Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 20:22
Static task
static1
General
-
Target
6109f63d790b633d9a16f5c6317d46be39a6665fe8f0903c4c5ccb869c0870d8.exe
-
Size
939KB
-
MD5
d4533578ad369d27ccd867eb5978b2e0
-
SHA1
e4cc4587376d0177a1862599f153ea879b734963
-
SHA256
6109f63d790b633d9a16f5c6317d46be39a6665fe8f0903c4c5ccb869c0870d8
-
SHA512
ec43c62810b0efff6f3ac8fc7ac419edf045b4a6fcdd1eaaffeb08166b2453f5cb36c09fa36498cb9c2606b0c6e121538afe13d0f1646878b294388981b27db6
-
SSDEEP
24576:cyvZb1nkIY6SAr7SyzMNxIbbkvPkb+hgFnmI:LvRM67vSyz+JP8+j
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
pr005307.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr005307.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr005307.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr005307.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr005307.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr005307.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr005307.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/4740-197-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-198-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-200-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-202-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-204-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-206-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-208-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-210-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-214-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-216-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-212-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-218-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-220-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-222-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-224-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-226-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-228-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-230-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4740-1115-0x0000000004C20000-0x0000000004C30000-memory.dmp family_redline behavioral1/memory/4740-1116-0x0000000004C20000-0x0000000004C30000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
si601811.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation si601811.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
un038313.exeun924104.exepr005307.exequ157097.exerk658649.exesi601811.exeoneetx.exeoneetx.exeoneetx.exepid process 1980 un038313.exe 3844 un924104.exe 2760 pr005307.exe 4740 qu157097.exe 3096 rk658649.exe 1368 si601811.exe 3140 oneetx.exe 3888 oneetx.exe 3644 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1856 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pr005307.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr005307.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr005307.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
un038313.exeun924104.exe6109f63d790b633d9a16f5c6317d46be39a6665fe8f0903c4c5ccb869c0870d8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un038313.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un924104.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un924104.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6109f63d790b633d9a16f5c6317d46be39a6665fe8f0903c4c5ccb869c0870d8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6109f63d790b633d9a16f5c6317d46be39a6665fe8f0903c4c5ccb869c0870d8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un038313.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3748 2760 WerFault.exe pr005307.exe 4496 4740 WerFault.exe qu157097.exe 3148 1368 WerFault.exe si601811.exe 4604 1368 WerFault.exe si601811.exe 5016 1368 WerFault.exe si601811.exe 4260 1368 WerFault.exe si601811.exe 3520 1368 WerFault.exe si601811.exe 2344 1368 WerFault.exe si601811.exe 1292 1368 WerFault.exe si601811.exe 5116 1368 WerFault.exe si601811.exe 1640 1368 WerFault.exe si601811.exe 3568 1368 WerFault.exe si601811.exe 3348 3140 WerFault.exe oneetx.exe 4040 3140 WerFault.exe oneetx.exe 504 3140 WerFault.exe oneetx.exe 4768 3140 WerFault.exe oneetx.exe 4052 3140 WerFault.exe oneetx.exe 2584 3140 WerFault.exe oneetx.exe 1820 3140 WerFault.exe oneetx.exe 3716 3140 WerFault.exe oneetx.exe 4952 3140 WerFault.exe oneetx.exe 4928 3140 WerFault.exe oneetx.exe 2180 3140 WerFault.exe oneetx.exe 380 3140 WerFault.exe oneetx.exe 3760 3888 WerFault.exe oneetx.exe 3096 3140 WerFault.exe oneetx.exe 5016 3140 WerFault.exe oneetx.exe 1452 3140 WerFault.exe oneetx.exe 4660 3644 WerFault.exe oneetx.exe 2380 3140 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pr005307.exequ157097.exerk658649.exepid process 2760 pr005307.exe 2760 pr005307.exe 4740 qu157097.exe 4740 qu157097.exe 3096 rk658649.exe 3096 rk658649.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pr005307.exequ157097.exerk658649.exedescription pid process Token: SeDebugPrivilege 2760 pr005307.exe Token: SeDebugPrivilege 4740 qu157097.exe Token: SeDebugPrivilege 3096 rk658649.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
si601811.exepid process 1368 si601811.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
6109f63d790b633d9a16f5c6317d46be39a6665fe8f0903c4c5ccb869c0870d8.exeun038313.exeun924104.exesi601811.exeoneetx.exedescription pid process target process PID 3384 wrote to memory of 1980 3384 6109f63d790b633d9a16f5c6317d46be39a6665fe8f0903c4c5ccb869c0870d8.exe un038313.exe PID 3384 wrote to memory of 1980 3384 6109f63d790b633d9a16f5c6317d46be39a6665fe8f0903c4c5ccb869c0870d8.exe un038313.exe PID 3384 wrote to memory of 1980 3384 6109f63d790b633d9a16f5c6317d46be39a6665fe8f0903c4c5ccb869c0870d8.exe un038313.exe PID 1980 wrote to memory of 3844 1980 un038313.exe un924104.exe PID 1980 wrote to memory of 3844 1980 un038313.exe un924104.exe PID 1980 wrote to memory of 3844 1980 un038313.exe un924104.exe PID 3844 wrote to memory of 2760 3844 un924104.exe pr005307.exe PID 3844 wrote to memory of 2760 3844 un924104.exe pr005307.exe PID 3844 wrote to memory of 2760 3844 un924104.exe pr005307.exe PID 3844 wrote to memory of 4740 3844 un924104.exe qu157097.exe PID 3844 wrote to memory of 4740 3844 un924104.exe qu157097.exe PID 3844 wrote to memory of 4740 3844 un924104.exe qu157097.exe PID 1980 wrote to memory of 3096 1980 un038313.exe rk658649.exe PID 1980 wrote to memory of 3096 1980 un038313.exe rk658649.exe PID 1980 wrote to memory of 3096 1980 un038313.exe rk658649.exe PID 3384 wrote to memory of 1368 3384 6109f63d790b633d9a16f5c6317d46be39a6665fe8f0903c4c5ccb869c0870d8.exe si601811.exe PID 3384 wrote to memory of 1368 3384 6109f63d790b633d9a16f5c6317d46be39a6665fe8f0903c4c5ccb869c0870d8.exe si601811.exe PID 3384 wrote to memory of 1368 3384 6109f63d790b633d9a16f5c6317d46be39a6665fe8f0903c4c5ccb869c0870d8.exe si601811.exe PID 1368 wrote to memory of 3140 1368 si601811.exe oneetx.exe PID 1368 wrote to memory of 3140 1368 si601811.exe oneetx.exe PID 1368 wrote to memory of 3140 1368 si601811.exe oneetx.exe PID 3140 wrote to memory of 1536 3140 oneetx.exe schtasks.exe PID 3140 wrote to memory of 1536 3140 oneetx.exe schtasks.exe PID 3140 wrote to memory of 1536 3140 oneetx.exe schtasks.exe PID 3140 wrote to memory of 1856 3140 oneetx.exe rundll32.exe PID 3140 wrote to memory of 1856 3140 oneetx.exe rundll32.exe PID 3140 wrote to memory of 1856 3140 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6109f63d790b633d9a16f5c6317d46be39a6665fe8f0903c4c5ccb869c0870d8.exe"C:\Users\Admin\AppData\Local\Temp\6109f63d790b633d9a16f5c6317d46be39a6665fe8f0903c4c5ccb869c0870d8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un038313.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un038313.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un924104.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un924104.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr005307.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr005307.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 10845⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu157097.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu157097.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 19565⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk658649.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk658649.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si601811.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si601811.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 7043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 7803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 9043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 9723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 9723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 12203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 12123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 13203⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 8764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 9364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 10884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 10884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 11084⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 9124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 12844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 14324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 11244⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 16284⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 14364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 16444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 13563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2760 -ip 27601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4740 -ip 47401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1368 -ip 13681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3140 -ip 31401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3140 -ip 31401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3140 -ip 31401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3140 -ip 31401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3140 -ip 31401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3140 -ip 31401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3140 -ip 31401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3140 -ip 31401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3140 -ip 31401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3140 -ip 31401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3140 -ip 31401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3140 -ip 31401⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3888 -ip 38881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3140 -ip 31401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3140 -ip 31401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3140 -ip 31401⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3644 -ip 36441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3140 -ip 31401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si601811.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si601811.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un038313.exeFilesize
674KB
MD50b2b7b4cc339a7d2093d617a0a84e2bc
SHA1d0ce635762b62808e71c7685a5ddf2503887e409
SHA2569ca809e3d4947610e8d5f6ee5df9771c36b9ae7383263875a2a5bb72ddd12c90
SHA5123f99b6f61c194d40d1c126f21859c182ecc4dac9cc638b1d84f95828accd456029064fabac3ce356a5ba8c1d7327be3376619aff061b028cdf784928813ad64f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un038313.exeFilesize
674KB
MD50b2b7b4cc339a7d2093d617a0a84e2bc
SHA1d0ce635762b62808e71c7685a5ddf2503887e409
SHA2569ca809e3d4947610e8d5f6ee5df9771c36b9ae7383263875a2a5bb72ddd12c90
SHA5123f99b6f61c194d40d1c126f21859c182ecc4dac9cc638b1d84f95828accd456029064fabac3ce356a5ba8c1d7327be3376619aff061b028cdf784928813ad64f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk658649.exeFilesize
169KB
MD534f6df9ba12b32f75aa1215e211ab67a
SHA1db36f01f8cf34727d1392a6b2bc87d48019bccf4
SHA256246482111675fcfed4cabb7b753c46dfe259ef2b7521b04d9a8d3e0515dca4d8
SHA51242c199f478a8678de6ad89ebbf31f979ca5f7564b6ebecbd58ade3ec53f2e93998dd986ccd17d1c169be0e3028d5e6fb55f0599d999f701a982dfba00a796c45
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk658649.exeFilesize
169KB
MD534f6df9ba12b32f75aa1215e211ab67a
SHA1db36f01f8cf34727d1392a6b2bc87d48019bccf4
SHA256246482111675fcfed4cabb7b753c46dfe259ef2b7521b04d9a8d3e0515dca4d8
SHA51242c199f478a8678de6ad89ebbf31f979ca5f7564b6ebecbd58ade3ec53f2e93998dd986ccd17d1c169be0e3028d5e6fb55f0599d999f701a982dfba00a796c45
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un924104.exeFilesize
520KB
MD5199a846fe66a9a233f522e19b5205e5b
SHA1805efbe0ae92377493724398e8047f9cc4632d9a
SHA2569dcf24af8dfaf8505f112e65e5539c1ee3d505bb426aae264f7acf2430db95cb
SHA51229aeb337ce7f1d5b4986cc837732905e2de1fa1a6b598e7c29b577d747b9ef653a2a8239b12177fde79c2cc37d26dc41fbcd1acdd6542390babc4288fedc18db
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un924104.exeFilesize
520KB
MD5199a846fe66a9a233f522e19b5205e5b
SHA1805efbe0ae92377493724398e8047f9cc4632d9a
SHA2569dcf24af8dfaf8505f112e65e5539c1ee3d505bb426aae264f7acf2430db95cb
SHA51229aeb337ce7f1d5b4986cc837732905e2de1fa1a6b598e7c29b577d747b9ef653a2a8239b12177fde79c2cc37d26dc41fbcd1acdd6542390babc4288fedc18db
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr005307.exeFilesize
239KB
MD5d2a2bde289d2e7718da51d90f1625a71
SHA17f606c4cb9905bf80187e72055629d1bffe66de9
SHA256ccdccc2b330e4fc84b1bca47fa2dcb44043668354296b93bb1635521ef9878e4
SHA5128c4f2ac3fba7e81dac44c6171b34975dceb760d3c25c034b5f958ef0404426203e526f70a47f487edbd7f9bd3995fb2bcbe63f14ed3eaa108e9aa3981caac6dc
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr005307.exeFilesize
239KB
MD5d2a2bde289d2e7718da51d90f1625a71
SHA17f606c4cb9905bf80187e72055629d1bffe66de9
SHA256ccdccc2b330e4fc84b1bca47fa2dcb44043668354296b93bb1635521ef9878e4
SHA5128c4f2ac3fba7e81dac44c6171b34975dceb760d3c25c034b5f958ef0404426203e526f70a47f487edbd7f9bd3995fb2bcbe63f14ed3eaa108e9aa3981caac6dc
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu157097.exeFilesize
297KB
MD5fa214922ff749e5f34e39e22724e8680
SHA15b3d82b359d44943de48fa8a61c51e6ee65d3981
SHA256e158340b4cafc45118da2c651aec5f39b6077f8ef86df0efffec13ba5c316e7e
SHA512db4457af0ca86f249dd27cccae3f59cf8f5c420165de1a355d4cb7a1f309e40f51c63aec70f8aa4d7abcc9e190bca834708d557f040f260d0552511f3aadd19b
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu157097.exeFilesize
297KB
MD5fa214922ff749e5f34e39e22724e8680
SHA15b3d82b359d44943de48fa8a61c51e6ee65d3981
SHA256e158340b4cafc45118da2c651aec5f39b6077f8ef86df0efffec13ba5c316e7e
SHA512db4457af0ca86f249dd27cccae3f59cf8f5c420165de1a355d4cb7a1f309e40f51c63aec70f8aa4d7abcc9e190bca834708d557f040f260d0552511f3aadd19b
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1368-1135-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB
-
memory/2760-157-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/2760-174-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2760-178-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2760-180-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2760-182-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2760-184-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2760-186-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2760-187-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2760-188-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/2760-189-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/2760-190-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/2760-192-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2760-155-0x0000000004BC0000-0x0000000005164000-memory.dmpFilesize
5.6MB
-
memory/2760-176-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2760-172-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2760-170-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2760-168-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2760-166-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2760-164-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2760-162-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2760-160-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2760-159-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2760-158-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/2760-156-0x0000000000580000-0x00000000005AD000-memory.dmpFilesize
180KB
-
memory/3096-1129-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/3096-1128-0x0000000000670000-0x00000000006A0000-memory.dmpFilesize
192KB
-
memory/4740-210-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-224-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-226-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-228-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-230-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-406-0x0000000000650000-0x000000000069B000-memory.dmpFilesize
300KB
-
memory/4740-409-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4740-411-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4740-408-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4740-1107-0x00000000052E0000-0x00000000058F8000-memory.dmpFilesize
6.1MB
-
memory/4740-1108-0x0000000005900000-0x0000000005A0A000-memory.dmpFilesize
1.0MB
-
memory/4740-1109-0x0000000004BF0000-0x0000000004C02000-memory.dmpFilesize
72KB
-
memory/4740-1110-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4740-1111-0x0000000005A10000-0x0000000005A4C000-memory.dmpFilesize
240KB
-
memory/4740-1112-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/4740-1113-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/4740-1115-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4740-1116-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4740-1117-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4740-1118-0x0000000006590000-0x0000000006606000-memory.dmpFilesize
472KB
-
memory/4740-1119-0x0000000006620000-0x0000000006670000-memory.dmpFilesize
320KB
-
memory/4740-222-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-220-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-218-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-212-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-216-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-214-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-208-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-206-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-204-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-202-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-200-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-198-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-197-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4740-1120-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4740-1121-0x00000000066D0000-0x0000000006892000-memory.dmpFilesize
1.8MB
-
memory/4740-1122-0x00000000068A0000-0x0000000006DCC000-memory.dmpFilesize
5.2MB