Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 21:48
Static task
static1
General
-
Target
332c4e122ff14e826dee46490a9e00b2dbe567fd9d37949db83834a92048c0bc.exe
-
Size
928KB
-
MD5
b628b52602577a3664e9dea6c306600f
-
SHA1
3618276c99511f9e6e63bd6397f804e0bbfb0302
-
SHA256
332c4e122ff14e826dee46490a9e00b2dbe567fd9d37949db83834a92048c0bc
-
SHA512
5883e038402dc0f31b4df195c5bdbff5bfad98456816e82964b047d08ec62fc1a2696bba1468f1da2fb39f324e9613900ca851726a564b12de9795cc8771289a
-
SSDEEP
24576:ayhl69XUGA9F3LVoOJADxxyIfG/1ZtBB6waIa:hu949oOqDaRtryI
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pr060580.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr060580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr060580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr060580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr060580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr060580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr060580.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/3792-199-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline behavioral1/memory/3792-201-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline behavioral1/memory/3792-198-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline behavioral1/memory/3792-203-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline behavioral1/memory/3792-205-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline behavioral1/memory/3792-207-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline behavioral1/memory/3792-210-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline behavioral1/memory/3792-213-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline behavioral1/memory/3792-216-0x0000000004A50000-0x0000000004A60000-memory.dmp family_redline behavioral1/memory/3792-219-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline behavioral1/memory/3792-221-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline behavioral1/memory/3792-217-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline behavioral1/memory/3792-223-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline behavioral1/memory/3792-225-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline behavioral1/memory/3792-227-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline behavioral1/memory/3792-229-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline behavioral1/memory/3792-231-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline behavioral1/memory/3792-233-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline behavioral1/memory/3792-235-0x00000000049D0000-0x0000000004A0F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
si759232.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation si759232.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
Processes:
un533274.exeun171404.exepr060580.exequ641772.exerk218621.exesi759232.exeoneetx.exeoneetx.exepid process 2584 un533274.exe 4940 un171404.exe 4816 pr060580.exe 3792 qu641772.exe 3632 rk218621.exe 2372 si759232.exe 468 oneetx.exe 3696 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1296 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pr060580.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr060580.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr060580.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
332c4e122ff14e826dee46490a9e00b2dbe567fd9d37949db83834a92048c0bc.exeun533274.exeun171404.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 332c4e122ff14e826dee46490a9e00b2dbe567fd9d37949db83834a92048c0bc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 332c4e122ff14e826dee46490a9e00b2dbe567fd9d37949db83834a92048c0bc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un533274.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un533274.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un171404.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un171404.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 29 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4444 4816 WerFault.exe pr060580.exe 4312 3792 WerFault.exe qu641772.exe 3532 2372 WerFault.exe si759232.exe 4240 2372 WerFault.exe si759232.exe 1292 2372 WerFault.exe si759232.exe 1296 2372 WerFault.exe si759232.exe 4756 2372 WerFault.exe si759232.exe 4856 2372 WerFault.exe si759232.exe 620 2372 WerFault.exe si759232.exe 4832 2372 WerFault.exe si759232.exe 4908 2372 WerFault.exe si759232.exe 2044 2372 WerFault.exe si759232.exe 1980 468 WerFault.exe oneetx.exe 3036 468 WerFault.exe oneetx.exe 2220 468 WerFault.exe oneetx.exe 4636 468 WerFault.exe oneetx.exe 632 468 WerFault.exe oneetx.exe 1820 468 WerFault.exe oneetx.exe 2184 468 WerFault.exe oneetx.exe 732 468 WerFault.exe oneetx.exe 4284 468 WerFault.exe oneetx.exe 2996 468 WerFault.exe oneetx.exe 312 468 WerFault.exe oneetx.exe 4564 468 WerFault.exe oneetx.exe 1636 468 WerFault.exe oneetx.exe 4124 3696 WerFault.exe oneetx.exe 2692 468 WerFault.exe oneetx.exe 4172 468 WerFault.exe oneetx.exe 4960 468 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pr060580.exequ641772.exerk218621.exepid process 4816 pr060580.exe 4816 pr060580.exe 3792 qu641772.exe 3792 qu641772.exe 3632 rk218621.exe 3632 rk218621.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pr060580.exequ641772.exerk218621.exedescription pid process Token: SeDebugPrivilege 4816 pr060580.exe Token: SeDebugPrivilege 3792 qu641772.exe Token: SeDebugPrivilege 3632 rk218621.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
si759232.exepid process 2372 si759232.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
332c4e122ff14e826dee46490a9e00b2dbe567fd9d37949db83834a92048c0bc.exeun533274.exeun171404.exesi759232.exeoneetx.exedescription pid process target process PID 4560 wrote to memory of 2584 4560 332c4e122ff14e826dee46490a9e00b2dbe567fd9d37949db83834a92048c0bc.exe un533274.exe PID 4560 wrote to memory of 2584 4560 332c4e122ff14e826dee46490a9e00b2dbe567fd9d37949db83834a92048c0bc.exe un533274.exe PID 4560 wrote to memory of 2584 4560 332c4e122ff14e826dee46490a9e00b2dbe567fd9d37949db83834a92048c0bc.exe un533274.exe PID 2584 wrote to memory of 4940 2584 un533274.exe un171404.exe PID 2584 wrote to memory of 4940 2584 un533274.exe un171404.exe PID 2584 wrote to memory of 4940 2584 un533274.exe un171404.exe PID 4940 wrote to memory of 4816 4940 un171404.exe pr060580.exe PID 4940 wrote to memory of 4816 4940 un171404.exe pr060580.exe PID 4940 wrote to memory of 4816 4940 un171404.exe pr060580.exe PID 4940 wrote to memory of 3792 4940 un171404.exe qu641772.exe PID 4940 wrote to memory of 3792 4940 un171404.exe qu641772.exe PID 4940 wrote to memory of 3792 4940 un171404.exe qu641772.exe PID 2584 wrote to memory of 3632 2584 un533274.exe rk218621.exe PID 2584 wrote to memory of 3632 2584 un533274.exe rk218621.exe PID 2584 wrote to memory of 3632 2584 un533274.exe rk218621.exe PID 4560 wrote to memory of 2372 4560 332c4e122ff14e826dee46490a9e00b2dbe567fd9d37949db83834a92048c0bc.exe si759232.exe PID 4560 wrote to memory of 2372 4560 332c4e122ff14e826dee46490a9e00b2dbe567fd9d37949db83834a92048c0bc.exe si759232.exe PID 4560 wrote to memory of 2372 4560 332c4e122ff14e826dee46490a9e00b2dbe567fd9d37949db83834a92048c0bc.exe si759232.exe PID 2372 wrote to memory of 468 2372 si759232.exe oneetx.exe PID 2372 wrote to memory of 468 2372 si759232.exe oneetx.exe PID 2372 wrote to memory of 468 2372 si759232.exe oneetx.exe PID 468 wrote to memory of 4476 468 oneetx.exe schtasks.exe PID 468 wrote to memory of 4476 468 oneetx.exe schtasks.exe PID 468 wrote to memory of 4476 468 oneetx.exe schtasks.exe PID 468 wrote to memory of 1296 468 oneetx.exe rundll32.exe PID 468 wrote to memory of 1296 468 oneetx.exe rundll32.exe PID 468 wrote to memory of 1296 468 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\332c4e122ff14e826dee46490a9e00b2dbe567fd9d37949db83834a92048c0bc.exe"C:\Users\Admin\AppData\Local\Temp\332c4e122ff14e826dee46490a9e00b2dbe567fd9d37949db83834a92048c0bc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un533274.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un533274.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un171404.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un171404.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr060580.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr060580.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 10805⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu641772.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu641772.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 16965⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk218621.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk218621.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si759232.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si759232.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 7803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 7963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 8043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 9923⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 10163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 12163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 12483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 13123⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 6964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 10044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 10124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 10964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 11084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 10964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 11084⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 8724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 12564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 12764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 10804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 16204⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 15804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 16004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 13563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4816 -ip 48161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3792 -ip 37921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2372 -ip 23721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2372 -ip 23721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2372 -ip 23721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2372 -ip 23721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2372 -ip 23721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2372 -ip 23721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2372 -ip 23721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2372 -ip 23721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2372 -ip 23721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2372 -ip 23721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 468 -ip 4681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 468 -ip 4681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 468 -ip 4681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 468 -ip 4681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 468 -ip 4681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 468 -ip 4681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 468 -ip 4681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 468 -ip 4681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 468 -ip 4681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 468 -ip 4681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 468 -ip 4681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 468 -ip 4681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 468 -ip 4681⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3696 -ip 36961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 468 -ip 4681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 468 -ip 4681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 468 -ip 4681⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si759232.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si759232.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un533274.exeFilesize
663KB
MD5c6b1bb1a94be1ab28606044cb5cd9881
SHA14e2399cb105dd929f7b0d6fcbcfa861f68ea3018
SHA256fdb2fe52eedb2535acfe45bd38df228060e7ad9fbe3bec4c396604245c0e94c3
SHA51238e7d6496dd4368f732728858ae0212f987f12c24fbdf7006ee4db975abfa6c203c866741c22645784fee7ac741452ca93b86d92f07b53acd8a7d26e5fd432fa
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un533274.exeFilesize
663KB
MD5c6b1bb1a94be1ab28606044cb5cd9881
SHA14e2399cb105dd929f7b0d6fcbcfa861f68ea3018
SHA256fdb2fe52eedb2535acfe45bd38df228060e7ad9fbe3bec4c396604245c0e94c3
SHA51238e7d6496dd4368f732728858ae0212f987f12c24fbdf7006ee4db975abfa6c203c866741c22645784fee7ac741452ca93b86d92f07b53acd8a7d26e5fd432fa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk218621.exeFilesize
176KB
MD5177aef522b20ba13bda6d607278eeda5
SHA13c49e975b15771664c9d11ae1bc8942ec3674785
SHA25671870b997863462c60999330fbcf9785b663c0bfec76baf5d561766e90ecee51
SHA5128dcfa933f845b384e2d7069e613a849d8212ca5a8af00d4405d49a58dd026853055eadfd300f56836b79eb84be105f340e349561e3912061ffbb78d2f96c36de
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk218621.exeFilesize
176KB
MD5177aef522b20ba13bda6d607278eeda5
SHA13c49e975b15771664c9d11ae1bc8942ec3674785
SHA25671870b997863462c60999330fbcf9785b663c0bfec76baf5d561766e90ecee51
SHA5128dcfa933f845b384e2d7069e613a849d8212ca5a8af00d4405d49a58dd026853055eadfd300f56836b79eb84be105f340e349561e3912061ffbb78d2f96c36de
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un171404.exeFilesize
521KB
MD538eee5955f1e31e1c9db858aeb68e2ac
SHA181b1ba376239b451b5cc484d6c542811a04938dc
SHA25693f21cfe508c61a707af5b0e9f5f60f6cccac8c8f41362cbe5a25aa2fa9efb73
SHA512c5f80e4253357c2240abe7035aebeb5e68d853ef47e432fa26f20c32ebea32c114a0a508e30491540d98efdbb2dfced8ad7dac9cce6261e9fc87ce3e38ccef93
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un171404.exeFilesize
521KB
MD538eee5955f1e31e1c9db858aeb68e2ac
SHA181b1ba376239b451b5cc484d6c542811a04938dc
SHA25693f21cfe508c61a707af5b0e9f5f60f6cccac8c8f41362cbe5a25aa2fa9efb73
SHA512c5f80e4253357c2240abe7035aebeb5e68d853ef47e432fa26f20c32ebea32c114a0a508e30491540d98efdbb2dfced8ad7dac9cce6261e9fc87ce3e38ccef93
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr060580.exeFilesize
239KB
MD5b86467453fd01765c261b1ebc86ded3e
SHA1dce54a5fc046119068f1ac79fc58ed61baf5ec72
SHA2564c7b10b7a584fa65f3cd77c8ee980517ba7f5779f898f41610fca7009f60579b
SHA512f1e2b31d81823f3747d4c577fc190920dcdf7b7da767c0f76df82ebf8090386fe0a57216fc61f2c10bc7d33f19c93232a748a81c60987b7bb1a078a1f20d14ca
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr060580.exeFilesize
239KB
MD5b86467453fd01765c261b1ebc86ded3e
SHA1dce54a5fc046119068f1ac79fc58ed61baf5ec72
SHA2564c7b10b7a584fa65f3cd77c8ee980517ba7f5779f898f41610fca7009f60579b
SHA512f1e2b31d81823f3747d4c577fc190920dcdf7b7da767c0f76df82ebf8090386fe0a57216fc61f2c10bc7d33f19c93232a748a81c60987b7bb1a078a1f20d14ca
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu641772.exeFilesize
297KB
MD598235184e192404447f023a59324123e
SHA1c7151e5ed78ff2c93a14ede6cafcb5c52c65f324
SHA2567520e78b33dceb3169fa7b5de7fbc96d89961e537008d88009abf12d9937c2a3
SHA5129eedbf62f99254f6637f4386b0ad203f11bbeb158838a1282056e45bbd44e7506ca9197b34ec77ebbdc160ff410f8da33564a3429915bca9c11768d04dc97f4d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu641772.exeFilesize
297KB
MD598235184e192404447f023a59324123e
SHA1c7151e5ed78ff2c93a14ede6cafcb5c52c65f324
SHA2567520e78b33dceb3169fa7b5de7fbc96d89961e537008d88009abf12d9937c2a3
SHA5129eedbf62f99254f6637f4386b0ad203f11bbeb158838a1282056e45bbd44e7506ca9197b34ec77ebbdc160ff410f8da33564a3429915bca9c11768d04dc97f4d
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/2372-1135-0x00000000005C0000-0x00000000005FB000-memory.dmpFilesize
236KB
-
memory/2372-1151-0x00000000005C0000-0x00000000005FB000-memory.dmpFilesize
236KB
-
memory/3632-1129-0x0000000005150000-0x0000000005160000-memory.dmpFilesize
64KB
-
memory/3632-1128-0x0000000000540000-0x0000000000572000-memory.dmpFilesize
200KB
-
memory/3792-1117-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/3792-1108-0x0000000005110000-0x0000000005728000-memory.dmpFilesize
6.1MB
-
memory/3792-1122-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/3792-1121-0x0000000006870000-0x0000000006D9C000-memory.dmpFilesize
5.2MB
-
memory/3792-1120-0x00000000066A0000-0x0000000006862000-memory.dmpFilesize
1.8MB
-
memory/3792-1119-0x0000000006640000-0x0000000006690000-memory.dmpFilesize
320KB
-
memory/3792-1118-0x00000000065B0000-0x0000000006626000-memory.dmpFilesize
472KB
-
memory/3792-1116-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/3792-1115-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/3792-199-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-201-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-198-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-203-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-205-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-207-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-210-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-209-0x00000000005F0000-0x000000000063B000-memory.dmpFilesize
300KB
-
memory/3792-211-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/3792-214-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/3792-213-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-216-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/3792-219-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-221-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-217-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-223-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-225-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-227-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-229-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-231-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-233-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-235-0x00000000049D0000-0x0000000004A0F000-memory.dmpFilesize
252KB
-
memory/3792-1114-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/3792-1109-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/3792-1110-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/3792-1111-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/3792-1112-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/4816-176-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4816-193-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/4816-187-0x0000000002410000-0x0000000002420000-memory.dmpFilesize
64KB
-
memory/4816-184-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4816-174-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4816-192-0x0000000002410000-0x0000000002420000-memory.dmpFilesize
64KB
-
memory/4816-191-0x0000000002410000-0x0000000002420000-memory.dmpFilesize
64KB
-
memory/4816-172-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4816-188-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/4816-182-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4816-180-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4816-178-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4816-186-0x0000000002410000-0x0000000002420000-memory.dmpFilesize
64KB
-
memory/4816-185-0x0000000002410000-0x0000000002420000-memory.dmpFilesize
64KB
-
memory/4816-190-0x0000000002410000-0x0000000002420000-memory.dmpFilesize
64KB
-
memory/4816-170-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4816-168-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4816-162-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4816-164-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4816-166-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4816-160-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4816-158-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4816-157-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4816-156-0x0000000004B00000-0x00000000050A4000-memory.dmpFilesize
5.6MB
-
memory/4816-155-0x0000000000580000-0x00000000005AD000-memory.dmpFilesize
180KB