Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 21:45
Static task
static1
General
-
Target
fcde76a87c5210c91087fa6501de9bf460797116e6371e337c293a2753bf9071.exe
-
Size
928KB
-
MD5
7da8d00a20dca82819db8e2e82883286
-
SHA1
61111549164d4d0df7c88f88e56ae96932837118
-
SHA256
fcde76a87c5210c91087fa6501de9bf460797116e6371e337c293a2753bf9071
-
SHA512
e1af6bb3ecdd82afa6826e5ed2928143373a1742443fc3fdfef01fa11971df0d0aa2ca411a1fa99bcbfd206409fe09a9329b48a85351a72cb0defe9b72392a56
-
SSDEEP
24576:RyqMDFxzCOec3noOmVPTIjPTruRawy1pTn:EqkFxzDoOm9EfAm
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pr308957.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr308957.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr308957.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr308957.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr308957.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr308957.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr308957.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/372-198-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/372-199-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/372-201-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/372-203-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/372-205-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/372-207-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/372-209-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/372-211-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/372-213-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/372-215-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/372-217-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/372-219-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/372-221-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/372-223-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/372-229-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/372-230-0x0000000004B00000-0x0000000004B10000-memory.dmp family_redline behavioral1/memory/372-233-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/372-225-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/372-235-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
si527423.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation si527423.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
un992895.exeun380813.exepr308957.exequ812021.exerk072539.exesi527423.exeoneetx.exeoneetx.exeoneetx.exepid process 2572 un992895.exe 1456 un380813.exe 2628 pr308957.exe 372 qu812021.exe 464 rk072539.exe 3936 si527423.exe 3596 oneetx.exe 3540 oneetx.exe 4996 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4212 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pr308957.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr308957.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr308957.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
un380813.exefcde76a87c5210c91087fa6501de9bf460797116e6371e337c293a2753bf9071.exeun992895.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un380813.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un380813.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fcde76a87c5210c91087fa6501de9bf460797116e6371e337c293a2753bf9071.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fcde76a87c5210c91087fa6501de9bf460797116e6371e337c293a2753bf9071.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un992895.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un992895.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4404 2628 WerFault.exe pr308957.exe 3208 372 WerFault.exe qu812021.exe 940 3936 WerFault.exe si527423.exe 2660 3936 WerFault.exe si527423.exe 4476 3936 WerFault.exe si527423.exe 4504 3936 WerFault.exe si527423.exe 1624 3936 WerFault.exe si527423.exe 3472 3936 WerFault.exe si527423.exe 2892 3936 WerFault.exe si527423.exe 1752 3936 WerFault.exe si527423.exe 1324 3936 WerFault.exe si527423.exe 1248 3936 WerFault.exe si527423.exe 1056 3596 WerFault.exe oneetx.exe 2996 3596 WerFault.exe oneetx.exe 996 3596 WerFault.exe oneetx.exe 428 3596 WerFault.exe oneetx.exe 4524 3596 WerFault.exe oneetx.exe 2532 3596 WerFault.exe oneetx.exe 1636 3596 WerFault.exe oneetx.exe 1260 3596 WerFault.exe oneetx.exe 5100 3596 WerFault.exe oneetx.exe 4984 3596 WerFault.exe oneetx.exe 4616 3596 WerFault.exe oneetx.exe 3712 3596 WerFault.exe oneetx.exe 1596 3540 WerFault.exe oneetx.exe 2984 3596 WerFault.exe oneetx.exe 2724 3596 WerFault.exe oneetx.exe 1240 3596 WerFault.exe oneetx.exe 1232 3596 WerFault.exe oneetx.exe 2036 4996 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pr308957.exequ812021.exerk072539.exepid process 2628 pr308957.exe 2628 pr308957.exe 372 qu812021.exe 372 qu812021.exe 464 rk072539.exe 464 rk072539.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pr308957.exequ812021.exerk072539.exedescription pid process Token: SeDebugPrivilege 2628 pr308957.exe Token: SeDebugPrivilege 372 qu812021.exe Token: SeDebugPrivilege 464 rk072539.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
si527423.exepid process 3936 si527423.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
fcde76a87c5210c91087fa6501de9bf460797116e6371e337c293a2753bf9071.exeun992895.exeun380813.exesi527423.exeoneetx.exedescription pid process target process PID 2128 wrote to memory of 2572 2128 fcde76a87c5210c91087fa6501de9bf460797116e6371e337c293a2753bf9071.exe un992895.exe PID 2128 wrote to memory of 2572 2128 fcde76a87c5210c91087fa6501de9bf460797116e6371e337c293a2753bf9071.exe un992895.exe PID 2128 wrote to memory of 2572 2128 fcde76a87c5210c91087fa6501de9bf460797116e6371e337c293a2753bf9071.exe un992895.exe PID 2572 wrote to memory of 1456 2572 un992895.exe un380813.exe PID 2572 wrote to memory of 1456 2572 un992895.exe un380813.exe PID 2572 wrote to memory of 1456 2572 un992895.exe un380813.exe PID 1456 wrote to memory of 2628 1456 un380813.exe pr308957.exe PID 1456 wrote to memory of 2628 1456 un380813.exe pr308957.exe PID 1456 wrote to memory of 2628 1456 un380813.exe pr308957.exe PID 1456 wrote to memory of 372 1456 un380813.exe qu812021.exe PID 1456 wrote to memory of 372 1456 un380813.exe qu812021.exe PID 1456 wrote to memory of 372 1456 un380813.exe qu812021.exe PID 2572 wrote to memory of 464 2572 un992895.exe rk072539.exe PID 2572 wrote to memory of 464 2572 un992895.exe rk072539.exe PID 2572 wrote to memory of 464 2572 un992895.exe rk072539.exe PID 2128 wrote to memory of 3936 2128 fcde76a87c5210c91087fa6501de9bf460797116e6371e337c293a2753bf9071.exe si527423.exe PID 2128 wrote to memory of 3936 2128 fcde76a87c5210c91087fa6501de9bf460797116e6371e337c293a2753bf9071.exe si527423.exe PID 2128 wrote to memory of 3936 2128 fcde76a87c5210c91087fa6501de9bf460797116e6371e337c293a2753bf9071.exe si527423.exe PID 3936 wrote to memory of 3596 3936 si527423.exe oneetx.exe PID 3936 wrote to memory of 3596 3936 si527423.exe oneetx.exe PID 3936 wrote to memory of 3596 3936 si527423.exe oneetx.exe PID 3596 wrote to memory of 1548 3596 oneetx.exe schtasks.exe PID 3596 wrote to memory of 1548 3596 oneetx.exe schtasks.exe PID 3596 wrote to memory of 1548 3596 oneetx.exe schtasks.exe PID 3596 wrote to memory of 4212 3596 oneetx.exe rundll32.exe PID 3596 wrote to memory of 4212 3596 oneetx.exe rundll32.exe PID 3596 wrote to memory of 4212 3596 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcde76a87c5210c91087fa6501de9bf460797116e6371e337c293a2753bf9071.exe"C:\Users\Admin\AppData\Local\Temp\fcde76a87c5210c91087fa6501de9bf460797116e6371e337c293a2753bf9071.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un992895.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un992895.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un380813.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un380813.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr308957.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr308957.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 10805⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu812021.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu812021.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 13365⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk072539.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk072539.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si527423.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si527423.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 7723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 9523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 9603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 8723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 12083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 12563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 10004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 10804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 11164⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 11524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 10084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 11164⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 7284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 8844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 12964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 11004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 16204⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 11564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 16364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 13643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2628 -ip 26281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 372 -ip 3721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3936 -ip 39361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3936 -ip 39361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3936 -ip 39361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3936 -ip 39361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3936 -ip 39361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3936 -ip 39361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3936 -ip 39361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3936 -ip 39361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3936 -ip 39361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3936 -ip 39361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3596 -ip 35961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3596 -ip 35961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3596 -ip 35961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3596 -ip 35961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3596 -ip 35961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3596 -ip 35961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3596 -ip 35961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3596 -ip 35961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3596 -ip 35961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3596 -ip 35961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3596 -ip 35961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3596 -ip 35961⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 2362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3540 -ip 35401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3596 -ip 35961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3596 -ip 35961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3596 -ip 35961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3596 -ip 35961⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4996 -ip 49961⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si527423.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si527423.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un992895.exeFilesize
663KB
MD5e5e04a736e08a432f20787461471916e
SHA1db63452eb8ca9ff304af4c57f27cf2b971ef25d9
SHA2562765d13bfbd7d1165edbdfd9c082c48b6dc2d514dddd2e03a2d2bacd4807407a
SHA512d6bac24330103a8472f305130163afc4f1c87064fce318b678383125eb2fa0d545486e412107e414f5a1096466acfa484f75389b48b70b544f63f7a7e01b9aff
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un992895.exeFilesize
663KB
MD5e5e04a736e08a432f20787461471916e
SHA1db63452eb8ca9ff304af4c57f27cf2b971ef25d9
SHA2562765d13bfbd7d1165edbdfd9c082c48b6dc2d514dddd2e03a2d2bacd4807407a
SHA512d6bac24330103a8472f305130163afc4f1c87064fce318b678383125eb2fa0d545486e412107e414f5a1096466acfa484f75389b48b70b544f63f7a7e01b9aff
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk072539.exeFilesize
176KB
MD5f64ef62f76512d3b08712ea7cc513af0
SHA15046ad641d23abf5a33f259c31a04f707d0d491a
SHA256924cfe264f58165de5a08f06c2760acb3fb7995c27502d29cac7a42c96721252
SHA512a1de9f61b89ad014f983d8a078180c8fdff9a193587a19bbd937c864796328c409ff833e59c577d1161c84084d481c165fa827686953785537be5cb7af1d245b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk072539.exeFilesize
176KB
MD5f64ef62f76512d3b08712ea7cc513af0
SHA15046ad641d23abf5a33f259c31a04f707d0d491a
SHA256924cfe264f58165de5a08f06c2760acb3fb7995c27502d29cac7a42c96721252
SHA512a1de9f61b89ad014f983d8a078180c8fdff9a193587a19bbd937c864796328c409ff833e59c577d1161c84084d481c165fa827686953785537be5cb7af1d245b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un380813.exeFilesize
521KB
MD51c77282d9ff9f7077cd9519e5605d171
SHA18bc4c743d299d27b074a59fcd1a7716ca5caf62a
SHA2564f24c8ff8d50edc33d0e259d57c6d2fbe0b2e69713b9ee947ed12a5f8fa061f0
SHA51231672fc23fddf1445f092ae47baa588ce95b1362e858ec9d263963eecaf67a3c52f3f743599cf809da6d859b313b1b7248559655d65e4de1f5d91af0c3c8e96f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un380813.exeFilesize
521KB
MD51c77282d9ff9f7077cd9519e5605d171
SHA18bc4c743d299d27b074a59fcd1a7716ca5caf62a
SHA2564f24c8ff8d50edc33d0e259d57c6d2fbe0b2e69713b9ee947ed12a5f8fa061f0
SHA51231672fc23fddf1445f092ae47baa588ce95b1362e858ec9d263963eecaf67a3c52f3f743599cf809da6d859b313b1b7248559655d65e4de1f5d91af0c3c8e96f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr308957.exeFilesize
239KB
MD5333ee5ecd5bb7658078e1e034143f46e
SHA1a07853149835fc7fa6aa1991a276cef01382aa8d
SHA2566249a18f04f1dd82137b4f85ecebbbf8a5b5f322f3e0e230338090d1fbb34c43
SHA5121f37869991e9da214ce8de842e6d697071a824ca1b823aef958eb61e42048747d5e648df2329acb85844eb4ab06f5a2bb63c8d1d0a25f6df93520fab7efc4dc0
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr308957.exeFilesize
239KB
MD5333ee5ecd5bb7658078e1e034143f46e
SHA1a07853149835fc7fa6aa1991a276cef01382aa8d
SHA2566249a18f04f1dd82137b4f85ecebbbf8a5b5f322f3e0e230338090d1fbb34c43
SHA5121f37869991e9da214ce8de842e6d697071a824ca1b823aef958eb61e42048747d5e648df2329acb85844eb4ab06f5a2bb63c8d1d0a25f6df93520fab7efc4dc0
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu812021.exeFilesize
297KB
MD52eba91d4c8909eb5638a73b8489ec9eb
SHA18ff716da1f18e4d2419f00c3560ef2078a659d90
SHA256072eb510b99577e368eb14cc1b78667ace1f5e761468d01274df754bf939a028
SHA51216393c8c12d97a0092513d306a2911d6212f755bb09ba33e18d46e59834f907ec84b49896ca47f930b800ef27b379c98d82d2fcff9ed0d397e66ca0c031a76bf
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu812021.exeFilesize
297KB
MD52eba91d4c8909eb5638a73b8489ec9eb
SHA18ff716da1f18e4d2419f00c3560ef2078a659d90
SHA256072eb510b99577e368eb14cc1b78667ace1f5e761468d01274df754bf939a028
SHA51216393c8c12d97a0092513d306a2911d6212f755bb09ba33e18d46e59834f907ec84b49896ca47f930b800ef27b379c98d82d2fcff9ed0d397e66ca0c031a76bf
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/372-1117-0x00000000063E0000-0x0000000006430000-memory.dmpFilesize
320KB
-
memory/372-235-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-1123-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/372-1122-0x0000000006770000-0x0000000006C9C000-memory.dmpFilesize
5.2MB
-
memory/372-1121-0x0000000006560000-0x0000000006722000-memory.dmpFilesize
1.8MB
-
memory/372-1120-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/372-1119-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/372-1118-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/372-1116-0x0000000006350000-0x00000000063C6000-memory.dmpFilesize
472KB
-
memory/372-1114-0x0000000006260000-0x00000000062F2000-memory.dmpFilesize
584KB
-
memory/372-1113-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/372-1112-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/372-198-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-199-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-201-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-203-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-205-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-207-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-209-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-211-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-213-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-215-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-217-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-219-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-221-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-223-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-228-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/372-229-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-230-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/372-232-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/372-233-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-226-0x00000000004C0000-0x000000000050B000-memory.dmpFilesize
300KB
-
memory/372-225-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/372-1111-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/372-1108-0x00000000050C0000-0x00000000056D8000-memory.dmpFilesize
6.1MB
-
memory/372-1109-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/372-1110-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/464-1129-0x0000000000CE0000-0x0000000000D12000-memory.dmpFilesize
200KB
-
memory/464-1130-0x00000000058E0000-0x00000000058F0000-memory.dmpFilesize
64KB
-
memory/2628-190-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/2628-155-0x00000000005A0000-0x00000000005CD000-memory.dmpFilesize
180KB
-
memory/2628-182-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2628-178-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2628-191-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/2628-184-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2628-188-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2628-187-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/2628-186-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/2628-185-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/2628-176-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2628-174-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2628-192-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/2628-193-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2628-162-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2628-170-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2628-180-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2628-168-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2628-166-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2628-164-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2628-156-0x0000000004BC0000-0x0000000005164000-memory.dmpFilesize
5.6MB
-
memory/2628-172-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2628-160-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2628-158-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2628-157-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/3936-1152-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB
-
memory/3936-1136-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB