Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 19:48
Static task
static1
General
-
Target
bfb07b5b52b462c3e12b49e4d7b1a869f6a3c7e762bdf485e11e3cec58e20763.exe
-
Size
800KB
-
MD5
1b070ca5386b41552df3982ef6dec944
-
SHA1
f1184dcdc54d5a7e757585e1193190645dc9afce
-
SHA256
bfb07b5b52b462c3e12b49e4d7b1a869f6a3c7e762bdf485e11e3cec58e20763
-
SHA512
d793f1f628eb0cd0df79d69c4ad0cc6f5310dc99c693ebb6d4c101543f470a66890c3b0d0ef08ba84c2a547d1291cd244556203843fa0e4715a8565cb5163273
-
SSDEEP
12288:XMr5y90LxQ0hLJQswbeSMxcxmkJmJxK7CzeWlqJkUiMqKPKsTR:CyEhLSmxZkJ+xfyWvOzl
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
it907241.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it907241.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it907241.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it907241.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it907241.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it907241.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it907241.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4236-164-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-165-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-167-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-169-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-171-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-173-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-177-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-175-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-179-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-181-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-183-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-185-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-187-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-189-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-191-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-193-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-195-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-197-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-199-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-201-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-203-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-205-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-207-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-209-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-211-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-213-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-215-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-217-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-219-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-221-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-223-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-225-0x0000000002400000-0x000000000243F000-memory.dmp family_redline behavioral1/memory/4236-227-0x0000000002400000-0x000000000243F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr412986.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation lr412986.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
ziMf9580.exeziwk1408.exeit907241.exejr714914.exekp428113.exelr412986.exeoneetx.exeoneetx.exeoneetx.exepid process 4052 ziMf9580.exe 2100 ziwk1408.exe 1440 it907241.exe 4236 jr714914.exe 3936 kp428113.exe 3024 lr412986.exe 5032 oneetx.exe 1996 oneetx.exe 3560 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 5068 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it907241.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it907241.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
ziwk1408.exebfb07b5b52b462c3e12b49e4d7b1a869f6a3c7e762bdf485e11e3cec58e20763.exeziMf9580.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ziwk1408.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bfb07b5b52b462c3e12b49e4d7b1a869f6a3c7e762bdf485e11e3cec58e20763.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" bfb07b5b52b462c3e12b49e4d7b1a869f6a3c7e762bdf485e11e3cec58e20763.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziMf9580.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziMf9580.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziwk1408.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 29 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4592 4236 WerFault.exe jr714914.exe 4196 3024 WerFault.exe lr412986.exe 1672 3024 WerFault.exe lr412986.exe 3192 3024 WerFault.exe lr412986.exe 4520 3024 WerFault.exe lr412986.exe 5056 3024 WerFault.exe lr412986.exe 4516 3024 WerFault.exe lr412986.exe 4880 3024 WerFault.exe lr412986.exe 4936 3024 WerFault.exe lr412986.exe 4876 3024 WerFault.exe lr412986.exe 832 3024 WerFault.exe lr412986.exe 1456 5032 WerFault.exe oneetx.exe 1396 5032 WerFault.exe oneetx.exe 4004 5032 WerFault.exe oneetx.exe 1584 5032 WerFault.exe oneetx.exe 264 5032 WerFault.exe oneetx.exe 2436 5032 WerFault.exe oneetx.exe 4612 5032 WerFault.exe oneetx.exe 4328 5032 WerFault.exe oneetx.exe 4476 5032 WerFault.exe oneetx.exe 2640 5032 WerFault.exe oneetx.exe 4716 5032 WerFault.exe oneetx.exe 728 5032 WerFault.exe oneetx.exe 2952 1996 WerFault.exe oneetx.exe 4196 5032 WerFault.exe oneetx.exe 1596 5032 WerFault.exe oneetx.exe 4552 5032 WerFault.exe oneetx.exe 4680 3560 WerFault.exe oneetx.exe 2204 5032 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it907241.exejr714914.exekp428113.exepid process 1440 it907241.exe 1440 it907241.exe 4236 jr714914.exe 4236 jr714914.exe 3936 kp428113.exe 3936 kp428113.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it907241.exejr714914.exekp428113.exedescription pid process Token: SeDebugPrivilege 1440 it907241.exe Token: SeDebugPrivilege 4236 jr714914.exe Token: SeDebugPrivilege 3936 kp428113.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr412986.exepid process 3024 lr412986.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
bfb07b5b52b462c3e12b49e4d7b1a869f6a3c7e762bdf485e11e3cec58e20763.exeziMf9580.exeziwk1408.exelr412986.exeoneetx.exedescription pid process target process PID 4224 wrote to memory of 4052 4224 bfb07b5b52b462c3e12b49e4d7b1a869f6a3c7e762bdf485e11e3cec58e20763.exe ziMf9580.exe PID 4224 wrote to memory of 4052 4224 bfb07b5b52b462c3e12b49e4d7b1a869f6a3c7e762bdf485e11e3cec58e20763.exe ziMf9580.exe PID 4224 wrote to memory of 4052 4224 bfb07b5b52b462c3e12b49e4d7b1a869f6a3c7e762bdf485e11e3cec58e20763.exe ziMf9580.exe PID 4052 wrote to memory of 2100 4052 ziMf9580.exe ziwk1408.exe PID 4052 wrote to memory of 2100 4052 ziMf9580.exe ziwk1408.exe PID 4052 wrote to memory of 2100 4052 ziMf9580.exe ziwk1408.exe PID 2100 wrote to memory of 1440 2100 ziwk1408.exe it907241.exe PID 2100 wrote to memory of 1440 2100 ziwk1408.exe it907241.exe PID 2100 wrote to memory of 4236 2100 ziwk1408.exe jr714914.exe PID 2100 wrote to memory of 4236 2100 ziwk1408.exe jr714914.exe PID 2100 wrote to memory of 4236 2100 ziwk1408.exe jr714914.exe PID 4052 wrote to memory of 3936 4052 ziMf9580.exe kp428113.exe PID 4052 wrote to memory of 3936 4052 ziMf9580.exe kp428113.exe PID 4052 wrote to memory of 3936 4052 ziMf9580.exe kp428113.exe PID 4224 wrote to memory of 3024 4224 bfb07b5b52b462c3e12b49e4d7b1a869f6a3c7e762bdf485e11e3cec58e20763.exe lr412986.exe PID 4224 wrote to memory of 3024 4224 bfb07b5b52b462c3e12b49e4d7b1a869f6a3c7e762bdf485e11e3cec58e20763.exe lr412986.exe PID 4224 wrote to memory of 3024 4224 bfb07b5b52b462c3e12b49e4d7b1a869f6a3c7e762bdf485e11e3cec58e20763.exe lr412986.exe PID 3024 wrote to memory of 5032 3024 lr412986.exe oneetx.exe PID 3024 wrote to memory of 5032 3024 lr412986.exe oneetx.exe PID 3024 wrote to memory of 5032 3024 lr412986.exe oneetx.exe PID 5032 wrote to memory of 1548 5032 oneetx.exe schtasks.exe PID 5032 wrote to memory of 1548 5032 oneetx.exe schtasks.exe PID 5032 wrote to memory of 1548 5032 oneetx.exe schtasks.exe PID 5032 wrote to memory of 5068 5032 oneetx.exe rundll32.exe PID 5032 wrote to memory of 5068 5032 oneetx.exe rundll32.exe PID 5032 wrote to memory of 5068 5032 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfb07b5b52b462c3e12b49e4d7b1a869f6a3c7e762bdf485e11e3cec58e20763.exe"C:\Users\Admin\AppData\Local\Temp\bfb07b5b52b462c3e12b49e4d7b1a869f6a3c7e762bdf485e11e3cec58e20763.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziMf9580.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziMf9580.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziwk1408.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziwk1408.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it907241.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it907241.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr714914.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr714914.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 13365⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp428113.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp428113.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr412986.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr412986.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 7803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 8083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 9523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 9763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 9763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 12203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 12283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 13203⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 8564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 8564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 9004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 10964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 10964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 11324⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 6844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 7284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 7804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 11084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 13524⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 15844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 16444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 14243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4236 -ip 42361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3024 -ip 30241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3024 -ip 30241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3024 -ip 30241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3024 -ip 30241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3024 -ip 30241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 3024 -ip 30241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3024 -ip 30241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3024 -ip 30241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3024 -ip 30241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3024 -ip 30241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5032 -ip 50321⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1996 -ip 19961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5032 -ip 50321⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3560 -ip 35601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5032 -ip 50321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr412986.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr412986.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziMf9580.exeFilesize
536KB
MD554b10e180136991c91bcf58f4bd46570
SHA114ec6211063cdd4af18938894b2cee89b1b04226
SHA2560c380a21a1a6a7a6d9b690cc5be921d3118c9d2665893c8e2106bface1579d66
SHA512c293356249577c9b82178c097fad8b14985b6e3f3b55f525949f3644cab41e57eef80f110b84174dc7eb226e11eeac8d6e871fce3d6082b58cddd96b4b3cec46
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziMf9580.exeFilesize
536KB
MD554b10e180136991c91bcf58f4bd46570
SHA114ec6211063cdd4af18938894b2cee89b1b04226
SHA2560c380a21a1a6a7a6d9b690cc5be921d3118c9d2665893c8e2106bface1579d66
SHA512c293356249577c9b82178c097fad8b14985b6e3f3b55f525949f3644cab41e57eef80f110b84174dc7eb226e11eeac8d6e871fce3d6082b58cddd96b4b3cec46
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp428113.exeFilesize
169KB
MD52c601adac5363eda1c5ccf9567b7c9f5
SHA1eb39bb1fe7236d495bb50661642048bcced80f8a
SHA25647dbc5d533138f0cc8965df04df9017bbcac0bb29c30c48fb7394eb1ea251688
SHA512d1d72a9f489876a3fbd3d54b626c3e8068a97bf2bfa423aa03d00943ddfd2baace823f3f0b09995ac8f95d208d2061825337b089cc56199f4290586b17a05463
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp428113.exeFilesize
169KB
MD52c601adac5363eda1c5ccf9567b7c9f5
SHA1eb39bb1fe7236d495bb50661642048bcced80f8a
SHA25647dbc5d533138f0cc8965df04df9017bbcac0bb29c30c48fb7394eb1ea251688
SHA512d1d72a9f489876a3fbd3d54b626c3e8068a97bf2bfa423aa03d00943ddfd2baace823f3f0b09995ac8f95d208d2061825337b089cc56199f4290586b17a05463
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziwk1408.exeFilesize
382KB
MD5183fc3a5fb84e3284c304566eca08761
SHA11629167ea8e8e074aab4daa2cec6e9136321ab7c
SHA256331958bbcab2f4eea0527c3a699da3ce3c93862870d64efb2fa80a3dea808c4a
SHA512b0fd1c04c6e09ee73e74274b28502678a3197920d0651472536f748d4dab2d05793f91e804358efe520b0eae66c998e0617e54b1223efbf4e4e1f2ebfadb19d1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziwk1408.exeFilesize
382KB
MD5183fc3a5fb84e3284c304566eca08761
SHA11629167ea8e8e074aab4daa2cec6e9136321ab7c
SHA256331958bbcab2f4eea0527c3a699da3ce3c93862870d64efb2fa80a3dea808c4a
SHA512b0fd1c04c6e09ee73e74274b28502678a3197920d0651472536f748d4dab2d05793f91e804358efe520b0eae66c998e0617e54b1223efbf4e4e1f2ebfadb19d1
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it907241.exeFilesize
11KB
MD58dd706a687ea3cf2322f398c156d4351
SHA17778f6cb9f40430c837040d6534954c233834f19
SHA256d46797a4b65211e1cd92e515d33fa400d4555d6ecb5d223d76bb00446cdeb4d2
SHA512a4a5a18945d00b7ddf983d8db20253080a9c248c84c661f394774216dd3875c53949c1f3d346816f8dc144888d28e78c133f4f44ea0d54012dc9f346534ac54e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it907241.exeFilesize
11KB
MD58dd706a687ea3cf2322f398c156d4351
SHA17778f6cb9f40430c837040d6534954c233834f19
SHA256d46797a4b65211e1cd92e515d33fa400d4555d6ecb5d223d76bb00446cdeb4d2
SHA512a4a5a18945d00b7ddf983d8db20253080a9c248c84c661f394774216dd3875c53949c1f3d346816f8dc144888d28e78c133f4f44ea0d54012dc9f346534ac54e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr714914.exeFilesize
297KB
MD56de8bdbf4fcf7e6e652afe158bb50621
SHA1713bf0f7dd1e8e9af2d9b9cc65a7d07ae8b91798
SHA256ffa1cf2a6ba37a43b4532b86fe13993e5b91d892963746b633660186643d4488
SHA51295181b7a1c34e10421a87b1eb34503907a7bc0c257f731fff655d78555f51298b59fb5ba6b3ed6a0571a3869367ddcc1cec8db68b27beb1241522e5d6f42e5ad
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr714914.exeFilesize
297KB
MD56de8bdbf4fcf7e6e652afe158bb50621
SHA1713bf0f7dd1e8e9af2d9b9cc65a7d07ae8b91798
SHA256ffa1cf2a6ba37a43b4532b86fe13993e5b91d892963746b633660186643d4488
SHA51295181b7a1c34e10421a87b1eb34503907a7bc0c257f731fff655d78555f51298b59fb5ba6b3ed6a0571a3869367ddcc1cec8db68b27beb1241522e5d6f42e5ad
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1440-154-0x0000000000DC0000-0x0000000000DCA000-memory.dmpFilesize
40KB
-
memory/3024-1098-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/3936-1092-0x00000000054A0000-0x00000000054B0000-memory.dmpFilesize
64KB
-
memory/3936-1091-0x0000000000C60000-0x0000000000C90000-memory.dmpFilesize
192KB
-
memory/4236-205-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-1070-0x0000000005370000-0x0000000005988000-memory.dmpFilesize
6.1MB
-
memory/4236-183-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-185-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-187-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-189-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-191-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-193-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-195-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-197-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-199-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-201-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-203-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-179-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-207-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-209-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-211-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-213-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-215-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-217-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-219-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-221-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-223-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-225-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-227-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-181-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-1071-0x0000000004C50000-0x0000000004D5A000-memory.dmpFilesize
1.0MB
-
memory/4236-1072-0x0000000002860000-0x0000000002872000-memory.dmpFilesize
72KB
-
memory/4236-1073-0x0000000002880000-0x00000000028BC000-memory.dmpFilesize
240KB
-
memory/4236-1074-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/4236-1076-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/4236-1077-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/4236-1078-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/4236-1079-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/4236-1080-0x0000000006270000-0x0000000006302000-memory.dmpFilesize
584KB
-
memory/4236-1081-0x0000000006380000-0x0000000006542000-memory.dmpFilesize
1.8MB
-
memory/4236-175-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-177-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-173-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-171-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-169-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-167-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-165-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-164-0x0000000002400000-0x000000000243F000-memory.dmpFilesize
252KB
-
memory/4236-163-0x0000000004DC0000-0x0000000005364000-memory.dmpFilesize
5.6MB
-
memory/4236-162-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/4236-161-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/4236-160-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/4236-1082-0x0000000006550000-0x0000000006A7C000-memory.dmpFilesize
5.2MB
-
memory/4236-1083-0x0000000006BA0000-0x0000000006C16000-memory.dmpFilesize
472KB
-
memory/4236-1084-0x0000000006C30000-0x0000000006C80000-memory.dmpFilesize
320KB
-
memory/4236-1085-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB