Analysis
-
max time kernel
140s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 21:49
Static task
static1
General
-
Target
75beaeb3f464063ab79d4639dd9d9fe9b5b05eb7e74ef0cd1f308363522a71d8.exe
-
Size
927KB
-
MD5
702370c98d318fa3ceb65f9aae84e857
-
SHA1
e90dc966332bb0f50d69989d9b16db5783da39ce
-
SHA256
75beaeb3f464063ab79d4639dd9d9fe9b5b05eb7e74ef0cd1f308363522a71d8
-
SHA512
9f0b32726c0eaf3856164ef99fdae56e0b12a0197432261c4d253dc76ed673b1959ad4ce127f3103a4c0c9aa6ac51b21dd5f6bf6b603aeb370fef82e598e67ca
-
SSDEEP
24576:/y0AtC9WdDZzrBbq9jAixifRWISLWQOchgwnbsHHUOOOq:K0AiW9/2jvxisbWJVQqU8
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pr600771.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr600771.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr600771.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr600771.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr600771.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr600771.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr600771.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2516-198-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2516-201-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2516-199-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2516-203-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2516-205-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2516-207-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2516-209-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2516-211-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2516-213-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2516-215-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2516-217-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2516-219-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2516-221-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2516-223-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2516-225-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2516-227-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2516-229-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2516-231-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
si972831.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation si972831.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
un903391.exeun823713.exepr600771.exequ582759.exerk429699.exesi972831.exeoneetx.exeoneetx.exeoneetx.exepid process 4896 un903391.exe 572 un823713.exe 676 pr600771.exe 2516 qu582759.exe 560 rk429699.exe 1788 si972831.exe 348 oneetx.exe 4660 oneetx.exe 2132 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3408 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pr600771.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr600771.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr600771.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
un903391.exeun823713.exe75beaeb3f464063ab79d4639dd9d9fe9b5b05eb7e74ef0cd1f308363522a71d8.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un903391.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un903391.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un823713.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un823713.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 75beaeb3f464063ab79d4639dd9d9fe9b5b05eb7e74ef0cd1f308363522a71d8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 75beaeb3f464063ab79d4639dd9d9fe9b5b05eb7e74ef0cd1f308363522a71d8.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 404 676 WerFault.exe pr600771.exe 4640 2516 WerFault.exe qu582759.exe 1568 1788 WerFault.exe si972831.exe 820 1788 WerFault.exe si972831.exe 3396 1788 WerFault.exe si972831.exe 4728 1788 WerFault.exe si972831.exe 4600 1788 WerFault.exe si972831.exe 1340 1788 WerFault.exe si972831.exe 2144 1788 WerFault.exe si972831.exe 4732 1788 WerFault.exe si972831.exe 1200 1788 WerFault.exe si972831.exe 1288 1788 WerFault.exe si972831.exe 3336 348 WerFault.exe oneetx.exe 1516 348 WerFault.exe oneetx.exe 1888 348 WerFault.exe oneetx.exe 3912 348 WerFault.exe oneetx.exe 2036 348 WerFault.exe oneetx.exe 4844 348 WerFault.exe oneetx.exe 4968 348 WerFault.exe oneetx.exe 3348 348 WerFault.exe oneetx.exe 2060 348 WerFault.exe oneetx.exe 1132 348 WerFault.exe oneetx.exe 3296 348 WerFault.exe oneetx.exe 4496 348 WerFault.exe oneetx.exe 2904 4660 WerFault.exe oneetx.exe 4448 348 WerFault.exe oneetx.exe 4596 348 WerFault.exe oneetx.exe 4648 348 WerFault.exe oneetx.exe 4132 2132 WerFault.exe oneetx.exe 3944 348 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pr600771.exequ582759.exerk429699.exepid process 676 pr600771.exe 676 pr600771.exe 2516 qu582759.exe 2516 qu582759.exe 560 rk429699.exe 560 rk429699.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pr600771.exequ582759.exerk429699.exedescription pid process Token: SeDebugPrivilege 676 pr600771.exe Token: SeDebugPrivilege 2516 qu582759.exe Token: SeDebugPrivilege 560 rk429699.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
si972831.exepid process 1788 si972831.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
75beaeb3f464063ab79d4639dd9d9fe9b5b05eb7e74ef0cd1f308363522a71d8.exeun903391.exeun823713.exesi972831.exeoneetx.exedescription pid process target process PID 4996 wrote to memory of 4896 4996 75beaeb3f464063ab79d4639dd9d9fe9b5b05eb7e74ef0cd1f308363522a71d8.exe un903391.exe PID 4996 wrote to memory of 4896 4996 75beaeb3f464063ab79d4639dd9d9fe9b5b05eb7e74ef0cd1f308363522a71d8.exe un903391.exe PID 4996 wrote to memory of 4896 4996 75beaeb3f464063ab79d4639dd9d9fe9b5b05eb7e74ef0cd1f308363522a71d8.exe un903391.exe PID 4896 wrote to memory of 572 4896 un903391.exe un823713.exe PID 4896 wrote to memory of 572 4896 un903391.exe un823713.exe PID 4896 wrote to memory of 572 4896 un903391.exe un823713.exe PID 572 wrote to memory of 676 572 un823713.exe pr600771.exe PID 572 wrote to memory of 676 572 un823713.exe pr600771.exe PID 572 wrote to memory of 676 572 un823713.exe pr600771.exe PID 572 wrote to memory of 2516 572 un823713.exe qu582759.exe PID 572 wrote to memory of 2516 572 un823713.exe qu582759.exe PID 572 wrote to memory of 2516 572 un823713.exe qu582759.exe PID 4896 wrote to memory of 560 4896 un903391.exe rk429699.exe PID 4896 wrote to memory of 560 4896 un903391.exe rk429699.exe PID 4896 wrote to memory of 560 4896 un903391.exe rk429699.exe PID 4996 wrote to memory of 1788 4996 75beaeb3f464063ab79d4639dd9d9fe9b5b05eb7e74ef0cd1f308363522a71d8.exe si972831.exe PID 4996 wrote to memory of 1788 4996 75beaeb3f464063ab79d4639dd9d9fe9b5b05eb7e74ef0cd1f308363522a71d8.exe si972831.exe PID 4996 wrote to memory of 1788 4996 75beaeb3f464063ab79d4639dd9d9fe9b5b05eb7e74ef0cd1f308363522a71d8.exe si972831.exe PID 1788 wrote to memory of 348 1788 si972831.exe oneetx.exe PID 1788 wrote to memory of 348 1788 si972831.exe oneetx.exe PID 1788 wrote to memory of 348 1788 si972831.exe oneetx.exe PID 348 wrote to memory of 4640 348 oneetx.exe schtasks.exe PID 348 wrote to memory of 4640 348 oneetx.exe schtasks.exe PID 348 wrote to memory of 4640 348 oneetx.exe schtasks.exe PID 348 wrote to memory of 3408 348 oneetx.exe rundll32.exe PID 348 wrote to memory of 3408 348 oneetx.exe rundll32.exe PID 348 wrote to memory of 3408 348 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75beaeb3f464063ab79d4639dd9d9fe9b5b05eb7e74ef0cd1f308363522a71d8.exe"C:\Users\Admin\AppData\Local\Temp\75beaeb3f464063ab79d4639dd9d9fe9b5b05eb7e74ef0cd1f308363522a71d8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un903391.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un903391.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un823713.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un823713.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr600771.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr600771.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 676 -s 10285⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu582759.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu582759.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 16765⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk429699.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk429699.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si972831.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si972831.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 7523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 9603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 9763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 9723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 12203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 12363⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 7004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 9004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 10124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 10204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 10964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 10964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 11084⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 10004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 12884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 13044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 7444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 15324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 10924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 16204⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 15764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 16364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 7563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 676 -ip 6761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2516 -ip 25161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1788 -ip 17881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1788 -ip 17881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1788 -ip 17881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1788 -ip 17881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1788 -ip 17881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1788 -ip 17881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1788 -ip 17881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1788 -ip 17881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1788 -ip 17881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1788 -ip 17881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 348 -ip 3481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 348 -ip 3481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 348 -ip 3481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 348 -ip 3481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 348 -ip 3481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 348 -ip 3481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 348 -ip 3481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 348 -ip 3481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 348 -ip 3481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 348 -ip 3481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 348 -ip 3481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 348 -ip 3481⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 3162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4660 -ip 46601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 348 -ip 3481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 348 -ip 3481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 348 -ip 3481⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 3122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2132 -ip 21321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 348 -ip 3481⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si972831.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si972831.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un903391.exeFilesize
662KB
MD515bf2b2317fdb69c0cfd95be63b6bc11
SHA1d9cac78abc751fada79d5e3986d64c67b89da09e
SHA256326e2730b506c8b6082ef2db8fff0fc3f6faac4ca66ac17da22b5a91fd4de5f0
SHA512f7fe14a3eb92d3b64837b73934be7ab0c1f23f6d57e942d45d0216ccfa0ca77a246d55b88085fc48aee54d7b641a96ae3795547ad8d88e51cf0f23f79ca7e812
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un903391.exeFilesize
662KB
MD515bf2b2317fdb69c0cfd95be63b6bc11
SHA1d9cac78abc751fada79d5e3986d64c67b89da09e
SHA256326e2730b506c8b6082ef2db8fff0fc3f6faac4ca66ac17da22b5a91fd4de5f0
SHA512f7fe14a3eb92d3b64837b73934be7ab0c1f23f6d57e942d45d0216ccfa0ca77a246d55b88085fc48aee54d7b641a96ae3795547ad8d88e51cf0f23f79ca7e812
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk429699.exeFilesize
176KB
MD5c9dbf251c0d1975f37d4fa4c52503b0a
SHA1aaa6b33f92f8a17ce63f9e8e27f7e5389e020bf2
SHA256275292c174c55f9326bf3a3ac6ba66e6c3e27249138c50fc90fefc142ebefa09
SHA51286c5121d2f61b53de3741ac960f2862b1ef04472897295137f8a543c57ee0c8561456a468022611f91644a408eecfcea8200d6123144d1e82004ed11885a22dd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk429699.exeFilesize
176KB
MD5c9dbf251c0d1975f37d4fa4c52503b0a
SHA1aaa6b33f92f8a17ce63f9e8e27f7e5389e020bf2
SHA256275292c174c55f9326bf3a3ac6ba66e6c3e27249138c50fc90fefc142ebefa09
SHA51286c5121d2f61b53de3741ac960f2862b1ef04472897295137f8a543c57ee0c8561456a468022611f91644a408eecfcea8200d6123144d1e82004ed11885a22dd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un823713.exeFilesize
520KB
MD5821cd111760ce69225072c02a86fb842
SHA1b1e7dc9e325bc753501464abd19c308657974d57
SHA25688d8e66cbc3876d047d674439a518417313c5cb9f9e64c8b4a0fc241cd10d693
SHA51265aecfb9a272cfdec83c448055b3abb3742e426d734ef07aebd4627f68320ccb87d0b0b169ee0277c9682c05708f910eaa89b102542bbd5c6347d5c34efbeb3a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un823713.exeFilesize
520KB
MD5821cd111760ce69225072c02a86fb842
SHA1b1e7dc9e325bc753501464abd19c308657974d57
SHA25688d8e66cbc3876d047d674439a518417313c5cb9f9e64c8b4a0fc241cd10d693
SHA51265aecfb9a272cfdec83c448055b3abb3742e426d734ef07aebd4627f68320ccb87d0b0b169ee0277c9682c05708f910eaa89b102542bbd5c6347d5c34efbeb3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr600771.exeFilesize
239KB
MD55da8e076c6e5f942cf5febef4efebb6f
SHA17b517cfcb9d073dd0496141f878e3d6611771136
SHA256144dd98ac12f3373ede58c44225983ddd7591f49a6e149f79b7a78c6a54510d5
SHA5120afc6ce533f8fda7fbd1bde0d37b032332e0b54c28ff990dd4142f8179f2988d0919abb2e9f354ee936d1feed23ba89ea657dbfcd2bdbb0e1bafe5446cfa1e10
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr600771.exeFilesize
239KB
MD55da8e076c6e5f942cf5febef4efebb6f
SHA17b517cfcb9d073dd0496141f878e3d6611771136
SHA256144dd98ac12f3373ede58c44225983ddd7591f49a6e149f79b7a78c6a54510d5
SHA5120afc6ce533f8fda7fbd1bde0d37b032332e0b54c28ff990dd4142f8179f2988d0919abb2e9f354ee936d1feed23ba89ea657dbfcd2bdbb0e1bafe5446cfa1e10
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu582759.exeFilesize
297KB
MD503c207945146f044efd2bb34c211dc5b
SHA1cafee6609265dfdca8024d5dd4bbe1b26ea70517
SHA2568a20e4d13a72cabb1e0b1b7a466b0ce7fd1f5a9e1cd9ff8f2ec1bde04c505374
SHA51200d1b8f5bfd342026e41157abc02817b3bd26b4b969bd67b27d9062d7db7929f2f0656bc5f9b22031595450971751140b584baec42bd7b6f2cb9d4a15d1fa2d4
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu582759.exeFilesize
297KB
MD503c207945146f044efd2bb34c211dc5b
SHA1cafee6609265dfdca8024d5dd4bbe1b26ea70517
SHA2568a20e4d13a72cabb1e0b1b7a466b0ce7fd1f5a9e1cd9ff8f2ec1bde04c505374
SHA51200d1b8f5bfd342026e41157abc02817b3bd26b4b969bd67b27d9062d7db7929f2f0656bc5f9b22031595450971751140b584baec42bd7b6f2cb9d4a15d1fa2d4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/560-1130-0x0000000005480000-0x0000000005490000-memory.dmpFilesize
64KB
-
memory/560-1129-0x0000000000880000-0x00000000008B2000-memory.dmpFilesize
200KB
-
memory/676-156-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/676-173-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/676-177-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/676-179-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/676-181-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/676-183-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/676-185-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/676-187-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/676-188-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/676-189-0x00000000026D0000-0x00000000026E0000-memory.dmpFilesize
64KB
-
memory/676-190-0x00000000026D0000-0x00000000026E0000-memory.dmpFilesize
64KB
-
memory/676-191-0x00000000026D0000-0x00000000026E0000-memory.dmpFilesize
64KB
-
memory/676-193-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/676-175-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/676-171-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/676-169-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/676-163-0x00000000026D0000-0x00000000026E0000-memory.dmpFilesize
64KB
-
memory/676-167-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/676-165-0x00000000026D0000-0x00000000026E0000-memory.dmpFilesize
64KB
-
memory/676-164-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/676-155-0x0000000004BB0000-0x0000000005154000-memory.dmpFilesize
5.6MB
-
memory/676-161-0x00000000026D0000-0x00000000026E0000-memory.dmpFilesize
64KB
-
memory/676-159-0x0000000000580000-0x00000000005AD000-memory.dmpFilesize
180KB
-
memory/676-160-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/676-157-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/1788-1136-0x0000000000590000-0x00000000005CB000-memory.dmpFilesize
236KB
-
memory/1788-1152-0x0000000000590000-0x00000000005CB000-memory.dmpFilesize
236KB
-
memory/2516-209-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-227-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-229-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-231-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-334-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/2516-332-0x00000000004C0000-0x000000000050B000-memory.dmpFilesize
300KB
-
memory/2516-336-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/2516-337-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/2516-1108-0x00000000050F0000-0x0000000005708000-memory.dmpFilesize
6.1MB
-
memory/2516-1109-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/2516-1110-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/2516-1111-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/2516-1112-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/2516-1114-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/2516-1115-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/2516-1116-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/2516-1117-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/2516-1118-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/2516-1119-0x0000000006470000-0x0000000006632000-memory.dmpFilesize
1.8MB
-
memory/2516-1120-0x0000000006650000-0x0000000006B7C000-memory.dmpFilesize
5.2MB
-
memory/2516-225-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-223-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-221-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-219-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-217-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-215-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-213-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-211-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-207-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-205-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-203-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-199-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-201-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-198-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2516-1121-0x0000000006E00000-0x0000000006E76000-memory.dmpFilesize
472KB
-
memory/2516-1122-0x0000000006E80000-0x0000000006ED0000-memory.dmpFilesize
320KB
-
memory/2516-1123-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB