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1384 -ip 13841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1384 -ip 13841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1384 -ip 13841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1384 -ip 13841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1384 -ip 13841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 1384 -ip 13841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1384 -ip 13841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1384 -ip 13841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1384 -ip 13841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1384 -ip 13841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5060 -ip 50601⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 1802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4292 -ip 42921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5060 -ip 50601⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3692 -ip 36921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5060 -ip 50601⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr620334.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr620334.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinZ3520.exeFilesize
522KB
MD508cb18253dd5169e6ced4a344993965a
SHA1f467301a96cab9682a8d3902732a90fd60abfff2
SHA256c96fc6011147c37280cf1dffdc799a96ef69fda4fb9133a1d8fb0b69d193ed4c
SHA51254448a2f3387f4c27409b1baeb3c98eea36ace9112ddeef4cd4a91d1ad7b5fff2ce656d5048900a9abf91b095747522209cdef4161f32a7416d91b700e3f2c42
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinZ3520.exeFilesize
522KB
MD508cb18253dd5169e6ced4a344993965a
SHA1f467301a96cab9682a8d3902732a90fd60abfff2
SHA256c96fc6011147c37280cf1dffdc799a96ef69fda4fb9133a1d8fb0b69d193ed4c
SHA51254448a2f3387f4c27409b1baeb3c98eea36ace9112ddeef4cd4a91d1ad7b5fff2ce656d5048900a9abf91b095747522209cdef4161f32a7416d91b700e3f2c42
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp721264.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp721264.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zipy4433.exeFilesize
379KB
MD5ab5186bb1105a29985260e896ff5056e
SHA178e0f551c10b3a53512d4aa3c4e8dcf40f779650
SHA256f43cff4435be5e77f930ba3c7a5680ce028b6cc3a9ddd61be3b60650e5e1b854
SHA5125263d186f72e0199dec6dbd8f435252f29681ae333cafd49ed65a8485cc08ce74a62bd751920d913df9bb85d8fd8af97bb808633eac1826e371f847c59bbe151
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zipy4433.exeFilesize
379KB
MD5ab5186bb1105a29985260e896ff5056e
SHA178e0f551c10b3a53512d4aa3c4e8dcf40f779650
SHA256f43cff4435be5e77f930ba3c7a5680ce028b6cc3a9ddd61be3b60650e5e1b854
SHA5125263d186f72e0199dec6dbd8f435252f29681ae333cafd49ed65a8485cc08ce74a62bd751920d913df9bb85d8fd8af97bb808633eac1826e371f847c59bbe151
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it295213.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it295213.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr270913.exeFilesize
292KB
MD5e7bc8a14b14f969d24ac34848f8d2ea4
SHA1dbdeb49327b0c3f513ea588b394a412d02ac3a12
SHA2569be12dd71cc5a8ebbbfbd2afb01e91dcaa375b9dec0d352a5962bdf7c809edce
SHA512038614bb1dc75a4de7a4e6b370503ad84b203bc34af1dfb2e151e0b307cfab9d5c4511c76d352c5780fdbc3cedaa5e5eb12aa557bf8b3e05663d8e260aadae27
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr270913.exeFilesize
292KB
MD5e7bc8a14b14f969d24ac34848f8d2ea4
SHA1dbdeb49327b0c3f513ea588b394a412d02ac3a12
SHA2569be12dd71cc5a8ebbbfbd2afb01e91dcaa375b9dec0d352a5962bdf7c809edce
SHA512038614bb1dc75a4de7a4e6b370503ad84b203bc34af1dfb2e151e0b307cfab9d5c4511c76d352c5780fdbc3cedaa5e5eb12aa557bf8b3e05663d8e260aadae27
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1384-1098-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/2732-1092-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/2732-1091-0x0000000000280000-0x00000000002B2000-memory.dmpFilesize
200KB
-
memory/3120-213-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-1074-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/3120-187-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-189-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-191-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-193-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-195-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-197-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-199-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-201-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-205-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-203-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-207-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-209-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-183-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-211-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-215-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-217-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-219-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-221-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-223-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-225-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-227-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-1070-0x0000000005190000-0x00000000057A8000-memory.dmpFilesize
6.1MB
-
memory/3120-1071-0x00000000057B0000-0x00000000058BA000-memory.dmpFilesize
1.0MB
-
memory/3120-1072-0x0000000004BB0000-0x0000000004BC2000-memory.dmpFilesize
72KB
-
memory/3120-1073-0x0000000005900000-0x000000000593C000-memory.dmpFilesize
240KB
-
memory/3120-185-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-1076-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/3120-1077-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/3120-1078-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/3120-1079-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/3120-1080-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/3120-1081-0x00000000065B0000-0x0000000006772000-memory.dmpFilesize
1.8MB
-
memory/3120-1082-0x0000000006790000-0x0000000006CBC000-memory.dmpFilesize
5.2MB
-
memory/3120-1083-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/3120-181-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-179-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-177-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-175-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-173-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-171-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-169-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-167-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-165-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-164-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/3120-163-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/3120-162-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/3120-161-0x0000000000710000-0x000000000075B000-memory.dmpFilesize
300KB
-
memory/3120-160-0x0000000004BE0000-0x0000000005184000-memory.dmpFilesize
5.6MB
-
memory/3120-1084-0x0000000006DF0000-0x0000000006E66000-memory.dmpFilesize
472KB
-
memory/3120-1085-0x0000000006E80000-0x0000000006ED0000-memory.dmpFilesize
320KB
-
memory/3412-154-0x0000000000040000-0x000000000004A000-memory.dmpFilesize
40KB