Analysis
-
max time kernel
147s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 19:24
Static task
static1
General
-
Target
67e932337eea9fbee837906422d729711fb66ab21da15bd6c54a7b9c0dfa4fa3.exe
-
Size
938KB
-
MD5
4090a735483cfa2c6d735983e29e985d
-
SHA1
9f53fd9e1e9e416da156ef7d8be23ec243ae959b
-
SHA256
67e932337eea9fbee837906422d729711fb66ab21da15bd6c54a7b9c0dfa4fa3
-
SHA512
6c0fe3132a9dbba546a0df701c3ebdbfd5987c20b962e0f9681214e7b0111afe5259752e1607d03f8789ab3a688eb332cb32384c59ee197fea1e4ffc1d3e1f2d
-
SSDEEP
24576:DyaRMkQIqPwxpXZ7KvTGuHS+OrRqVGaAI7NBaaZiKKfm:WauNIqgpl+qSS+O1qV8oaaZkf
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
pr681266.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr681266.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr681266.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr681266.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr681266.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr681266.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr681266.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/3052-198-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/3052-199-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/3052-201-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/3052-208-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/3052-203-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/3052-211-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/3052-213-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/3052-215-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/3052-217-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/3052-219-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/3052-221-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/3052-223-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/3052-225-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/3052-227-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/3052-229-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/3052-231-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/3052-233-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/3052-235-0x0000000005040000-0x000000000507F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
si932765.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation si932765.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
Processes:
un703491.exeun108359.exepr681266.exequ108218.exerk977811.exesi932765.exeoneetx.exeoneetx.exepid process 884 un703491.exe 4736 un108359.exe 1368 pr681266.exe 3052 qu108218.exe 2420 rk977811.exe 4260 si932765.exe 2108 oneetx.exe 516 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4728 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pr681266.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr681266.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr681266.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
un108359.exe67e932337eea9fbee837906422d729711fb66ab21da15bd6c54a7b9c0dfa4fa3.exeun703491.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un108359.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un108359.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 67e932337eea9fbee837906422d729711fb66ab21da15bd6c54a7b9c0dfa4fa3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 67e932337eea9fbee837906422d729711fb66ab21da15bd6c54a7b9c0dfa4fa3.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un703491.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un703491.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 29 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1244 1368 WerFault.exe pr681266.exe 1872 3052 WerFault.exe qu108218.exe 1384 4260 WerFault.exe si932765.exe 552 4260 WerFault.exe si932765.exe 460 4260 WerFault.exe si932765.exe 3308 4260 WerFault.exe si932765.exe 4912 4260 WerFault.exe si932765.exe 4948 4260 WerFault.exe si932765.exe 4808 4260 WerFault.exe si932765.exe 1988 4260 WerFault.exe si932765.exe 1016 4260 WerFault.exe si932765.exe 448 4260 WerFault.exe si932765.exe 5116 2108 WerFault.exe oneetx.exe 2164 2108 WerFault.exe oneetx.exe 1344 2108 WerFault.exe oneetx.exe 2868 2108 WerFault.exe oneetx.exe 3312 2108 WerFault.exe oneetx.exe 4244 2108 WerFault.exe oneetx.exe 1508 2108 WerFault.exe oneetx.exe 4592 2108 WerFault.exe oneetx.exe 2448 2108 WerFault.exe oneetx.exe 3832 2108 WerFault.exe oneetx.exe 4952 2108 WerFault.exe oneetx.exe 1076 2108 WerFault.exe oneetx.exe 3904 2108 WerFault.exe oneetx.exe 808 516 WerFault.exe oneetx.exe 2796 2108 WerFault.exe oneetx.exe 4444 2108 WerFault.exe oneetx.exe 2620 2108 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pr681266.exequ108218.exerk977811.exepid process 1368 pr681266.exe 1368 pr681266.exe 3052 qu108218.exe 3052 qu108218.exe 2420 rk977811.exe 2420 rk977811.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pr681266.exequ108218.exerk977811.exedescription pid process Token: SeDebugPrivilege 1368 pr681266.exe Token: SeDebugPrivilege 3052 qu108218.exe Token: SeDebugPrivilege 2420 rk977811.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
si932765.exepid process 4260 si932765.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
67e932337eea9fbee837906422d729711fb66ab21da15bd6c54a7b9c0dfa4fa3.exeun703491.exeun108359.exesi932765.exeoneetx.exedescription pid process target process PID 860 wrote to memory of 884 860 67e932337eea9fbee837906422d729711fb66ab21da15bd6c54a7b9c0dfa4fa3.exe un703491.exe PID 860 wrote to memory of 884 860 67e932337eea9fbee837906422d729711fb66ab21da15bd6c54a7b9c0dfa4fa3.exe un703491.exe PID 860 wrote to memory of 884 860 67e932337eea9fbee837906422d729711fb66ab21da15bd6c54a7b9c0dfa4fa3.exe un703491.exe PID 884 wrote to memory of 4736 884 un703491.exe un108359.exe PID 884 wrote to memory of 4736 884 un703491.exe un108359.exe PID 884 wrote to memory of 4736 884 un703491.exe un108359.exe PID 4736 wrote to memory of 1368 4736 un108359.exe pr681266.exe PID 4736 wrote to memory of 1368 4736 un108359.exe pr681266.exe PID 4736 wrote to memory of 1368 4736 un108359.exe pr681266.exe PID 4736 wrote to memory of 3052 4736 un108359.exe qu108218.exe PID 4736 wrote to memory of 3052 4736 un108359.exe qu108218.exe PID 4736 wrote to memory of 3052 4736 un108359.exe qu108218.exe PID 884 wrote to memory of 2420 884 un703491.exe rk977811.exe PID 884 wrote to memory of 2420 884 un703491.exe rk977811.exe PID 884 wrote to memory of 2420 884 un703491.exe rk977811.exe PID 860 wrote to memory of 4260 860 67e932337eea9fbee837906422d729711fb66ab21da15bd6c54a7b9c0dfa4fa3.exe si932765.exe PID 860 wrote to memory of 4260 860 67e932337eea9fbee837906422d729711fb66ab21da15bd6c54a7b9c0dfa4fa3.exe si932765.exe PID 860 wrote to memory of 4260 860 67e932337eea9fbee837906422d729711fb66ab21da15bd6c54a7b9c0dfa4fa3.exe si932765.exe PID 4260 wrote to memory of 2108 4260 si932765.exe oneetx.exe PID 4260 wrote to memory of 2108 4260 si932765.exe oneetx.exe PID 4260 wrote to memory of 2108 4260 si932765.exe oneetx.exe PID 2108 wrote to memory of 1308 2108 oneetx.exe schtasks.exe PID 2108 wrote to memory of 1308 2108 oneetx.exe schtasks.exe PID 2108 wrote to memory of 1308 2108 oneetx.exe schtasks.exe PID 2108 wrote to memory of 4728 2108 oneetx.exe rundll32.exe PID 2108 wrote to memory of 4728 2108 oneetx.exe rundll32.exe PID 2108 wrote to memory of 4728 2108 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\67e932337eea9fbee837906422d729711fb66ab21da15bd6c54a7b9c0dfa4fa3.exe"C:\Users\Admin\AppData\Local\Temp\67e932337eea9fbee837906422d729711fb66ab21da15bd6c54a7b9c0dfa4fa3.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un703491.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un703491.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un108359.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un108359.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr681266.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr681266.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 10805⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu108218.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu108218.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 19525⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk977811.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk977811.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si932765.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si932765.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 7803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 7963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 9603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 9603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 8083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 12163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 12563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 13123⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 8644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 8604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 10844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 11084⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 12884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 7524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 7284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 14364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 10924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 16284⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 10764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 16444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 8043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3052 -ip 30521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4260 -ip 42601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4260 -ip 42601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4260 -ip 42601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4260 -ip 42601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4260 -ip 42601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4260 -ip 42601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4260 -ip 42601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4260 -ip 42601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4260 -ip 42601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4260 -ip 42601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2108 -ip 21081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2108 -ip 21081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2108 -ip 21081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2108 -ip 21081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2108 -ip 21081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2108 -ip 21081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2108 -ip 21081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2108 -ip 21081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2108 -ip 21081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2108 -ip 21081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2108 -ip 21081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2108 -ip 21081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2108 -ip 21081⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 516 -ip 5161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2108 -ip 21081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2108 -ip 21081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2108 -ip 21081⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si932765.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si932765.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un703491.exeFilesize
673KB
MD57090c0f95c91c21152f6841b158e3a62
SHA13ffccf642917a300e02acbebbfc37bcae1c4474d
SHA2566775532bed7d52afe486ef085ee91aed0e4cc759b0517431e30a97cb9cc49483
SHA512ba5aa2f6526d95e3799b0b56a8b0bf76b06862910a43e9bfe5222a9a43960abb4d7f84199664293f5bfbf1cfdf89faebe0dc80ebab02c3ff940007cd9a577d48
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un703491.exeFilesize
673KB
MD57090c0f95c91c21152f6841b158e3a62
SHA13ffccf642917a300e02acbebbfc37bcae1c4474d
SHA2566775532bed7d52afe486ef085ee91aed0e4cc759b0517431e30a97cb9cc49483
SHA512ba5aa2f6526d95e3799b0b56a8b0bf76b06862910a43e9bfe5222a9a43960abb4d7f84199664293f5bfbf1cfdf89faebe0dc80ebab02c3ff940007cd9a577d48
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk977811.exeFilesize
168KB
MD51a38d9b85c764c67fd49d35bfc04c65c
SHA16e7eaed93ce357a4d3117753d8ccffef9bbcabe6
SHA2564542c52bb6ff593348181e0c53e0e4da6db552d4c4d92c863340f83c3a9c8378
SHA5125b8bb55cfd68f0f45e90811b741f8e70b79c922a611554674de9f41c31e0591501d495033ea82a8ac51fadac32117713b79fda0150ba82ad75c021e35a8e3458
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk977811.exeFilesize
168KB
MD51a38d9b85c764c67fd49d35bfc04c65c
SHA16e7eaed93ce357a4d3117753d8ccffef9bbcabe6
SHA2564542c52bb6ff593348181e0c53e0e4da6db552d4c4d92c863340f83c3a9c8378
SHA5125b8bb55cfd68f0f45e90811b741f8e70b79c922a611554674de9f41c31e0591501d495033ea82a8ac51fadac32117713b79fda0150ba82ad75c021e35a8e3458
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un108359.exeFilesize
520KB
MD5583186a5f969ee012588c5633d20f27f
SHA12102fdacf2a3d6df38319657c15a0242526fb616
SHA2563bb299373af14cf00e32648552cb8a0157da089265b4bfc316a499299d5f3421
SHA51251cc523906c59d828d218581b7ff601da7266b9da3c44faf9715df9b7efc7053302af28a7ab937a8ba6b8fff0ba293789f8b97937a555d53f5b9ed4b778dc939
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un108359.exeFilesize
520KB
MD5583186a5f969ee012588c5633d20f27f
SHA12102fdacf2a3d6df38319657c15a0242526fb616
SHA2563bb299373af14cf00e32648552cb8a0157da089265b4bfc316a499299d5f3421
SHA51251cc523906c59d828d218581b7ff601da7266b9da3c44faf9715df9b7efc7053302af28a7ab937a8ba6b8fff0ba293789f8b97937a555d53f5b9ed4b778dc939
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr681266.exeFilesize
239KB
MD52f98254423d07d38a63502720f1b63ea
SHA1d0c1b4113222c20f345e7788ed025c4a47a3c70b
SHA256c54ac2d8f04856a137a3a13ff8ae827943029740cb427b65386f4a678fb2aa7f
SHA51279e1d88cd5871a3f77fddb22dfe25c8ba64eea71015040ab600b72e4362d532e6e3309aecfdb5be2a7f49122a28e759bfa2744dd0d5f92cbc9667d5dbddddf22
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr681266.exeFilesize
239KB
MD52f98254423d07d38a63502720f1b63ea
SHA1d0c1b4113222c20f345e7788ed025c4a47a3c70b
SHA256c54ac2d8f04856a137a3a13ff8ae827943029740cb427b65386f4a678fb2aa7f
SHA51279e1d88cd5871a3f77fddb22dfe25c8ba64eea71015040ab600b72e4362d532e6e3309aecfdb5be2a7f49122a28e759bfa2744dd0d5f92cbc9667d5dbddddf22
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu108218.exeFilesize
297KB
MD59109c79f49fb758a20b6378af1c9aa49
SHA1153fe2a53f3466040cf97f8404a594991fcd1c04
SHA2569a26f9bddc44d2bbe968cb2ed86832e3a4df3d24c83625a6e71185d8f84ac33c
SHA5126d370547deacca1a7f671377c720389007cfa4a22ecaede5f7e4d9124b3ea5ac58db32d67a7279adf3d4643afa947760ac2186622bd5857424cd591900619773
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu108218.exeFilesize
297KB
MD59109c79f49fb758a20b6378af1c9aa49
SHA1153fe2a53f3466040cf97f8404a594991fcd1c04
SHA2569a26f9bddc44d2bbe968cb2ed86832e3a4df3d24c83625a6e71185d8f84ac33c
SHA5126d370547deacca1a7f671377c720389007cfa4a22ecaede5f7e4d9124b3ea5ac58db32d67a7279adf3d4643afa947760ac2186622bd5857424cd591900619773
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1368-157-0x0000000002690000-0x00000000026A0000-memory.dmpFilesize
64KB
-
memory/1368-191-0x0000000002690000-0x00000000026A0000-memory.dmpFilesize
64KB
-
memory/1368-173-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/1368-175-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/1368-177-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/1368-179-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/1368-181-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/1368-183-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/1368-185-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/1368-187-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/1368-188-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/1368-189-0x0000000002690000-0x00000000026A0000-memory.dmpFilesize
64KB
-
memory/1368-190-0x0000000002690000-0x00000000026A0000-memory.dmpFilesize
64KB
-
memory/1368-171-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/1368-193-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/1368-155-0x00000000004B0000-0x00000000004DD000-memory.dmpFilesize
180KB
-
memory/1368-169-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/1368-167-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/1368-165-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/1368-163-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/1368-160-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/1368-161-0x0000000002690000-0x00000000026A0000-memory.dmpFilesize
64KB
-
memory/1368-158-0x0000000002690000-0x00000000026A0000-memory.dmpFilesize
64KB
-
memory/1368-159-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/1368-156-0x0000000004D40000-0x00000000052E4000-memory.dmpFilesize
5.6MB
-
memory/2420-1130-0x0000000005240000-0x0000000005250000-memory.dmpFilesize
64KB
-
memory/2420-1129-0x00000000009E0000-0x0000000000A10000-memory.dmpFilesize
192KB
-
memory/2420-1131-0x0000000005240000-0x0000000005250000-memory.dmpFilesize
64KB
-
memory/3052-208-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/3052-1118-0x0000000004940000-0x0000000004950000-memory.dmpFilesize
64KB
-
memory/3052-221-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/3052-223-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/3052-225-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/3052-227-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/3052-229-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/3052-231-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/3052-233-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/3052-235-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/3052-1108-0x00000000050C0000-0x00000000056D8000-memory.dmpFilesize
6.1MB
-
memory/3052-1109-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/3052-1110-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/3052-1111-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/3052-1112-0x0000000004940000-0x0000000004950000-memory.dmpFilesize
64KB
-
memory/3052-1113-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/3052-1114-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/3052-1116-0x0000000004940000-0x0000000004950000-memory.dmpFilesize
64KB
-
memory/3052-1117-0x0000000004940000-0x0000000004950000-memory.dmpFilesize
64KB
-
memory/3052-219-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/3052-1119-0x0000000006450000-0x00000000064C6000-memory.dmpFilesize
472KB
-
memory/3052-1120-0x00000000064E0000-0x0000000006530000-memory.dmpFilesize
320KB
-
memory/3052-217-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/3052-215-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/3052-210-0x0000000004940000-0x0000000004950000-memory.dmpFilesize
64KB
-
memory/3052-213-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/3052-1121-0x0000000006760000-0x0000000006922000-memory.dmpFilesize
1.8MB
-
memory/3052-1122-0x0000000006930000-0x0000000006E5C000-memory.dmpFilesize
5.2MB
-
memory/3052-1123-0x0000000004940000-0x0000000004950000-memory.dmpFilesize
64KB
-
memory/3052-198-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/3052-211-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/3052-203-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/3052-207-0x0000000004940000-0x0000000004950000-memory.dmpFilesize
64KB
-
memory/3052-206-0x0000000004940000-0x0000000004950000-memory.dmpFilesize
64KB
-
memory/3052-204-0x00000000005E0000-0x000000000062B000-memory.dmpFilesize
300KB
-
memory/3052-201-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/3052-199-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4260-1137-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB