Analysis
-
max time kernel
149s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 20:08
Static task
static1
General
-
Target
fbb902b8f6898210bce6cd973480dd5a9b8c5ab852cbafb7df971ffeb66f2676.exe
-
Size
801KB
-
MD5
9075d7e52e5c4cfb0c6f18339a4747c0
-
SHA1
6d62e9ed23dab1870e3efe542fd1041701ea7212
-
SHA256
fbb902b8f6898210bce6cd973480dd5a9b8c5ab852cbafb7df971ffeb66f2676
-
SHA512
ec8cced296605055679d882aa4ac19e5c633814fead314680c3e4d400ceca472a0e11e6482b128d2665ad630cb7678488b4fe8fd445977cc52384fd96ef9ebdd
-
SSDEEP
12288:cMrOy90cD7sVLLdmK48arYoYLxK7CHG0yeztlyGYqJyBe+tGvvebTkU/9mW+kif0:qyjDemK75xf4Cj7JIUveBQW7RFQK
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
it768848.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it768848.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it768848.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it768848.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it768848.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it768848.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it768848.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/1852-162-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-163-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-165-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-167-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-171-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-169-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-173-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-175-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-177-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-183-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-185-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-181-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-179-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-188-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-192-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-194-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-196-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-198-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-200-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-202-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-204-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-206-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-208-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-210-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-212-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-214-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-216-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-218-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-220-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-222-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-224-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-226-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-228-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1852-1080-0x0000000004BC0000-0x0000000004BD0000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr458744.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation lr458744.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
zixU1255.exeziDx0439.exeit768848.exejr640311.exekp642246.exelr458744.exeoneetx.exeoneetx.exeoneetx.exepid process 2332 zixU1255.exe 3284 ziDx0439.exe 1772 it768848.exe 1852 jr640311.exe 1200 kp642246.exe 1432 lr458744.exe 1756 oneetx.exe 1428 oneetx.exe 3272 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3560 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it768848.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it768848.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
fbb902b8f6898210bce6cd973480dd5a9b8c5ab852cbafb7df971ffeb66f2676.exezixU1255.exeziDx0439.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fbb902b8f6898210bce6cd973480dd5a9b8c5ab852cbafb7df971ffeb66f2676.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fbb902b8f6898210bce6cd973480dd5a9b8c5ab852cbafb7df971ffeb66f2676.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zixU1255.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zixU1255.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziDx0439.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ziDx0439.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 28 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 384 1852 WerFault.exe jr640311.exe 1308 1432 WerFault.exe lr458744.exe 2480 1432 WerFault.exe lr458744.exe 4496 1432 WerFault.exe lr458744.exe 2512 1432 WerFault.exe lr458744.exe 4944 1432 WerFault.exe lr458744.exe 3052 1432 WerFault.exe lr458744.exe 1892 1432 WerFault.exe lr458744.exe 3292 1432 WerFault.exe lr458744.exe 1916 1432 WerFault.exe lr458744.exe 4120 1432 WerFault.exe lr458744.exe 3288 1756 WerFault.exe oneetx.exe 1872 1756 WerFault.exe oneetx.exe 2784 1756 WerFault.exe oneetx.exe 3508 1756 WerFault.exe oneetx.exe 4940 1756 WerFault.exe oneetx.exe 2656 1756 WerFault.exe oneetx.exe 2516 1756 WerFault.exe oneetx.exe 888 1756 WerFault.exe oneetx.exe 4104 1756 WerFault.exe oneetx.exe 4832 1756 WerFault.exe oneetx.exe 4500 1756 WerFault.exe oneetx.exe 4916 1428 WerFault.exe oneetx.exe 2876 1756 WerFault.exe oneetx.exe 2860 1756 WerFault.exe oneetx.exe 1596 1756 WerFault.exe oneetx.exe 2288 3272 WerFault.exe oneetx.exe 3372 1756 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it768848.exejr640311.exekp642246.exepid process 1772 it768848.exe 1772 it768848.exe 1852 jr640311.exe 1852 jr640311.exe 1200 kp642246.exe 1200 kp642246.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it768848.exejr640311.exekp642246.exedescription pid process Token: SeDebugPrivilege 1772 it768848.exe Token: SeDebugPrivilege 1852 jr640311.exe Token: SeDebugPrivilege 1200 kp642246.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr458744.exepid process 1432 lr458744.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
fbb902b8f6898210bce6cd973480dd5a9b8c5ab852cbafb7df971ffeb66f2676.exezixU1255.exeziDx0439.exelr458744.exeoneetx.exedescription pid process target process PID 1516 wrote to memory of 2332 1516 fbb902b8f6898210bce6cd973480dd5a9b8c5ab852cbafb7df971ffeb66f2676.exe zixU1255.exe PID 1516 wrote to memory of 2332 1516 fbb902b8f6898210bce6cd973480dd5a9b8c5ab852cbafb7df971ffeb66f2676.exe zixU1255.exe PID 1516 wrote to memory of 2332 1516 fbb902b8f6898210bce6cd973480dd5a9b8c5ab852cbafb7df971ffeb66f2676.exe zixU1255.exe PID 2332 wrote to memory of 3284 2332 zixU1255.exe ziDx0439.exe PID 2332 wrote to memory of 3284 2332 zixU1255.exe ziDx0439.exe PID 2332 wrote to memory of 3284 2332 zixU1255.exe ziDx0439.exe PID 3284 wrote to memory of 1772 3284 ziDx0439.exe it768848.exe PID 3284 wrote to memory of 1772 3284 ziDx0439.exe it768848.exe PID 3284 wrote to memory of 1852 3284 ziDx0439.exe jr640311.exe PID 3284 wrote to memory of 1852 3284 ziDx0439.exe jr640311.exe PID 3284 wrote to memory of 1852 3284 ziDx0439.exe jr640311.exe PID 2332 wrote to memory of 1200 2332 zixU1255.exe kp642246.exe PID 2332 wrote to memory of 1200 2332 zixU1255.exe kp642246.exe PID 2332 wrote to memory of 1200 2332 zixU1255.exe kp642246.exe PID 1516 wrote to memory of 1432 1516 fbb902b8f6898210bce6cd973480dd5a9b8c5ab852cbafb7df971ffeb66f2676.exe lr458744.exe PID 1516 wrote to memory of 1432 1516 fbb902b8f6898210bce6cd973480dd5a9b8c5ab852cbafb7df971ffeb66f2676.exe lr458744.exe PID 1516 wrote to memory of 1432 1516 fbb902b8f6898210bce6cd973480dd5a9b8c5ab852cbafb7df971ffeb66f2676.exe lr458744.exe PID 1432 wrote to memory of 1756 1432 lr458744.exe oneetx.exe PID 1432 wrote to memory of 1756 1432 lr458744.exe oneetx.exe PID 1432 wrote to memory of 1756 1432 lr458744.exe oneetx.exe PID 1756 wrote to memory of 3592 1756 oneetx.exe schtasks.exe PID 1756 wrote to memory of 3592 1756 oneetx.exe schtasks.exe PID 1756 wrote to memory of 3592 1756 oneetx.exe schtasks.exe PID 1756 wrote to memory of 3560 1756 oneetx.exe rundll32.exe PID 1756 wrote to memory of 3560 1756 oneetx.exe rundll32.exe PID 1756 wrote to memory of 3560 1756 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbb902b8f6898210bce6cd973480dd5a9b8c5ab852cbafb7df971ffeb66f2676.exe"C:\Users\Admin\AppData\Local\Temp\fbb902b8f6898210bce6cd973480dd5a9b8c5ab852cbafb7df971ffeb66f2676.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixU1255.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixU1255.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziDx0439.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziDx0439.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it768848.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it768848.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr640311.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr640311.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 13485⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp642246.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp642246.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr458744.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr458744.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 7643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 8123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 9723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 9963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 9963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 12083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 12443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 6364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 8164⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 8884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 10604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 10644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 10604⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 9244⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 7684⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 7524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 12924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 16124⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 15564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 16284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 8123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1852 -ip 18521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1432 -ip 14321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1432 -ip 14321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1432 -ip 14321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1432 -ip 14321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1432 -ip 14321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1432 -ip 14321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1432 -ip 14321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 1432 -ip 14321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1432 -ip 14321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1432 -ip 14321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1756 -ip 17561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1756 -ip 17561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1756 -ip 17561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1756 -ip 17561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1756 -ip 17561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1756 -ip 17561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1756 -ip 17561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1756 -ip 17561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1756 -ip 17561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1756 -ip 17561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1756 -ip 17561⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1428 -ip 14281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1756 -ip 17561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1756 -ip 17561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1756 -ip 17561⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 3162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3272 -ip 32721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1756 -ip 17561⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr458744.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr458744.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixU1255.exeFilesize
535KB
MD557fec1386f335f711eb261a273860385
SHA1edea4c56a72197822e9048a5a8142272f1710854
SHA2563a4ce9fa246924bc049d37e077d35874ea6806845a0cb512139df90a1bbe0562
SHA512603baad7f1472b2e3d68f275eaf43470200021a6d609e6c7f35351014156ce876c3aa7b86fc5bf44af42dc67357c1aef236436ce386a66d1d28da3b0ff145f9c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixU1255.exeFilesize
535KB
MD557fec1386f335f711eb261a273860385
SHA1edea4c56a72197822e9048a5a8142272f1710854
SHA2563a4ce9fa246924bc049d37e077d35874ea6806845a0cb512139df90a1bbe0562
SHA512603baad7f1472b2e3d68f275eaf43470200021a6d609e6c7f35351014156ce876c3aa7b86fc5bf44af42dc67357c1aef236436ce386a66d1d28da3b0ff145f9c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp642246.exeFilesize
169KB
MD51ec7bf6887a5e7635f0aa0c916bd5df1
SHA14684211c71bf67213e970d1e1b4a2cab24d2e2d5
SHA25693a4506ed06e7cccbba5593d0b2f7dcce7a7050d91d83dd9128a4da8ee8568c9
SHA512b204198b0a0d42156d72c36ede876387869922ea64f4382954b8c89de66cd25299b988cf525e210d6ebe14065e73bb0a123993f5a4d56eba48c90f02778f2fd9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp642246.exeFilesize
169KB
MD51ec7bf6887a5e7635f0aa0c916bd5df1
SHA14684211c71bf67213e970d1e1b4a2cab24d2e2d5
SHA25693a4506ed06e7cccbba5593d0b2f7dcce7a7050d91d83dd9128a4da8ee8568c9
SHA512b204198b0a0d42156d72c36ede876387869922ea64f4382954b8c89de66cd25299b988cf525e210d6ebe14065e73bb0a123993f5a4d56eba48c90f02778f2fd9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziDx0439.exeFilesize
382KB
MD5a78a9e137312b6b27e69074748ce907b
SHA15b4483393d74e9effd8728260c21c86633cb619d
SHA256516686a8356cab04d0dd8d8a07bf94f67a4bb68e9652b5c8beb751f2c75fc692
SHA51272ad59a9ecbbd9f8968b8b4b5bf7e9ed1a9748af4b1e865f4f52f59518dd47de965ba0f063bd4dbbd6d6020d88a8b8838bea4d498b2617af3559368aa3ce284b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziDx0439.exeFilesize
382KB
MD5a78a9e137312b6b27e69074748ce907b
SHA15b4483393d74e9effd8728260c21c86633cb619d
SHA256516686a8356cab04d0dd8d8a07bf94f67a4bb68e9652b5c8beb751f2c75fc692
SHA51272ad59a9ecbbd9f8968b8b4b5bf7e9ed1a9748af4b1e865f4f52f59518dd47de965ba0f063bd4dbbd6d6020d88a8b8838bea4d498b2617af3559368aa3ce284b
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it768848.exeFilesize
11KB
MD5d8c5787eccdf1a982b642ddde7667899
SHA1a12d727bf992e0aceda76cd1d782dff89cb85fc1
SHA256c684fe61d26739acec9b186b1387f5e4a7b0a384d2716eefc6881d0387784409
SHA5127860d16712baae543e463c2305c99892c444f5755e03d407086d395adfdd2d11ac6567cf136b1e713f950b2b3ba02b9376d4abb4ccebbc845b2685ddeafe302b
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it768848.exeFilesize
11KB
MD5d8c5787eccdf1a982b642ddde7667899
SHA1a12d727bf992e0aceda76cd1d782dff89cb85fc1
SHA256c684fe61d26739acec9b186b1387f5e4a7b0a384d2716eefc6881d0387784409
SHA5127860d16712baae543e463c2305c99892c444f5755e03d407086d395adfdd2d11ac6567cf136b1e713f950b2b3ba02b9376d4abb4ccebbc845b2685ddeafe302b
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr640311.exeFilesize
297KB
MD5ca38bd9870e570150458e09d14353743
SHA1ac9c18247b6d2ec64a6865a4ae65dc6f13d41ed8
SHA256809245a343ef12ee6ebf8cd6548d2013b2f155312e6ee4b560b0aadd0126630e
SHA512f0f38eb34cbd51220aef77c2fac78b0008b8bcb974d6d63d2a00e1026c465995c3313acaff976024795e1290d6e0e9dd107e3bf343afdc8597c3ffde1b7e477f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr640311.exeFilesize
297KB
MD5ca38bd9870e570150458e09d14353743
SHA1ac9c18247b6d2ec64a6865a4ae65dc6f13d41ed8
SHA256809245a343ef12ee6ebf8cd6548d2013b2f155312e6ee4b560b0aadd0126630e
SHA512f0f38eb34cbd51220aef77c2fac78b0008b8bcb974d6d63d2a00e1026c465995c3313acaff976024795e1290d6e0e9dd107e3bf343afdc8597c3ffde1b7e477f
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1200-1092-0x0000000000E90000-0x0000000000EC0000-memory.dmpFilesize
192KB
-
memory/1200-1094-0x0000000005820000-0x0000000005830000-memory.dmpFilesize
64KB
-
memory/1200-1093-0x0000000005820000-0x0000000005830000-memory.dmpFilesize
64KB
-
memory/1432-1100-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB
-
memory/1772-154-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/1852-206-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-1074-0x00000000058D0000-0x000000000590C000-memory.dmpFilesize
240KB
-
memory/1852-189-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1852-191-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1852-187-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1852-192-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-194-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-196-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-198-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-200-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-202-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-204-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-179-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-208-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-210-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-212-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-214-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-216-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-218-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-220-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-222-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-224-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-226-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-228-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-1071-0x0000000005180000-0x0000000005798000-memory.dmpFilesize
6.1MB
-
memory/1852-1072-0x00000000057A0000-0x00000000058AA000-memory.dmpFilesize
1.0MB
-
memory/1852-1073-0x00000000058B0000-0x00000000058C2000-memory.dmpFilesize
72KB
-
memory/1852-188-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-1075-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1852-1077-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/1852-1078-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1852-1080-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1852-1079-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1852-1081-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/1852-1082-0x0000000006450000-0x00000000064C6000-memory.dmpFilesize
472KB
-
memory/1852-1083-0x00000000064E0000-0x0000000006530000-memory.dmpFilesize
320KB
-
memory/1852-181-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-185-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-183-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-177-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-175-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-173-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-169-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-171-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-167-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-165-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-163-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-162-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1852-161-0x0000000004BD0000-0x0000000005174000-memory.dmpFilesize
5.6MB
-
memory/1852-160-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/1852-1084-0x0000000006560000-0x0000000006722000-memory.dmpFilesize
1.8MB
-
memory/1852-1085-0x0000000006730000-0x0000000006C5C000-memory.dmpFilesize
5.2MB
-
memory/1852-1086-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB