Analysis
-
max time kernel
149s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 20:28
Static task
static1
General
-
Target
e2971db5508e46d672a93d99d010c49e45c3e491259af8afb882f25797ee9e4d.exe
-
Size
801KB
-
MD5
e71eeb20faa1571f8ed5607a898e3d54
-
SHA1
770e1cebd0d6a92bed4458e3aed706a512cf480b
-
SHA256
e2971db5508e46d672a93d99d010c49e45c3e491259af8afb882f25797ee9e4d
-
SHA512
b5538ad3e6ce636bf2e8072ebaac8c53decf2bb104683ab2895a564087c77308e456af843694a4838b68672910145fecccd9aa50deb5917f972eb6d38ab31e52
-
SSDEEP
24576:6y4XZEhiZh3Z7INRxf1iOq4s0Rl2FBbcm:B4pSiN7ERxTqt0RSBbc
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
it246570.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it246570.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it246570.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it246570.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it246570.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it246570.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it246570.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/2264-165-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-168-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-170-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-166-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-172-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-174-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-176-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-178-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-180-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-182-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-184-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-186-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-188-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-190-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-192-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-194-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-196-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-198-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-200-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-202-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-204-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-206-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-208-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-210-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-212-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-214-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-216-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-218-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-220-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-222-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-224-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-226-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/2264-228-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr643858.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation lr643858.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
zizA0666.exezinz3690.exeit246570.exejr879900.exekp537960.exelr643858.exeoneetx.exeoneetx.exeoneetx.exepid process 5068 zizA0666.exe 4676 zinz3690.exe 1704 it246570.exe 2264 jr879900.exe 2964 kp537960.exe 3540 lr643858.exe 2256 oneetx.exe 3384 oneetx.exe 5100 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4612 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it246570.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it246570.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
zizA0666.exezinz3690.exee2971db5508e46d672a93d99d010c49e45c3e491259af8afb882f25797ee9e4d.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zizA0666.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zizA0666.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zinz3690.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zinz3690.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce e2971db5508e46d672a93d99d010c49e45c3e491259af8afb882f25797ee9e4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e2971db5508e46d672a93d99d010c49e45c3e491259af8afb882f25797ee9e4d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 29 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2660 2264 WerFault.exe jr879900.exe 4068 3540 WerFault.exe lr643858.exe 2332 3540 WerFault.exe lr643858.exe 3200 3540 WerFault.exe lr643858.exe 1064 3540 WerFault.exe lr643858.exe 1776 3540 WerFault.exe lr643858.exe 4016 3540 WerFault.exe lr643858.exe 2824 3540 WerFault.exe lr643858.exe 3704 3540 WerFault.exe lr643858.exe 4808 3540 WerFault.exe lr643858.exe 3764 3540 WerFault.exe lr643858.exe 3216 2256 WerFault.exe oneetx.exe 1068 2256 WerFault.exe oneetx.exe 3700 2256 WerFault.exe oneetx.exe 548 2256 WerFault.exe oneetx.exe 4596 2256 WerFault.exe oneetx.exe 488 2256 WerFault.exe oneetx.exe 4812 2256 WerFault.exe oneetx.exe 3228 2256 WerFault.exe oneetx.exe 396 2256 WerFault.exe oneetx.exe 3292 2256 WerFault.exe oneetx.exe 224 2256 WerFault.exe oneetx.exe 640 2256 WerFault.exe oneetx.exe 2896 2256 WerFault.exe oneetx.exe 1668 3384 WerFault.exe oneetx.exe 2536 2256 WerFault.exe oneetx.exe 2136 2256 WerFault.exe oneetx.exe 4448 2256 WerFault.exe oneetx.exe 2180 5100 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it246570.exejr879900.exekp537960.exepid process 1704 it246570.exe 1704 it246570.exe 2264 jr879900.exe 2264 jr879900.exe 2964 kp537960.exe 2964 kp537960.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it246570.exejr879900.exekp537960.exedescription pid process Token: SeDebugPrivilege 1704 it246570.exe Token: SeDebugPrivilege 2264 jr879900.exe Token: SeDebugPrivilege 2964 kp537960.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr643858.exepid process 3540 lr643858.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
e2971db5508e46d672a93d99d010c49e45c3e491259af8afb882f25797ee9e4d.exezizA0666.exezinz3690.exelr643858.exeoneetx.exedescription pid process target process PID 1260 wrote to memory of 5068 1260 e2971db5508e46d672a93d99d010c49e45c3e491259af8afb882f25797ee9e4d.exe zizA0666.exe PID 1260 wrote to memory of 5068 1260 e2971db5508e46d672a93d99d010c49e45c3e491259af8afb882f25797ee9e4d.exe zizA0666.exe PID 1260 wrote to memory of 5068 1260 e2971db5508e46d672a93d99d010c49e45c3e491259af8afb882f25797ee9e4d.exe zizA0666.exe PID 5068 wrote to memory of 4676 5068 zizA0666.exe zinz3690.exe PID 5068 wrote to memory of 4676 5068 zizA0666.exe zinz3690.exe PID 5068 wrote to memory of 4676 5068 zizA0666.exe zinz3690.exe PID 4676 wrote to memory of 1704 4676 zinz3690.exe it246570.exe PID 4676 wrote to memory of 1704 4676 zinz3690.exe it246570.exe PID 4676 wrote to memory of 2264 4676 zinz3690.exe jr879900.exe PID 4676 wrote to memory of 2264 4676 zinz3690.exe jr879900.exe PID 4676 wrote to memory of 2264 4676 zinz3690.exe jr879900.exe PID 5068 wrote to memory of 2964 5068 zizA0666.exe kp537960.exe PID 5068 wrote to memory of 2964 5068 zizA0666.exe kp537960.exe PID 5068 wrote to memory of 2964 5068 zizA0666.exe kp537960.exe PID 1260 wrote to memory of 3540 1260 e2971db5508e46d672a93d99d010c49e45c3e491259af8afb882f25797ee9e4d.exe lr643858.exe PID 1260 wrote to memory of 3540 1260 e2971db5508e46d672a93d99d010c49e45c3e491259af8afb882f25797ee9e4d.exe lr643858.exe PID 1260 wrote to memory of 3540 1260 e2971db5508e46d672a93d99d010c49e45c3e491259af8afb882f25797ee9e4d.exe lr643858.exe PID 3540 wrote to memory of 2256 3540 lr643858.exe oneetx.exe PID 3540 wrote to memory of 2256 3540 lr643858.exe oneetx.exe PID 3540 wrote to memory of 2256 3540 lr643858.exe oneetx.exe PID 2256 wrote to memory of 320 2256 oneetx.exe schtasks.exe PID 2256 wrote to memory of 320 2256 oneetx.exe schtasks.exe PID 2256 wrote to memory of 320 2256 oneetx.exe schtasks.exe PID 2256 wrote to memory of 4612 2256 oneetx.exe rundll32.exe PID 2256 wrote to memory of 4612 2256 oneetx.exe rundll32.exe PID 2256 wrote to memory of 4612 2256 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2971db5508e46d672a93d99d010c49e45c3e491259af8afb882f25797ee9e4d.exe"C:\Users\Admin\AppData\Local\Temp\e2971db5508e46d672a93d99d010c49e45c3e491259af8afb882f25797ee9e4d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizA0666.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizA0666.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zinz3690.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zinz3690.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it246570.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it246570.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr879900.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr879900.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 13565⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp537960.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp537960.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr643858.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr643858.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 7803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 8643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 9723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 9643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 12083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 12243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 7044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 8924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 11124⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 10204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 12724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 7084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 9004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 15364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 16324⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 16524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 16484⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 13563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2264 -ip 22641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3540 -ip 35401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3540 -ip 35401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3540 -ip 35401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3540 -ip 35401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3540 -ip 35401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3540 -ip 35401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3540 -ip 35401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3540 -ip 35401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3540 -ip 35401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3540 -ip 35401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2256 -ip 22561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2256 -ip 22561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2256 -ip 22561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2256 -ip 22561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2256 -ip 22561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2256 -ip 22561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2256 -ip 22561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2256 -ip 22561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2256 -ip 22561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2256 -ip 22561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2256 -ip 22561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2256 -ip 22561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2256 -ip 22561⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3384 -ip 33841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2256 -ip 22561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2256 -ip 22561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2256 -ip 22561⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 3162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5100 -ip 51001⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr643858.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr643858.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizA0666.exeFilesize
536KB
MD577e8a7f3d3f6f5440922356e7fba6452
SHA146c12ec81efa982da52ed571e0c50bcd474cc9ff
SHA256e6bbe26f248f47846f13d1f44fb42ad08f7dd2ea8d55f35809049e6aaab1230e
SHA51287e4d31b1e438d94080299642d02263d8142020482f518cd14e25e8ef9c57c2682d9fac53acd31d8a2482054ae09060c768ac9cf4513795a780a33e5dcfe12ba
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizA0666.exeFilesize
536KB
MD577e8a7f3d3f6f5440922356e7fba6452
SHA146c12ec81efa982da52ed571e0c50bcd474cc9ff
SHA256e6bbe26f248f47846f13d1f44fb42ad08f7dd2ea8d55f35809049e6aaab1230e
SHA51287e4d31b1e438d94080299642d02263d8142020482f518cd14e25e8ef9c57c2682d9fac53acd31d8a2482054ae09060c768ac9cf4513795a780a33e5dcfe12ba
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp537960.exeFilesize
169KB
MD5413ddabf90815b63219f50cbec43b627
SHA16c9de0fe2584462a7754d0b6548d3932416d648c
SHA25651ee45ec963842804395d163364784c6b064c9cd482eff0f5455715cd90674fd
SHA512ce7d397e65fb6b6f085f5f4613f3ea805991c46d69968b514874caee11762ae99ee95b048dbe44fd4b73d8b39a70832da410a68b4a725ffc0e9f674e6793e205
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp537960.exeFilesize
169KB
MD5413ddabf90815b63219f50cbec43b627
SHA16c9de0fe2584462a7754d0b6548d3932416d648c
SHA25651ee45ec963842804395d163364784c6b064c9cd482eff0f5455715cd90674fd
SHA512ce7d397e65fb6b6f085f5f4613f3ea805991c46d69968b514874caee11762ae99ee95b048dbe44fd4b73d8b39a70832da410a68b4a725ffc0e9f674e6793e205
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zinz3690.exeFilesize
382KB
MD55388f0a49537d44dd6f828e91b59cf5c
SHA1c1909aeeef7693907ca4c614da5859076807d78c
SHA2564431c852935c82ac595c87b8b36b2e4aac7f2afcc7bf12f1c02e8f1b0262abcb
SHA512520d0cda74178b451c2d923f8ed485d3abf9d71992656691714d15d7dca946d07f267beac6f3545061a69d24fba56d63247d1b6e0922f0d609d5c826a83cb405
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zinz3690.exeFilesize
382KB
MD55388f0a49537d44dd6f828e91b59cf5c
SHA1c1909aeeef7693907ca4c614da5859076807d78c
SHA2564431c852935c82ac595c87b8b36b2e4aac7f2afcc7bf12f1c02e8f1b0262abcb
SHA512520d0cda74178b451c2d923f8ed485d3abf9d71992656691714d15d7dca946d07f267beac6f3545061a69d24fba56d63247d1b6e0922f0d609d5c826a83cb405
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it246570.exeFilesize
11KB
MD54c9d144dcabb867ef0774fc2c469639e
SHA1a16cf50f7e46e0cb02e75f2d065d9a4057b03177
SHA256dbbd7477e8fd935f419df33e5afd87095bccd5b317690b0e4bf58cd418689b0c
SHA512328e4a104c6b0927c01c6a5a9210e929a630b3bb8e7ce914d6585dd8d38ea6f106ce2962ba13aa3678403a8f5f4a1c3592fa87269a14f874e840bd893af77e66
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it246570.exeFilesize
11KB
MD54c9d144dcabb867ef0774fc2c469639e
SHA1a16cf50f7e46e0cb02e75f2d065d9a4057b03177
SHA256dbbd7477e8fd935f419df33e5afd87095bccd5b317690b0e4bf58cd418689b0c
SHA512328e4a104c6b0927c01c6a5a9210e929a630b3bb8e7ce914d6585dd8d38ea6f106ce2962ba13aa3678403a8f5f4a1c3592fa87269a14f874e840bd893af77e66
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr879900.exeFilesize
297KB
MD50de5a3b7acdf65b1cdfef92373fae8a7
SHA186f294145dc70a8df580752691bb5e659dcc7421
SHA256d4af50e3c6f238931e57c2b1930c3f445a52943e76685b8c9a96ca30ff8b3a59
SHA5125b6637a1125bc2db3151b63cc58e6709a1b4661c9fb7e3beab596310c8c84e4a7ffd5936d7ead1f76b62842bda63f8f0b20ca4598524ef7a24b097e91dc10b08
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr879900.exeFilesize
297KB
MD50de5a3b7acdf65b1cdfef92373fae8a7
SHA186f294145dc70a8df580752691bb5e659dcc7421
SHA256d4af50e3c6f238931e57c2b1930c3f445a52943e76685b8c9a96ca30ff8b3a59
SHA5125b6637a1125bc2db3151b63cc58e6709a1b4661c9fb7e3beab596310c8c84e4a7ffd5936d7ead1f76b62842bda63f8f0b20ca4598524ef7a24b097e91dc10b08
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1704-154-0x0000000000AD0000-0x0000000000ADA000-memory.dmpFilesize
40KB
-
memory/2264-204-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-226-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-176-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-178-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-180-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-182-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-184-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-186-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-188-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-190-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-192-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-194-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-196-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-198-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-200-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-202-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-172-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-206-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-208-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-210-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-212-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-214-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-216-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-218-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-220-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-222-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-224-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-174-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-228-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-1071-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/2264-1072-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/2264-1073-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/2264-1074-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/2264-1075-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/2264-1077-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/2264-1078-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/2264-1079-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/2264-1080-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/2264-1081-0x00000000065B0000-0x0000000006772000-memory.dmpFilesize
1.8MB
-
memory/2264-1082-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/2264-1083-0x0000000006790000-0x0000000006CBC000-memory.dmpFilesize
5.2MB
-
memory/2264-1084-0x0000000006DE0000-0x0000000006E56000-memory.dmpFilesize
472KB
-
memory/2264-1085-0x0000000006E80000-0x0000000006ED0000-memory.dmpFilesize
320KB
-
memory/2264-160-0x00000000004C0000-0x000000000050B000-memory.dmpFilesize
300KB
-
memory/2264-161-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/2264-162-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/2264-166-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-170-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-168-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-165-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2264-164-0x0000000004C40000-0x00000000051E4000-memory.dmpFilesize
5.6MB
-
memory/2264-163-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/2964-1092-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/2964-1091-0x0000000000020000-0x0000000000050000-memory.dmpFilesize
192KB
-
memory/3540-1098-0x0000000000590000-0x00000000005CB000-memory.dmpFilesize
236KB