Analysis
-
max time kernel
147s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 21:21
Static task
static1
General
-
Target
9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5.exe
-
Size
801KB
-
MD5
fa02a25d98be47f51c6f07d5d2043797
-
SHA1
58342b20c10146cd22907a071e3d77505f2e4ec0
-
SHA256
9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5
-
SHA512
6d2156fcc5ce23ccab757d89c3130e56167cc0a4e81d4ae64c06c4b9ee9d703f797c8d49812ea9b28d52b511c09d1d6b2750117bb853732fddb36afbf43e9e69
-
SSDEEP
12288:pMrBfy90ZV9MV8ENZxBuLzEaX+PxK7ClsRWzdyHBNaxwHjK05URbqfJzzaq:6fyWCK4ZxBun/XyxfSWzdKhjKnx4Jz
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
it232109.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it232109.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it232109.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it232109.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it232109.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it232109.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it232109.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/1856-165-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-166-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-168-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-172-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-174-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-170-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-176-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-178-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-180-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-182-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-184-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-186-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-188-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-190-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-192-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-194-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-196-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-198-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-200-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-202-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-204-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-206-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-208-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-210-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-212-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-214-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-216-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-218-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-220-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-222-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-224-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-226-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1856-228-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr623215.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation lr623215.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
Processes:
ziPI9700.exezizw6351.exeit232109.exejr199681.exekp313911.exelr623215.exeoneetx.exeoneetx.exepid process 4148 ziPI9700.exe 4944 zizw6351.exe 4288 it232109.exe 1856 jr199681.exe 4752 kp313911.exe 4132 lr623215.exe 2704 oneetx.exe 3120 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4752 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it232109.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it232109.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5.exeziPI9700.exezizw6351.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziPI9700.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziPI9700.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zizw6351.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zizw6351.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 28 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3064 1856 WerFault.exe jr199681.exe 3432 4132 WerFault.exe lr623215.exe 1076 4132 WerFault.exe lr623215.exe 1092 4132 WerFault.exe lr623215.exe 2292 4132 WerFault.exe lr623215.exe 1604 4132 WerFault.exe lr623215.exe 436 4132 WerFault.exe lr623215.exe 4556 4132 WerFault.exe lr623215.exe 3624 4132 WerFault.exe lr623215.exe 1360 4132 WerFault.exe lr623215.exe 4916 4132 WerFault.exe lr623215.exe 2020 2704 WerFault.exe oneetx.exe 1132 2704 WerFault.exe oneetx.exe 1104 2704 WerFault.exe oneetx.exe 408 2704 WerFault.exe oneetx.exe 1788 2704 WerFault.exe oneetx.exe 1216 2704 WerFault.exe oneetx.exe 5036 2704 WerFault.exe oneetx.exe 348 2704 WerFault.exe oneetx.exe 3088 2704 WerFault.exe oneetx.exe 624 2704 WerFault.exe oneetx.exe 4216 2704 WerFault.exe oneetx.exe 1592 2704 WerFault.exe oneetx.exe 2040 2704 WerFault.exe oneetx.exe 2856 2704 WerFault.exe oneetx.exe 4972 2704 WerFault.exe oneetx.exe 2204 3120 WerFault.exe oneetx.exe 2076 2704 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it232109.exejr199681.exekp313911.exepid process 4288 it232109.exe 4288 it232109.exe 1856 jr199681.exe 1856 jr199681.exe 4752 kp313911.exe 4752 kp313911.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it232109.exejr199681.exekp313911.exedescription pid process Token: SeDebugPrivilege 4288 it232109.exe Token: SeDebugPrivilege 1856 jr199681.exe Token: SeDebugPrivilege 4752 kp313911.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr623215.exepid process 4132 lr623215.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5.exeziPI9700.exezizw6351.exelr623215.exeoneetx.exedescription pid process target process PID 1644 wrote to memory of 4148 1644 9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5.exe ziPI9700.exe PID 1644 wrote to memory of 4148 1644 9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5.exe ziPI9700.exe PID 1644 wrote to memory of 4148 1644 9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5.exe ziPI9700.exe PID 4148 wrote to memory of 4944 4148 ziPI9700.exe zizw6351.exe PID 4148 wrote to memory of 4944 4148 ziPI9700.exe zizw6351.exe PID 4148 wrote to memory of 4944 4148 ziPI9700.exe zizw6351.exe PID 4944 wrote to memory of 4288 4944 zizw6351.exe it232109.exe PID 4944 wrote to memory of 4288 4944 zizw6351.exe it232109.exe PID 4944 wrote to memory of 1856 4944 zizw6351.exe jr199681.exe PID 4944 wrote to memory of 1856 4944 zizw6351.exe jr199681.exe PID 4944 wrote to memory of 1856 4944 zizw6351.exe jr199681.exe PID 4148 wrote to memory of 4752 4148 ziPI9700.exe kp313911.exe PID 4148 wrote to memory of 4752 4148 ziPI9700.exe kp313911.exe PID 4148 wrote to memory of 4752 4148 ziPI9700.exe kp313911.exe PID 1644 wrote to memory of 4132 1644 9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5.exe lr623215.exe PID 1644 wrote to memory of 4132 1644 9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5.exe lr623215.exe PID 1644 wrote to memory of 4132 1644 9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5.exe lr623215.exe PID 4132 wrote to memory of 2704 4132 lr623215.exe oneetx.exe PID 4132 wrote to memory of 2704 4132 lr623215.exe oneetx.exe PID 4132 wrote to memory of 2704 4132 lr623215.exe oneetx.exe PID 2704 wrote to memory of 2668 2704 oneetx.exe schtasks.exe PID 2704 wrote to memory of 2668 2704 oneetx.exe schtasks.exe PID 2704 wrote to memory of 2668 2704 oneetx.exe schtasks.exe PID 2704 wrote to memory of 4752 2704 oneetx.exe rundll32.exe PID 2704 wrote to memory of 4752 2704 oneetx.exe rundll32.exe PID 2704 wrote to memory of 4752 2704 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5.exe"C:\Users\Admin\AppData\Local\Temp\9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPI9700.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPI9700.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zizw6351.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zizw6351.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it232109.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it232109.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr199681.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr199681.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 15885⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp313911.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp313911.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr623215.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr623215.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 7803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 9763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 8643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 8643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 11523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 12283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 6964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 10084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 10924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 11004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 11124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 11204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 11284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 11364⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 9964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 12924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 13124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 13604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 11324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 16124⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 11004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 16284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 13683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1856 -ip 18561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4132 -ip 41321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4132 -ip 41321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4132 -ip 41321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4132 -ip 41321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4132 -ip 41321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4132 -ip 41321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4132 -ip 41321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4132 -ip 41321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4132 -ip 41321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4132 -ip 41321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2704 -ip 27041⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 3122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3120 -ip 31201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2704 -ip 27041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr623215.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr623215.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPI9700.exeFilesize
536KB
MD50b320f96befe550329fba58dbd64f106
SHA14649eae9bafacae99513b92b6385de5f88a6c4c0
SHA2562ec5fc225c71d1f30cd7d254647a2cbac4d862c11a72e71941503438e7faae29
SHA5125dc6715e502f9c017866770bec2a4f06c809d2a028f6ec170c1f27678f464eb2fab10281c412d28efede7cc82a3da1920a029bc079f054572c9102c7afeb5729
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPI9700.exeFilesize
536KB
MD50b320f96befe550329fba58dbd64f106
SHA14649eae9bafacae99513b92b6385de5f88a6c4c0
SHA2562ec5fc225c71d1f30cd7d254647a2cbac4d862c11a72e71941503438e7faae29
SHA5125dc6715e502f9c017866770bec2a4f06c809d2a028f6ec170c1f27678f464eb2fab10281c412d28efede7cc82a3da1920a029bc079f054572c9102c7afeb5729
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp313911.exeFilesize
169KB
MD54094466f53c653a693fc6eb7675f2096
SHA14a9fe1ef89d2f691a8eeb7c24840bcbf172b51d8
SHA256a664a4b2af8d93a9615f82099c5cf8f335c6365687b3ac584e8b4acdc6059e37
SHA51231775e3355d961c69fcade33bab86a67ae2376c3b3336761bcf617402b85194884959f510c0d51ae4ce2d10d710a0fbf33d7ded97bbc7bcfe83f000293e13ce2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp313911.exeFilesize
169KB
MD54094466f53c653a693fc6eb7675f2096
SHA14a9fe1ef89d2f691a8eeb7c24840bcbf172b51d8
SHA256a664a4b2af8d93a9615f82099c5cf8f335c6365687b3ac584e8b4acdc6059e37
SHA51231775e3355d961c69fcade33bab86a67ae2376c3b3336761bcf617402b85194884959f510c0d51ae4ce2d10d710a0fbf33d7ded97bbc7bcfe83f000293e13ce2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zizw6351.exeFilesize
382KB
MD599bc037bdaf7d76166242b64efc4842c
SHA1b462a166f971ab3ece515e5d586ec767a4f35838
SHA2563a36e28db43d4413bd727c5b6e37d8cdc59b69bda21c8ae04c01660977373676
SHA512e9efc6abebe33e9a8a01fc35d99bb8d776cd0de83b517aeffb740b9f084f83887ac3589a79bf5c53d51b916631a55c58594d0f9e6e6b56c1c342cc4d3bf68e00
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zizw6351.exeFilesize
382KB
MD599bc037bdaf7d76166242b64efc4842c
SHA1b462a166f971ab3ece515e5d586ec767a4f35838
SHA2563a36e28db43d4413bd727c5b6e37d8cdc59b69bda21c8ae04c01660977373676
SHA512e9efc6abebe33e9a8a01fc35d99bb8d776cd0de83b517aeffb740b9f084f83887ac3589a79bf5c53d51b916631a55c58594d0f9e6e6b56c1c342cc4d3bf68e00
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it232109.exeFilesize
11KB
MD5dd11ddde5afc0d8d231a6aaa19573143
SHA15911fe8964008d341862475b11a4772dfbe7d86b
SHA256dff51c523f7cc99bfdd0736996c9b7d8fba6537a38a543b4d4c95713ce96a873
SHA5121b2577a7d0836c506a44bc546b06da590a142ea8042b7366cfc8c3f38233ab1d7d9fb9343e607a53ea8b676251bf6488eddfbdcc51f40b8521938b74e1c6cb21
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it232109.exeFilesize
11KB
MD5dd11ddde5afc0d8d231a6aaa19573143
SHA15911fe8964008d341862475b11a4772dfbe7d86b
SHA256dff51c523f7cc99bfdd0736996c9b7d8fba6537a38a543b4d4c95713ce96a873
SHA5121b2577a7d0836c506a44bc546b06da590a142ea8042b7366cfc8c3f38233ab1d7d9fb9343e607a53ea8b676251bf6488eddfbdcc51f40b8521938b74e1c6cb21
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr199681.exeFilesize
297KB
MD527406d36c2c47c40e234ad3eae43d621
SHA16022e2607a3eb63dd3411345a37b77bbf1ac1aed
SHA256d0f4268a155ed6c43eab57f5568777367d83a0862623e8d384b6aa1533968181
SHA512740e06ddc6c897e025a359d4feb738a2fb2b41df283e223a9f0306896a61b1458e026178de10321138173458169db2b977ee4c28d8e4e8e3f43fad561a9c1756
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr199681.exeFilesize
297KB
MD527406d36c2c47c40e234ad3eae43d621
SHA16022e2607a3eb63dd3411345a37b77bbf1ac1aed
SHA256d0f4268a155ed6c43eab57f5568777367d83a0862623e8d384b6aa1533968181
SHA512740e06ddc6c897e025a359d4feb738a2fb2b41df283e223a9f0306896a61b1458e026178de10321138173458169db2b977ee4c28d8e4e8e3f43fad561a9c1756
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1856-206-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-228-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-170-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-176-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-178-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-180-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-182-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-184-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-186-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-188-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-190-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-192-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-194-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-196-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-198-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-200-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-202-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-204-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-172-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-208-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-210-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-212-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-214-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-216-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-218-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-220-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-222-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-224-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-226-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-174-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-1071-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/1856-1072-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/1856-1073-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/1856-1074-0x0000000005B00000-0x0000000005B3C000-memory.dmpFilesize
240KB
-
memory/1856-1075-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/1856-1077-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/1856-1078-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/1856-1079-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/1856-1080-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/1856-1081-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/1856-1082-0x0000000006730000-0x00000000067A6000-memory.dmpFilesize
472KB
-
memory/1856-1083-0x00000000067C0000-0x0000000006810000-memory.dmpFilesize
320KB
-
memory/1856-1084-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/1856-1085-0x0000000006B50000-0x0000000006D12000-memory.dmpFilesize
1.8MB
-
memory/1856-1086-0x0000000006D20000-0x000000000724C000-memory.dmpFilesize
5.2MB
-
memory/1856-160-0x0000000004AC0000-0x0000000005064000-memory.dmpFilesize
5.6MB
-
memory/1856-161-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/1856-168-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-166-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-165-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1856-162-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/1856-164-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/1856-163-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/4132-1115-0x00000000005A0000-0x00000000005DB000-memory.dmpFilesize
236KB
-
memory/4132-1099-0x00000000005A0000-0x00000000005DB000-memory.dmpFilesize
236KB
-
memory/4288-154-0x0000000000940000-0x000000000094A000-memory.dmpFilesize
40KB
-
memory/4752-1092-0x0000000000030000-0x0000000000060000-memory.dmpFilesize
192KB
-
memory/4752-1093-0x00000000021D0000-0x00000000021E0000-memory.dmpFilesize
64KB