Analysis
-
max time kernel
148s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 21:14
Static task
static1
General
-
Target
1eda2cc6cfe33e7749fbdb7a2d5e32eb92a1c1a452b89de3047d08173fb11e2f.exe
-
Size
801KB
-
MD5
806348f61a969b76ccca03e90a52856b
-
SHA1
44b3e7df4a3b266a0f5bd09c2a39a4391e1ae9a0
-
SHA256
1eda2cc6cfe33e7749fbdb7a2d5e32eb92a1c1a452b89de3047d08173fb11e2f
-
SHA512
f89653974a6127310ac9c2018a64cae59c3f9eb39a933981e182251a530b6951f9fc8df263eefb2b7f7efb8cb9cb7adfde451564479587c6cced1f7c641cdfc5
-
SSDEEP
24576:Byy5HB0WJiSxMZM6I+/mxfoNj3X2nownbzHHeyjIL:0RIiSxQMM/mxQNjHFQPzjI
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
it314314.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it314314.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it314314.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it314314.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it314314.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it314314.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it314314.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/2452-165-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-166-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-168-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-170-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-172-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-174-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-176-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-178-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-180-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-182-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-184-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-186-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-188-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-190-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-192-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-194-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-196-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-198-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-200-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-202-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-204-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-206-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-212-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-210-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-208-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-214-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-216-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-218-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-220-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-222-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-224-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-226-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline behavioral1/memory/2452-228-0x00000000051A0000-0x00000000051DF000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr310488.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation lr310488.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
ziYS7583.exeziRK9591.exeit314314.exejr437157.exekp391599.exelr310488.exeoneetx.exeoneetx.exeoneetx.exepid process 4672 ziYS7583.exe 4700 ziRK9591.exe 4312 it314314.exe 2452 jr437157.exe 4956 kp391599.exe 4708 lr310488.exe 3936 oneetx.exe 452 oneetx.exe 2452 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1528 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it314314.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it314314.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
ziRK9591.exe1eda2cc6cfe33e7749fbdb7a2d5e32eb92a1c1a452b89de3047d08173fb11e2f.exeziYS7583.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziRK9591.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ziRK9591.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1eda2cc6cfe33e7749fbdb7a2d5e32eb92a1c1a452b89de3047d08173fb11e2f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1eda2cc6cfe33e7749fbdb7a2d5e32eb92a1c1a452b89de3047d08173fb11e2f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziYS7583.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziYS7583.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 28 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1820 2452 WerFault.exe jr437157.exe 4268 4708 WerFault.exe lr310488.exe 1808 4708 WerFault.exe lr310488.exe 4548 4708 WerFault.exe lr310488.exe 1880 4708 WerFault.exe lr310488.exe 1836 4708 WerFault.exe lr310488.exe 852 4708 WerFault.exe lr310488.exe 3996 4708 WerFault.exe lr310488.exe 1612 4708 WerFault.exe lr310488.exe 3232 4708 WerFault.exe lr310488.exe 2680 4708 WerFault.exe lr310488.exe 2236 3936 WerFault.exe oneetx.exe 3412 3936 WerFault.exe oneetx.exe 3492 3936 WerFault.exe oneetx.exe 4360 3936 WerFault.exe oneetx.exe 2644 3936 WerFault.exe oneetx.exe 1940 3936 WerFault.exe oneetx.exe 4648 3936 WerFault.exe oneetx.exe 920 3936 WerFault.exe oneetx.exe 3900 3936 WerFault.exe oneetx.exe 4172 3936 WerFault.exe oneetx.exe 2008 3936 WerFault.exe oneetx.exe 2716 452 WerFault.exe oneetx.exe 4628 3936 WerFault.exe oneetx.exe 32 3936 WerFault.exe oneetx.exe 824 3936 WerFault.exe oneetx.exe 4700 2452 WerFault.exe oneetx.exe 1664 3936 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it314314.exejr437157.exekp391599.exepid process 4312 it314314.exe 4312 it314314.exe 2452 jr437157.exe 2452 jr437157.exe 4956 kp391599.exe 4956 kp391599.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it314314.exejr437157.exekp391599.exedescription pid process Token: SeDebugPrivilege 4312 it314314.exe Token: SeDebugPrivilege 2452 jr437157.exe Token: SeDebugPrivilege 4956 kp391599.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr310488.exepid process 4708 lr310488.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
1eda2cc6cfe33e7749fbdb7a2d5e32eb92a1c1a452b89de3047d08173fb11e2f.exeziYS7583.exeziRK9591.exelr310488.exeoneetx.exedescription pid process target process PID 1988 wrote to memory of 4672 1988 1eda2cc6cfe33e7749fbdb7a2d5e32eb92a1c1a452b89de3047d08173fb11e2f.exe ziYS7583.exe PID 1988 wrote to memory of 4672 1988 1eda2cc6cfe33e7749fbdb7a2d5e32eb92a1c1a452b89de3047d08173fb11e2f.exe ziYS7583.exe PID 1988 wrote to memory of 4672 1988 1eda2cc6cfe33e7749fbdb7a2d5e32eb92a1c1a452b89de3047d08173fb11e2f.exe ziYS7583.exe PID 4672 wrote to memory of 4700 4672 ziYS7583.exe ziRK9591.exe PID 4672 wrote to memory of 4700 4672 ziYS7583.exe ziRK9591.exe PID 4672 wrote to memory of 4700 4672 ziYS7583.exe ziRK9591.exe PID 4700 wrote to memory of 4312 4700 ziRK9591.exe it314314.exe PID 4700 wrote to memory of 4312 4700 ziRK9591.exe it314314.exe PID 4700 wrote to memory of 2452 4700 ziRK9591.exe jr437157.exe PID 4700 wrote to memory of 2452 4700 ziRK9591.exe jr437157.exe PID 4700 wrote to memory of 2452 4700 ziRK9591.exe jr437157.exe PID 4672 wrote to memory of 4956 4672 ziYS7583.exe kp391599.exe PID 4672 wrote to memory of 4956 4672 ziYS7583.exe kp391599.exe PID 4672 wrote to memory of 4956 4672 ziYS7583.exe kp391599.exe PID 1988 wrote to memory of 4708 1988 1eda2cc6cfe33e7749fbdb7a2d5e32eb92a1c1a452b89de3047d08173fb11e2f.exe lr310488.exe PID 1988 wrote to memory of 4708 1988 1eda2cc6cfe33e7749fbdb7a2d5e32eb92a1c1a452b89de3047d08173fb11e2f.exe lr310488.exe PID 1988 wrote to memory of 4708 1988 1eda2cc6cfe33e7749fbdb7a2d5e32eb92a1c1a452b89de3047d08173fb11e2f.exe lr310488.exe PID 4708 wrote to memory of 3936 4708 lr310488.exe oneetx.exe PID 4708 wrote to memory of 3936 4708 lr310488.exe oneetx.exe PID 4708 wrote to memory of 3936 4708 lr310488.exe oneetx.exe PID 3936 wrote to memory of 1052 3936 oneetx.exe schtasks.exe PID 3936 wrote to memory of 1052 3936 oneetx.exe schtasks.exe PID 3936 wrote to memory of 1052 3936 oneetx.exe schtasks.exe PID 3936 wrote to memory of 1528 3936 oneetx.exe rundll32.exe PID 3936 wrote to memory of 1528 3936 oneetx.exe rundll32.exe PID 3936 wrote to memory of 1528 3936 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1eda2cc6cfe33e7749fbdb7a2d5e32eb92a1c1a452b89de3047d08173fb11e2f.exe"C:\Users\Admin\AppData\Local\Temp\1eda2cc6cfe33e7749fbdb7a2d5e32eb92a1c1a452b89de3047d08173fb11e2f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYS7583.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYS7583.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziRK9591.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziRK9591.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it314314.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it314314.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr437157.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr437157.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2452 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 13565⤵
- Program crash
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp391599.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp391599.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr310488.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr310488.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 6963⤵
- Program crash
PID:4268 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 7643⤵
- Program crash
PID:1808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 8563⤵
- Program crash
PID:4548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 9723⤵
- Program crash
PID:1880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 9803⤵
- Program crash
PID:1836 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 9483⤵
- Program crash
PID:852 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 12163⤵
- Program crash
PID:3996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 12163⤵
- Program crash
PID:1612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 12883⤵
- Program crash
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 6924⤵
- Program crash
PID:2236 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 8484⤵
- Program crash
PID:3412 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 10124⤵
- Program crash
PID:3492 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 10204⤵
- Program crash
PID:4360 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 11164⤵
- Program crash
PID:2644 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 11164⤵
- Program crash
PID:1940 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 10764⤵
- Program crash
PID:4648 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:1052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 10004⤵
- Program crash
PID:920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 12924⤵
- Program crash
PID:3900 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 7644⤵
- Program crash
PID:4172 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 7444⤵
- Program crash
PID:2008 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 11324⤵
- Program crash
PID:4628 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 15724⤵
- Program crash
PID:32 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:1528 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 15604⤵
- Program crash
PID:824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 16044⤵
- Program crash
PID:1664 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 7483⤵
- Program crash
PID:2680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2452 -ip 24521⤵PID:4484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4708 -ip 47081⤵PID:3392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4708 -ip 47081⤵PID:2196
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4708 -ip 47081⤵PID:2600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4708 -ip 47081⤵PID:1120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4708 -ip 47081⤵PID:4872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4708 -ip 47081⤵PID:1240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4708 -ip 47081⤵PID:2976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4708 -ip 47081⤵PID:3432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4708 -ip 47081⤵PID:4880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4708 -ip 47081⤵PID:3868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 3936 -ip 39361⤵PID:4844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3936 -ip 39361⤵PID:5092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3936 -ip 39361⤵PID:4168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3936 -ip 39361⤵PID:3992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3936 -ip 39361⤵PID:5088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 3936 -ip 39361⤵PID:4468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3936 -ip 39361⤵PID:2740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3936 -ip 39361⤵PID:804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3936 -ip 39361⤵PID:1364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3936 -ip 39361⤵PID:1896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3936 -ip 39361⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:452 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 3122⤵
- Program crash
PID:2716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 452 -ip 4521⤵PID:2304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3936 -ip 39361⤵PID:1164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3936 -ip 39361⤵PID:2004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3936 -ip 39361⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:2452 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 3122⤵
- Program crash
PID:4700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2452 -ip 24521⤵PID:3792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3936 -ip 39361⤵PID:3188
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr310488.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr310488.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYS7583.exeFilesize
536KB
MD58713c8f1eb6f4820d5b314de0ff5de6f
SHA1340be890e092f96ec32da5f09ec5ca74d5e92e67
SHA256695f621d5559d9bddc8bf5c257d0faede8ef491fb05305cab71d6efcb3c433be
SHA512868d6d4e0ad1f984829b58257213adc4afb3f10191bbaef35ac75b21d4409b2db2d8d6e9afc16240c7a263895f8138ee9de826bdf9433afe92db22a0515df9e7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYS7583.exeFilesize
536KB
MD58713c8f1eb6f4820d5b314de0ff5de6f
SHA1340be890e092f96ec32da5f09ec5ca74d5e92e67
SHA256695f621d5559d9bddc8bf5c257d0faede8ef491fb05305cab71d6efcb3c433be
SHA512868d6d4e0ad1f984829b58257213adc4afb3f10191bbaef35ac75b21d4409b2db2d8d6e9afc16240c7a263895f8138ee9de826bdf9433afe92db22a0515df9e7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp391599.exeFilesize
169KB
MD5ac67ef6188354392481a9b5581c502a4
SHA1d5fdadbb2568868b9cc7f6d87d02d1b9097b2ad9
SHA256b67973b3292b7a1b577214959a6576017189b5e25a88d7de660d8f5ad2cfa6ec
SHA512e87bb9d1d2f1715dd1a9a2fb97e1c9ad26d80779ccc2ca32aec7d2a8870f097568f638e80ee157560ad64c2b001300894516475e40694762a1d4d74b42b15666
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp391599.exeFilesize
169KB
MD5ac67ef6188354392481a9b5581c502a4
SHA1d5fdadbb2568868b9cc7f6d87d02d1b9097b2ad9
SHA256b67973b3292b7a1b577214959a6576017189b5e25a88d7de660d8f5ad2cfa6ec
SHA512e87bb9d1d2f1715dd1a9a2fb97e1c9ad26d80779ccc2ca32aec7d2a8870f097568f638e80ee157560ad64c2b001300894516475e40694762a1d4d74b42b15666
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziRK9591.exeFilesize
382KB
MD50a6045f6c6aa906cb10c3437ac1789f4
SHA16a62ffc960654b14ab96f3b6ef00dddf1bf7d2dd
SHA2561a30005c067b36af95604de3c684a44612ebbbeb962dd3643c115b71cbd069be
SHA512b5162e655fd4d99b12619e6d97fc46b2a407a56ae9a03d8f8833c9c05bb38f69cf24976e0532ed3877865fc6a2b6e59b1eedec69292111b90f6174ae610068ec
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziRK9591.exeFilesize
382KB
MD50a6045f6c6aa906cb10c3437ac1789f4
SHA16a62ffc960654b14ab96f3b6ef00dddf1bf7d2dd
SHA2561a30005c067b36af95604de3c684a44612ebbbeb962dd3643c115b71cbd069be
SHA512b5162e655fd4d99b12619e6d97fc46b2a407a56ae9a03d8f8833c9c05bb38f69cf24976e0532ed3877865fc6a2b6e59b1eedec69292111b90f6174ae610068ec
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it314314.exeFilesize
11KB
MD5537f4effeddafb4635414ed13aae8ee5
SHA143314e01e51a12f558eca3d28ce902a15d280f17
SHA25695b64baafed7f9a424807342d685b88178c2ed3e36e89484c79d9ccf0956fcdb
SHA51258259d9dfe26bda77e1fc1dd3b278b75e219274151ebc2720ba2be8b45e7b407a670058980f6fb8c971b3deda628f7b84c7a2978ee79afa32dc36dcb1211f341
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it314314.exeFilesize
11KB
MD5537f4effeddafb4635414ed13aae8ee5
SHA143314e01e51a12f558eca3d28ce902a15d280f17
SHA25695b64baafed7f9a424807342d685b88178c2ed3e36e89484c79d9ccf0956fcdb
SHA51258259d9dfe26bda77e1fc1dd3b278b75e219274151ebc2720ba2be8b45e7b407a670058980f6fb8c971b3deda628f7b84c7a2978ee79afa32dc36dcb1211f341
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr437157.exeFilesize
297KB
MD5fb7f774fca6c6aea1358bd35b1fa093c
SHA1ffcdf2c2c438f171750d50e7454904ea0398ae1d
SHA256a5c671fb65ea719b12778b6d56097d58ebf1969c8dc589b2887ad71447366d7d
SHA5126cb27a84c008ab4286a6d166ff480d26ab17c271134b853c6d62bfaabbe63ef9e8ece0b20e8adb49c8f9cfbaea41276d8c5dc4ea5e59c45909f0782d396e1dfd
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr437157.exeFilesize
297KB
MD5fb7f774fca6c6aea1358bd35b1fa093c
SHA1ffcdf2c2c438f171750d50e7454904ea0398ae1d
SHA256a5c671fb65ea719b12778b6d56097d58ebf1969c8dc589b2887ad71447366d7d
SHA5126cb27a84c008ab4286a6d166ff480d26ab17c271134b853c6d62bfaabbe63ef9e8ece0b20e8adb49c8f9cfbaea41276d8c5dc4ea5e59c45909f0782d396e1dfd
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/2452-210-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-1071-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/2452-176-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-178-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-180-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-182-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-184-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-186-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-188-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-190-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-192-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-194-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-196-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-198-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-200-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-202-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-204-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-206-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-212-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-172-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-208-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-214-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-216-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-218-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-220-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-222-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-224-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-226-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-228-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-174-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-1072-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/2452-1073-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/2452-1074-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/2452-1075-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/2452-1077-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/2452-1078-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/2452-1079-0x00000000064C0000-0x0000000006682000-memory.dmpFilesize
1.8MB
-
memory/2452-1080-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/2452-1081-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/2452-1082-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/2452-1083-0x0000000006690000-0x0000000006BBC000-memory.dmpFilesize
5.2MB
-
memory/2452-1084-0x0000000006F40000-0x0000000006FB6000-memory.dmpFilesize
472KB
-
memory/2452-1085-0x0000000006FC0000-0x0000000007010000-memory.dmpFilesize
320KB
-
memory/2452-1086-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/2452-160-0x0000000004BB0000-0x0000000005154000-memory.dmpFilesize
5.6MB
-
memory/2452-161-0x0000000000620000-0x000000000066B000-memory.dmpFilesize
300KB
-
memory/2452-163-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/2452-170-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-168-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-166-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-162-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/2452-165-0x00000000051A0000-0x00000000051DF000-memory.dmpFilesize
252KB
-
memory/2452-164-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/4312-154-0x0000000000F10000-0x0000000000F1A000-memory.dmpFilesize
40KB
-
memory/4708-1116-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/4708-1100-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/4956-1092-0x0000000000010000-0x0000000000040000-memory.dmpFilesize
192KB
-
memory/4956-1093-0x0000000004950000-0x0000000004960000-memory.dmpFilesize
64KB
-
memory/4956-1094-0x0000000004950000-0x0000000004960000-memory.dmpFilesize
64KB