Analysis
-
max time kernel
147s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 20:45
Static task
static1
General
-
Target
05ecfd0f0b28ea39096f8a43b62e7a2e8899bfb0ff9954ea6536994c40cfd358.exe
-
Size
801KB
-
MD5
744083bef11a426f5c2162f880344456
-
SHA1
ad81cd77d3fb49a817adc27b91ed44219e7ab235
-
SHA256
05ecfd0f0b28ea39096f8a43b62e7a2e8899bfb0ff9954ea6536994c40cfd358
-
SHA512
1b093458f4e1ae5e679db6ba80db5c20fe919c0ca6c71b1ab46db94b85ea74446a7716869277860230ae97b051122e35916c008072d55cf3362fd67422faa0e0
-
SSDEEP
12288:8MrWy90lGmU108s/jAcJV0wux0VY0Y9R5W5PnvU5/2cxK7C93k0lIt5R6+gb1G5W:iyD1ajAcIJ0kec9xxfC0l7+OOg
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
it225218.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it225218.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it225218.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it225218.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it225218.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it225218.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it225218.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/1460-162-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-163-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-165-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-167-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-169-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-171-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-173-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-175-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-177-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-179-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-183-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-185-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-187-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-189-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-191-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-193-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-195-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-197-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-199-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-203-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-201-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-205-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-207-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-209-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-211-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-213-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-215-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-217-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-219-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-221-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-223-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-225-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-227-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/1460-1078-0x0000000004A80000-0x0000000004A90000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr636727.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation lr636727.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
zifO1498.exeziWj3669.exeit225218.exejr357908.exekp286509.exelr636727.exeoneetx.exeoneetx.exeoneetx.exepid process 2120 zifO1498.exe 3284 ziWj3669.exe 1772 it225218.exe 1460 jr357908.exe 3572 kp286509.exe 3724 lr636727.exe 3368 oneetx.exe 1992 oneetx.exe 480 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1972 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it225218.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it225218.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
zifO1498.exeziWj3669.exe05ecfd0f0b28ea39096f8a43b62e7a2e8899bfb0ff9954ea6536994c40cfd358.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zifO1498.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziWj3669.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ziWj3669.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 05ecfd0f0b28ea39096f8a43b62e7a2e8899bfb0ff9954ea6536994c40cfd358.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 05ecfd0f0b28ea39096f8a43b62e7a2e8899bfb0ff9954ea6536994c40cfd358.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zifO1498.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 28 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2896 1460 WerFault.exe jr357908.exe 1184 3724 WerFault.exe lr636727.exe 1252 3724 WerFault.exe lr636727.exe 2860 3724 WerFault.exe lr636727.exe 3560 3724 WerFault.exe lr636727.exe 5060 3724 WerFault.exe lr636727.exe 1824 3724 WerFault.exe lr636727.exe 4940 3724 WerFault.exe lr636727.exe 1520 3724 WerFault.exe lr636727.exe 648 3724 WerFault.exe lr636727.exe 2252 3724 WerFault.exe lr636727.exe 2260 3368 WerFault.exe oneetx.exe 2676 3368 WerFault.exe oneetx.exe 2308 3368 WerFault.exe oneetx.exe 208 3368 WerFault.exe oneetx.exe 3972 3368 WerFault.exe oneetx.exe 932 3368 WerFault.exe oneetx.exe 4092 3368 WerFault.exe oneetx.exe 1980 3368 WerFault.exe oneetx.exe 2012 3368 WerFault.exe oneetx.exe 2288 3368 WerFault.exe oneetx.exe 752 3368 WerFault.exe oneetx.exe 384 3368 WerFault.exe oneetx.exe 808 1992 WerFault.exe oneetx.exe 2720 3368 WerFault.exe oneetx.exe 5012 3368 WerFault.exe oneetx.exe 2092 3368 WerFault.exe oneetx.exe 1012 480 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it225218.exejr357908.exekp286509.exepid process 1772 it225218.exe 1772 it225218.exe 1460 jr357908.exe 1460 jr357908.exe 3572 kp286509.exe 3572 kp286509.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it225218.exejr357908.exekp286509.exedescription pid process Token: SeDebugPrivilege 1772 it225218.exe Token: SeDebugPrivilege 1460 jr357908.exe Token: SeDebugPrivilege 3572 kp286509.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr636727.exepid process 3724 lr636727.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
05ecfd0f0b28ea39096f8a43b62e7a2e8899bfb0ff9954ea6536994c40cfd358.exezifO1498.exeziWj3669.exelr636727.exeoneetx.exedescription pid process target process PID 3684 wrote to memory of 2120 3684 05ecfd0f0b28ea39096f8a43b62e7a2e8899bfb0ff9954ea6536994c40cfd358.exe zifO1498.exe PID 3684 wrote to memory of 2120 3684 05ecfd0f0b28ea39096f8a43b62e7a2e8899bfb0ff9954ea6536994c40cfd358.exe zifO1498.exe PID 3684 wrote to memory of 2120 3684 05ecfd0f0b28ea39096f8a43b62e7a2e8899bfb0ff9954ea6536994c40cfd358.exe zifO1498.exe PID 2120 wrote to memory of 3284 2120 zifO1498.exe ziWj3669.exe PID 2120 wrote to memory of 3284 2120 zifO1498.exe ziWj3669.exe PID 2120 wrote to memory of 3284 2120 zifO1498.exe ziWj3669.exe PID 3284 wrote to memory of 1772 3284 ziWj3669.exe it225218.exe PID 3284 wrote to memory of 1772 3284 ziWj3669.exe it225218.exe PID 3284 wrote to memory of 1460 3284 ziWj3669.exe jr357908.exe PID 3284 wrote to memory of 1460 3284 ziWj3669.exe jr357908.exe PID 3284 wrote to memory of 1460 3284 ziWj3669.exe jr357908.exe PID 2120 wrote to memory of 3572 2120 zifO1498.exe kp286509.exe PID 2120 wrote to memory of 3572 2120 zifO1498.exe kp286509.exe PID 2120 wrote to memory of 3572 2120 zifO1498.exe kp286509.exe PID 3684 wrote to memory of 3724 3684 05ecfd0f0b28ea39096f8a43b62e7a2e8899bfb0ff9954ea6536994c40cfd358.exe lr636727.exe PID 3684 wrote to memory of 3724 3684 05ecfd0f0b28ea39096f8a43b62e7a2e8899bfb0ff9954ea6536994c40cfd358.exe lr636727.exe PID 3684 wrote to memory of 3724 3684 05ecfd0f0b28ea39096f8a43b62e7a2e8899bfb0ff9954ea6536994c40cfd358.exe lr636727.exe PID 3724 wrote to memory of 3368 3724 lr636727.exe oneetx.exe PID 3724 wrote to memory of 3368 3724 lr636727.exe oneetx.exe PID 3724 wrote to memory of 3368 3724 lr636727.exe oneetx.exe PID 3368 wrote to memory of 3636 3368 oneetx.exe schtasks.exe PID 3368 wrote to memory of 3636 3368 oneetx.exe schtasks.exe PID 3368 wrote to memory of 3636 3368 oneetx.exe schtasks.exe PID 3368 wrote to memory of 1972 3368 oneetx.exe rundll32.exe PID 3368 wrote to memory of 1972 3368 oneetx.exe rundll32.exe PID 3368 wrote to memory of 1972 3368 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05ecfd0f0b28ea39096f8a43b62e7a2e8899bfb0ff9954ea6536994c40cfd358.exe"C:\Users\Admin\AppData\Local\Temp\05ecfd0f0b28ea39096f8a43b62e7a2e8899bfb0ff9954ea6536994c40cfd358.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifO1498.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifO1498.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziWj3669.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziWj3669.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it225218.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it225218.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr357908.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr357908.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 17645⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp286509.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp286509.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr636727.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr636727.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 7963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 8683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 8723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 9883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 10043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 12163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 12083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 13123⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 8324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 8884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 10604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 10604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 10924⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 8364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 12884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 12964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 11324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 16044⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 11324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 15844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 7643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1460 -ip 14601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3724 -ip 37241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3724 -ip 37241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3724 -ip 37241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 3724 -ip 37241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3724 -ip 37241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3724 -ip 37241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3724 -ip 37241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3724 -ip 37241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3724 -ip 37241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3724 -ip 37241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3368 -ip 33681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3368 -ip 33681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3368 -ip 33681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3368 -ip 33681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3368 -ip 33681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3368 -ip 33681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3368 -ip 33681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3368 -ip 33681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3368 -ip 33681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3368 -ip 33681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 3368 -ip 33681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3368 -ip 33681⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1992 -ip 19921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3368 -ip 33681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3368 -ip 33681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3368 -ip 33681⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 480 -s 3122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 480 -ip 4801⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr636727.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr636727.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifO1498.exeFilesize
536KB
MD555b60086a60e80318f21c4b345956ae2
SHA117724cb4e02f4eef83ae737be1f8c2ab0e13f9a0
SHA25641e29427594e3df543092eb4ae6969a933eb57068a5f8741a5379d0c7dbed486
SHA512300885e5824f70952fcb519ec07191feb4bec6dd8859373810c732aeea94e51bbf0f7a7ec8770c3dd16d436ff904e7d39af22d10968cb59bd33b6ac1df874e0a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifO1498.exeFilesize
536KB
MD555b60086a60e80318f21c4b345956ae2
SHA117724cb4e02f4eef83ae737be1f8c2ab0e13f9a0
SHA25641e29427594e3df543092eb4ae6969a933eb57068a5f8741a5379d0c7dbed486
SHA512300885e5824f70952fcb519ec07191feb4bec6dd8859373810c732aeea94e51bbf0f7a7ec8770c3dd16d436ff904e7d39af22d10968cb59bd33b6ac1df874e0a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp286509.exeFilesize
169KB
MD5c7c7e2e59ef1ff0cfb96edb4cea37e82
SHA131fca64a4eee6f513672792de9138e9d8ba1f4f5
SHA256d11360d357a3f388d63bfdb35f0a3b45c45cb4304c8cbbbe5e907c1d0f285f21
SHA5121f0c2eb149b926b0e74fc20fbaeb4ce611974e292fc15bc6802c8b70843b18448a241e67e5450674f90c96423e72422e56863698a5bd378837d60cc62f97bd61
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp286509.exeFilesize
169KB
MD5c7c7e2e59ef1ff0cfb96edb4cea37e82
SHA131fca64a4eee6f513672792de9138e9d8ba1f4f5
SHA256d11360d357a3f388d63bfdb35f0a3b45c45cb4304c8cbbbe5e907c1d0f285f21
SHA5121f0c2eb149b926b0e74fc20fbaeb4ce611974e292fc15bc6802c8b70843b18448a241e67e5450674f90c96423e72422e56863698a5bd378837d60cc62f97bd61
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziWj3669.exeFilesize
382KB
MD5c10e06810ec4e2b7bf06f9b93bae3090
SHA1da5fb9f853e2b97eb8a89e65a8ddce3eabc22cf9
SHA256d65623e50c1ee5eece6ef0cbb0f7db28ee3640de59a00fc65f05c2da0ca16a3a
SHA5125cf81d57b66e4fd863ea9a9ada1977e706e5eb94c3fcafff3751104aa4b34036de4207261e6486bf8df56c56d26b159455bebe33afedc50d428b8af333d5cec8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziWj3669.exeFilesize
382KB
MD5c10e06810ec4e2b7bf06f9b93bae3090
SHA1da5fb9f853e2b97eb8a89e65a8ddce3eabc22cf9
SHA256d65623e50c1ee5eece6ef0cbb0f7db28ee3640de59a00fc65f05c2da0ca16a3a
SHA5125cf81d57b66e4fd863ea9a9ada1977e706e5eb94c3fcafff3751104aa4b34036de4207261e6486bf8df56c56d26b159455bebe33afedc50d428b8af333d5cec8
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it225218.exeFilesize
11KB
MD552be802c6b06a586dc2e8a4fccc6d075
SHA176904ad8f17c83d0cc1233407540b6b331ba0284
SHA2560fcb74c81aba859b155329895f2e8485ead4404ac9ccc8e182da55d8702abe02
SHA512152413ee88e7f0cce9b7f1b163bfd9ceb78b3c14041a3cea1a5fac9e9408f17cc3b9f1e49b6b817b24b91faa3626ee4a03fd35ee8bbef55d79599fc191098959
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it225218.exeFilesize
11KB
MD552be802c6b06a586dc2e8a4fccc6d075
SHA176904ad8f17c83d0cc1233407540b6b331ba0284
SHA2560fcb74c81aba859b155329895f2e8485ead4404ac9ccc8e182da55d8702abe02
SHA512152413ee88e7f0cce9b7f1b163bfd9ceb78b3c14041a3cea1a5fac9e9408f17cc3b9f1e49b6b817b24b91faa3626ee4a03fd35ee8bbef55d79599fc191098959
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr357908.exeFilesize
297KB
MD5afd91391d71324fd863fb743e3052252
SHA18e5ed4f8fbe4bbc3d2a09d8f91db400feaa0b2c5
SHA2565b6cd694d88b24f0726b6d2c135f184aa14c6e32d3df355ffaaabdfa9118055b
SHA5124476f5d64c52666eab5d8cd9e9bb602f9902e3f5dd119b701a7410d3721329d1d53d96c508895ff0858da6be26abd76faed64303d5f585e84c343067b78cf70f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr357908.exeFilesize
297KB
MD5afd91391d71324fd863fb743e3052252
SHA18e5ed4f8fbe4bbc3d2a09d8f91db400feaa0b2c5
SHA2565b6cd694d88b24f0726b6d2c135f184aa14c6e32d3df355ffaaabdfa9118055b
SHA5124476f5d64c52666eab5d8cd9e9bb602f9902e3f5dd119b701a7410d3721329d1d53d96c508895ff0858da6be26abd76faed64303d5f585e84c343067b78cf70f
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1460-207-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-227-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-179-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-180-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1460-183-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-182-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1460-185-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-187-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-189-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-191-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-193-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-195-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-197-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-199-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-203-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-201-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-205-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-175-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-209-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-211-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-213-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-215-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-217-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-219-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-221-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-223-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-225-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-177-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-1070-0x00000000050C0000-0x00000000056D8000-memory.dmpFilesize
6.1MB
-
memory/1460-1071-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/1460-1072-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/1460-1073-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/1460-1074-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1460-1076-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/1460-1077-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/1460-1078-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1460-1079-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1460-1080-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1460-1081-0x0000000006370000-0x00000000063E6000-memory.dmpFilesize
472KB
-
memory/1460-1082-0x0000000006400000-0x0000000006450000-memory.dmpFilesize
320KB
-
memory/1460-1083-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1460-1084-0x00000000066B0000-0x0000000006872000-memory.dmpFilesize
1.8MB
-
memory/1460-1085-0x0000000006880000-0x0000000006DAC000-memory.dmpFilesize
5.2MB
-
memory/1460-160-0x0000000001E50000-0x0000000001E9B000-memory.dmpFilesize
300KB
-
memory/1460-161-0x0000000004A90000-0x0000000005034000-memory.dmpFilesize
5.6MB
-
memory/1460-162-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-163-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-173-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-171-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-169-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-167-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1460-165-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/1772-154-0x0000000000950000-0x000000000095A000-memory.dmpFilesize
40KB
-
memory/3572-1092-0x0000000005840000-0x0000000005850000-memory.dmpFilesize
64KB
-
memory/3572-1091-0x0000000000F00000-0x0000000000F30000-memory.dmpFilesize
192KB
-
memory/3724-1098-0x00000000005F0000-0x000000000062B000-memory.dmpFilesize
236KB