Analysis
-
max time kernel
141s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 21:47
Static task
static1
General
-
Target
095794eae57eb66aec26134523c2a2ce4e098fcc2215324922efb0044b740672.exe
-
Size
789KB
-
MD5
f54658c785fe7cc92aaf562e9d3b6aa8
-
SHA1
ac46562db30fffe871056bdec8148c3263de8ea0
-
SHA256
095794eae57eb66aec26134523c2a2ce4e098fcc2215324922efb0044b740672
-
SHA512
2b52f2b4317506f0566832a1d2135d6b7d880ebad23d466e26ca88a39e672aaf2b8805439d932899c3fbfb7e897e9d42ca1f9792b74d394a9817a0aeb1f00193
-
SSDEEP
12288:fMrvy90+oxHUCsc3cFHIqQr+ojN+xK7CRlgHMCct3NLtLv2vAwlx5ue:wyXTw3xAxf8HM3NLdGx5ue
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
it774751.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it774751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it774751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it774751.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it774751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it774751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it774751.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/3120-162-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-163-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-165-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-167-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-169-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-171-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-173-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-176-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-179-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-182-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-184-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-186-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-188-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-190-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-192-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-194-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-196-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-198-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-200-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-202-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-204-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-206-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-208-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-210-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-212-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-214-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-216-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-218-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-220-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-222-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-224-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-226-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3120-228-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
oneetx.exelr552107.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation oneetx.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation lr552107.exe -
Executes dropped EXE 8 IoCs
Processes:
zint9818.exeziOW1164.exeit774751.exejr884400.exekp486033.exelr552107.exeoneetx.exeoneetx.exepid process 4108 zint9818.exe 2172 ziOW1164.exe 2496 it774751.exe 3120 jr884400.exe 3704 kp486033.exe 928 lr552107.exe 3636 oneetx.exe 4832 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3532 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it774751.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it774751.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
095794eae57eb66aec26134523c2a2ce4e098fcc2215324922efb0044b740672.exezint9818.exeziOW1164.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 095794eae57eb66aec26134523c2a2ce4e098fcc2215324922efb0044b740672.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zint9818.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zint9818.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziOW1164.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ziOW1164.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 095794eae57eb66aec26134523c2a2ce4e098fcc2215324922efb0044b740672.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 28 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4948 3120 WerFault.exe jr884400.exe 4236 928 WerFault.exe lr552107.exe 3068 928 WerFault.exe lr552107.exe 4888 928 WerFault.exe lr552107.exe 800 928 WerFault.exe lr552107.exe 4484 928 WerFault.exe lr552107.exe 4916 928 WerFault.exe lr552107.exe 1672 928 WerFault.exe lr552107.exe 4504 928 WerFault.exe lr552107.exe 5096 928 WerFault.exe lr552107.exe 4080 928 WerFault.exe lr552107.exe 3744 3636 WerFault.exe oneetx.exe 4624 3636 WerFault.exe oneetx.exe 4696 3636 WerFault.exe oneetx.exe 4164 3636 WerFault.exe oneetx.exe 3836 3636 WerFault.exe oneetx.exe 1292 3636 WerFault.exe oneetx.exe 1568 3636 WerFault.exe oneetx.exe 1416 3636 WerFault.exe oneetx.exe 3208 3636 WerFault.exe oneetx.exe 4684 3636 WerFault.exe oneetx.exe 3916 3636 WerFault.exe oneetx.exe 736 3636 WerFault.exe oneetx.exe 3672 3636 WerFault.exe oneetx.exe 4312 3636 WerFault.exe oneetx.exe 4404 3636 WerFault.exe oneetx.exe 2572 4832 WerFault.exe oneetx.exe 2784 3636 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it774751.exejr884400.exekp486033.exepid process 2496 it774751.exe 2496 it774751.exe 3120 jr884400.exe 3120 jr884400.exe 3704 kp486033.exe 3704 kp486033.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it774751.exejr884400.exekp486033.exedescription pid process Token: SeDebugPrivilege 2496 it774751.exe Token: SeDebugPrivilege 3120 jr884400.exe Token: SeDebugPrivilege 3704 kp486033.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr552107.exepid process 928 lr552107.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
095794eae57eb66aec26134523c2a2ce4e098fcc2215324922efb0044b740672.exezint9818.exeziOW1164.exelr552107.exeoneetx.exedescription pid process target process PID 4284 wrote to memory of 4108 4284 095794eae57eb66aec26134523c2a2ce4e098fcc2215324922efb0044b740672.exe zint9818.exe PID 4284 wrote to memory of 4108 4284 095794eae57eb66aec26134523c2a2ce4e098fcc2215324922efb0044b740672.exe zint9818.exe PID 4284 wrote to memory of 4108 4284 095794eae57eb66aec26134523c2a2ce4e098fcc2215324922efb0044b740672.exe zint9818.exe PID 4108 wrote to memory of 2172 4108 zint9818.exe ziOW1164.exe PID 4108 wrote to memory of 2172 4108 zint9818.exe ziOW1164.exe PID 4108 wrote to memory of 2172 4108 zint9818.exe ziOW1164.exe PID 2172 wrote to memory of 2496 2172 ziOW1164.exe it774751.exe PID 2172 wrote to memory of 2496 2172 ziOW1164.exe it774751.exe PID 2172 wrote to memory of 3120 2172 ziOW1164.exe jr884400.exe PID 2172 wrote to memory of 3120 2172 ziOW1164.exe jr884400.exe PID 2172 wrote to memory of 3120 2172 ziOW1164.exe jr884400.exe PID 4108 wrote to memory of 3704 4108 zint9818.exe kp486033.exe PID 4108 wrote to memory of 3704 4108 zint9818.exe kp486033.exe PID 4108 wrote to memory of 3704 4108 zint9818.exe kp486033.exe PID 4284 wrote to memory of 928 4284 095794eae57eb66aec26134523c2a2ce4e098fcc2215324922efb0044b740672.exe lr552107.exe PID 4284 wrote to memory of 928 4284 095794eae57eb66aec26134523c2a2ce4e098fcc2215324922efb0044b740672.exe lr552107.exe PID 4284 wrote to memory of 928 4284 095794eae57eb66aec26134523c2a2ce4e098fcc2215324922efb0044b740672.exe lr552107.exe PID 928 wrote to memory of 3636 928 lr552107.exe oneetx.exe PID 928 wrote to memory of 3636 928 lr552107.exe oneetx.exe PID 928 wrote to memory of 3636 928 lr552107.exe oneetx.exe PID 3636 wrote to memory of 3148 3636 oneetx.exe schtasks.exe PID 3636 wrote to memory of 3148 3636 oneetx.exe schtasks.exe PID 3636 wrote to memory of 3148 3636 oneetx.exe schtasks.exe PID 3636 wrote to memory of 3532 3636 oneetx.exe rundll32.exe PID 3636 wrote to memory of 3532 3636 oneetx.exe rundll32.exe PID 3636 wrote to memory of 3532 3636 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\095794eae57eb66aec26134523c2a2ce4e098fcc2215324922efb0044b740672.exe"C:\Users\Admin\AppData\Local\Temp\095794eae57eb66aec26134523c2a2ce4e098fcc2215324922efb0044b740672.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zint9818.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zint9818.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziOW1164.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziOW1164.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it774751.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it774751.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr884400.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr884400.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 13365⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp486033.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp486033.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr552107.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr552107.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 7043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 7723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 9603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 9483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 9843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 12203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 12043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 12923⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 8444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 8684⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 10604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 11084⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 8844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 7804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 15284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 11364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 15404⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 15884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 16444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 14283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3120 -ip 31201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 928 -ip 9281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 928 -ip 9281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 928 -ip 9281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 928 -ip 9281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 928 -ip 9281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 928 -ip 9281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 928 -ip 9281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 928 -ip 9281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 928 -ip 9281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 928 -ip 9281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3636 -ip 36361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3636 -ip 36361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3636 -ip 36361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3636 -ip 36361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3636 -ip 36361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3636 -ip 36361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3636 -ip 36361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3636 -ip 36361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3636 -ip 36361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3636 -ip 36361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3636 -ip 36361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3636 -ip 36361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3636 -ip 36361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3636 -ip 36361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3636 -ip 36361⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 3122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4832 -ip 48321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3636 -ip 36361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr552107.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr552107.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zint9818.exeFilesize
524KB
MD5cd90570a30cdda01ecc27b7f72b2a050
SHA11ce33801933c5917f2dcee6e0fd31c284ddb2916
SHA2566f9968645487ee1f28dfd3a1f30be9d030a846786a877520a455696805f9f17e
SHA51240092b5678fe9a7b2889bce594705d46358c2e8547e97fda26d35932bf9d8137ae23a91e607ba537d7957850deed65eb1f829f6e6f849ae38369a36b686b2fc5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zint9818.exeFilesize
524KB
MD5cd90570a30cdda01ecc27b7f72b2a050
SHA11ce33801933c5917f2dcee6e0fd31c284ddb2916
SHA2566f9968645487ee1f28dfd3a1f30be9d030a846786a877520a455696805f9f17e
SHA51240092b5678fe9a7b2889bce594705d46358c2e8547e97fda26d35932bf9d8137ae23a91e607ba537d7957850deed65eb1f829f6e6f849ae38369a36b686b2fc5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp486033.exeFilesize
176KB
MD5dfb87ed0aad0736ef720b8b4eef778c6
SHA18e8b72ab204a15a04edea560260980f39a3a10f9
SHA256be6065524e3de80c93390a1e5dc2ff2cd8b541e602f4f97c8b27076184c854c8
SHA512a8a0915fd86e80ebd4c0ba9816710f25d5d483ce44019bb7e8b50b05254b433d2d0d7157a0510e12d9a6b5a403e6e2ccf0ffaae7c7e1b478df92e3d6ece4e667
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp486033.exeFilesize
176KB
MD5dfb87ed0aad0736ef720b8b4eef778c6
SHA18e8b72ab204a15a04edea560260980f39a3a10f9
SHA256be6065524e3de80c93390a1e5dc2ff2cd8b541e602f4f97c8b27076184c854c8
SHA512a8a0915fd86e80ebd4c0ba9816710f25d5d483ce44019bb7e8b50b05254b433d2d0d7157a0510e12d9a6b5a403e6e2ccf0ffaae7c7e1b478df92e3d6ece4e667
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziOW1164.exeFilesize
382KB
MD5c4a08acae0de1b0c4f812b295818f0a8
SHA1edd583b745e23231172ffa13c63413117ebd510a
SHA2560c79b5bd0ae5ed54cdd599f1023a9b98bd47e95bbc0588db1f807e899ac02cca
SHA512811f749b2a05268d708c2776feb5a71173ca4bc8477aa1c2a7ab96b1e288f1d3b5ae151b587d05dd77564ea33480cd400132e09b72d6e3c48d9387f4833285cd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziOW1164.exeFilesize
382KB
MD5c4a08acae0de1b0c4f812b295818f0a8
SHA1edd583b745e23231172ffa13c63413117ebd510a
SHA2560c79b5bd0ae5ed54cdd599f1023a9b98bd47e95bbc0588db1f807e899ac02cca
SHA512811f749b2a05268d708c2776feb5a71173ca4bc8477aa1c2a7ab96b1e288f1d3b5ae151b587d05dd77564ea33480cd400132e09b72d6e3c48d9387f4833285cd
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it774751.exeFilesize
11KB
MD567fa991e464adb0cbe6c4c01090ebf8d
SHA15e1b375b08191834298fd3c669e1b66d9a8dfc96
SHA2566f9f7a745538518d1f3909b8717dcff1b63f3267803dfc8acd15077265a9e6f6
SHA512e810061e11b3b21fee8b6d624190fb4ae6a17a802bcf669fd6553233210e37df46a1e42d393839032fe530c1c05bb6c1ae3aa1b85adbf8e01464a0f18a86f5f8
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it774751.exeFilesize
11KB
MD567fa991e464adb0cbe6c4c01090ebf8d
SHA15e1b375b08191834298fd3c669e1b66d9a8dfc96
SHA2566f9f7a745538518d1f3909b8717dcff1b63f3267803dfc8acd15077265a9e6f6
SHA512e810061e11b3b21fee8b6d624190fb4ae6a17a802bcf669fd6553233210e37df46a1e42d393839032fe530c1c05bb6c1ae3aa1b85adbf8e01464a0f18a86f5f8
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr884400.exeFilesize
297KB
MD5dc61dfbe214a1317f9a0bb0242555bd2
SHA1d36e152479db646e82db1c8d543660a8e5b4315a
SHA256d15053a70b71618f702b5757a519ddf62d2ff77c7341621fb9b709d3482ea4ce
SHA5125bf9f08ab1c28185dd6def085f0134b0d81f169aa476bb35251ed998a527dd8959125250f00515886b12ea5a61c5830eb2f94f7f02fa8197f2ac06db4a6bce77
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr884400.exeFilesize
297KB
MD5dc61dfbe214a1317f9a0bb0242555bd2
SHA1d36e152479db646e82db1c8d543660a8e5b4315a
SHA256d15053a70b71618f702b5757a519ddf62d2ff77c7341621fb9b709d3482ea4ce
SHA5125bf9f08ab1c28185dd6def085f0134b0d81f169aa476bb35251ed998a527dd8959125250f00515886b12ea5a61c5830eb2f94f7f02fa8197f2ac06db4a6bce77
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/928-1116-0x00000000005B0000-0x00000000005EB000-memory.dmpFilesize
236KB
-
memory/928-1100-0x00000000005B0000-0x00000000005EB000-memory.dmpFilesize
236KB
-
memory/2496-154-0x0000000000CB0000-0x0000000000CBA000-memory.dmpFilesize
40KB
-
memory/3120-204-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-228-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-179-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-180-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/3120-182-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-184-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-186-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-188-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-190-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-192-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-194-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-196-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-198-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-200-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-202-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-177-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/3120-206-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-208-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-210-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-212-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-214-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-216-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-218-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-220-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-222-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-224-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-226-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-176-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-1071-0x0000000005270000-0x0000000005888000-memory.dmpFilesize
6.1MB
-
memory/3120-1072-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/3120-1073-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/3120-1074-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/3120-1075-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/3120-1079-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/3120-1078-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/3120-1080-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/3120-1077-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/3120-1081-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/3120-1082-0x0000000006830000-0x00000000069F2000-memory.dmpFilesize
1.8MB
-
memory/3120-1083-0x0000000006A10000-0x0000000006F3C000-memory.dmpFilesize
5.2MB
-
memory/3120-1084-0x0000000008200000-0x0000000008276000-memory.dmpFilesize
472KB
-
memory/3120-1085-0x00000000082A0000-0x00000000082F0000-memory.dmpFilesize
320KB
-
memory/3120-1086-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/3120-160-0x0000000001E80000-0x0000000001ECB000-memory.dmpFilesize
300KB
-
memory/3120-175-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/3120-173-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-171-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-169-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-167-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-165-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-163-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-162-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3120-161-0x0000000004BC0000-0x0000000005164000-memory.dmpFilesize
5.6MB
-
memory/3704-1092-0x0000000000900000-0x0000000000932000-memory.dmpFilesize
200KB
-
memory/3704-1093-0x0000000005480000-0x0000000005490000-memory.dmpFilesize
64KB
-
memory/3704-1094-0x0000000005480000-0x0000000005490000-memory.dmpFilesize
64KB