Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 20:29
Static task
static1
General
-
Target
eef95a339bd54865da508cef50692d793de2145363b0d242d6d99ffec56f9be9.exe
-
Size
801KB
-
MD5
dc972b85c0534b30a77b0c54b3cc2736
-
SHA1
881e23da3fade70bd1c70963c3f70c7413e95214
-
SHA256
eef95a339bd54865da508cef50692d793de2145363b0d242d6d99ffec56f9be9
-
SHA512
fc8666d9eeeca9f610f067acc3d05197fe48b7a35b1e5584c9f8b72758940509a6f6583edbd5ccd611636675dadf46446406a91b236f4995adf2e2c3009104c1
-
SSDEEP
12288:yMryy90DeJk5Wyn8oIe2hDiJ5dn5HFwcvfTkxK7CnaX/rQWlUeCyrhjaKsp:sybJC5Ie2hDivdXQxfavrQWWeCyr4Kq
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
it375449.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it375449.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it375449.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it375449.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it375449.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it375449.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it375449.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/4808-162-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-165-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-163-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-167-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-169-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-171-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-173-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-175-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-177-0x0000000004DE0000-0x0000000004DF0000-memory.dmp family_redline behavioral1/memory/4808-178-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-181-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-184-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-186-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-188-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-190-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-192-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-194-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-196-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-198-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-200-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-202-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-204-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-206-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-208-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-210-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-212-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-214-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-216-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-218-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-220-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-222-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-224-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-226-0x0000000002760000-0x000000000279F000-memory.dmp family_redline behavioral1/memory/4808-228-0x0000000002760000-0x000000000279F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr922594.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation lr922594.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
ziHu0863.exezicW9811.exeit375449.exejr801869.exekp206180.exelr922594.exeoneetx.exeoneetx.exeoneetx.exepid process 1184 ziHu0863.exe 636 zicW9811.exe 2452 it375449.exe 4808 jr801869.exe 2584 kp206180.exe 2112 lr922594.exe 4484 oneetx.exe 2808 oneetx.exe 2756 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1688 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it375449.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it375449.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
eef95a339bd54865da508cef50692d793de2145363b0d242d6d99ffec56f9be9.exeziHu0863.exezicW9811.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce eef95a339bd54865da508cef50692d793de2145363b0d242d6d99ffec56f9be9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" eef95a339bd54865da508cef50692d793de2145363b0d242d6d99ffec56f9be9.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziHu0863.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziHu0863.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zicW9811.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zicW9811.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 28 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 544 4808 WerFault.exe jr801869.exe 2196 2112 WerFault.exe lr922594.exe 2680 2112 WerFault.exe lr922594.exe 396 2112 WerFault.exe lr922594.exe 1020 2112 WerFault.exe lr922594.exe 4424 2112 WerFault.exe lr922594.exe 392 2112 WerFault.exe lr922594.exe 1128 2112 WerFault.exe lr922594.exe 3228 2112 WerFault.exe lr922594.exe 3656 2112 WerFault.exe lr922594.exe 4500 2112 WerFault.exe lr922594.exe 4624 4484 WerFault.exe oneetx.exe 4668 4484 WerFault.exe oneetx.exe 2404 4484 WerFault.exe oneetx.exe 2252 4484 WerFault.exe oneetx.exe 3900 4484 WerFault.exe oneetx.exe 3700 4484 WerFault.exe oneetx.exe 2132 4484 WerFault.exe oneetx.exe 1744 4484 WerFault.exe oneetx.exe 3112 4484 WerFault.exe oneetx.exe 1268 4484 WerFault.exe oneetx.exe 808 4484 WerFault.exe oneetx.exe 944 2808 WerFault.exe oneetx.exe 4068 4484 WerFault.exe oneetx.exe 2624 4484 WerFault.exe oneetx.exe 964 4484 WerFault.exe oneetx.exe 4680 2756 WerFault.exe oneetx.exe 2324 4484 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it375449.exejr801869.exekp206180.exepid process 2452 it375449.exe 2452 it375449.exe 4808 jr801869.exe 4808 jr801869.exe 2584 kp206180.exe 2584 kp206180.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it375449.exejr801869.exekp206180.exedescription pid process Token: SeDebugPrivilege 2452 it375449.exe Token: SeDebugPrivilege 4808 jr801869.exe Token: SeDebugPrivilege 2584 kp206180.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr922594.exepid process 2112 lr922594.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
eef95a339bd54865da508cef50692d793de2145363b0d242d6d99ffec56f9be9.exeziHu0863.exezicW9811.exelr922594.exeoneetx.exedescription pid process target process PID 4280 wrote to memory of 1184 4280 eef95a339bd54865da508cef50692d793de2145363b0d242d6d99ffec56f9be9.exe ziHu0863.exe PID 4280 wrote to memory of 1184 4280 eef95a339bd54865da508cef50692d793de2145363b0d242d6d99ffec56f9be9.exe ziHu0863.exe PID 4280 wrote to memory of 1184 4280 eef95a339bd54865da508cef50692d793de2145363b0d242d6d99ffec56f9be9.exe ziHu0863.exe PID 1184 wrote to memory of 636 1184 ziHu0863.exe zicW9811.exe PID 1184 wrote to memory of 636 1184 ziHu0863.exe zicW9811.exe PID 1184 wrote to memory of 636 1184 ziHu0863.exe zicW9811.exe PID 636 wrote to memory of 2452 636 zicW9811.exe it375449.exe PID 636 wrote to memory of 2452 636 zicW9811.exe it375449.exe PID 636 wrote to memory of 4808 636 zicW9811.exe jr801869.exe PID 636 wrote to memory of 4808 636 zicW9811.exe jr801869.exe PID 636 wrote to memory of 4808 636 zicW9811.exe jr801869.exe PID 1184 wrote to memory of 2584 1184 ziHu0863.exe kp206180.exe PID 1184 wrote to memory of 2584 1184 ziHu0863.exe kp206180.exe PID 1184 wrote to memory of 2584 1184 ziHu0863.exe kp206180.exe PID 4280 wrote to memory of 2112 4280 eef95a339bd54865da508cef50692d793de2145363b0d242d6d99ffec56f9be9.exe lr922594.exe PID 4280 wrote to memory of 2112 4280 eef95a339bd54865da508cef50692d793de2145363b0d242d6d99ffec56f9be9.exe lr922594.exe PID 4280 wrote to memory of 2112 4280 eef95a339bd54865da508cef50692d793de2145363b0d242d6d99ffec56f9be9.exe lr922594.exe PID 2112 wrote to memory of 4484 2112 lr922594.exe oneetx.exe PID 2112 wrote to memory of 4484 2112 lr922594.exe oneetx.exe PID 2112 wrote to memory of 4484 2112 lr922594.exe oneetx.exe PID 4484 wrote to memory of 4296 4484 oneetx.exe schtasks.exe PID 4484 wrote to memory of 4296 4484 oneetx.exe schtasks.exe PID 4484 wrote to memory of 4296 4484 oneetx.exe schtasks.exe PID 4484 wrote to memory of 1688 4484 oneetx.exe rundll32.exe PID 4484 wrote to memory of 1688 4484 oneetx.exe rundll32.exe PID 4484 wrote to memory of 1688 4484 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eef95a339bd54865da508cef50692d793de2145363b0d242d6d99ffec56f9be9.exe"C:\Users\Admin\AppData\Local\Temp\eef95a339bd54865da508cef50692d793de2145363b0d242d6d99ffec56f9be9.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHu0863.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHu0863.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zicW9811.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zicW9811.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it375449.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it375449.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr801869.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr801869.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 13405⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp206180.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp206180.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr922594.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr922594.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 7643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 8003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 8083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 9803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 9803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 12163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 12483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 7924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 8324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 10924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 10684⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 11164⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 7524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 9244⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 13204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 11324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 16044⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 15844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 16204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 14283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4808 -ip 48081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2112 -ip 21121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2112 -ip 21121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2112 -ip 21121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2112 -ip 21121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2112 -ip 21121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2112 -ip 21121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2112 -ip 21121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2112 -ip 21121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2112 -ip 21121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2112 -ip 21121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4484 -ip 44841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4484 -ip 44841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4484 -ip 44841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4484 -ip 44841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4484 -ip 44841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4484 -ip 44841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4484 -ip 44841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4484 -ip 44841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4484 -ip 44841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4484 -ip 44841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4484 -ip 44841⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2808 -ip 28081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4484 -ip 44841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4484 -ip 44841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4484 -ip 44841⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2756 -ip 27561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4484 -ip 44841⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr922594.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr922594.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHu0863.exeFilesize
536KB
MD5c400708a2b55b137fc06000236740d09
SHA185547767a9ac5d27d0bc6ae235a46fd6b366b161
SHA256120eea3a0a264ce1cdfbdad3947b387d0acbd78ec5998c2e9f64ba864b504345
SHA512f4dfacbfac51fa0120797ce9060948c3db7d155767714c0ba42ef8375e578cc7c63ed9cb978048e26a662df64f66ab45d7e2272fbf2086817ab6da1930bf6dc0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHu0863.exeFilesize
536KB
MD5c400708a2b55b137fc06000236740d09
SHA185547767a9ac5d27d0bc6ae235a46fd6b366b161
SHA256120eea3a0a264ce1cdfbdad3947b387d0acbd78ec5998c2e9f64ba864b504345
SHA512f4dfacbfac51fa0120797ce9060948c3db7d155767714c0ba42ef8375e578cc7c63ed9cb978048e26a662df64f66ab45d7e2272fbf2086817ab6da1930bf6dc0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp206180.exeFilesize
169KB
MD5fe274a91de1181c0609a78106535d229
SHA1a1a3345ee9aa7b1b2f7a92bf0af792215d363511
SHA256d687c7fac77cbe08abdeaff4b88f5dca57eaba73712bc96642ad55618950d47e
SHA512675a91e2ab97f87f8bb6c9261270f561c774db22de407faf89ecf89ffb06643fcf56c7d5f42e3d7fd255f7628b8c70fe8b79e30bc5ea35a8c6cf21d9b5375669
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp206180.exeFilesize
169KB
MD5fe274a91de1181c0609a78106535d229
SHA1a1a3345ee9aa7b1b2f7a92bf0af792215d363511
SHA256d687c7fac77cbe08abdeaff4b88f5dca57eaba73712bc96642ad55618950d47e
SHA512675a91e2ab97f87f8bb6c9261270f561c774db22de407faf89ecf89ffb06643fcf56c7d5f42e3d7fd255f7628b8c70fe8b79e30bc5ea35a8c6cf21d9b5375669
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zicW9811.exeFilesize
382KB
MD51f0e584d5fed9cc148ec0791a2da2764
SHA135c26f226214aaa311cbdabc62a08bda9145809a
SHA256fa22ab16d09fdb675de8b1167eb1aaa06ed32650ac2db7a140654fba24ad410f
SHA5121b072c823d8e9aaaab368f8e209ba9e9c9e800dfad627430a7baeb815466c915ed7d1cc4e6acc80463995a1627bfd6267cedba2a9d204966e0f11a694b426e4a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zicW9811.exeFilesize
382KB
MD51f0e584d5fed9cc148ec0791a2da2764
SHA135c26f226214aaa311cbdabc62a08bda9145809a
SHA256fa22ab16d09fdb675de8b1167eb1aaa06ed32650ac2db7a140654fba24ad410f
SHA5121b072c823d8e9aaaab368f8e209ba9e9c9e800dfad627430a7baeb815466c915ed7d1cc4e6acc80463995a1627bfd6267cedba2a9d204966e0f11a694b426e4a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it375449.exeFilesize
11KB
MD5a34beffb7275981be425ec0b460b017f
SHA10e74e41587a05b1e2c14c58889e0cf436a686b55
SHA25616192b42775060fc2940d44f12f368cd7ad11c8709225013728aa51c2a74930a
SHA512b919f1f1e0bcd7b839c5954c0dc0e6df433d332553e470cdf6f4f0d0b6bb2532a47bc369bd35cad576161ff53e82b6b8eef6ca1d4991a1f3d810210c5a1c650d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it375449.exeFilesize
11KB
MD5a34beffb7275981be425ec0b460b017f
SHA10e74e41587a05b1e2c14c58889e0cf436a686b55
SHA25616192b42775060fc2940d44f12f368cd7ad11c8709225013728aa51c2a74930a
SHA512b919f1f1e0bcd7b839c5954c0dc0e6df433d332553e470cdf6f4f0d0b6bb2532a47bc369bd35cad576161ff53e82b6b8eef6ca1d4991a1f3d810210c5a1c650d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr801869.exeFilesize
297KB
MD5667e17a482144a6303ef8db7f15f16fd
SHA149c0de5cc297e0bea31fd352b6fc21649772f173
SHA25616fba4602ecb9e5fa26b18d7a8edb4d14d155d2f8abdecba12d21316d255a1a1
SHA512505ea9c772a3bad07771c93d8cf04bfe7ddb0eed01f232203d54e287bd264e99a3f777cf839709d432da3e28a72808b830316262be90ebf4fbb464b1e9d09929
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr801869.exeFilesize
297KB
MD5667e17a482144a6303ef8db7f15f16fd
SHA149c0de5cc297e0bea31fd352b6fc21649772f173
SHA25616fba4602ecb9e5fa26b18d7a8edb4d14d155d2f8abdecba12d21316d255a1a1
SHA512505ea9c772a3bad07771c93d8cf04bfe7ddb0eed01f232203d54e287bd264e99a3f777cf839709d432da3e28a72808b830316262be90ebf4fbb464b1e9d09929
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/2112-1099-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/2452-154-0x00000000002D0000-0x00000000002DA000-memory.dmpFilesize
40KB
-
memory/2584-1092-0x0000000005750000-0x0000000005760000-memory.dmpFilesize
64KB
-
memory/2584-1091-0x0000000000DF0000-0x0000000000E20000-memory.dmpFilesize
192KB
-
memory/2584-1094-0x0000000005750000-0x0000000005760000-memory.dmpFilesize
64KB
-
memory/4808-204-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-1071-0x00000000053A0000-0x00000000059B8000-memory.dmpFilesize
6.1MB
-
memory/4808-184-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-186-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-188-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-190-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-192-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-194-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-196-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-198-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-200-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-202-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-182-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/4808-206-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-208-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-210-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-212-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-214-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-216-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-218-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-220-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-222-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-224-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-226-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-228-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-181-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-1072-0x0000000004CC0000-0x0000000004DCA000-memory.dmpFilesize
1.0MB
-
memory/4808-1073-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/4808-1074-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/4808-1075-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/4808-1077-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/4808-1078-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/4808-1079-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/4808-1080-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/4808-1081-0x0000000006590000-0x0000000006606000-memory.dmpFilesize
472KB
-
memory/4808-179-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/4808-178-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-177-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/4808-175-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-173-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-171-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-169-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-167-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-163-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-165-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-162-0x0000000002760000-0x000000000279F000-memory.dmpFilesize
252KB
-
memory/4808-161-0x0000000004DF0000-0x0000000005394000-memory.dmpFilesize
5.6MB
-
memory/4808-160-0x00000000004C0000-0x000000000050B000-memory.dmpFilesize
300KB
-
memory/4808-1082-0x0000000006620000-0x0000000006670000-memory.dmpFilesize
320KB
-
memory/4808-1083-0x00000000068A0000-0x0000000006A62000-memory.dmpFilesize
1.8MB
-
memory/4808-1084-0x0000000006A80000-0x0000000006FAC000-memory.dmpFilesize
5.2MB
-
memory/4808-1085-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB