Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 21:51
Static task
static1
General
-
Target
e2c8bbe557295e0ef8382b948730cc7a0edf5a8a3e5409eedb15cc4985f9d106.exe
-
Size
928KB
-
MD5
f57a6f8edb938535da0b860161bf608e
-
SHA1
8df0aa34badeca4bf389cedac6b6d45da386fa3b
-
SHA256
e2c8bbe557295e0ef8382b948730cc7a0edf5a8a3e5409eedb15cc4985f9d106
-
SHA512
36c80e99c3a6d8aa9bc7a3c886ffb1cfd89de4357a210e98c8bed02a2a913a69223a44739e4b3f5b60c4325c8c4a2ba2d73194226c34d46fb9707e8d6729f579
-
SSDEEP
24576:yy48yq5bPQP69rSslq1nI9fkRu7IwnblHHk:ZUWzQP6NlKf3QJ
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pr007764.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr007764.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr007764.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr007764.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr007764.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr007764.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr007764.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4588-198-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/4588-201-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/4588-199-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/4588-203-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/4588-205-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/4588-207-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/4588-209-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/4588-211-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/4588-213-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/4588-216-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/4588-220-0x0000000004B20000-0x0000000004B30000-memory.dmp family_redline behavioral1/memory/4588-219-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/4588-223-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/4588-225-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/4588-227-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/4588-229-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/4588-231-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/4588-233-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/4588-235-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
si277885.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation si277885.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
Processes:
un502759.exeun776885.exepr007764.exequ931198.exerk493329.exesi277885.exeoneetx.exeoneetx.exepid process 1928 un502759.exe 2296 un776885.exe 3304 pr007764.exe 4588 qu931198.exe 4636 rk493329.exe 3364 si277885.exe 1372 oneetx.exe 2964 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2804 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pr007764.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr007764.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr007764.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
e2c8bbe557295e0ef8382b948730cc7a0edf5a8a3e5409eedb15cc4985f9d106.exeun502759.exeun776885.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e2c8bbe557295e0ef8382b948730cc7a0edf5a8a3e5409eedb15cc4985f9d106.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un502759.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un502759.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un776885.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un776885.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce e2c8bbe557295e0ef8382b948730cc7a0edf5a8a3e5409eedb15cc4985f9d106.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 28 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4988 3304 WerFault.exe pr007764.exe 2820 4588 WerFault.exe qu931198.exe 228 3364 WerFault.exe si277885.exe 552 3364 WerFault.exe si277885.exe 4648 3364 WerFault.exe si277885.exe 2248 3364 WerFault.exe si277885.exe 2728 3364 WerFault.exe si277885.exe 1376 3364 WerFault.exe si277885.exe 2560 3364 WerFault.exe si277885.exe 2700 3364 WerFault.exe si277885.exe 1332 3364 WerFault.exe si277885.exe 4700 3364 WerFault.exe si277885.exe 4968 1372 WerFault.exe oneetx.exe 4484 1372 WerFault.exe oneetx.exe 1808 1372 WerFault.exe oneetx.exe 4872 1372 WerFault.exe oneetx.exe 2056 1372 WerFault.exe oneetx.exe 1848 1372 WerFault.exe oneetx.exe 4284 1372 WerFault.exe oneetx.exe 1000 1372 WerFault.exe oneetx.exe 5064 1372 WerFault.exe oneetx.exe 3768 1372 WerFault.exe oneetx.exe 2040 1372 WerFault.exe oneetx.exe 724 1372 WerFault.exe oneetx.exe 1632 2964 WerFault.exe oneetx.exe 3972 1372 WerFault.exe oneetx.exe 4420 1372 WerFault.exe oneetx.exe 2044 1372 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pr007764.exequ931198.exerk493329.exepid process 3304 pr007764.exe 3304 pr007764.exe 4588 qu931198.exe 4588 qu931198.exe 4636 rk493329.exe 4636 rk493329.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pr007764.exequ931198.exerk493329.exedescription pid process Token: SeDebugPrivilege 3304 pr007764.exe Token: SeDebugPrivilege 4588 qu931198.exe Token: SeDebugPrivilege 4636 rk493329.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
si277885.exepid process 3364 si277885.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
e2c8bbe557295e0ef8382b948730cc7a0edf5a8a3e5409eedb15cc4985f9d106.exeun502759.exeun776885.exesi277885.exeoneetx.exedescription pid process target process PID 1684 wrote to memory of 1928 1684 e2c8bbe557295e0ef8382b948730cc7a0edf5a8a3e5409eedb15cc4985f9d106.exe un502759.exe PID 1684 wrote to memory of 1928 1684 e2c8bbe557295e0ef8382b948730cc7a0edf5a8a3e5409eedb15cc4985f9d106.exe un502759.exe PID 1684 wrote to memory of 1928 1684 e2c8bbe557295e0ef8382b948730cc7a0edf5a8a3e5409eedb15cc4985f9d106.exe un502759.exe PID 1928 wrote to memory of 2296 1928 un502759.exe un776885.exe PID 1928 wrote to memory of 2296 1928 un502759.exe un776885.exe PID 1928 wrote to memory of 2296 1928 un502759.exe un776885.exe PID 2296 wrote to memory of 3304 2296 un776885.exe pr007764.exe PID 2296 wrote to memory of 3304 2296 un776885.exe pr007764.exe PID 2296 wrote to memory of 3304 2296 un776885.exe pr007764.exe PID 2296 wrote to memory of 4588 2296 un776885.exe qu931198.exe PID 2296 wrote to memory of 4588 2296 un776885.exe qu931198.exe PID 2296 wrote to memory of 4588 2296 un776885.exe qu931198.exe PID 1928 wrote to memory of 4636 1928 un502759.exe rk493329.exe PID 1928 wrote to memory of 4636 1928 un502759.exe rk493329.exe PID 1928 wrote to memory of 4636 1928 un502759.exe rk493329.exe PID 1684 wrote to memory of 3364 1684 e2c8bbe557295e0ef8382b948730cc7a0edf5a8a3e5409eedb15cc4985f9d106.exe si277885.exe PID 1684 wrote to memory of 3364 1684 e2c8bbe557295e0ef8382b948730cc7a0edf5a8a3e5409eedb15cc4985f9d106.exe si277885.exe PID 1684 wrote to memory of 3364 1684 e2c8bbe557295e0ef8382b948730cc7a0edf5a8a3e5409eedb15cc4985f9d106.exe si277885.exe PID 3364 wrote to memory of 1372 3364 si277885.exe oneetx.exe PID 3364 wrote to memory of 1372 3364 si277885.exe oneetx.exe PID 3364 wrote to memory of 1372 3364 si277885.exe oneetx.exe PID 1372 wrote to memory of 4304 1372 oneetx.exe schtasks.exe PID 1372 wrote to memory of 4304 1372 oneetx.exe schtasks.exe PID 1372 wrote to memory of 4304 1372 oneetx.exe schtasks.exe PID 1372 wrote to memory of 2804 1372 oneetx.exe rundll32.exe PID 1372 wrote to memory of 2804 1372 oneetx.exe rundll32.exe PID 1372 wrote to memory of 2804 1372 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2c8bbe557295e0ef8382b948730cc7a0edf5a8a3e5409eedb15cc4985f9d106.exe"C:\Users\Admin\AppData\Local\Temp\e2c8bbe557295e0ef8382b948730cc7a0edf5a8a3e5409eedb15cc4985f9d106.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un502759.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un502759.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un776885.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un776885.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr007764.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr007764.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 10805⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu931198.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu931198.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 13365⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk493329.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk493329.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si277885.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si277885.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 7843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 9683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 12123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 12243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 12843⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 8604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 8924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 10964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 11164⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 11244⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 10084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 13084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 12924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 13164⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 11404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 16124⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 10884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 16284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 13643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3304 -ip 33041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4588 -ip 45881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3364 -ip 33641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3364 -ip 33641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3364 -ip 33641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3364 -ip 33641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3364 -ip 33641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3364 -ip 33641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3364 -ip 33641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3364 -ip 33641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3364 -ip 33641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3364 -ip 33641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1372 -ip 13721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1372 -ip 13721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1372 -ip 13721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1372 -ip 13721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1372 -ip 13721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1372 -ip 13721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1372 -ip 13721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1372 -ip 13721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1372 -ip 13721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1372 -ip 13721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1372 -ip 13721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1372 -ip 13721⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2964 -ip 29641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1372 -ip 13721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1372 -ip 13721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1372 -ip 13721⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si277885.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si277885.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un502759.exeFilesize
663KB
MD546083fc863ac6e5e17c174ee52f4bbaa
SHA1773c9a688ca41f3b8d90877093fa4bc7feaa7003
SHA256c3498fd78adfbf7219bbf770a3f092c1bde979109ad1e350af67282b85619c3f
SHA51276cd6c4dda574537cfbe52be1b03067b441221c145a2c26f4dec0201bf1da7aefb6839a3fe9aafa7673f127c48a53ef2556679b7b949eb2d3ac0c3cc2bc7936a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un502759.exeFilesize
663KB
MD546083fc863ac6e5e17c174ee52f4bbaa
SHA1773c9a688ca41f3b8d90877093fa4bc7feaa7003
SHA256c3498fd78adfbf7219bbf770a3f092c1bde979109ad1e350af67282b85619c3f
SHA51276cd6c4dda574537cfbe52be1b03067b441221c145a2c26f4dec0201bf1da7aefb6839a3fe9aafa7673f127c48a53ef2556679b7b949eb2d3ac0c3cc2bc7936a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk493329.exeFilesize
176KB
MD5c1e093d939573ac96a66df5b76dbe862
SHA1cc5c0a48fae2b87aeac113fe596699dbed0c6915
SHA256db5bdd692878f362dcb27376b696f15e3701b45c2fd011852024bed1219737ba
SHA512fc9041a8f0b40a6e52699e118ecad198330c87d63e7c960ca59f9ed416962dc1d5490db0a4728519518a6e3b98f1d464f4259a3d45d7fbcbd702b4921f026124
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk493329.exeFilesize
176KB
MD5c1e093d939573ac96a66df5b76dbe862
SHA1cc5c0a48fae2b87aeac113fe596699dbed0c6915
SHA256db5bdd692878f362dcb27376b696f15e3701b45c2fd011852024bed1219737ba
SHA512fc9041a8f0b40a6e52699e118ecad198330c87d63e7c960ca59f9ed416962dc1d5490db0a4728519518a6e3b98f1d464f4259a3d45d7fbcbd702b4921f026124
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un776885.exeFilesize
521KB
MD5e3339228c319ba6fe718ff7eccfb9ff4
SHA1b21310df8a58a8db95ee6f1ecef743d5d59a9544
SHA256b117d4d11df2642a029339d4a3648139a9e7e58b22af1161e872f35c7f7534ab
SHA512c4bb77cd1d840553483861fc9309145c195c61f4f8f8994e2a1d5902a10d500b727a53ef2cbd8d9b91f7b9188899eb267d446c448eb9b3db31445e2f33e401c8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un776885.exeFilesize
521KB
MD5e3339228c319ba6fe718ff7eccfb9ff4
SHA1b21310df8a58a8db95ee6f1ecef743d5d59a9544
SHA256b117d4d11df2642a029339d4a3648139a9e7e58b22af1161e872f35c7f7534ab
SHA512c4bb77cd1d840553483861fc9309145c195c61f4f8f8994e2a1d5902a10d500b727a53ef2cbd8d9b91f7b9188899eb267d446c448eb9b3db31445e2f33e401c8
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr007764.exeFilesize
239KB
MD5cb5b7f35ee62f885248d0c5591048d88
SHA1f06f6c4b17049dfabb197cf28b734e7e6dc9e7b2
SHA256ef9172c2b6984ac010bb4577171129ea14e80928cebea4eb375c5c1800510be6
SHA5125fb553a76b0d711deac2dc6c1a692bf66718b3567ff81be6e2eab922cf67b4fd6930f49d00bc85a054219b7a5e6ad45925c8152c107c509ed44d622a7a3dd1a6
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr007764.exeFilesize
239KB
MD5cb5b7f35ee62f885248d0c5591048d88
SHA1f06f6c4b17049dfabb197cf28b734e7e6dc9e7b2
SHA256ef9172c2b6984ac010bb4577171129ea14e80928cebea4eb375c5c1800510be6
SHA5125fb553a76b0d711deac2dc6c1a692bf66718b3567ff81be6e2eab922cf67b4fd6930f49d00bc85a054219b7a5e6ad45925c8152c107c509ed44d622a7a3dd1a6
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu931198.exeFilesize
297KB
MD5e2f159d86e8623c0d97b4750400427b2
SHA1c8b2efc09222ab45309d771b1753a09119a6c1bc
SHA256a6ed0d2dcd4daa319cbe37694cb17c38060986502ccb181718f9f5f1f0d99419
SHA5124a8cf705f345d8ed558354540ac3c793c7ce7f3b8faed0516ba3e319be5a8244e455938ff6c03de8639630989db1513771c945155a53cea3c0ede11ffd41fbd0
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu931198.exeFilesize
297KB
MD5e2f159d86e8623c0d97b4750400427b2
SHA1c8b2efc09222ab45309d771b1753a09119a6c1bc
SHA256a6ed0d2dcd4daa319cbe37694cb17c38060986502ccb181718f9f5f1f0d99419
SHA5124a8cf705f345d8ed558354540ac3c793c7ce7f3b8faed0516ba3e319be5a8244e455938ff6c03de8639630989db1513771c945155a53cea3c0ede11ffd41fbd0
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/3304-172-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/3304-190-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/3304-168-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/3304-174-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/3304-176-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/3304-178-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/3304-180-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/3304-182-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/3304-184-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/3304-186-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/3304-187-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/3304-188-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/3304-189-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/3304-170-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/3304-192-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/3304-193-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/3304-166-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/3304-164-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/3304-162-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/3304-160-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/3304-159-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/3304-155-0x00000000004B0000-0x00000000004DD000-memory.dmpFilesize
180KB
-
memory/3304-158-0x0000000004AD0000-0x0000000005074000-memory.dmpFilesize
5.6MB
-
memory/3304-157-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/3304-156-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/3364-1152-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/3364-1136-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/4588-209-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4588-1117-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/4588-219-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4588-223-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4588-218-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/4588-225-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4588-227-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4588-229-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4588-231-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4588-233-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4588-235-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4588-1108-0x00000000050E0000-0x00000000056F8000-memory.dmpFilesize
6.1MB
-
memory/4588-1109-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/4588-1110-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/4588-1111-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/4588-1112-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/4588-1114-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/4588-1115-0x0000000006270000-0x0000000006302000-memory.dmpFilesize
584KB
-
memory/4588-1116-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/4588-220-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/4588-1118-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/4588-1119-0x0000000006380000-0x0000000006542000-memory.dmpFilesize
1.8MB
-
memory/4588-1120-0x0000000006550000-0x0000000006A7C000-memory.dmpFilesize
5.2MB
-
memory/4588-1121-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/4588-1122-0x00000000081A0000-0x0000000008216000-memory.dmpFilesize
472KB
-
memory/4588-1123-0x0000000008220000-0x0000000008270000-memory.dmpFilesize
320KB
-
memory/4588-198-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4588-221-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/4588-216-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4588-215-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/4588-213-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4588-211-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4588-207-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4588-205-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4588-203-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4588-199-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4588-201-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4636-1129-0x0000000000FE0000-0x0000000001012000-memory.dmpFilesize
200KB
-
memory/4636-1130-0x0000000005900000-0x0000000005910000-memory.dmpFilesize
64KB