Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 20:33
Static task
static1
General
-
Target
bbd29abab3b590bc5a3d68b385ddf8dd11c2e2e827748e19b793acc3d47b5dbd.exe
-
Size
940KB
-
MD5
9dc035e110740cef9e7a1c7200b2fb0e
-
SHA1
f97c22ec89bf5411d858b2403dd38fc18acfaacb
-
SHA256
bbd29abab3b590bc5a3d68b385ddf8dd11c2e2e827748e19b793acc3d47b5dbd
-
SHA512
177d94bc93d142938fec7785d52f9d5aa6836eaa12c06deda02dac33bd967cea471528415c9609fb4366b6a2073d06fc0842da6e2f4084ff2897dfdbca16e543
-
SSDEEP
24576:0yLV/C4qJeNkb9VXsDOsR50I0/I0cIx9sHi8G3H+Pg:DcJV9Q0hiIIC8me
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
pr175717.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr175717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr175717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr175717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr175717.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr175717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr175717.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4300-202-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-201-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-204-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-206-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-208-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-210-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-212-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-214-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-216-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-218-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-220-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-222-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-224-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-226-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-228-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-230-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-232-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-234-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/4300-1118-0x00000000024C0000-0x00000000024D0000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
si311215.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation si311215.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
Processes:
un615487.exeun185198.exepr175717.exequ596847.exerk843920.exesi311215.exeoneetx.exeoneetx.exepid process 2164 un615487.exe 3196 un185198.exe 1436 pr175717.exe 4300 qu596847.exe 452 rk843920.exe 3792 si311215.exe 224 oneetx.exe 2936 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4204 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pr175717.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr175717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr175717.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
un615487.exeun185198.exebbd29abab3b590bc5a3d68b385ddf8dd11c2e2e827748e19b793acc3d47b5dbd.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un615487.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un615487.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un185198.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un185198.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bbd29abab3b590bc5a3d68b385ddf8dd11c2e2e827748e19b793acc3d47b5dbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" bbd29abab3b590bc5a3d68b385ddf8dd11c2e2e827748e19b793acc3d47b5dbd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 28 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2948 1436 WerFault.exe pr175717.exe 5060 4300 WerFault.exe qu596847.exe 4968 3792 WerFault.exe si311215.exe 2824 3792 WerFault.exe si311215.exe 924 3792 WerFault.exe si311215.exe 1112 3792 WerFault.exe si311215.exe 628 3792 WerFault.exe si311215.exe 2544 3792 WerFault.exe si311215.exe 4444 3792 WerFault.exe si311215.exe 3768 3792 WerFault.exe si311215.exe 2296 3792 WerFault.exe si311215.exe 4396 3792 WerFault.exe si311215.exe 1212 224 WerFault.exe oneetx.exe 4596 224 WerFault.exe oneetx.exe 2556 224 WerFault.exe oneetx.exe 4876 224 WerFault.exe oneetx.exe 1148 224 WerFault.exe oneetx.exe 4692 224 WerFault.exe oneetx.exe 4040 224 WerFault.exe oneetx.exe 3388 224 WerFault.exe oneetx.exe 5016 224 WerFault.exe oneetx.exe 4696 224 WerFault.exe oneetx.exe 1452 224 WerFault.exe oneetx.exe 3704 224 WerFault.exe oneetx.exe 2080 2936 WerFault.exe oneetx.exe 1956 224 WerFault.exe oneetx.exe 2484 224 WerFault.exe oneetx.exe 2324 224 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pr175717.exequ596847.exerk843920.exepid process 1436 pr175717.exe 1436 pr175717.exe 4300 qu596847.exe 4300 qu596847.exe 452 rk843920.exe 452 rk843920.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pr175717.exequ596847.exerk843920.exedescription pid process Token: SeDebugPrivilege 1436 pr175717.exe Token: SeDebugPrivilege 4300 qu596847.exe Token: SeDebugPrivilege 452 rk843920.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
si311215.exepid process 3792 si311215.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
bbd29abab3b590bc5a3d68b385ddf8dd11c2e2e827748e19b793acc3d47b5dbd.exeun615487.exeun185198.exesi311215.exeoneetx.exedescription pid process target process PID 820 wrote to memory of 2164 820 bbd29abab3b590bc5a3d68b385ddf8dd11c2e2e827748e19b793acc3d47b5dbd.exe un615487.exe PID 820 wrote to memory of 2164 820 bbd29abab3b590bc5a3d68b385ddf8dd11c2e2e827748e19b793acc3d47b5dbd.exe un615487.exe PID 820 wrote to memory of 2164 820 bbd29abab3b590bc5a3d68b385ddf8dd11c2e2e827748e19b793acc3d47b5dbd.exe un615487.exe PID 2164 wrote to memory of 3196 2164 un615487.exe un185198.exe PID 2164 wrote to memory of 3196 2164 un615487.exe un185198.exe PID 2164 wrote to memory of 3196 2164 un615487.exe un185198.exe PID 3196 wrote to memory of 1436 3196 un185198.exe pr175717.exe PID 3196 wrote to memory of 1436 3196 un185198.exe pr175717.exe PID 3196 wrote to memory of 1436 3196 un185198.exe pr175717.exe PID 3196 wrote to memory of 4300 3196 un185198.exe qu596847.exe PID 3196 wrote to memory of 4300 3196 un185198.exe qu596847.exe PID 3196 wrote to memory of 4300 3196 un185198.exe qu596847.exe PID 2164 wrote to memory of 452 2164 un615487.exe rk843920.exe PID 2164 wrote to memory of 452 2164 un615487.exe rk843920.exe PID 2164 wrote to memory of 452 2164 un615487.exe rk843920.exe PID 820 wrote to memory of 3792 820 bbd29abab3b590bc5a3d68b385ddf8dd11c2e2e827748e19b793acc3d47b5dbd.exe si311215.exe PID 820 wrote to memory of 3792 820 bbd29abab3b590bc5a3d68b385ddf8dd11c2e2e827748e19b793acc3d47b5dbd.exe si311215.exe PID 820 wrote to memory of 3792 820 bbd29abab3b590bc5a3d68b385ddf8dd11c2e2e827748e19b793acc3d47b5dbd.exe si311215.exe PID 3792 wrote to memory of 224 3792 si311215.exe oneetx.exe PID 3792 wrote to memory of 224 3792 si311215.exe oneetx.exe PID 3792 wrote to memory of 224 3792 si311215.exe oneetx.exe PID 224 wrote to memory of 3916 224 oneetx.exe schtasks.exe PID 224 wrote to memory of 3916 224 oneetx.exe schtasks.exe PID 224 wrote to memory of 3916 224 oneetx.exe schtasks.exe PID 224 wrote to memory of 4204 224 oneetx.exe rundll32.exe PID 224 wrote to memory of 4204 224 oneetx.exe rundll32.exe PID 224 wrote to memory of 4204 224 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbd29abab3b590bc5a3d68b385ddf8dd11c2e2e827748e19b793acc3d47b5dbd.exe"C:\Users\Admin\AppData\Local\Temp\bbd29abab3b590bc5a3d68b385ddf8dd11c2e2e827748e19b793acc3d47b5dbd.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un615487.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un615487.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un185198.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un185198.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr175717.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr175717.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 10805⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu596847.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu596847.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 11485⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk843920.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk843920.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si311215.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si311215.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 7803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 7923⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 9523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 9523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 9683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 12163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 12483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 13123⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 7004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 8924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 10884⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 10004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 12004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 7124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 7924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 11084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 16204⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 16284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 7483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1436 -ip 14361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4300 -ip 43001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3792 -ip 37921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3792 -ip 37921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3792 -ip 37921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3792 -ip 37921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3792 -ip 37921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3792 -ip 37921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3792 -ip 37921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3792 -ip 37921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3792 -ip 37921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3792 -ip 37921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 224 -ip 2241⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 3122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2936 -ip 29361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 224 -ip 2241⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si311215.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si311215.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un615487.exeFilesize
675KB
MD590c348d67e60278ce856301927632d47
SHA1b74af4f4605ef79484d2fe16aeed89dcc4855f0a
SHA2564a41a586d896f81d42e0aa93efc65981e3fe1c48171dbc7805ee7196bd3de6c8
SHA5123eb22f3502fab9003cbd2b0f0e1844bf582db6e648ce9a8fee5667854aa6436960749de4ddf62942d157b9a88633da1443d11f33fce224525ab8d2b90c01241a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un615487.exeFilesize
675KB
MD590c348d67e60278ce856301927632d47
SHA1b74af4f4605ef79484d2fe16aeed89dcc4855f0a
SHA2564a41a586d896f81d42e0aa93efc65981e3fe1c48171dbc7805ee7196bd3de6c8
SHA5123eb22f3502fab9003cbd2b0f0e1844bf582db6e648ce9a8fee5667854aa6436960749de4ddf62942d157b9a88633da1443d11f33fce224525ab8d2b90c01241a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk843920.exeFilesize
169KB
MD5c99a8a5453938158014cf38b82ac9631
SHA18c1ff9443b44c8fa0a8a6975370c08df30ea5202
SHA256c067e6e24fc33eb371ccb6903642a2714d3c0a38079d9bb19b17792d4bba2388
SHA5125129b5df8c7fb8b20642d31ca7e21d656c84ee20a218b6e06f04afb492559babf4a5bb7d827b4f79fca95fb24181385c206d9593e7d290e26cdfcbb2491ee731
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk843920.exeFilesize
169KB
MD5c99a8a5453938158014cf38b82ac9631
SHA18c1ff9443b44c8fa0a8a6975370c08df30ea5202
SHA256c067e6e24fc33eb371ccb6903642a2714d3c0a38079d9bb19b17792d4bba2388
SHA5125129b5df8c7fb8b20642d31ca7e21d656c84ee20a218b6e06f04afb492559babf4a5bb7d827b4f79fca95fb24181385c206d9593e7d290e26cdfcbb2491ee731
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un185198.exeFilesize
521KB
MD5429fb6e4563cc7bcc65d99cc129792ab
SHA1d7929a0acca6f9f45723acaa719befc311410df8
SHA2566e2ac391307f15530f1b960f7905593889b992228d4fb3c3958d5337e19dc02e
SHA512588f913a66cecd06b064c0f655c23b563549da1f39ed3cc80f5cb5b8032a51ba5674aed2dc490ab9cc6ad25f127d034bada05cf3153e76714ec7feb43a035c2a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un185198.exeFilesize
521KB
MD5429fb6e4563cc7bcc65d99cc129792ab
SHA1d7929a0acca6f9f45723acaa719befc311410df8
SHA2566e2ac391307f15530f1b960f7905593889b992228d4fb3c3958d5337e19dc02e
SHA512588f913a66cecd06b064c0f655c23b563549da1f39ed3cc80f5cb5b8032a51ba5674aed2dc490ab9cc6ad25f127d034bada05cf3153e76714ec7feb43a035c2a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr175717.exeFilesize
239KB
MD5bf3493a3091b30c2874cb198dfa87afe
SHA10e0e7380055949e0d850ff1b71a86d2b32ea6dbd
SHA25605fdb045233724715b01fddf49591a28fd7574bf6b1beb8869f380b9cd8b93ef
SHA512b85a75bae70edc6cec5039b14fabdd53d7f47d81d681ad52c7e5dc43bd4e42147f52b8f3192cb6a5e1518233545b731fe42b43523aa4f9b8f0218efcd45b2ec8
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr175717.exeFilesize
239KB
MD5bf3493a3091b30c2874cb198dfa87afe
SHA10e0e7380055949e0d850ff1b71a86d2b32ea6dbd
SHA25605fdb045233724715b01fddf49591a28fd7574bf6b1beb8869f380b9cd8b93ef
SHA512b85a75bae70edc6cec5039b14fabdd53d7f47d81d681ad52c7e5dc43bd4e42147f52b8f3192cb6a5e1518233545b731fe42b43523aa4f9b8f0218efcd45b2ec8
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu596847.exeFilesize
297KB
MD583691bf732207e8481057350c2b18b86
SHA1c6e30c7a3e78976e89d84a829d466b8f8ef9792b
SHA256726e0870f3deeafddf53aed08dbdbd3d66f1290479c8d71be03af9857c4e93bb
SHA5125f08297dd0bf28a483298c4873cdea4f7cb59a5b8ef5f128b2a5c53ea36f17d07e45a863d70a514b0cdbfe2d1367c868765ecbcc5aa9e3aa33e3980009b8d414
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu596847.exeFilesize
297KB
MD583691bf732207e8481057350c2b18b86
SHA1c6e30c7a3e78976e89d84a829d466b8f8ef9792b
SHA256726e0870f3deeafddf53aed08dbdbd3d66f1290479c8d71be03af9857c4e93bb
SHA5125f08297dd0bf28a483298c4873cdea4f7cb59a5b8ef5f128b2a5c53ea36f17d07e45a863d70a514b0cdbfe2d1367c868765ecbcc5aa9e3aa33e3980009b8d414
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/452-1131-0x00000000056F0000-0x0000000005700000-memory.dmpFilesize
64KB
-
memory/452-1130-0x00000000056F0000-0x0000000005700000-memory.dmpFilesize
64KB
-
memory/452-1129-0x0000000000CE0000-0x0000000000D10000-memory.dmpFilesize
192KB
-
memory/1436-158-0x0000000004D50000-0x0000000004D60000-memory.dmpFilesize
64KB
-
memory/1436-173-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1436-181-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1436-183-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1436-185-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1436-187-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1436-188-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/1436-189-0x0000000004D50000-0x0000000004D60000-memory.dmpFilesize
64KB
-
memory/1436-190-0x0000000004D50000-0x0000000004D60000-memory.dmpFilesize
64KB
-
memory/1436-191-0x0000000004D50000-0x0000000004D60000-memory.dmpFilesize
64KB
-
memory/1436-193-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/1436-177-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1436-175-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1436-179-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1436-171-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1436-169-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1436-167-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1436-165-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1436-163-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1436-161-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1436-155-0x00000000005B0000-0x00000000005DD000-memory.dmpFilesize
180KB
-
memory/1436-160-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1436-159-0x0000000004D50000-0x0000000004D60000-memory.dmpFilesize
64KB
-
memory/1436-157-0x0000000004D50000-0x0000000004D60000-memory.dmpFilesize
64KB
-
memory/1436-156-0x0000000004D60000-0x0000000005304000-memory.dmpFilesize
5.6MB
-
memory/3792-1137-0x00000000004E0000-0x000000000051B000-memory.dmpFilesize
236KB
-
memory/4300-210-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-226-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-228-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-230-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-232-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-234-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-545-0x00000000024C0000-0x00000000024D0000-memory.dmpFilesize
64KB
-
memory/4300-1108-0x0000000005110000-0x0000000005728000-memory.dmpFilesize
6.1MB
-
memory/4300-1109-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/4300-1110-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/4300-1111-0x00000000024C0000-0x00000000024D0000-memory.dmpFilesize
64KB
-
memory/4300-1112-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/4300-1114-0x00000000024C0000-0x00000000024D0000-memory.dmpFilesize
64KB
-
memory/4300-1115-0x00000000024C0000-0x00000000024D0000-memory.dmpFilesize
64KB
-
memory/4300-1116-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/4300-1117-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/4300-1118-0x00000000024C0000-0x00000000024D0000-memory.dmpFilesize
64KB
-
memory/4300-1119-0x00000000065F0000-0x0000000006666000-memory.dmpFilesize
472KB
-
memory/4300-1120-0x0000000006680000-0x00000000066D0000-memory.dmpFilesize
320KB
-
memory/4300-1121-0x00000000024C0000-0x00000000024D0000-memory.dmpFilesize
64KB
-
memory/4300-1122-0x00000000067E0000-0x00000000069A2000-memory.dmpFilesize
1.8MB
-
memory/4300-224-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-222-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-220-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-218-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-216-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-214-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-212-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-208-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-206-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-204-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-201-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-202-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/4300-200-0x00000000024C0000-0x00000000024D0000-memory.dmpFilesize
64KB
-
memory/4300-199-0x00000000024C0000-0x00000000024D0000-memory.dmpFilesize
64KB
-
memory/4300-198-0x00000000004C0000-0x000000000050B000-memory.dmpFilesize
300KB
-
memory/4300-1123-0x00000000069B0000-0x0000000006EDC000-memory.dmpFilesize
5.2MB