Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 20:03
Static task
static1
General
-
Target
5855948a3887a2fa355316874aa4b63881ddd8847c9825f14975ba7a64756b0f.exe
-
Size
801KB
-
MD5
af83b9e161c8017ccac8a20137951b31
-
SHA1
c149b34553ca8e526094d6bfa5fcde1cbf539e91
-
SHA256
5855948a3887a2fa355316874aa4b63881ddd8847c9825f14975ba7a64756b0f
-
SHA512
7163ce78472bc7acfb1cd6ed74e3ce7b5df623e55f3e7273bba29fe589e7fa495d34525332115c5d94eb1dd38826017593c45b4473dfa0379619ee0756c08831
-
SSDEEP
24576:ByRX09SWMfntuSBAk4G7JXxfcK0gADVW1s3h:090iAR1MxaXZW1C
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
it655409.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it655409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it655409.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it655409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it655409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it655409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it655409.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/2240-165-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-166-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-168-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-170-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-172-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-176-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-174-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-178-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-180-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-182-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-184-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-186-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-188-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-190-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-192-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-194-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-196-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-198-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-200-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-202-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-204-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-206-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-208-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-210-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-214-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-212-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-216-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-218-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-220-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-222-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-224-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-228-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2240-226-0x0000000002710000-0x000000000274F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr879209.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation lr879209.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
ziPE6415.exeziIh5026.exeit655409.exejr339148.exekp810544.exelr879209.exeoneetx.exeoneetx.exeoneetx.exepid process 1124 ziPE6415.exe 1812 ziIh5026.exe 2460 it655409.exe 2240 jr339148.exe 4672 kp810544.exe 1664 lr879209.exe 3120 oneetx.exe 4700 oneetx.exe 1520 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 404 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it655409.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it655409.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
ziIh5026.exe5855948a3887a2fa355316874aa4b63881ddd8847c9825f14975ba7a64756b0f.exeziPE6415.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ziIh5026.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5855948a3887a2fa355316874aa4b63881ddd8847c9825f14975ba7a64756b0f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5855948a3887a2fa355316874aa4b63881ddd8847c9825f14975ba7a64756b0f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziPE6415.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziPE6415.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziIh5026.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 28 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2972 2240 WerFault.exe jr339148.exe 512 1664 WerFault.exe lr879209.exe 2108 1664 WerFault.exe lr879209.exe 4840 1664 WerFault.exe lr879209.exe 4856 1664 WerFault.exe lr879209.exe 2808 1664 WerFault.exe lr879209.exe 2268 1664 WerFault.exe lr879209.exe 4676 1664 WerFault.exe lr879209.exe 2912 1664 WerFault.exe lr879209.exe 4788 1664 WerFault.exe lr879209.exe 1596 1664 WerFault.exe lr879209.exe 5000 3120 WerFault.exe oneetx.exe 2708 3120 WerFault.exe oneetx.exe 3256 3120 WerFault.exe oneetx.exe 4880 3120 WerFault.exe oneetx.exe 4564 3120 WerFault.exe oneetx.exe 4408 3120 WerFault.exe oneetx.exe 2888 3120 WerFault.exe oneetx.exe 4740 3120 WerFault.exe oneetx.exe 536 3120 WerFault.exe oneetx.exe 1144 3120 WerFault.exe oneetx.exe 1996 3120 WerFault.exe oneetx.exe 2540 4700 WerFault.exe oneetx.exe 2100 3120 WerFault.exe oneetx.exe 3564 3120 WerFault.exe oneetx.exe 3688 3120 WerFault.exe oneetx.exe 2412 1520 WerFault.exe oneetx.exe 2268 3120 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it655409.exejr339148.exekp810544.exepid process 2460 it655409.exe 2460 it655409.exe 2240 jr339148.exe 2240 jr339148.exe 4672 kp810544.exe 4672 kp810544.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it655409.exejr339148.exekp810544.exedescription pid process Token: SeDebugPrivilege 2460 it655409.exe Token: SeDebugPrivilege 2240 jr339148.exe Token: SeDebugPrivilege 4672 kp810544.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr879209.exepid process 1664 lr879209.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
5855948a3887a2fa355316874aa4b63881ddd8847c9825f14975ba7a64756b0f.exeziPE6415.exeziIh5026.exelr879209.exeoneetx.exedescription pid process target process PID 1168 wrote to memory of 1124 1168 5855948a3887a2fa355316874aa4b63881ddd8847c9825f14975ba7a64756b0f.exe ziPE6415.exe PID 1168 wrote to memory of 1124 1168 5855948a3887a2fa355316874aa4b63881ddd8847c9825f14975ba7a64756b0f.exe ziPE6415.exe PID 1168 wrote to memory of 1124 1168 5855948a3887a2fa355316874aa4b63881ddd8847c9825f14975ba7a64756b0f.exe ziPE6415.exe PID 1124 wrote to memory of 1812 1124 ziPE6415.exe ziIh5026.exe PID 1124 wrote to memory of 1812 1124 ziPE6415.exe ziIh5026.exe PID 1124 wrote to memory of 1812 1124 ziPE6415.exe ziIh5026.exe PID 1812 wrote to memory of 2460 1812 ziIh5026.exe it655409.exe PID 1812 wrote to memory of 2460 1812 ziIh5026.exe it655409.exe PID 1812 wrote to memory of 2240 1812 ziIh5026.exe jr339148.exe PID 1812 wrote to memory of 2240 1812 ziIh5026.exe jr339148.exe PID 1812 wrote to memory of 2240 1812 ziIh5026.exe jr339148.exe PID 1124 wrote to memory of 4672 1124 ziPE6415.exe kp810544.exe PID 1124 wrote to memory of 4672 1124 ziPE6415.exe kp810544.exe PID 1124 wrote to memory of 4672 1124 ziPE6415.exe kp810544.exe PID 1168 wrote to memory of 1664 1168 5855948a3887a2fa355316874aa4b63881ddd8847c9825f14975ba7a64756b0f.exe lr879209.exe PID 1168 wrote to memory of 1664 1168 5855948a3887a2fa355316874aa4b63881ddd8847c9825f14975ba7a64756b0f.exe lr879209.exe PID 1168 wrote to memory of 1664 1168 5855948a3887a2fa355316874aa4b63881ddd8847c9825f14975ba7a64756b0f.exe lr879209.exe PID 1664 wrote to memory of 3120 1664 lr879209.exe oneetx.exe PID 1664 wrote to memory of 3120 1664 lr879209.exe oneetx.exe PID 1664 wrote to memory of 3120 1664 lr879209.exe oneetx.exe PID 3120 wrote to memory of 2644 3120 oneetx.exe schtasks.exe PID 3120 wrote to memory of 2644 3120 oneetx.exe schtasks.exe PID 3120 wrote to memory of 2644 3120 oneetx.exe schtasks.exe PID 3120 wrote to memory of 404 3120 oneetx.exe rundll32.exe PID 3120 wrote to memory of 404 3120 oneetx.exe rundll32.exe PID 3120 wrote to memory of 404 3120 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5855948a3887a2fa355316874aa4b63881ddd8847c9825f14975ba7a64756b0f.exe"C:\Users\Admin\AppData\Local\Temp\5855948a3887a2fa355316874aa4b63881ddd8847c9825f14975ba7a64756b0f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPE6415.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPE6415.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziIh5026.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziIh5026.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it655409.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it655409.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr339148.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr339148.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 15405⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp810544.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp810544.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr879209.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr879209.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 7283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 8123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 9523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 9763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 9763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 12203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 12323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 8324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 8324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 11084⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 7684⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 7524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 8964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 11364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 13684⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 15804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 16204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 15563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2240 -ip 22401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1664 -ip 16641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1664 -ip 16641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1664 -ip 16641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1664 -ip 16641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1664 -ip 16641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1664 -ip 16641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1664 -ip 16641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1664 -ip 16641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1664 -ip 16641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1664 -ip 16641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3120 -ip 31201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3120 -ip 31201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3120 -ip 31201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3120 -ip 31201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3120 -ip 31201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3120 -ip 31201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3120 -ip 31201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3120 -ip 31201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3120 -ip 31201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3120 -ip 31201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3120 -ip 31201⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 3122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4700 -ip 47001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3120 -ip 31201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3120 -ip 31201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3120 -ip 31201⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 3122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1520 -ip 15201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3120 -ip 31201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr879209.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr879209.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPE6415.exeFilesize
536KB
MD54682d81c2df10fe47e8b7a9c32f0ca5c
SHA19fb97117852c2a9da8d0bcd81ae71fbb8bfa89e8
SHA256c02469f12d217048b75b1479e9488c07620c680a980176afd204f0c25c061b7c
SHA512807e57eb2bd5e2ae989fc1bc2057d39ea5afa95390da13a4f009cdc643de0ab6ce6749c91ed714acbdc81c14fc5e00fd87b3081e598763955b09900bf593b4d1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPE6415.exeFilesize
536KB
MD54682d81c2df10fe47e8b7a9c32f0ca5c
SHA19fb97117852c2a9da8d0bcd81ae71fbb8bfa89e8
SHA256c02469f12d217048b75b1479e9488c07620c680a980176afd204f0c25c061b7c
SHA512807e57eb2bd5e2ae989fc1bc2057d39ea5afa95390da13a4f009cdc643de0ab6ce6749c91ed714acbdc81c14fc5e00fd87b3081e598763955b09900bf593b4d1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp810544.exeFilesize
169KB
MD5479038df5aece8c0ca8dceeada5de39f
SHA1d4b057ff9c0d3632c3ade7b936dc6db6d8e97781
SHA256e70a7a6cab4496ab9bf67ee69b1ec7825623877f73b746a005599947334f7140
SHA5126ce596e39bbcca5003e0bcf2e3276166dd4024fcb2e4343e49cf51cec4185783b20a2268bcc97535c25e7d82a098987df68d8596e68ce71d5d19f479bb2b2f6a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp810544.exeFilesize
169KB
MD5479038df5aece8c0ca8dceeada5de39f
SHA1d4b057ff9c0d3632c3ade7b936dc6db6d8e97781
SHA256e70a7a6cab4496ab9bf67ee69b1ec7825623877f73b746a005599947334f7140
SHA5126ce596e39bbcca5003e0bcf2e3276166dd4024fcb2e4343e49cf51cec4185783b20a2268bcc97535c25e7d82a098987df68d8596e68ce71d5d19f479bb2b2f6a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziIh5026.exeFilesize
382KB
MD575aa4269a94ad20c37e5f9cfc08ff7de
SHA1d9071290703d5c46f2736d43a2c9ad8d856c19e0
SHA25615f19ad403ab7cd8e46dba5b395e49af8a87cfa79827727bb2a39d66372e379d
SHA512124f72db5be8c45dd2fb0238ad5013063bc908689b10cc974ff8505f2c9d0ac5fb5bfeca5ea9485dfc4700f1630a8ce5a877d7e99e3d7dc917b6dc736e01ec28
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziIh5026.exeFilesize
382KB
MD575aa4269a94ad20c37e5f9cfc08ff7de
SHA1d9071290703d5c46f2736d43a2c9ad8d856c19e0
SHA25615f19ad403ab7cd8e46dba5b395e49af8a87cfa79827727bb2a39d66372e379d
SHA512124f72db5be8c45dd2fb0238ad5013063bc908689b10cc974ff8505f2c9d0ac5fb5bfeca5ea9485dfc4700f1630a8ce5a877d7e99e3d7dc917b6dc736e01ec28
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it655409.exeFilesize
11KB
MD5af56016ecac8bf2c0f0f3aa9822911fb
SHA1f510035c7c776a50dd3a17abf441be1de126282f
SHA2564dd702cd774e79d6f55eabb5922498584a29f4a60b7f8b967b48b3cac0c48b41
SHA5121af5b6117a9d2d61cf9e3544c88d04c70ee65fec627b741374be5f9c9c3f7687a2bc221e61cf597f8c0e971e345a22c92874f714a5ae852ecde42b1b394cd591
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it655409.exeFilesize
11KB
MD5af56016ecac8bf2c0f0f3aa9822911fb
SHA1f510035c7c776a50dd3a17abf441be1de126282f
SHA2564dd702cd774e79d6f55eabb5922498584a29f4a60b7f8b967b48b3cac0c48b41
SHA5121af5b6117a9d2d61cf9e3544c88d04c70ee65fec627b741374be5f9c9c3f7687a2bc221e61cf597f8c0e971e345a22c92874f714a5ae852ecde42b1b394cd591
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr339148.exeFilesize
297KB
MD5d5a2451836ad9f1a5249ed5267c2b21f
SHA1bd617c45cb9b5f9d33607afb3ba7f7fbf371491e
SHA256a63ecb4fc6ccd7b8f58b8c288b4ba4d6ef3298257a8d9c06d6e68194501179b3
SHA512d993e141068a7205975645ea96cadacee7f5401ecd453bb2603868fd892404269d9e36324166c99db7344ec21bfc62e60bfdfb5078c5a709d4f829abeef85b9a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr339148.exeFilesize
297KB
MD5d5a2451836ad9f1a5249ed5267c2b21f
SHA1bd617c45cb9b5f9d33607afb3ba7f7fbf371491e
SHA256a63ecb4fc6ccd7b8f58b8c288b4ba4d6ef3298257a8d9c06d6e68194501179b3
SHA512d993e141068a7205975645ea96cadacee7f5401ecd453bb2603868fd892404269d9e36324166c99db7344ec21bfc62e60bfdfb5078c5a709d4f829abeef85b9a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1664-1100-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB
-
memory/2240-206-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-226-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-178-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-180-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-182-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-184-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-186-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-188-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-190-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-192-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-194-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-196-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-198-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-200-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-202-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-204-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-176-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-208-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-210-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-214-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-212-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-216-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-218-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-220-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-222-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-224-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-228-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-174-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-1071-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/2240-1072-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/2240-1073-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/2240-1074-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB
-
memory/2240-1075-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/2240-1077-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB
-
memory/2240-1078-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB
-
memory/2240-1079-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB
-
memory/2240-1080-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/2240-1081-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/2240-1082-0x00000000064B0000-0x0000000006672000-memory.dmpFilesize
1.8MB
-
memory/2240-1083-0x0000000006690000-0x0000000006BBC000-memory.dmpFilesize
5.2MB
-
memory/2240-1084-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB
-
memory/2240-1085-0x0000000006CF0000-0x0000000006D66000-memory.dmpFilesize
472KB
-
memory/2240-1086-0x0000000006D80000-0x0000000006DD0000-memory.dmpFilesize
320KB
-
memory/2240-160-0x0000000004B00000-0x00000000050A4000-memory.dmpFilesize
5.6MB
-
memory/2240-172-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-170-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-168-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-166-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-165-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2240-164-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB
-
memory/2240-163-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB
-
memory/2240-162-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB
-
memory/2240-161-0x00000000008B0000-0x00000000008FB000-memory.dmpFilesize
300KB
-
memory/2460-154-0x0000000000B20000-0x0000000000B2A000-memory.dmpFilesize
40KB
-
memory/4672-1093-0x00000000006A0000-0x00000000006D0000-memory.dmpFilesize
192KB
-
memory/4672-1094-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB