Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 21:49
Static task
static1
General
-
Target
a602d5d56397e412bd3c0deb2e9ad4eea9de4a3a109e34388146e170e853ecf7.exe
-
Size
790KB
-
MD5
b4d34450ddae4b8989110dd73c947305
-
SHA1
59fcea586c256d503387ce2527d6dd8060d4e8d5
-
SHA256
a602d5d56397e412bd3c0deb2e9ad4eea9de4a3a109e34388146e170e853ecf7
-
SHA512
9cbafefc127386a612576d78b60343a5b25c59566ebba3cf01a4da5890b65fa088bb9d0fea7f08f6c7b84b852a31299e0b53e025cd7614159531bc3bedbfddd6
-
SSDEEP
24576:ZyO9ko+Ymz4IXFog9HrxfUKl2ZXnnbPHHTeJRa:M8H+zUa5rxM9nLTy
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
it313237.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it313237.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it313237.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it313237.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it313237.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it313237.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it313237.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4412-164-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-165-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-167-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-169-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-171-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-173-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-175-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-177-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-179-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-181-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-183-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-185-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-187-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-189-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-193-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-191-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-195-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-197-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-199-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-201-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-203-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-205-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-207-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-209-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-211-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-213-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-215-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-217-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-219-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-221-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-223-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-225-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline behavioral1/memory/4412-227-0x0000000005170000-0x00000000051AF000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr483755.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation lr483755.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
zinP4503.exeziVC7823.exeit313237.exejr934066.exekp064661.exelr483755.exeoneetx.exeoneetx.exeoneetx.exepid process 2164 zinP4503.exe 1972 ziVC7823.exe 3656 it313237.exe 4412 jr934066.exe 3536 kp064661.exe 1368 lr483755.exe 4004 oneetx.exe 2456 oneetx.exe 1552 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4840 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it313237.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it313237.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
a602d5d56397e412bd3c0deb2e9ad4eea9de4a3a109e34388146e170e853ecf7.exezinP4503.exeziVC7823.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a602d5d56397e412bd3c0deb2e9ad4eea9de4a3a109e34388146e170e853ecf7.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zinP4503.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zinP4503.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziVC7823.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ziVC7823.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a602d5d56397e412bd3c0deb2e9ad4eea9de4a3a109e34388146e170e853ecf7.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 29 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4872 4412 WerFault.exe jr934066.exe 1572 1368 WerFault.exe lr483755.exe 4840 1368 WerFault.exe lr483755.exe 4548 1368 WerFault.exe lr483755.exe 1904 1368 WerFault.exe lr483755.exe 2852 1368 WerFault.exe lr483755.exe 2504 1368 WerFault.exe lr483755.exe 3876 1368 WerFault.exe lr483755.exe 3900 1368 WerFault.exe lr483755.exe 880 1368 WerFault.exe lr483755.exe 4112 1368 WerFault.exe lr483755.exe 5048 4004 WerFault.exe oneetx.exe 4500 4004 WerFault.exe oneetx.exe 3012 4004 WerFault.exe oneetx.exe 2812 4004 WerFault.exe oneetx.exe 5096 4004 WerFault.exe oneetx.exe 916 4004 WerFault.exe oneetx.exe 3492 4004 WerFault.exe oneetx.exe 3640 4004 WerFault.exe oneetx.exe 2148 4004 WerFault.exe oneetx.exe 4952 4004 WerFault.exe oneetx.exe 3752 4004 WerFault.exe oneetx.exe 4072 4004 WerFault.exe oneetx.exe 3396 2456 WerFault.exe oneetx.exe 1996 4004 WerFault.exe oneetx.exe 4476 4004 WerFault.exe oneetx.exe 2268 4004 WerFault.exe oneetx.exe 2256 1552 WerFault.exe oneetx.exe 1392 4004 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it313237.exejr934066.exekp064661.exepid process 3656 it313237.exe 3656 it313237.exe 4412 jr934066.exe 4412 jr934066.exe 3536 kp064661.exe 3536 kp064661.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it313237.exejr934066.exekp064661.exedescription pid process Token: SeDebugPrivilege 3656 it313237.exe Token: SeDebugPrivilege 4412 jr934066.exe Token: SeDebugPrivilege 3536 kp064661.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr483755.exepid process 1368 lr483755.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
a602d5d56397e412bd3c0deb2e9ad4eea9de4a3a109e34388146e170e853ecf7.exezinP4503.exeziVC7823.exelr483755.exeoneetx.exedescription pid process target process PID 2348 wrote to memory of 2164 2348 a602d5d56397e412bd3c0deb2e9ad4eea9de4a3a109e34388146e170e853ecf7.exe zinP4503.exe PID 2348 wrote to memory of 2164 2348 a602d5d56397e412bd3c0deb2e9ad4eea9de4a3a109e34388146e170e853ecf7.exe zinP4503.exe PID 2348 wrote to memory of 2164 2348 a602d5d56397e412bd3c0deb2e9ad4eea9de4a3a109e34388146e170e853ecf7.exe zinP4503.exe PID 2164 wrote to memory of 1972 2164 zinP4503.exe ziVC7823.exe PID 2164 wrote to memory of 1972 2164 zinP4503.exe ziVC7823.exe PID 2164 wrote to memory of 1972 2164 zinP4503.exe ziVC7823.exe PID 1972 wrote to memory of 3656 1972 ziVC7823.exe it313237.exe PID 1972 wrote to memory of 3656 1972 ziVC7823.exe it313237.exe PID 1972 wrote to memory of 4412 1972 ziVC7823.exe jr934066.exe PID 1972 wrote to memory of 4412 1972 ziVC7823.exe jr934066.exe PID 1972 wrote to memory of 4412 1972 ziVC7823.exe jr934066.exe PID 2164 wrote to memory of 3536 2164 zinP4503.exe kp064661.exe PID 2164 wrote to memory of 3536 2164 zinP4503.exe kp064661.exe PID 2164 wrote to memory of 3536 2164 zinP4503.exe kp064661.exe PID 2348 wrote to memory of 1368 2348 a602d5d56397e412bd3c0deb2e9ad4eea9de4a3a109e34388146e170e853ecf7.exe lr483755.exe PID 2348 wrote to memory of 1368 2348 a602d5d56397e412bd3c0deb2e9ad4eea9de4a3a109e34388146e170e853ecf7.exe lr483755.exe PID 2348 wrote to memory of 1368 2348 a602d5d56397e412bd3c0deb2e9ad4eea9de4a3a109e34388146e170e853ecf7.exe lr483755.exe PID 1368 wrote to memory of 4004 1368 lr483755.exe oneetx.exe PID 1368 wrote to memory of 4004 1368 lr483755.exe oneetx.exe PID 1368 wrote to memory of 4004 1368 lr483755.exe oneetx.exe PID 4004 wrote to memory of 4132 4004 oneetx.exe schtasks.exe PID 4004 wrote to memory of 4132 4004 oneetx.exe schtasks.exe PID 4004 wrote to memory of 4132 4004 oneetx.exe schtasks.exe PID 4004 wrote to memory of 4840 4004 oneetx.exe rundll32.exe PID 4004 wrote to memory of 4840 4004 oneetx.exe rundll32.exe PID 4004 wrote to memory of 4840 4004 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a602d5d56397e412bd3c0deb2e9ad4eea9de4a3a109e34388146e170e853ecf7.exe"C:\Users\Admin\AppData\Local\Temp\a602d5d56397e412bd3c0deb2e9ad4eea9de4a3a109e34388146e170e853ecf7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinP4503.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinP4503.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziVC7823.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziVC7823.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it313237.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it313237.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr934066.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr934066.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 20725⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp064661.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp064661.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr483755.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr483755.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 7723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 9683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 9803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 8683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 12043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 12403⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 13123⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 9084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 9444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 10844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 10204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 11244⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 11324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 9364⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 10124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 7764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 7804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 13164⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 11484⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 16284⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 15724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 16364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 13643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4412 -ip 44121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4004 -ip 40041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4004 -ip 40041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4004 -ip 40041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4004 -ip 40041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4004 -ip 40041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4004 -ip 40041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4004 -ip 40041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4004 -ip 40041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4004 -ip 40041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4004 -ip 40041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4004 -ip 40041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4004 -ip 40041⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2456 -ip 24561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4004 -ip 40041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4004 -ip 40041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4004 -ip 40041⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 3162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1552 -ip 15521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4004 -ip 40041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr483755.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr483755.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinP4503.exeFilesize
524KB
MD5b587e497b4d89eec1bb1be3b3c167c05
SHA1a386ef307a3143142daad9b38209a5e31d5339ce
SHA256d90dbd0237aae7f315537e6eb82eee4fefebec5cd4dda3ac3d6f9ddb30c333f4
SHA5123a17ef58b40d35ada27af81361d4eb6fd5f8185dfa4636ddda7ebb227414254c01336ff77e7d00b32e0c3a451c0914859b36d33cc0f352feb817d645ceb4d083
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinP4503.exeFilesize
524KB
MD5b587e497b4d89eec1bb1be3b3c167c05
SHA1a386ef307a3143142daad9b38209a5e31d5339ce
SHA256d90dbd0237aae7f315537e6eb82eee4fefebec5cd4dda3ac3d6f9ddb30c333f4
SHA5123a17ef58b40d35ada27af81361d4eb6fd5f8185dfa4636ddda7ebb227414254c01336ff77e7d00b32e0c3a451c0914859b36d33cc0f352feb817d645ceb4d083
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp064661.exeFilesize
176KB
MD5212ccf21c6ed5e4e9ad6040002dd739a
SHA15e0650f0fc04165fea751e8af2b99d2dcf6a248f
SHA256908829cbabfe872cd49b059cf131d63627727aaa60608ccf8b33f23dff601232
SHA512aae24ee7a7d431c8be98206b2241c19431c1ffd5df494d2b417b46010a2aecc02191577a456f21fc21fa306ea1b279320eeca869a985fece18a223c305b2a4b4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp064661.exeFilesize
176KB
MD5212ccf21c6ed5e4e9ad6040002dd739a
SHA15e0650f0fc04165fea751e8af2b99d2dcf6a248f
SHA256908829cbabfe872cd49b059cf131d63627727aaa60608ccf8b33f23dff601232
SHA512aae24ee7a7d431c8be98206b2241c19431c1ffd5df494d2b417b46010a2aecc02191577a456f21fc21fa306ea1b279320eeca869a985fece18a223c305b2a4b4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziVC7823.exeFilesize
382KB
MD59397fbcd63b7418a07d75f5c1bda41f9
SHA19750a83e467a99e7680b927bde051e78981bf888
SHA2566cad3b0966d16300385d9e34c727c86cb8aa6c798bb4a91cfd16da0bdec78118
SHA5129cdfc43ee59e76d0fc14cadb29c268a05e4e4b128f3869c95bef68e2bd336c500382971bd3209dc61f9673ffdd36affb7d36c916d5b80510a415433ec0bfe6d3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziVC7823.exeFilesize
382KB
MD59397fbcd63b7418a07d75f5c1bda41f9
SHA19750a83e467a99e7680b927bde051e78981bf888
SHA2566cad3b0966d16300385d9e34c727c86cb8aa6c798bb4a91cfd16da0bdec78118
SHA5129cdfc43ee59e76d0fc14cadb29c268a05e4e4b128f3869c95bef68e2bd336c500382971bd3209dc61f9673ffdd36affb7d36c916d5b80510a415433ec0bfe6d3
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it313237.exeFilesize
11KB
MD550230721969baf6ffd6ac5e906699eb2
SHA10809aeb89c548bb40c69eaee2374ed7cc77d540c
SHA2568432bca28dceff4837e912289864bb6b4c28e8584e57c5c59f1d63ad70dbb2a6
SHA51296a66d691ad0b459f504b5413f3cd591adb5509076fb92c4364ef5fb1a7d7e5eeb9e54a6924c8ce9858c14701225cefcb3c415d581bd49bdb14521261fe37afc
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it313237.exeFilesize
11KB
MD550230721969baf6ffd6ac5e906699eb2
SHA10809aeb89c548bb40c69eaee2374ed7cc77d540c
SHA2568432bca28dceff4837e912289864bb6b4c28e8584e57c5c59f1d63ad70dbb2a6
SHA51296a66d691ad0b459f504b5413f3cd591adb5509076fb92c4364ef5fb1a7d7e5eeb9e54a6924c8ce9858c14701225cefcb3c415d581bd49bdb14521261fe37afc
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr934066.exeFilesize
297KB
MD50a6da593ed6b2bffc0882969f84cf1ee
SHA1118ce0754524c64a525d6c42457a2acc924cc057
SHA25683d06b6194e659e5b8328c6d1eab367d265fc821b05083d7723276561583e80e
SHA5128c5697f4e55b7343e211b80cf9bdffc5fe4435db5723cf7c422b42f6e14a8b7800e1083cd6b92eb8f3843f4991a421e3e9815d6582d3212695b0256a7721b0d3
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr934066.exeFilesize
297KB
MD50a6da593ed6b2bffc0882969f84cf1ee
SHA1118ce0754524c64a525d6c42457a2acc924cc057
SHA25683d06b6194e659e5b8328c6d1eab367d265fc821b05083d7723276561583e80e
SHA5128c5697f4e55b7343e211b80cf9bdffc5fe4435db5723cf7c422b42f6e14a8b7800e1083cd6b92eb8f3843f4991a421e3e9815d6582d3212695b0256a7721b0d3
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1368-1098-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/1368-1114-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/3536-1090-0x0000000000B70000-0x0000000000BA2000-memory.dmpFilesize
200KB
-
memory/3536-1091-0x0000000005750000-0x0000000005760000-memory.dmpFilesize
64KB
-
memory/3536-1092-0x0000000005750000-0x0000000005760000-memory.dmpFilesize
64KB
-
memory/3656-154-0x0000000000660000-0x000000000066A000-memory.dmpFilesize
40KB
-
memory/4412-205-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-1072-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/4412-187-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-189-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-193-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-191-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-195-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-197-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-199-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-201-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-203-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-183-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-207-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-209-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-211-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-213-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-215-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-217-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-219-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-221-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-223-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-225-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-227-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-1070-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/4412-1071-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/4412-185-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-1073-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4412-1074-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/4412-1076-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4412-1077-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4412-1078-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/4412-1079-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/4412-1080-0x0000000006490000-0x0000000006506000-memory.dmpFilesize
472KB
-
memory/4412-181-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-179-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-177-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-175-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-173-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-171-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-169-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-167-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-165-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-164-0x0000000005170000-0x00000000051AF000-memory.dmpFilesize
252KB
-
memory/4412-163-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4412-162-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4412-161-0x00000000005D0000-0x000000000061B000-memory.dmpFilesize
300KB
-
memory/4412-160-0x0000000004B80000-0x0000000005124000-memory.dmpFilesize
5.6MB
-
memory/4412-1081-0x0000000006520000-0x0000000006570000-memory.dmpFilesize
320KB
-
memory/4412-1082-0x00000000067E0000-0x00000000069A2000-memory.dmpFilesize
1.8MB
-
memory/4412-1083-0x00000000069C0000-0x0000000006EEC000-memory.dmpFilesize
5.2MB
-
memory/4412-1084-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB