Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 21:23
Static task
static1
General
-
Target
6298651f5d0b9bf4e7b299571c851bcb7f2c26a3518060744901b2efebd3ecbb.exe
-
Size
940KB
-
MD5
82465b01882d75cb00010cd7849fa046
-
SHA1
f5dd8d12ba96111aada71ecf72d298ec39c127cc
-
SHA256
6298651f5d0b9bf4e7b299571c851bcb7f2c26a3518060744901b2efebd3ecbb
-
SHA512
f857bd5f331c427a7d2f2a71b4e1c61ca70e03558e6a97d92811c2517b6c9e054edaa7a1ceea08037e57af73f988fc49b377b3cff11179916ed572dc7627e7a7
-
SSDEEP
24576:Qy5bSaWs9/mVpNY5pWdwd5GIXjntcGCnhC5G+d7FyZW:X5bSaWskVbIAwqen6Gaw3d7F
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
pr588832.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr588832.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr588832.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr588832.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr588832.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr588832.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr588832.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/5116-198-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/5116-201-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/5116-199-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/5116-203-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/5116-205-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/5116-207-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/5116-209-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/5116-211-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/5116-213-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/5116-215-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/5116-217-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/5116-219-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/5116-221-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/5116-223-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/5116-225-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/5116-227-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/5116-229-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/5116-231-0x0000000002430000-0x000000000246F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
si184023.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation si184023.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
un127580.exeun882070.exepr588832.exequ023703.exerk638662.exesi184023.exeoneetx.exeoneetx.exeoneetx.exepid process 4676 un127580.exe 3012 un882070.exe 2720 pr588832.exe 5116 qu023703.exe 4400 rk638662.exe 4388 si184023.exe 924 oneetx.exe 3012 oneetx.exe 2660 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1296 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pr588832.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr588832.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr588832.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
6298651f5d0b9bf4e7b299571c851bcb7f2c26a3518060744901b2efebd3ecbb.exeun127580.exeun882070.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6298651f5d0b9bf4e7b299571c851bcb7f2c26a3518060744901b2efebd3ecbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6298651f5d0b9bf4e7b299571c851bcb7f2c26a3518060744901b2efebd3ecbb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un127580.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un127580.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un882070.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un882070.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1968 2720 WerFault.exe pr588832.exe 3624 5116 WerFault.exe qu023703.exe 4504 4388 WerFault.exe si184023.exe 4224 4388 WerFault.exe si184023.exe 2720 4388 WerFault.exe si184023.exe 2024 4388 WerFault.exe si184023.exe 4048 4388 WerFault.exe si184023.exe 4964 4388 WerFault.exe si184023.exe 960 4388 WerFault.exe si184023.exe 4612 4388 WerFault.exe si184023.exe 4804 4388 WerFault.exe si184023.exe 3428 4388 WerFault.exe si184023.exe 1920 924 WerFault.exe oneetx.exe 4976 924 WerFault.exe oneetx.exe 2344 924 WerFault.exe oneetx.exe 1576 924 WerFault.exe oneetx.exe 2736 924 WerFault.exe oneetx.exe 3632 924 WerFault.exe oneetx.exe 2224 924 WerFault.exe oneetx.exe 3356 924 WerFault.exe oneetx.exe 5016 924 WerFault.exe oneetx.exe 2080 924 WerFault.exe oneetx.exe 1704 924 WerFault.exe oneetx.exe 2204 924 WerFault.exe oneetx.exe 2644 3012 WerFault.exe oneetx.exe 2716 924 WerFault.exe oneetx.exe 1640 924 WerFault.exe oneetx.exe 400 924 WerFault.exe oneetx.exe 3716 2660 WerFault.exe oneetx.exe 4332 924 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pr588832.exequ023703.exerk638662.exepid process 2720 pr588832.exe 2720 pr588832.exe 5116 qu023703.exe 5116 qu023703.exe 4400 rk638662.exe 4400 rk638662.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pr588832.exequ023703.exerk638662.exedescription pid process Token: SeDebugPrivilege 2720 pr588832.exe Token: SeDebugPrivilege 5116 qu023703.exe Token: SeDebugPrivilege 4400 rk638662.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
si184023.exepid process 4388 si184023.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
6298651f5d0b9bf4e7b299571c851bcb7f2c26a3518060744901b2efebd3ecbb.exeun127580.exeun882070.exesi184023.exeoneetx.exedescription pid process target process PID 2100 wrote to memory of 4676 2100 6298651f5d0b9bf4e7b299571c851bcb7f2c26a3518060744901b2efebd3ecbb.exe un127580.exe PID 2100 wrote to memory of 4676 2100 6298651f5d0b9bf4e7b299571c851bcb7f2c26a3518060744901b2efebd3ecbb.exe un127580.exe PID 2100 wrote to memory of 4676 2100 6298651f5d0b9bf4e7b299571c851bcb7f2c26a3518060744901b2efebd3ecbb.exe un127580.exe PID 4676 wrote to memory of 3012 4676 un127580.exe un882070.exe PID 4676 wrote to memory of 3012 4676 un127580.exe un882070.exe PID 4676 wrote to memory of 3012 4676 un127580.exe un882070.exe PID 3012 wrote to memory of 2720 3012 un882070.exe pr588832.exe PID 3012 wrote to memory of 2720 3012 un882070.exe pr588832.exe PID 3012 wrote to memory of 2720 3012 un882070.exe pr588832.exe PID 3012 wrote to memory of 5116 3012 un882070.exe qu023703.exe PID 3012 wrote to memory of 5116 3012 un882070.exe qu023703.exe PID 3012 wrote to memory of 5116 3012 un882070.exe qu023703.exe PID 4676 wrote to memory of 4400 4676 un127580.exe rk638662.exe PID 4676 wrote to memory of 4400 4676 un127580.exe rk638662.exe PID 4676 wrote to memory of 4400 4676 un127580.exe rk638662.exe PID 2100 wrote to memory of 4388 2100 6298651f5d0b9bf4e7b299571c851bcb7f2c26a3518060744901b2efebd3ecbb.exe si184023.exe PID 2100 wrote to memory of 4388 2100 6298651f5d0b9bf4e7b299571c851bcb7f2c26a3518060744901b2efebd3ecbb.exe si184023.exe PID 2100 wrote to memory of 4388 2100 6298651f5d0b9bf4e7b299571c851bcb7f2c26a3518060744901b2efebd3ecbb.exe si184023.exe PID 4388 wrote to memory of 924 4388 si184023.exe oneetx.exe PID 4388 wrote to memory of 924 4388 si184023.exe oneetx.exe PID 4388 wrote to memory of 924 4388 si184023.exe oneetx.exe PID 924 wrote to memory of 4764 924 oneetx.exe schtasks.exe PID 924 wrote to memory of 4764 924 oneetx.exe schtasks.exe PID 924 wrote to memory of 4764 924 oneetx.exe schtasks.exe PID 924 wrote to memory of 1296 924 oneetx.exe rundll32.exe PID 924 wrote to memory of 1296 924 oneetx.exe rundll32.exe PID 924 wrote to memory of 1296 924 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6298651f5d0b9bf4e7b299571c851bcb7f2c26a3518060744901b2efebd3ecbb.exe"C:\Users\Admin\AppData\Local\Temp\6298651f5d0b9bf4e7b299571c851bcb7f2c26a3518060744901b2efebd3ecbb.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un127580.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un127580.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un882070.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un882070.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr588832.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr588832.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 10845⤵
- Program crash
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu023703.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu023703.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 13485⤵
- Program crash
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk638662.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk638662.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si184023.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si184023.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 6963⤵
- Program crash
PID:4504 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 7803⤵
- Program crash
PID:4224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 8563⤵
- Program crash
PID:2720 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 9683⤵
- Program crash
PID:2024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 8683⤵
- Program crash
PID:4048 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 8683⤵
- Program crash
PID:4964 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 12083⤵
- Program crash
PID:960 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 12243⤵
- Program crash
PID:4612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 13123⤵
- Program crash
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 6924⤵
- Program crash
PID:1920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 8644⤵
- Program crash
PID:4976 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 9124⤵
- Program crash
PID:2344 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 10524⤵
- Program crash
PID:1576 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 10724⤵
- Program crash
PID:2736 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 10924⤵
- Program crash
PID:3632 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 11284⤵
- Program crash
PID:2224 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:4764 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 10004⤵
- Program crash
PID:3356 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 7644⤵
- Program crash
PID:5016 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 9124⤵
- Program crash
PID:2080 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 7604⤵
- Program crash
PID:1704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 14364⤵
- Program crash
PID:2204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 11684⤵
- Program crash
PID:2716 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 16204⤵
- Program crash
PID:1640 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:1296 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 14404⤵
- Program crash
PID:400 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 16004⤵
- Program crash
PID:4332 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 8643⤵
- Program crash
PID:3428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2720 -ip 27201⤵PID:3732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5116 -ip 51161⤵PID:2780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4388 -ip 43881⤵PID:4240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4388 -ip 43881⤵PID:1708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4388 -ip 43881⤵PID:1640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4388 -ip 43881⤵PID:4344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4388 -ip 43881⤵PID:2816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4388 -ip 43881⤵PID:4828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4388 -ip 43881⤵PID:1692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4388 -ip 43881⤵PID:1948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 4388 -ip 43881⤵PID:1816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4388 -ip 43881⤵PID:4196
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 924 -ip 9241⤵PID:4848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 924 -ip 9241⤵PID:5028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 924 -ip 9241⤵PID:5036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 924 -ip 9241⤵PID:4028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 924 -ip 9241⤵PID:2368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 924 -ip 9241⤵PID:1508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 924 -ip 9241⤵PID:1376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 924 -ip 9241⤵PID:4316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 924 -ip 9241⤵PID:1540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 924 -ip 9241⤵PID:1456
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 924 -ip 9241⤵PID:1356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 924 -ip 9241⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:3012 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 3202⤵
- Program crash
PID:2644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3012 -ip 30121⤵PID:4484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 924 -ip 9241⤵PID:3360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 924 -ip 9241⤵PID:4224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 924 -ip 9241⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:2660 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 3202⤵
- Program crash
PID:3716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 2660 -ip 26601⤵PID:4048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 924 -ip 9241⤵PID:4412
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si184023.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si184023.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un127580.exeFilesize
674KB
MD547b165a1e7408676061647ce67c32abb
SHA1920bdf7c0b035a95d2a085c35579647b8f66c6d7
SHA256ac80a8283f9f7fe5add41c38e1b09d5e86b04c706ed836c8182b00b23328da51
SHA5127014dc980216286ad982cbf484569c9a832cd5fe42f403244de754480d0a38f9186691d13cf68b8bdf389db95a5b48c1fd036561f859d394c38271146f571712
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un127580.exeFilesize
674KB
MD547b165a1e7408676061647ce67c32abb
SHA1920bdf7c0b035a95d2a085c35579647b8f66c6d7
SHA256ac80a8283f9f7fe5add41c38e1b09d5e86b04c706ed836c8182b00b23328da51
SHA5127014dc980216286ad982cbf484569c9a832cd5fe42f403244de754480d0a38f9186691d13cf68b8bdf389db95a5b48c1fd036561f859d394c38271146f571712
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk638662.exeFilesize
169KB
MD5f776f2b117bc1188278fb343793ade7f
SHA1741735f282678506936b817c4c56f0e0f69dcc2d
SHA25613c7ead44ba7bb957fddac68a727b21ba5b018369298af01f649660c17c54b15
SHA512ba4f171b61013e11a3de0c0fa5e41a2027b6e0d27f16bf21718d758cd14d3fb3f5397701e6f4966c673e21e0acfe5b3031ddafad13094c03c018e158610314ed
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk638662.exeFilesize
169KB
MD5f776f2b117bc1188278fb343793ade7f
SHA1741735f282678506936b817c4c56f0e0f69dcc2d
SHA25613c7ead44ba7bb957fddac68a727b21ba5b018369298af01f649660c17c54b15
SHA512ba4f171b61013e11a3de0c0fa5e41a2027b6e0d27f16bf21718d758cd14d3fb3f5397701e6f4966c673e21e0acfe5b3031ddafad13094c03c018e158610314ed
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un882070.exeFilesize
521KB
MD5bca0b12cff9e7e37359fbb49669aa9be
SHA14cb912b909d04994f9caf66ce43e8a1d6c26bf34
SHA256eda4ef31a48ae080aa448dd727211578aa18d2584a3fb1092a32ad15096ffd2c
SHA512d0928a0976419083997d23e05773df3a11e798709623cee7b0f15f858e1332e86d9c79788aa95f37e10ce797fcf2f768593f302ee31597d6393fd31fde4a0cbd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un882070.exeFilesize
521KB
MD5bca0b12cff9e7e37359fbb49669aa9be
SHA14cb912b909d04994f9caf66ce43e8a1d6c26bf34
SHA256eda4ef31a48ae080aa448dd727211578aa18d2584a3fb1092a32ad15096ffd2c
SHA512d0928a0976419083997d23e05773df3a11e798709623cee7b0f15f858e1332e86d9c79788aa95f37e10ce797fcf2f768593f302ee31597d6393fd31fde4a0cbd
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr588832.exeFilesize
239KB
MD5f75601caeac9112c56ddd49238bfee37
SHA1c0a711d668512ea1131952f44a26250e2fc9eef6
SHA256a5ed14bc7367aabcd9cf59ed8216277d3e8b3ef828ef94210004c353d8717c8a
SHA512520883785dc1bdf45170a9ce54a5534ea952d8d6a4ffc1353c4759027ffc40f177e978b6e128c8645fc92419a7abd28b95aa659b29f16f89b25552d0f0ef3eac
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr588832.exeFilesize
239KB
MD5f75601caeac9112c56ddd49238bfee37
SHA1c0a711d668512ea1131952f44a26250e2fc9eef6
SHA256a5ed14bc7367aabcd9cf59ed8216277d3e8b3ef828ef94210004c353d8717c8a
SHA512520883785dc1bdf45170a9ce54a5534ea952d8d6a4ffc1353c4759027ffc40f177e978b6e128c8645fc92419a7abd28b95aa659b29f16f89b25552d0f0ef3eac
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu023703.exeFilesize
297KB
MD5479d73597b46cb6ec8c8d2902ccd33b9
SHA1a2039ab26595057c484e61bb1851236a0fd96ffd
SHA256ce5f4e8f30f5ab2be208dc7b48f2d6f1c6738be72d6fc897a9bf37f7ff7a6997
SHA512980235507471f5003aadd20b4d57e4d842fc5d1c6045334b929d6e99021702434f3ab9b44922416b3a0fb71b336d3b22d5d3aa3b5c88d13747ef880ae9b90b04
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu023703.exeFilesize
297KB
MD5479d73597b46cb6ec8c8d2902ccd33b9
SHA1a2039ab26595057c484e61bb1851236a0fd96ffd
SHA256ce5f4e8f30f5ab2be208dc7b48f2d6f1c6738be72d6fc897a9bf37f7ff7a6997
SHA512980235507471f5003aadd20b4d57e4d842fc5d1c6045334b929d6e99021702434f3ab9b44922416b3a0fb71b336d3b22d5d3aa3b5c88d13747ef880ae9b90b04
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/2720-156-0x0000000000580000-0x00000000005AD000-memory.dmpFilesize
180KB
-
memory/2720-169-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/2720-175-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/2720-177-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/2720-179-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/2720-181-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/2720-183-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/2720-185-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/2720-187-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/2720-188-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2720-189-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/2720-190-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/2720-191-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/2720-193-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2720-171-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/2720-173-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/2720-167-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/2720-165-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/2720-163-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/2720-161-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/2720-155-0x0000000004CC0000-0x0000000005264000-memory.dmpFilesize
5.6MB
-
memory/2720-160-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/2720-159-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/2720-158-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/2720-157-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4388-1136-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/4388-1152-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/4400-1128-0x00000000007F0000-0x0000000000820000-memory.dmpFilesize
192KB
-
memory/4400-1130-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB
-
memory/4400-1129-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB
-
memory/5116-211-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-231-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-524-0x0000000000700000-0x000000000074B000-memory.dmpFilesize
300KB
-
memory/5116-525-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/5116-527-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/5116-529-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/5116-1108-0x0000000005340000-0x0000000005958000-memory.dmpFilesize
6.1MB
-
memory/5116-1109-0x0000000005960000-0x0000000005A6A000-memory.dmpFilesize
1.0MB
-
memory/5116-1110-0x0000000004BF0000-0x0000000004C02000-memory.dmpFilesize
72KB
-
memory/5116-1111-0x0000000004C10000-0x0000000004C4C000-memory.dmpFilesize
240KB
-
memory/5116-1112-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/5116-1113-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/5116-1114-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/5116-1116-0x00000000064B0000-0x0000000006672000-memory.dmpFilesize
1.8MB
-
memory/5116-1117-0x0000000006680000-0x0000000006BAC000-memory.dmpFilesize
5.2MB
-
memory/5116-1118-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/5116-1119-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/5116-1120-0x0000000006F40000-0x0000000006FB6000-memory.dmpFilesize
472KB
-
memory/5116-229-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-227-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-225-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-223-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-221-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-219-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-217-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-215-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-213-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-209-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-207-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-205-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-203-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-199-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-201-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-198-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5116-1121-0x0000000006FC0000-0x0000000007010000-memory.dmpFilesize
320KB
-
memory/5116-1122-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB