Analysis
-
max time kernel
147s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 19:50
Static task
static1
General
-
Target
2c67ba2fc09418bd707d2c2a34e3209ecc67185510e203ddf073635751dff1f3.exe
-
Size
801KB
-
MD5
fa58806bb65649fa0c6710d2e354f0f8
-
SHA1
a4660feded224f23aeb3658945624583a1a80ffc
-
SHA256
2c67ba2fc09418bd707d2c2a34e3209ecc67185510e203ddf073635751dff1f3
-
SHA512
8c2d723b24cc802dd5246acd99fadc4382c13ca4855b5c0c2f6f1c5b9a49c075e7989c9cf440ce7119a7886c35fddc3e3faef8fc947e835647fd8af3019f997a
-
SSDEEP
24576:YWyLfjTipm5Ny8PNPxf9tBtuhm41GKfgVNDpdfwqgh+oO:++whxFTAwMcNDpd4qg
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
it066876.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it066876.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it066876.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it066876.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it066876.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it066876.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it066876.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/1264-165-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-168-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-166-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-170-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-172-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-174-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-176-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-178-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-180-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-182-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-184-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-186-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-188-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-190-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-192-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-194-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-196-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-198-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-200-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-202-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-204-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-206-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-208-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-210-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-212-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-214-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-216-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-218-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-220-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-222-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-224-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-226-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1264-228-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr416959.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation lr416959.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
Processes:
ziPz1919.exeziJw1019.exeit066876.exejr189269.exekp440119.exelr416959.exeoneetx.exeoneetx.exepid process 2032 ziPz1919.exe 4180 ziJw1019.exe 5068 it066876.exe 1264 jr189269.exe 3732 kp440119.exe 1840 lr416959.exe 5008 oneetx.exe 3628 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1264 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it066876.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it066876.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
ziPz1919.exeziJw1019.exe2c67ba2fc09418bd707d2c2a34e3209ecc67185510e203ddf073635751dff1f3.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziPz1919.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziPz1919.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziJw1019.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ziJw1019.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2c67ba2fc09418bd707d2c2a34e3209ecc67185510e203ddf073635751dff1f3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2c67ba2fc09418bd707d2c2a34e3209ecc67185510e203ddf073635751dff1f3.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 27 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1520 1264 WerFault.exe jr189269.exe 3396 1840 WerFault.exe lr416959.exe 4948 1840 WerFault.exe lr416959.exe 2864 1840 WerFault.exe lr416959.exe 1256 1840 WerFault.exe lr416959.exe 3024 1840 WerFault.exe lr416959.exe 4312 1840 WerFault.exe lr416959.exe 1684 1840 WerFault.exe lr416959.exe 3744 1840 WerFault.exe lr416959.exe 2584 1840 WerFault.exe lr416959.exe 4588 1840 WerFault.exe lr416959.exe 4204 5008 WerFault.exe oneetx.exe 1896 5008 WerFault.exe oneetx.exe 2396 5008 WerFault.exe oneetx.exe 2872 5008 WerFault.exe oneetx.exe 1572 5008 WerFault.exe oneetx.exe 3452 5008 WerFault.exe oneetx.exe 3256 5008 WerFault.exe oneetx.exe 3236 5008 WerFault.exe oneetx.exe 4656 5008 WerFault.exe oneetx.exe 364 5008 WerFault.exe oneetx.exe 32 5008 WerFault.exe oneetx.exe 4812 5008 WerFault.exe oneetx.exe 2552 3628 WerFault.exe oneetx.exe 4308 5008 WerFault.exe oneetx.exe 3652 5008 WerFault.exe oneetx.exe 2256 5008 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it066876.exejr189269.exekp440119.exepid process 5068 it066876.exe 5068 it066876.exe 1264 jr189269.exe 1264 jr189269.exe 3732 kp440119.exe 3732 kp440119.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it066876.exejr189269.exekp440119.exedescription pid process Token: SeDebugPrivilege 5068 it066876.exe Token: SeDebugPrivilege 1264 jr189269.exe Token: SeDebugPrivilege 3732 kp440119.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr416959.exepid process 1840 lr416959.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
2c67ba2fc09418bd707d2c2a34e3209ecc67185510e203ddf073635751dff1f3.exeziPz1919.exeziJw1019.exelr416959.exeoneetx.exedescription pid process target process PID 1452 wrote to memory of 2032 1452 2c67ba2fc09418bd707d2c2a34e3209ecc67185510e203ddf073635751dff1f3.exe ziPz1919.exe PID 1452 wrote to memory of 2032 1452 2c67ba2fc09418bd707d2c2a34e3209ecc67185510e203ddf073635751dff1f3.exe ziPz1919.exe PID 1452 wrote to memory of 2032 1452 2c67ba2fc09418bd707d2c2a34e3209ecc67185510e203ddf073635751dff1f3.exe ziPz1919.exe PID 2032 wrote to memory of 4180 2032 ziPz1919.exe ziJw1019.exe PID 2032 wrote to memory of 4180 2032 ziPz1919.exe ziJw1019.exe PID 2032 wrote to memory of 4180 2032 ziPz1919.exe ziJw1019.exe PID 4180 wrote to memory of 5068 4180 ziJw1019.exe it066876.exe PID 4180 wrote to memory of 5068 4180 ziJw1019.exe it066876.exe PID 4180 wrote to memory of 1264 4180 ziJw1019.exe jr189269.exe PID 4180 wrote to memory of 1264 4180 ziJw1019.exe jr189269.exe PID 4180 wrote to memory of 1264 4180 ziJw1019.exe jr189269.exe PID 2032 wrote to memory of 3732 2032 ziPz1919.exe kp440119.exe PID 2032 wrote to memory of 3732 2032 ziPz1919.exe kp440119.exe PID 2032 wrote to memory of 3732 2032 ziPz1919.exe kp440119.exe PID 1452 wrote to memory of 1840 1452 2c67ba2fc09418bd707d2c2a34e3209ecc67185510e203ddf073635751dff1f3.exe lr416959.exe PID 1452 wrote to memory of 1840 1452 2c67ba2fc09418bd707d2c2a34e3209ecc67185510e203ddf073635751dff1f3.exe lr416959.exe PID 1452 wrote to memory of 1840 1452 2c67ba2fc09418bd707d2c2a34e3209ecc67185510e203ddf073635751dff1f3.exe lr416959.exe PID 1840 wrote to memory of 5008 1840 lr416959.exe oneetx.exe PID 1840 wrote to memory of 5008 1840 lr416959.exe oneetx.exe PID 1840 wrote to memory of 5008 1840 lr416959.exe oneetx.exe PID 5008 wrote to memory of 3272 5008 oneetx.exe schtasks.exe PID 5008 wrote to memory of 3272 5008 oneetx.exe schtasks.exe PID 5008 wrote to memory of 3272 5008 oneetx.exe schtasks.exe PID 5008 wrote to memory of 1264 5008 oneetx.exe rundll32.exe PID 5008 wrote to memory of 1264 5008 oneetx.exe rundll32.exe PID 5008 wrote to memory of 1264 5008 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c67ba2fc09418bd707d2c2a34e3209ecc67185510e203ddf073635751dff1f3.exe"C:\Users\Admin\AppData\Local\Temp\2c67ba2fc09418bd707d2c2a34e3209ecc67185510e203ddf073635751dff1f3.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPz1919.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPz1919.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziJw1019.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziJw1019.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it066876.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it066876.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr189269.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr189269.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 13525⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp440119.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp440119.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr416959.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr416959.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 7763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 8603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 9603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 9523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 8723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 12243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 12123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 13243⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 8284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 9124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 10884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 11084⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 7444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 7884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 7524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 10644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 16204⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 11004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 16284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 13683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1264 -ip 12641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1840 -ip 18401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1840 -ip 18401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1840 -ip 18401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1840 -ip 18401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1840 -ip 18401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1840 -ip 18401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1840 -ip 18401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1840 -ip 18401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1840 -ip 18401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1840 -ip 18401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 5008 -ip 50081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5008 -ip 50081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5008 -ip 50081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5008 -ip 50081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5008 -ip 50081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5008 -ip 50081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5008 -ip 50081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5008 -ip 50081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5008 -ip 50081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5008 -ip 50081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5008 -ip 50081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5008 -ip 50081⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 3162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3628 -ip 36281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5008 -ip 50081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5008 -ip 50081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5008 -ip 50081⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr416959.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr416959.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPz1919.exeFilesize
536KB
MD5944f437282d03b82650026c12ef1998f
SHA112d3f02c37022f70bed3a3333bd658ca0a2fa509
SHA256c5f167f676efe649e99ffff054f7be1816ba96d06f24d73d88ccce077d1a3da3
SHA512a4659c24cc9093fadc265d807ee2cec8e87dc51c36dfc7d7336502475e1406e22d4850ea7e5ebe0845083360aa711fb51fd7e2b7fb8d71dcbd01221b3ed15137
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPz1919.exeFilesize
536KB
MD5944f437282d03b82650026c12ef1998f
SHA112d3f02c37022f70bed3a3333bd658ca0a2fa509
SHA256c5f167f676efe649e99ffff054f7be1816ba96d06f24d73d88ccce077d1a3da3
SHA512a4659c24cc9093fadc265d807ee2cec8e87dc51c36dfc7d7336502475e1406e22d4850ea7e5ebe0845083360aa711fb51fd7e2b7fb8d71dcbd01221b3ed15137
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp440119.exeFilesize
169KB
MD5ce8adde0a96a72f92564290fce15e79a
SHA125cc8ac479f7731f7337b334c678ef0a5bf40634
SHA2565056af87643da0aa603494c3136da5ae23b7396f65f34d1cdd1d790d18dd88c2
SHA512fa29cbddd903ca8238b6c2d1bcc010199bd386a198b63c53d57a4050cc7713a63738fd279140217ab5f0a884a102b0e9d055c9d79ab9db6301e98d3803923bf2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp440119.exeFilesize
169KB
MD5ce8adde0a96a72f92564290fce15e79a
SHA125cc8ac479f7731f7337b334c678ef0a5bf40634
SHA2565056af87643da0aa603494c3136da5ae23b7396f65f34d1cdd1d790d18dd88c2
SHA512fa29cbddd903ca8238b6c2d1bcc010199bd386a198b63c53d57a4050cc7713a63738fd279140217ab5f0a884a102b0e9d055c9d79ab9db6301e98d3803923bf2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziJw1019.exeFilesize
382KB
MD5b35db7fba1e7f79e847d8b173c564c2d
SHA192207738348417611bca08361e859349a089430c
SHA2566aea04b8ea79284eae426268242d014f0e394db85af0e7c508c767c7eddf3e3a
SHA512e6890c32ff2e7e7ba4cf466f1338f2bbf1e914129399e720ff86481fd3236088e3c37195642c6b942224956ec4d27838b12af531f7cd8a0e440e8eb13714b98e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziJw1019.exeFilesize
382KB
MD5b35db7fba1e7f79e847d8b173c564c2d
SHA192207738348417611bca08361e859349a089430c
SHA2566aea04b8ea79284eae426268242d014f0e394db85af0e7c508c767c7eddf3e3a
SHA512e6890c32ff2e7e7ba4cf466f1338f2bbf1e914129399e720ff86481fd3236088e3c37195642c6b942224956ec4d27838b12af531f7cd8a0e440e8eb13714b98e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it066876.exeFilesize
11KB
MD50a6f7211f62d7f315875f132c64d271d
SHA111ed0ff7128193405ffacd1fea366847a8688ddb
SHA2566b7fc1cc485263cbba88da6e0bc1990aa8de25e6b1fff302ed06978d8ea7cf21
SHA5120240ffe944eadbdb6e573c4660c7a2da64992351549881799dacbb7a4c8dff3cd8f16c1b52bafcad80ba5cfb8e334cf8784f0c5190ce1d78668494be01ba4633
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it066876.exeFilesize
11KB
MD50a6f7211f62d7f315875f132c64d271d
SHA111ed0ff7128193405ffacd1fea366847a8688ddb
SHA2566b7fc1cc485263cbba88da6e0bc1990aa8de25e6b1fff302ed06978d8ea7cf21
SHA5120240ffe944eadbdb6e573c4660c7a2da64992351549881799dacbb7a4c8dff3cd8f16c1b52bafcad80ba5cfb8e334cf8784f0c5190ce1d78668494be01ba4633
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr189269.exeFilesize
297KB
MD5b58c738e0bb3ea16ade81e6db47c88f7
SHA16d43ce582d0e2b1a8c8e15d991a83d48dad2d014
SHA2563dbfb63ebac5e6cc4f88d46cc8a4e0a50a980051f057b53fcd096705e5b62718
SHA51281b3f948044a441521c4c33d33fbbd27a4dd3a539edb3ba557c51044de4d6a8c2690d14819b35e8ff83fdcb527ce2babc0249e9e795784b630fb1097d61c9fda
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr189269.exeFilesize
297KB
MD5b58c738e0bb3ea16ade81e6db47c88f7
SHA16d43ce582d0e2b1a8c8e15d991a83d48dad2d014
SHA2563dbfb63ebac5e6cc4f88d46cc8a4e0a50a980051f057b53fcd096705e5b62718
SHA51281b3f948044a441521c4c33d33fbbd27a4dd3a539edb3ba557c51044de4d6a8c2690d14819b35e8ff83fdcb527ce2babc0249e9e795784b630fb1097d61c9fda
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1264-206-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-228-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-174-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-176-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-178-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-180-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-182-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-184-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-186-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-188-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-190-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-192-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-194-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-196-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-198-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-200-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-202-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-204-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-170-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-208-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-210-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-212-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-214-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-216-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-218-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-220-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-222-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-224-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-226-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-172-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-1071-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/1264-1072-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/1264-1074-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/1264-1073-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/1264-1075-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/1264-1077-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/1264-1078-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/1264-1079-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/1264-1080-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/1264-1081-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/1264-1082-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/1264-1083-0x0000000007820000-0x00000000079E2000-memory.dmpFilesize
1.8MB
-
memory/1264-1084-0x00000000079F0000-0x0000000007F1C000-memory.dmpFilesize
5.2MB
-
memory/1264-1085-0x00000000064C0000-0x0000000006536000-memory.dmpFilesize
472KB
-
memory/1264-1086-0x0000000006550000-0x00000000065A0000-memory.dmpFilesize
320KB
-
memory/1264-160-0x0000000004A80000-0x0000000005024000-memory.dmpFilesize
5.6MB
-
memory/1264-166-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-168-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-165-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1264-164-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/1264-162-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/1264-163-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/1264-161-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/1840-1099-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB
-
memory/3732-1092-0x0000000000430000-0x0000000000460000-memory.dmpFilesize
192KB
-
memory/3732-1093-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/5068-154-0x00000000007D0000-0x00000000007DA000-memory.dmpFilesize
40KB