Analysis
-
max time kernel
148s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 21:46
Static task
static1
General
-
Target
2d602ea7a5052d950466d49dbcc5e563ae323435af08a0518163399a302707b2.exe
-
Size
928KB
-
MD5
b358fa0f3af53cfa267addea6df1b212
-
SHA1
67f502097de3eecc92251218dab59b05b097cf63
-
SHA256
2d602ea7a5052d950466d49dbcc5e563ae323435af08a0518163399a302707b2
-
SHA512
3b87838df3d3a921c491c61dbfd3df32fa6b4706b83348b585825f8b37899ae5c9a5a4a1e928388bb8bcffe8a6ac57bae65a6ffaad950e232f2bbb9b807c6f0e
-
SSDEEP
24576:yywNE54a0xx8hxNy8FlQGVaKaIeNC0zDNFLF6:Zw20cFlQGVWI0P
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pr959922.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr959922.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr959922.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr959922.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr959922.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr959922.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr959922.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2392-198-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2392-199-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2392-201-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2392-203-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2392-205-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2392-207-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2392-209-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2392-211-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2392-213-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2392-215-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2392-217-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2392-219-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2392-221-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2392-223-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2392-225-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2392-227-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2392-229-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2392-231-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
oneetx.exesi587467.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation si587467.exe -
Executes dropped EXE 9 IoCs
Processes:
un827758.exeun600812.exepr959922.exequ627963.exerk081716.exesi587467.exeoneetx.exeoneetx.exeoneetx.exepid process 3488 un827758.exe 2412 un600812.exe 1160 pr959922.exe 2392 qu627963.exe 3888 rk081716.exe 1112 si587467.exe 1040 oneetx.exe 3444 oneetx.exe 4596 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1656 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pr959922.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr959922.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr959922.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
2d602ea7a5052d950466d49dbcc5e563ae323435af08a0518163399a302707b2.exeun827758.exeun600812.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2d602ea7a5052d950466d49dbcc5e563ae323435af08a0518163399a302707b2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2d602ea7a5052d950466d49dbcc5e563ae323435af08a0518163399a302707b2.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un827758.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un827758.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un600812.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un600812.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 224 1160 WerFault.exe pr959922.exe 392 2392 WerFault.exe qu627963.exe 2764 1112 WerFault.exe si587467.exe 3412 1112 WerFault.exe si587467.exe 1512 1112 WerFault.exe si587467.exe 4252 1112 WerFault.exe si587467.exe 2556 1112 WerFault.exe si587467.exe 4724 1112 WerFault.exe si587467.exe 2720 1112 WerFault.exe si587467.exe 3180 1112 WerFault.exe si587467.exe 3492 1112 WerFault.exe si587467.exe 2464 1112 WerFault.exe si587467.exe 1992 1040 WerFault.exe oneetx.exe 2836 1040 WerFault.exe oneetx.exe 1220 1040 WerFault.exe oneetx.exe 2176 1040 WerFault.exe oneetx.exe 2996 1040 WerFault.exe oneetx.exe 3228 1040 WerFault.exe oneetx.exe 1108 1040 WerFault.exe oneetx.exe 4876 1040 WerFault.exe oneetx.exe 4508 1040 WerFault.exe oneetx.exe 2132 1040 WerFault.exe oneetx.exe 760 1040 WerFault.exe oneetx.exe 628 1040 WerFault.exe oneetx.exe 5032 3444 WerFault.exe oneetx.exe 2424 1040 WerFault.exe oneetx.exe 964 1040 WerFault.exe oneetx.exe 1468 1040 WerFault.exe oneetx.exe 3936 4596 WerFault.exe oneetx.exe 2940 1040 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pr959922.exequ627963.exerk081716.exepid process 1160 pr959922.exe 1160 pr959922.exe 2392 qu627963.exe 2392 qu627963.exe 3888 rk081716.exe 3888 rk081716.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pr959922.exequ627963.exerk081716.exedescription pid process Token: SeDebugPrivilege 1160 pr959922.exe Token: SeDebugPrivilege 2392 qu627963.exe Token: SeDebugPrivilege 3888 rk081716.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
si587467.exepid process 1112 si587467.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
2d602ea7a5052d950466d49dbcc5e563ae323435af08a0518163399a302707b2.exeun827758.exeun600812.exesi587467.exeoneetx.exedescription pid process target process PID 2676 wrote to memory of 3488 2676 2d602ea7a5052d950466d49dbcc5e563ae323435af08a0518163399a302707b2.exe un827758.exe PID 2676 wrote to memory of 3488 2676 2d602ea7a5052d950466d49dbcc5e563ae323435af08a0518163399a302707b2.exe un827758.exe PID 2676 wrote to memory of 3488 2676 2d602ea7a5052d950466d49dbcc5e563ae323435af08a0518163399a302707b2.exe un827758.exe PID 3488 wrote to memory of 2412 3488 un827758.exe un600812.exe PID 3488 wrote to memory of 2412 3488 un827758.exe un600812.exe PID 3488 wrote to memory of 2412 3488 un827758.exe un600812.exe PID 2412 wrote to memory of 1160 2412 un600812.exe pr959922.exe PID 2412 wrote to memory of 1160 2412 un600812.exe pr959922.exe PID 2412 wrote to memory of 1160 2412 un600812.exe pr959922.exe PID 2412 wrote to memory of 2392 2412 un600812.exe qu627963.exe PID 2412 wrote to memory of 2392 2412 un600812.exe qu627963.exe PID 2412 wrote to memory of 2392 2412 un600812.exe qu627963.exe PID 3488 wrote to memory of 3888 3488 un827758.exe rk081716.exe PID 3488 wrote to memory of 3888 3488 un827758.exe rk081716.exe PID 3488 wrote to memory of 3888 3488 un827758.exe rk081716.exe PID 2676 wrote to memory of 1112 2676 2d602ea7a5052d950466d49dbcc5e563ae323435af08a0518163399a302707b2.exe si587467.exe PID 2676 wrote to memory of 1112 2676 2d602ea7a5052d950466d49dbcc5e563ae323435af08a0518163399a302707b2.exe si587467.exe PID 2676 wrote to memory of 1112 2676 2d602ea7a5052d950466d49dbcc5e563ae323435af08a0518163399a302707b2.exe si587467.exe PID 1112 wrote to memory of 1040 1112 si587467.exe oneetx.exe PID 1112 wrote to memory of 1040 1112 si587467.exe oneetx.exe PID 1112 wrote to memory of 1040 1112 si587467.exe oneetx.exe PID 1040 wrote to memory of 100 1040 oneetx.exe schtasks.exe PID 1040 wrote to memory of 100 1040 oneetx.exe schtasks.exe PID 1040 wrote to memory of 100 1040 oneetx.exe schtasks.exe PID 1040 wrote to memory of 1656 1040 oneetx.exe rundll32.exe PID 1040 wrote to memory of 1656 1040 oneetx.exe rundll32.exe PID 1040 wrote to memory of 1656 1040 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d602ea7a5052d950466d49dbcc5e563ae323435af08a0518163399a302707b2.exe"C:\Users\Admin\AppData\Local\Temp\2d602ea7a5052d950466d49dbcc5e563ae323435af08a0518163399a302707b2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un827758.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un827758.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un600812.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un600812.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr959922.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr959922.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 10285⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu627963.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu627963.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 19205⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk081716.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk081716.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si587467.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si587467.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 7803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 7963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 8043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 9523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 9523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 12083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 12323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 10044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 10964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 10044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 11004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 10924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 11364⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 9964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 12484⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 7684⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 12564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 11244⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 16164⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 15724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 16444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 13083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1160 -ip 11601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2392 -ip 23921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1112 -ip 11121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1112 -ip 11121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1112 -ip 11121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1112 -ip 11121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1112 -ip 11121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1112 -ip 11121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1112 -ip 11121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1112 -ip 11121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1112 -ip 11121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1112 -ip 11121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1040 -ip 10401⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 1922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3444 -ip 34441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1040 -ip 10401⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 3122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4596 -ip 45961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1040 -ip 10401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si587467.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si587467.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un827758.exeFilesize
663KB
MD5f47959f2b02ce51d87a096aeadfe8fe2
SHA1d51abf89e65d36c311e7c7bb78ab72a625fb8283
SHA256e1a76c314311b82dae591fe2ef4c1932f903a632254dd47f9c5875420b15f91d
SHA512799888c17ebbc4a23fac0af124b12d9495f2df598d82c88372f0c87331a0fd03131b3868aaa0f78f443908f16df25b69cb4629aa406e1855c98f821150a1864a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un827758.exeFilesize
663KB
MD5f47959f2b02ce51d87a096aeadfe8fe2
SHA1d51abf89e65d36c311e7c7bb78ab72a625fb8283
SHA256e1a76c314311b82dae591fe2ef4c1932f903a632254dd47f9c5875420b15f91d
SHA512799888c17ebbc4a23fac0af124b12d9495f2df598d82c88372f0c87331a0fd03131b3868aaa0f78f443908f16df25b69cb4629aa406e1855c98f821150a1864a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk081716.exeFilesize
176KB
MD52122e22ca2c876dd2dd9108a36641e80
SHA134cb0c804a6b63ac4e0bfe45256481070b14a389
SHA256add26a94d0c22eb7cbcb0590427064caf0ab569bdc1dbde14ad827c5abe2ee32
SHA512c2dfd5a605b48ca7f107ebe74cd6474a0e54839e3644647d850240b6ee0cd3a1e10039b5e650f3b8c262ed32c5bb4fd8e3e6a0c314b130458ee6e80425220366
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk081716.exeFilesize
176KB
MD52122e22ca2c876dd2dd9108a36641e80
SHA134cb0c804a6b63ac4e0bfe45256481070b14a389
SHA256add26a94d0c22eb7cbcb0590427064caf0ab569bdc1dbde14ad827c5abe2ee32
SHA512c2dfd5a605b48ca7f107ebe74cd6474a0e54839e3644647d850240b6ee0cd3a1e10039b5e650f3b8c262ed32c5bb4fd8e3e6a0c314b130458ee6e80425220366
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un600812.exeFilesize
521KB
MD57b252fbfd6a7f43d83be8354ca7438d1
SHA1c7857c870cc062cc4e3cc519fd5fae21a862ff96
SHA25606baab6986d09b1c06222085470f06df9d3a4f0c1edff62e469bc139fb8f5664
SHA512f4c4e668aefdb146c6857384ccc8920786b8f75135444cb8acf0f13b6e7425ffe4406d69e8d9c5476a7f21d1f7b7813fbbf51cce09d2d8f761d5b03ac038dcfb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un600812.exeFilesize
521KB
MD57b252fbfd6a7f43d83be8354ca7438d1
SHA1c7857c870cc062cc4e3cc519fd5fae21a862ff96
SHA25606baab6986d09b1c06222085470f06df9d3a4f0c1edff62e469bc139fb8f5664
SHA512f4c4e668aefdb146c6857384ccc8920786b8f75135444cb8acf0f13b6e7425ffe4406d69e8d9c5476a7f21d1f7b7813fbbf51cce09d2d8f761d5b03ac038dcfb
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr959922.exeFilesize
239KB
MD517ecaac870836224f2b4b6e67daff86b
SHA18a67f1f001e14188e1a34b7f2dba3ef7faf16b30
SHA2568896522c39c79968fcc5fcf0485e35255066f3330ab61651f724ea0e3e5e308f
SHA51297979fad52633250829ad9425343d41fdf3c1101e8ec92be73583e6c4b5ffaacc6de4d13af891e2b89e46a4081cd6a00c153285b816c3860776c4f4290bbeaeb
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr959922.exeFilesize
239KB
MD517ecaac870836224f2b4b6e67daff86b
SHA18a67f1f001e14188e1a34b7f2dba3ef7faf16b30
SHA2568896522c39c79968fcc5fcf0485e35255066f3330ab61651f724ea0e3e5e308f
SHA51297979fad52633250829ad9425343d41fdf3c1101e8ec92be73583e6c4b5ffaacc6de4d13af891e2b89e46a4081cd6a00c153285b816c3860776c4f4290bbeaeb
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu627963.exeFilesize
297KB
MD58337fadca771b63a5c6e703be968a7f2
SHA11fe615cc430a578dce3b590d6ac28587775dfb44
SHA25620a40968ea07ee5343667b2a7eeedfa79da06811403874876ba97f2a6b822775
SHA5129c12cf9bfe040e0233afc400bde5fed156cf0a15a04192a273f4a245ce2cd704cd73005ee285057bf71ae574de0fed74f3296786f1cdbb30efc70e20631ed0df
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu627963.exeFilesize
297KB
MD58337fadca771b63a5c6e703be968a7f2
SHA11fe615cc430a578dce3b590d6ac28587775dfb44
SHA25620a40968ea07ee5343667b2a7eeedfa79da06811403874876ba97f2a6b822775
SHA5129c12cf9bfe040e0233afc400bde5fed156cf0a15a04192a273f4a245ce2cd704cd73005ee285057bf71ae574de0fed74f3296786f1cdbb30efc70e20631ed0df
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1112-1152-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/1112-1136-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/1160-157-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/1160-174-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1160-180-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1160-182-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1160-184-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1160-186-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1160-187-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/1160-188-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/1160-189-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/1160-190-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/1160-191-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/1160-193-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/1160-176-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1160-178-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1160-172-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1160-170-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1160-168-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1160-166-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1160-164-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1160-162-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1160-160-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1160-159-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1160-158-0x0000000004CA0000-0x0000000005244000-memory.dmpFilesize
5.6MB
-
memory/1160-156-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/1160-155-0x00000000004B0000-0x00000000004DD000-memory.dmpFilesize
180KB
-
memory/2392-211-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/2392-1119-0x00000000064B0000-0x0000000006672000-memory.dmpFilesize
1.8MB
-
memory/2392-227-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/2392-229-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/2392-231-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/2392-348-0x00000000005A0000-0x00000000005EB000-memory.dmpFilesize
300KB
-
memory/2392-349-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/2392-351-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/2392-354-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/2392-1108-0x0000000005220000-0x0000000005838000-memory.dmpFilesize
6.1MB
-
memory/2392-1109-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/2392-1110-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/2392-1111-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/2392-1112-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/2392-1113-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/2392-1114-0x00000000063B0000-0x0000000006442000-memory.dmpFilesize
584KB
-
memory/2392-1116-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/2392-1117-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/2392-1118-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/2392-225-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/2392-1120-0x0000000006690000-0x0000000006BBC000-memory.dmpFilesize
5.2MB
-
memory/2392-1121-0x0000000006E00000-0x0000000006E76000-memory.dmpFilesize
472KB
-
memory/2392-1122-0x0000000006E90000-0x0000000006EE0000-memory.dmpFilesize
320KB
-
memory/2392-1123-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/2392-198-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/2392-199-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/2392-223-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/2392-221-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/2392-219-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/2392-217-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/2392-215-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/2392-213-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/2392-209-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/2392-207-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/2392-205-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/2392-203-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/2392-201-0x0000000004AC0000-0x0000000004AFF000-memory.dmpFilesize
252KB
-
memory/3888-1130-0x0000000005290000-0x00000000052A0000-memory.dmpFilesize
64KB
-
memory/3888-1129-0x00000000009D0000-0x0000000000A02000-memory.dmpFilesize
200KB