Analysis
-
max time kernel
145s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 20:11
Static task
static1
General
-
Target
3fc9bcf32109bcc65eb2cee8e7af7e54512bde9120c61a48aab59b9d3ef45924.exe
-
Size
800KB
-
MD5
aa5298588a2a24ab2a7d654b27a334b7
-
SHA1
9409a393451e08fa485e8f55c5614f3462bf1122
-
SHA256
3fc9bcf32109bcc65eb2cee8e7af7e54512bde9120c61a48aab59b9d3ef45924
-
SHA512
9abf02e182e31559f7d83afc57ff1de7617a2032d8fb0ca56b421dd2321679689bf71cfa7472cfbe08ca0cfd5b5b6a11fa0f0faa26ab2c42ea1753b95da14d5e
-
SSDEEP
12288:CMrqy90fUNHEE6sLZ8rUMo38MBCj2xK7Cv9OcakQZW0UsU8+Ug//+JNrYVAw:kyqAHunoMBixfvdakQnUJ7CIAw
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
it851667.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it851667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it851667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it851667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it851667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it851667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it851667.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/220-164-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-165-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-167-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-169-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-171-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-173-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-175-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-177-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-179-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-181-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-183-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-185-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-187-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-189-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-191-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-193-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-195-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-197-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-199-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-201-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-203-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-205-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-207-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-209-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-211-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-213-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-215-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-217-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-219-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-221-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-223-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-225-0x0000000002850000-0x000000000288F000-memory.dmp family_redline behavioral1/memory/220-227-0x0000000002850000-0x000000000288F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
oneetx.exelr613700.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation oneetx.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation lr613700.exe -
Executes dropped EXE 9 IoCs
Processes:
ziSa5826.exezitn7811.exeit851667.exejr718605.exekp980475.exelr613700.exeoneetx.exeoneetx.exeoneetx.exepid process 3792 ziSa5826.exe 3260 zitn7811.exe 1060 it851667.exe 220 jr718605.exe 1624 kp980475.exe 2336 lr613700.exe 3228 oneetx.exe 5048 oneetx.exe 2988 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2984 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it851667.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it851667.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
3fc9bcf32109bcc65eb2cee8e7af7e54512bde9120c61a48aab59b9d3ef45924.exeziSa5826.exezitn7811.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3fc9bcf32109bcc65eb2cee8e7af7e54512bde9120c61a48aab59b9d3ef45924.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziSa5826.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziSa5826.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zitn7811.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zitn7811.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 3fc9bcf32109bcc65eb2cee8e7af7e54512bde9120c61a48aab59b9d3ef45924.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 29 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 5064 220 WerFault.exe jr718605.exe 3768 2336 WerFault.exe lr613700.exe 3000 2336 WerFault.exe lr613700.exe 1772 2336 WerFault.exe lr613700.exe 3776 2336 WerFault.exe lr613700.exe 2872 2336 WerFault.exe lr613700.exe 644 2336 WerFault.exe lr613700.exe 1368 2336 WerFault.exe lr613700.exe 3212 2336 WerFault.exe lr613700.exe 1700 2336 WerFault.exe lr613700.exe 2672 2336 WerFault.exe lr613700.exe 456 3228 WerFault.exe oneetx.exe 400 3228 WerFault.exe oneetx.exe 3488 3228 WerFault.exe oneetx.exe 460 3228 WerFault.exe oneetx.exe 1892 3228 WerFault.exe oneetx.exe 3004 3228 WerFault.exe oneetx.exe 3444 3228 WerFault.exe oneetx.exe 4604 3228 WerFault.exe oneetx.exe 560 3228 WerFault.exe oneetx.exe 2300 3228 WerFault.exe oneetx.exe 884 3228 WerFault.exe oneetx.exe 3304 3228 WerFault.exe oneetx.exe 3420 5048 WerFault.exe oneetx.exe 220 3228 WerFault.exe oneetx.exe 2712 3228 WerFault.exe oneetx.exe 4932 3228 WerFault.exe oneetx.exe 2008 3228 WerFault.exe oneetx.exe 4572 2988 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it851667.exejr718605.exekp980475.exepid process 1060 it851667.exe 1060 it851667.exe 220 jr718605.exe 220 jr718605.exe 1624 kp980475.exe 1624 kp980475.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it851667.exejr718605.exekp980475.exedescription pid process Token: SeDebugPrivilege 1060 it851667.exe Token: SeDebugPrivilege 220 jr718605.exe Token: SeDebugPrivilege 1624 kp980475.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr613700.exepid process 2336 lr613700.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
3fc9bcf32109bcc65eb2cee8e7af7e54512bde9120c61a48aab59b9d3ef45924.exeziSa5826.exezitn7811.exelr613700.exeoneetx.exedescription pid process target process PID 1988 wrote to memory of 3792 1988 3fc9bcf32109bcc65eb2cee8e7af7e54512bde9120c61a48aab59b9d3ef45924.exe ziSa5826.exe PID 1988 wrote to memory of 3792 1988 3fc9bcf32109bcc65eb2cee8e7af7e54512bde9120c61a48aab59b9d3ef45924.exe ziSa5826.exe PID 1988 wrote to memory of 3792 1988 3fc9bcf32109bcc65eb2cee8e7af7e54512bde9120c61a48aab59b9d3ef45924.exe ziSa5826.exe PID 3792 wrote to memory of 3260 3792 ziSa5826.exe zitn7811.exe PID 3792 wrote to memory of 3260 3792 ziSa5826.exe zitn7811.exe PID 3792 wrote to memory of 3260 3792 ziSa5826.exe zitn7811.exe PID 3260 wrote to memory of 1060 3260 zitn7811.exe it851667.exe PID 3260 wrote to memory of 1060 3260 zitn7811.exe it851667.exe PID 3260 wrote to memory of 220 3260 zitn7811.exe jr718605.exe PID 3260 wrote to memory of 220 3260 zitn7811.exe jr718605.exe PID 3260 wrote to memory of 220 3260 zitn7811.exe jr718605.exe PID 3792 wrote to memory of 1624 3792 ziSa5826.exe kp980475.exe PID 3792 wrote to memory of 1624 3792 ziSa5826.exe kp980475.exe PID 3792 wrote to memory of 1624 3792 ziSa5826.exe kp980475.exe PID 1988 wrote to memory of 2336 1988 3fc9bcf32109bcc65eb2cee8e7af7e54512bde9120c61a48aab59b9d3ef45924.exe lr613700.exe PID 1988 wrote to memory of 2336 1988 3fc9bcf32109bcc65eb2cee8e7af7e54512bde9120c61a48aab59b9d3ef45924.exe lr613700.exe PID 1988 wrote to memory of 2336 1988 3fc9bcf32109bcc65eb2cee8e7af7e54512bde9120c61a48aab59b9d3ef45924.exe lr613700.exe PID 2336 wrote to memory of 3228 2336 lr613700.exe oneetx.exe PID 2336 wrote to memory of 3228 2336 lr613700.exe oneetx.exe PID 2336 wrote to memory of 3228 2336 lr613700.exe oneetx.exe PID 3228 wrote to memory of 4112 3228 oneetx.exe schtasks.exe PID 3228 wrote to memory of 4112 3228 oneetx.exe schtasks.exe PID 3228 wrote to memory of 4112 3228 oneetx.exe schtasks.exe PID 3228 wrote to memory of 2984 3228 oneetx.exe rundll32.exe PID 3228 wrote to memory of 2984 3228 oneetx.exe rundll32.exe PID 3228 wrote to memory of 2984 3228 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fc9bcf32109bcc65eb2cee8e7af7e54512bde9120c61a48aab59b9d3ef45924.exe"C:\Users\Admin\AppData\Local\Temp\3fc9bcf32109bcc65eb2cee8e7af7e54512bde9120c61a48aab59b9d3ef45924.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziSa5826.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziSa5826.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zitn7811.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zitn7811.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it851667.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it851667.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr718605.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr718605.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 13565⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp980475.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp980475.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr613700.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr613700.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 7803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 9523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 9883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 8603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 12203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 12443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 8364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 9044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 10604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 10604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 11004⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 8284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 12644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 13444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 16004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 10604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 16964⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 11444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 17124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 13603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 220 -ip 2201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2336 -ip 23361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2336 -ip 23361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2336 -ip 23361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2336 -ip 23361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2336 -ip 23361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2336 -ip 23361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2336 -ip 23361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2336 -ip 23361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2336 -ip 23361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2336 -ip 23361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3228 -ip 32281⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 3162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5048 -ip 50481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3228 -ip 32281⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2988 -ip 29881⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr613700.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr613700.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziSa5826.exeFilesize
536KB
MD5ab073592c19992185715bb3c288aa920
SHA19aea29d86fed19d5928ed8fceb892aaa9250c7e4
SHA256eb9c64eb8f3b7078768c163bee19000a741d290e42d56d731abb10e37a62fa03
SHA51250235f1e3fd898e46a426d10401def779890f58913ae2b926a8d0696f9e8a6a60f763e6d9709ba4947b118d99b1428d68400fa7d8a821fce7a0e65468d2a045f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziSa5826.exeFilesize
536KB
MD5ab073592c19992185715bb3c288aa920
SHA19aea29d86fed19d5928ed8fceb892aaa9250c7e4
SHA256eb9c64eb8f3b7078768c163bee19000a741d290e42d56d731abb10e37a62fa03
SHA51250235f1e3fd898e46a426d10401def779890f58913ae2b926a8d0696f9e8a6a60f763e6d9709ba4947b118d99b1428d68400fa7d8a821fce7a0e65468d2a045f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp980475.exeFilesize
169KB
MD5c34ddac290b31a161ce2a596ac88bc0d
SHA1c685936c5fced45115bdbdce9aa36419da8a6d77
SHA25622c2c1f7cb18776c63b1cb6961432b448dead0ffc79f714333ac3d9a2f94e0e8
SHA512f9ef5b8a42bd3c44bf4f60f90f94b148aa2cced29e22cb3704f782d4d3e6eb624c669eb7abb8edfe3b73ede1a9611aefde27f35f0d15aa5ac7ace43bdc3df5f3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp980475.exeFilesize
169KB
MD5c34ddac290b31a161ce2a596ac88bc0d
SHA1c685936c5fced45115bdbdce9aa36419da8a6d77
SHA25622c2c1f7cb18776c63b1cb6961432b448dead0ffc79f714333ac3d9a2f94e0e8
SHA512f9ef5b8a42bd3c44bf4f60f90f94b148aa2cced29e22cb3704f782d4d3e6eb624c669eb7abb8edfe3b73ede1a9611aefde27f35f0d15aa5ac7ace43bdc3df5f3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zitn7811.exeFilesize
382KB
MD5b83543d275cbaaae2116bc526fed77f3
SHA1a3ce6b00d1e69060988940f774b36f791527fc62
SHA256615993bdd7720db9da2188b6d3ec2acb975d28f978a0aa23ae2cf20e44caacb0
SHA512b1cd9b6ea18c4b316511d1b88010ecddb54d572c068cefa2568a8da3b12cc0c3f1725bee00fc60bfc2d5065224c94b7186673a13f640b2e70ec086d6c51ec46a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zitn7811.exeFilesize
382KB
MD5b83543d275cbaaae2116bc526fed77f3
SHA1a3ce6b00d1e69060988940f774b36f791527fc62
SHA256615993bdd7720db9da2188b6d3ec2acb975d28f978a0aa23ae2cf20e44caacb0
SHA512b1cd9b6ea18c4b316511d1b88010ecddb54d572c068cefa2568a8da3b12cc0c3f1725bee00fc60bfc2d5065224c94b7186673a13f640b2e70ec086d6c51ec46a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it851667.exeFilesize
11KB
MD52458baa27c18b42d9f731c14aecbcca6
SHA18579b1b7f3b9448712b023d59aab0a0a9a08a4bc
SHA256d7e6fb558d11511ac2a8346e2d1510811184af72ade28371a7c7f06e457ea6a2
SHA51239f81b6346ea07ee70391170ddb8cf855b44ca3f6e555967ef71789f18ac0d8f7a45fa634ccfc0e132c90ba19fe10a01f97490edfb5d1643c6fc7683c518bcba
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it851667.exeFilesize
11KB
MD52458baa27c18b42d9f731c14aecbcca6
SHA18579b1b7f3b9448712b023d59aab0a0a9a08a4bc
SHA256d7e6fb558d11511ac2a8346e2d1510811184af72ade28371a7c7f06e457ea6a2
SHA51239f81b6346ea07ee70391170ddb8cf855b44ca3f6e555967ef71789f18ac0d8f7a45fa634ccfc0e132c90ba19fe10a01f97490edfb5d1643c6fc7683c518bcba
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr718605.exeFilesize
297KB
MD57aefc8a24dfb96eddf52000e6f9c37f5
SHA1fa4ebb80431cf8fef1ce3a65dd22585eb9025ba7
SHA256177a2b284fa2c8cb0183dc34b9b5b6ff2eb0c3b2d68cb48c293e12c36f75f225
SHA512c3bacf8e5717b177a8940c4fc02b9312ca4130993550bf51a75e177e2cd7833171db1d25dbd378cf7c2c887d08f078260382d79cae3c1bd3cbcc8f4c8a015c26
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr718605.exeFilesize
297KB
MD57aefc8a24dfb96eddf52000e6f9c37f5
SHA1fa4ebb80431cf8fef1ce3a65dd22585eb9025ba7
SHA256177a2b284fa2c8cb0183dc34b9b5b6ff2eb0c3b2d68cb48c293e12c36f75f225
SHA512c3bacf8e5717b177a8940c4fc02b9312ca4130993550bf51a75e177e2cd7833171db1d25dbd378cf7c2c887d08f078260382d79cae3c1bd3cbcc8f4c8a015c26
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/220-207-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-227-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-177-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-179-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-181-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-183-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-185-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-187-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-189-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-191-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-193-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-195-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-197-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-199-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-201-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-203-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-205-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-173-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-209-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-211-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-213-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-215-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-217-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-219-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-221-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-223-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-225-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-175-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-1070-0x0000000005290000-0x00000000058A8000-memory.dmpFilesize
6.1MB
-
memory/220-1071-0x00000000058B0000-0x00000000059BA000-memory.dmpFilesize
1.0MB
-
memory/220-1072-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/220-1073-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/220-1074-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/220-1076-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/220-1077-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/220-1078-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/220-1079-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/220-1080-0x00000000065D0000-0x0000000006792000-memory.dmpFilesize
1.8MB
-
memory/220-1081-0x00000000067A0000-0x0000000006CCC000-memory.dmpFilesize
5.2MB
-
memory/220-1082-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/220-1083-0x0000000006DF0000-0x0000000006E66000-memory.dmpFilesize
472KB
-
memory/220-1084-0x0000000006E70000-0x0000000006EC0000-memory.dmpFilesize
320KB
-
memory/220-160-0x0000000004CE0000-0x0000000005284000-memory.dmpFilesize
5.6MB
-
memory/220-161-0x00000000004C0000-0x000000000050B000-memory.dmpFilesize
300KB
-
memory/220-162-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/220-163-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/220-171-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-169-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-167-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-165-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/220-164-0x0000000002850000-0x000000000288F000-memory.dmpFilesize
252KB
-
memory/1060-154-0x0000000000470000-0x000000000047A000-memory.dmpFilesize
40KB
-
memory/1624-1091-0x0000000004870000-0x0000000004880000-memory.dmpFilesize
64KB
-
memory/1624-1090-0x0000000000090000-0x00000000000C0000-memory.dmpFilesize
192KB
-
memory/2336-1097-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB