Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 20:25
Static task
static1
General
-
Target
e730d7ed85ae230af17eb1995a29b753da36de4f9729e4c46d304b36c6bae3a6.exe
-
Size
800KB
-
MD5
916109fad7ffe0a4c99ef5104ea1a0d2
-
SHA1
25839f39e0f84c5b7cfa2784a7212f7361a7db3c
-
SHA256
e730d7ed85ae230af17eb1995a29b753da36de4f9729e4c46d304b36c6bae3a6
-
SHA512
2a1d372d3f4956e7c5a4e32cd8fa6fbb7a5c323812b3a5bc8a686f26be8007c4ace11e6096cf182c9d7939b2ffe9f5ca1b6500e46443af465b4598689b9be5eb
-
SSDEEP
12288:jMryy901988zPBt8Lo1qcNMgZySBQ2HxK7CZlguIRY1OfwnXP4abWL:1yC7Bt0sNMSyMQ8xfIvRQOfwnXzbm
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
it783060.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it783060.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it783060.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it783060.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it783060.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it783060.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it783060.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4424-165-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-166-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-168-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-170-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-172-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-174-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-176-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-178-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-180-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-182-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-184-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-186-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-188-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-190-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-192-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-194-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-196-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-198-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-200-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-202-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-204-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-206-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-208-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-210-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-212-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-214-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-216-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-218-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-220-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-222-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-224-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-226-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4424-228-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr963527.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation lr963527.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
Processes:
ziWX4935.exeziPp0077.exeit783060.exejr741698.exekp966572.exelr963527.exeoneetx.exeoneetx.exepid process 1520 ziWX4935.exe 1264 ziPp0077.exe 2080 it783060.exe 4424 jr741698.exe 2632 kp966572.exe 3740 lr963527.exe 4752 oneetx.exe 2780 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1540 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it783060.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it783060.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
e730d7ed85ae230af17eb1995a29b753da36de4f9729e4c46d304b36c6bae3a6.exeziWX4935.exeziPp0077.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e730d7ed85ae230af17eb1995a29b753da36de4f9729e4c46d304b36c6bae3a6.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziWX4935.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziWX4935.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziPp0077.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ziPp0077.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce e730d7ed85ae230af17eb1995a29b753da36de4f9729e4c46d304b36c6bae3a6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 27 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4328 4424 WerFault.exe jr741698.exe 2328 3740 WerFault.exe lr963527.exe 3572 3740 WerFault.exe lr963527.exe 904 3740 WerFault.exe lr963527.exe 4728 3740 WerFault.exe lr963527.exe 1748 3740 WerFault.exe lr963527.exe 4924 3740 WerFault.exe lr963527.exe 4820 3740 WerFault.exe lr963527.exe 3348 3740 WerFault.exe lr963527.exe 2156 3740 WerFault.exe lr963527.exe 3564 3740 WerFault.exe lr963527.exe 4960 4752 WerFault.exe oneetx.exe 728 4752 WerFault.exe oneetx.exe 948 4752 WerFault.exe oneetx.exe 4028 4752 WerFault.exe oneetx.exe 2688 4752 WerFault.exe oneetx.exe 4464 4752 WerFault.exe oneetx.exe 2356 4752 WerFault.exe oneetx.exe 1672 4752 WerFault.exe oneetx.exe 3304 4752 WerFault.exe oneetx.exe 3932 4752 WerFault.exe oneetx.exe 4468 4752 WerFault.exe oneetx.exe 1408 4752 WerFault.exe oneetx.exe 2676 2780 WerFault.exe oneetx.exe 2536 4752 WerFault.exe oneetx.exe 2084 4752 WerFault.exe oneetx.exe 2328 4752 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it783060.exejr741698.exekp966572.exepid process 2080 it783060.exe 2080 it783060.exe 4424 jr741698.exe 4424 jr741698.exe 2632 kp966572.exe 2632 kp966572.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it783060.exejr741698.exekp966572.exedescription pid process Token: SeDebugPrivilege 2080 it783060.exe Token: SeDebugPrivilege 4424 jr741698.exe Token: SeDebugPrivilege 2632 kp966572.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr963527.exepid process 3740 lr963527.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
e730d7ed85ae230af17eb1995a29b753da36de4f9729e4c46d304b36c6bae3a6.exeziWX4935.exeziPp0077.exelr963527.exeoneetx.exedescription pid process target process PID 832 wrote to memory of 1520 832 e730d7ed85ae230af17eb1995a29b753da36de4f9729e4c46d304b36c6bae3a6.exe ziWX4935.exe PID 832 wrote to memory of 1520 832 e730d7ed85ae230af17eb1995a29b753da36de4f9729e4c46d304b36c6bae3a6.exe ziWX4935.exe PID 832 wrote to memory of 1520 832 e730d7ed85ae230af17eb1995a29b753da36de4f9729e4c46d304b36c6bae3a6.exe ziWX4935.exe PID 1520 wrote to memory of 1264 1520 ziWX4935.exe ziPp0077.exe PID 1520 wrote to memory of 1264 1520 ziWX4935.exe ziPp0077.exe PID 1520 wrote to memory of 1264 1520 ziWX4935.exe ziPp0077.exe PID 1264 wrote to memory of 2080 1264 ziPp0077.exe it783060.exe PID 1264 wrote to memory of 2080 1264 ziPp0077.exe it783060.exe PID 1264 wrote to memory of 4424 1264 ziPp0077.exe jr741698.exe PID 1264 wrote to memory of 4424 1264 ziPp0077.exe jr741698.exe PID 1264 wrote to memory of 4424 1264 ziPp0077.exe jr741698.exe PID 1520 wrote to memory of 2632 1520 ziWX4935.exe kp966572.exe PID 1520 wrote to memory of 2632 1520 ziWX4935.exe kp966572.exe PID 1520 wrote to memory of 2632 1520 ziWX4935.exe kp966572.exe PID 832 wrote to memory of 3740 832 e730d7ed85ae230af17eb1995a29b753da36de4f9729e4c46d304b36c6bae3a6.exe lr963527.exe PID 832 wrote to memory of 3740 832 e730d7ed85ae230af17eb1995a29b753da36de4f9729e4c46d304b36c6bae3a6.exe lr963527.exe PID 832 wrote to memory of 3740 832 e730d7ed85ae230af17eb1995a29b753da36de4f9729e4c46d304b36c6bae3a6.exe lr963527.exe PID 3740 wrote to memory of 4752 3740 lr963527.exe oneetx.exe PID 3740 wrote to memory of 4752 3740 lr963527.exe oneetx.exe PID 3740 wrote to memory of 4752 3740 lr963527.exe oneetx.exe PID 4752 wrote to memory of 1764 4752 oneetx.exe schtasks.exe PID 4752 wrote to memory of 1764 4752 oneetx.exe schtasks.exe PID 4752 wrote to memory of 1764 4752 oneetx.exe schtasks.exe PID 4752 wrote to memory of 1540 4752 oneetx.exe rundll32.exe PID 4752 wrote to memory of 1540 4752 oneetx.exe rundll32.exe PID 4752 wrote to memory of 1540 4752 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e730d7ed85ae230af17eb1995a29b753da36de4f9729e4c46d304b36c6bae3a6.exe"C:\Users\Admin\AppData\Local\Temp\e730d7ed85ae230af17eb1995a29b753da36de4f9729e4c46d304b36c6bae3a6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWX4935.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWX4935.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziPp0077.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziPp0077.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it783060.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it783060.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr741698.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr741698.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 19125⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp966572.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp966572.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr963527.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr963527.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 7803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 9603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 9883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 9883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 12163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 12483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 12883⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 8324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 9044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 10604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 10804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 10644⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 10004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 6844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 6764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 10004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 11084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 16204⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 13724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 16284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 8643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4424 -ip 44241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4752 -ip 47521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4752 -ip 47521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4752 -ip 47521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4752 -ip 47521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4752 -ip 47521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4752 -ip 47521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4752 -ip 47521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4752 -ip 47521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4752 -ip 47521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4752 -ip 47521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4752 -ip 47521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4752 -ip 47521⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2780 -ip 27801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4752 -ip 47521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4752 -ip 47521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4752 -ip 47521⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr963527.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr963527.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWX4935.exeFilesize
536KB
MD5c380ecce0388fced69d9def1a1a11851
SHA1adb07eb8b0cc984e7926f7071534e750fafb232d
SHA25638b813708c39065c0a9aa4290fce9dd423e2c6df412f5f50653c63012e70e7b2
SHA512f9e14757affaf2175247995fc10062278a7248a25c3e0801f345715745ce9343afbd22e9d99e0ceec8f20a0515c041c9aae4a3969221bd37eb575bd8bbb5095b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWX4935.exeFilesize
536KB
MD5c380ecce0388fced69d9def1a1a11851
SHA1adb07eb8b0cc984e7926f7071534e750fafb232d
SHA25638b813708c39065c0a9aa4290fce9dd423e2c6df412f5f50653c63012e70e7b2
SHA512f9e14757affaf2175247995fc10062278a7248a25c3e0801f345715745ce9343afbd22e9d99e0ceec8f20a0515c041c9aae4a3969221bd37eb575bd8bbb5095b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp966572.exeFilesize
169KB
MD56e4232fdd59b5ebab5637148e8c66e97
SHA1440b24609c2b9336504559a474b2355941a40a32
SHA2565841db5589ebb442dfd491725d0b5afc98d0800c636cbcd843d54f5215a90f9b
SHA512b23918191d1cccf0b9b501f8d827334fdc86a1f775f83a63d2e62b6fcc3678292f2c7266bfb248d7ed74d11804b7595e5d2dd2439b8d03593124917e741a73ce
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp966572.exeFilesize
169KB
MD56e4232fdd59b5ebab5637148e8c66e97
SHA1440b24609c2b9336504559a474b2355941a40a32
SHA2565841db5589ebb442dfd491725d0b5afc98d0800c636cbcd843d54f5215a90f9b
SHA512b23918191d1cccf0b9b501f8d827334fdc86a1f775f83a63d2e62b6fcc3678292f2c7266bfb248d7ed74d11804b7595e5d2dd2439b8d03593124917e741a73ce
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziPp0077.exeFilesize
382KB
MD5d1d141e6b81dee9fb4a566b690e4e6d4
SHA104e1fdcc06b08f93a8c221721e6619f49d038636
SHA2560656d2f8c11925d0c91b3fcd0d0bc2b7197d2ee5ba87ab058cc8d47655a6ac59
SHA51244500554c5ff11f44151c20480d87f60653eee099e7c959dafa2af74c27e00461698cc614c558f1daafae7d968d1b6d04e2e42cc62318bef0db1edd8fb73c3f9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziPp0077.exeFilesize
382KB
MD5d1d141e6b81dee9fb4a566b690e4e6d4
SHA104e1fdcc06b08f93a8c221721e6619f49d038636
SHA2560656d2f8c11925d0c91b3fcd0d0bc2b7197d2ee5ba87ab058cc8d47655a6ac59
SHA51244500554c5ff11f44151c20480d87f60653eee099e7c959dafa2af74c27e00461698cc614c558f1daafae7d968d1b6d04e2e42cc62318bef0db1edd8fb73c3f9
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it783060.exeFilesize
11KB
MD5f53dad119013acb06f4fd3e93a724065
SHA1f22fa1aacedb1d95a7c56b4d570b3a7a88b9f1bf
SHA2564da084c70aac2e578fa72442175d8bcfe21e1fc04446922958c809fd783de34b
SHA512f1b3e9229265d5b0383474a1e2d07c3caee0644ed2e7c44e97637b5a4f4313dd919a175d64b5855a0fb9785f35c68ec610295168250045b6427d45670aee0225
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it783060.exeFilesize
11KB
MD5f53dad119013acb06f4fd3e93a724065
SHA1f22fa1aacedb1d95a7c56b4d570b3a7a88b9f1bf
SHA2564da084c70aac2e578fa72442175d8bcfe21e1fc04446922958c809fd783de34b
SHA512f1b3e9229265d5b0383474a1e2d07c3caee0644ed2e7c44e97637b5a4f4313dd919a175d64b5855a0fb9785f35c68ec610295168250045b6427d45670aee0225
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr741698.exeFilesize
297KB
MD5abba4c25c0fd00f920daed043ac62a05
SHA14df886a3eb7e42b52912ffa866ad132850426c30
SHA256184d610556cc476baae33ca7bc10c686e83910fc6ba64686a7b0e9ffc54fb347
SHA512d130ec95a3e75b1a72204f8960fbaa1a62e284de3c506dd28816c31026103a2e4a1861a533e77108483aa8c467ef2f94a953c309f3495adbd07fe486aa517ec5
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr741698.exeFilesize
297KB
MD5abba4c25c0fd00f920daed043ac62a05
SHA14df886a3eb7e42b52912ffa866ad132850426c30
SHA256184d610556cc476baae33ca7bc10c686e83910fc6ba64686a7b0e9ffc54fb347
SHA512d130ec95a3e75b1a72204f8960fbaa1a62e284de3c506dd28816c31026103a2e4a1861a533e77108483aa8c467ef2f94a953c309f3495adbd07fe486aa517ec5
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/2080-154-0x0000000000DE0000-0x0000000000DEA000-memory.dmpFilesize
40KB
-
memory/2632-1091-0x00000000003B0000-0x00000000003E0000-memory.dmpFilesize
192KB
-
memory/2632-1094-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/2632-1092-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/3740-1099-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB
-
memory/4424-206-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-1071-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/4424-184-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-186-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-188-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-190-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-192-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-194-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-196-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-198-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-200-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-202-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-204-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-180-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-208-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-210-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-212-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-214-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-216-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-218-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-220-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-222-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-224-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-226-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-228-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-182-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-1072-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/4424-1073-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/4424-1074-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/4424-1075-0x0000000002560000-0x0000000002570000-memory.dmpFilesize
64KB
-
memory/4424-1077-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/4424-1078-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/4424-1079-0x0000000002560000-0x0000000002570000-memory.dmpFilesize
64KB
-
memory/4424-1080-0x0000000002560000-0x0000000002570000-memory.dmpFilesize
64KB
-
memory/4424-1081-0x00000000066E0000-0x0000000006756000-memory.dmpFilesize
472KB
-
memory/4424-1082-0x0000000006760000-0x00000000067B0000-memory.dmpFilesize
320KB
-
memory/4424-178-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-176-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-174-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-172-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-170-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-168-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-166-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-165-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4424-164-0x0000000002560000-0x0000000002570000-memory.dmpFilesize
64KB
-
memory/4424-163-0x0000000002560000-0x0000000002570000-memory.dmpFilesize
64KB
-
memory/4424-162-0x0000000004A80000-0x0000000005024000-memory.dmpFilesize
5.6MB
-
memory/4424-161-0x0000000002560000-0x0000000002570000-memory.dmpFilesize
64KB
-
memory/4424-160-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/4424-1083-0x0000000002560000-0x0000000002570000-memory.dmpFilesize
64KB
-
memory/4424-1084-0x0000000006950000-0x0000000006B12000-memory.dmpFilesize
1.8MB
-
memory/4424-1085-0x0000000006B20000-0x000000000704C000-memory.dmpFilesize
5.2MB