Analysis
-
max time kernel
147s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 20:56
Static task
static1
General
-
Target
176203d7e9fab3142be1a6e6f4c14367a6022ea498deb65ea022a9c867867b16.exe
-
Size
800KB
-
MD5
baf4dfc2411e087a53fa873d568ee011
-
SHA1
5f47ecdf919850ff1198bf6e3621090f8c22bd84
-
SHA256
176203d7e9fab3142be1a6e6f4c14367a6022ea498deb65ea022a9c867867b16
-
SHA512
94a71ad2558a54021e8ca875ce946099cd63f1eaf1857667cdbc1f9cd3b8837474033b56078969fb2f19cd948030d376a05baded426ed0fb700eef8a878ab017
-
SSDEEP
12288:aMrAy90yoRjhvPu0yJXbkVgoTPxK7CCrgEms715LIqjEnxvQ9Qh05w:2yFoRjlpnVgoLxfY1FImYxuW
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
it958854.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it958854.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it958854.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it958854.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it958854.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it958854.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it958854.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2308-162-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-163-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-167-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-165-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-169-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-171-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-173-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-176-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-180-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-182-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-186-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-184-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-188-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-190-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-192-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-194-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-196-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-198-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-200-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-202-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-204-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-206-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-208-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-210-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-212-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-214-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-216-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-218-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-224-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-222-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-220-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-226-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-228-0x0000000005160000-0x000000000519F000-memory.dmp family_redline behavioral1/memory/2308-1079-0x0000000004B40000-0x0000000004B50000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr708813.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation lr708813.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
Processes:
ziCg6986.exeziqr3310.exeit958854.exejr617490.exekp395546.exelr708813.exeoneetx.exeoneetx.exepid process 4172 ziCg6986.exe 2124 ziqr3310.exe 2724 it958854.exe 2308 jr617490.exe 4220 kp395546.exe 2024 lr708813.exe 3800 oneetx.exe 4160 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2720 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it958854.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it958854.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
ziCg6986.exeziqr3310.exe176203d7e9fab3142be1a6e6f4c14367a6022ea498deb65ea022a9c867867b16.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziCg6986.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziqr3310.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ziqr3310.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 176203d7e9fab3142be1a6e6f4c14367a6022ea498deb65ea022a9c867867b16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 176203d7e9fab3142be1a6e6f4c14367a6022ea498deb65ea022a9c867867b16.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziCg6986.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 27 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2044 2308 WerFault.exe jr617490.exe 4288 2024 WerFault.exe lr708813.exe 3104 2024 WerFault.exe lr708813.exe 4916 2024 WerFault.exe lr708813.exe 2004 2024 WerFault.exe lr708813.exe 372 2024 WerFault.exe lr708813.exe 3972 2024 WerFault.exe lr708813.exe 4412 2024 WerFault.exe lr708813.exe 1704 2024 WerFault.exe lr708813.exe 232 2024 WerFault.exe lr708813.exe 2636 2024 WerFault.exe lr708813.exe 1648 3800 WerFault.exe oneetx.exe 2856 3800 WerFault.exe oneetx.exe 992 3800 WerFault.exe oneetx.exe 848 3800 WerFault.exe oneetx.exe 4080 3800 WerFault.exe oneetx.exe 4164 3800 WerFault.exe oneetx.exe 3492 3800 WerFault.exe oneetx.exe 3608 3800 WerFault.exe oneetx.exe 3812 3800 WerFault.exe oneetx.exe 1076 3800 WerFault.exe oneetx.exe 3648 3800 WerFault.exe oneetx.exe 4684 3800 WerFault.exe oneetx.exe 5116 3800 WerFault.exe oneetx.exe 4284 3800 WerFault.exe oneetx.exe 4784 4160 WerFault.exe oneetx.exe 4376 3800 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it958854.exejr617490.exekp395546.exepid process 2724 it958854.exe 2724 it958854.exe 2308 jr617490.exe 2308 jr617490.exe 4220 kp395546.exe 4220 kp395546.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it958854.exejr617490.exekp395546.exedescription pid process Token: SeDebugPrivilege 2724 it958854.exe Token: SeDebugPrivilege 2308 jr617490.exe Token: SeDebugPrivilege 4220 kp395546.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr708813.exepid process 2024 lr708813.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
176203d7e9fab3142be1a6e6f4c14367a6022ea498deb65ea022a9c867867b16.exeziCg6986.exeziqr3310.exelr708813.exeoneetx.exedescription pid process target process PID 1644 wrote to memory of 4172 1644 176203d7e9fab3142be1a6e6f4c14367a6022ea498deb65ea022a9c867867b16.exe ziCg6986.exe PID 1644 wrote to memory of 4172 1644 176203d7e9fab3142be1a6e6f4c14367a6022ea498deb65ea022a9c867867b16.exe ziCg6986.exe PID 1644 wrote to memory of 4172 1644 176203d7e9fab3142be1a6e6f4c14367a6022ea498deb65ea022a9c867867b16.exe ziCg6986.exe PID 4172 wrote to memory of 2124 4172 ziCg6986.exe ziqr3310.exe PID 4172 wrote to memory of 2124 4172 ziCg6986.exe ziqr3310.exe PID 4172 wrote to memory of 2124 4172 ziCg6986.exe ziqr3310.exe PID 2124 wrote to memory of 2724 2124 ziqr3310.exe it958854.exe PID 2124 wrote to memory of 2724 2124 ziqr3310.exe it958854.exe PID 2124 wrote to memory of 2308 2124 ziqr3310.exe jr617490.exe PID 2124 wrote to memory of 2308 2124 ziqr3310.exe jr617490.exe PID 2124 wrote to memory of 2308 2124 ziqr3310.exe jr617490.exe PID 4172 wrote to memory of 4220 4172 ziCg6986.exe kp395546.exe PID 4172 wrote to memory of 4220 4172 ziCg6986.exe kp395546.exe PID 4172 wrote to memory of 4220 4172 ziCg6986.exe kp395546.exe PID 1644 wrote to memory of 2024 1644 176203d7e9fab3142be1a6e6f4c14367a6022ea498deb65ea022a9c867867b16.exe lr708813.exe PID 1644 wrote to memory of 2024 1644 176203d7e9fab3142be1a6e6f4c14367a6022ea498deb65ea022a9c867867b16.exe lr708813.exe PID 1644 wrote to memory of 2024 1644 176203d7e9fab3142be1a6e6f4c14367a6022ea498deb65ea022a9c867867b16.exe lr708813.exe PID 2024 wrote to memory of 3800 2024 lr708813.exe oneetx.exe PID 2024 wrote to memory of 3800 2024 lr708813.exe oneetx.exe PID 2024 wrote to memory of 3800 2024 lr708813.exe oneetx.exe PID 3800 wrote to memory of 4584 3800 oneetx.exe schtasks.exe PID 3800 wrote to memory of 4584 3800 oneetx.exe schtasks.exe PID 3800 wrote to memory of 4584 3800 oneetx.exe schtasks.exe PID 3800 wrote to memory of 2720 3800 oneetx.exe rundll32.exe PID 3800 wrote to memory of 2720 3800 oneetx.exe rundll32.exe PID 3800 wrote to memory of 2720 3800 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\176203d7e9fab3142be1a6e6f4c14367a6022ea498deb65ea022a9c867867b16.exe"C:\Users\Admin\AppData\Local\Temp\176203d7e9fab3142be1a6e6f4c14367a6022ea498deb65ea022a9c867867b16.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCg6986.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCg6986.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziqr3310.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziqr3310.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it958854.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it958854.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr617490.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr617490.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 13485⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp395546.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp395546.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr708813.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr708813.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 7803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 9523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 9603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 9803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 12163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 12043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 13123⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 8284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 8404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 10884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 11084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 11324⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 7764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 7564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 12924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 11564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 16084⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 14004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 16244⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 13603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2308 -ip 23081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2024 -ip 20241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2024 -ip 20241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2024 -ip 20241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2024 -ip 20241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2024 -ip 20241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2024 -ip 20241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2024 -ip 20241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2024 -ip 20241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2024 -ip 20241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2024 -ip 20241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3800 -ip 38001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3800 -ip 38001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3800 -ip 38001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 3800 -ip 38001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3800 -ip 38001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3800 -ip 38001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3800 -ip 38001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3800 -ip 38001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3800 -ip 38001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3800 -ip 38001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3800 -ip 38001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3800 -ip 38001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3800 -ip 38001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3800 -ip 38001⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4160 -ip 41601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3800 -ip 38001⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr708813.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr708813.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCg6986.exeFilesize
536KB
MD5a47b7d4857cf8050e521d1cd570a45ed
SHA16b3fa2b617743a4af41aef2231655ff6175845ea
SHA256048c344cf8f692a023a0792dbea0f650d1d4b28c4848445dc3a48e30c53d6dd9
SHA512fc1b83f63b8ea564b5e92e1ffea11c2d56c52805b46a56fafe408a967848df5a457bb15fc7319d696515d3ab326060468b093591d1d2d4da5a6691b06ca1f406
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCg6986.exeFilesize
536KB
MD5a47b7d4857cf8050e521d1cd570a45ed
SHA16b3fa2b617743a4af41aef2231655ff6175845ea
SHA256048c344cf8f692a023a0792dbea0f650d1d4b28c4848445dc3a48e30c53d6dd9
SHA512fc1b83f63b8ea564b5e92e1ffea11c2d56c52805b46a56fafe408a967848df5a457bb15fc7319d696515d3ab326060468b093591d1d2d4da5a6691b06ca1f406
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp395546.exeFilesize
169KB
MD5e12594efd135240f0c09d82927d97dfa
SHA17ae6ff4e8e2bdb71c37ce13c6d7cddb66df2f07c
SHA2569ea8731d7270e2ef292da815226b71f65d8f02537a49d3c51ed0d09194cf2d78
SHA512d7f4f1cf0c35d2518513903bb23017e28c76ca6d4839f4129793a215b1253bac29274b7d7c2e54d49006715c653b347df6b8ca20090b4dc4d7c6d9322cf2edef
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp395546.exeFilesize
169KB
MD5e12594efd135240f0c09d82927d97dfa
SHA17ae6ff4e8e2bdb71c37ce13c6d7cddb66df2f07c
SHA2569ea8731d7270e2ef292da815226b71f65d8f02537a49d3c51ed0d09194cf2d78
SHA512d7f4f1cf0c35d2518513903bb23017e28c76ca6d4839f4129793a215b1253bac29274b7d7c2e54d49006715c653b347df6b8ca20090b4dc4d7c6d9322cf2edef
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziqr3310.exeFilesize
382KB
MD5e200a3326b2edeab1aeb673c230da5b7
SHA1cee2ca38ab4f9fe26b34c196e63babc6a0ff0541
SHA256e4b588d262d5d38cc9b13e8acfeaf1a7835d0418f5a7080ea8f5fba6c7138ca0
SHA512689b0c3de8db1b5d233b4b464c922a26d4eb200645c73d0816663efa42ed94c37f4281cde9ae4b6718ebebc0c95f0d4a21976cef4b184f519f677492c32ed1d2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziqr3310.exeFilesize
382KB
MD5e200a3326b2edeab1aeb673c230da5b7
SHA1cee2ca38ab4f9fe26b34c196e63babc6a0ff0541
SHA256e4b588d262d5d38cc9b13e8acfeaf1a7835d0418f5a7080ea8f5fba6c7138ca0
SHA512689b0c3de8db1b5d233b4b464c922a26d4eb200645c73d0816663efa42ed94c37f4281cde9ae4b6718ebebc0c95f0d4a21976cef4b184f519f677492c32ed1d2
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it958854.exeFilesize
11KB
MD53bddd3d94ca1082b3338368cfd684a60
SHA1a02d9b07193c3b3f71cb6f63f352a2f2b6b35957
SHA256b303c48001d61b947a4216a15893b110306cf29ace8e651978be88a193812a1a
SHA512fcc6ec88cdc46e67971f7c163695b24233272518f696aba921031fdafa60307efb8cfd3f99349e8c35fd6289208edeba3643388a11f462b56ff918ebe745fbe3
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it958854.exeFilesize
11KB
MD53bddd3d94ca1082b3338368cfd684a60
SHA1a02d9b07193c3b3f71cb6f63f352a2f2b6b35957
SHA256b303c48001d61b947a4216a15893b110306cf29ace8e651978be88a193812a1a
SHA512fcc6ec88cdc46e67971f7c163695b24233272518f696aba921031fdafa60307efb8cfd3f99349e8c35fd6289208edeba3643388a11f462b56ff918ebe745fbe3
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr617490.exeFilesize
297KB
MD5d5a37ed27268eeb8070c6b004bc074f9
SHA1d9fda42eca9408a11ec52031e195618ff0d35e4c
SHA2569ff2c650201595d0f85bdfb8b544a8f07e0389b32a02c0872cdcd7880e3c8bd2
SHA5127b8f34b45102d860a3917211be9e154ac6baf3d21da325659ca8f4b8588eade6fd997880b2b56ca0cf9fd65c428109555c63bf1638a876b6ac23eec2c9da922d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr617490.exeFilesize
297KB
MD5d5a37ed27268eeb8070c6b004bc074f9
SHA1d9fda42eca9408a11ec52031e195618ff0d35e4c
SHA2569ff2c650201595d0f85bdfb8b544a8f07e0389b32a02c0872cdcd7880e3c8bd2
SHA5127b8f34b45102d860a3917211be9e154ac6baf3d21da325659ca8f4b8588eade6fd997880b2b56ca0cf9fd65c428109555c63bf1638a876b6ac23eec2c9da922d
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/2024-1099-0x00000000005B0000-0x00000000005EB000-memory.dmpFilesize
236KB
-
memory/2308-208-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-228-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-176-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-180-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-182-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-186-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-184-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-188-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-190-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-192-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-194-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-196-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-198-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-200-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-202-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-204-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-206-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-177-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2308-210-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-212-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-214-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-216-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-218-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-224-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-222-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-220-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-226-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-179-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2308-1071-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/2308-1072-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/2308-1073-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/2308-1075-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2308-1074-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/2308-1077-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/2308-1078-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/2308-1081-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2308-1080-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2308-1079-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2308-1082-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2308-1083-0x00000000066F0000-0x0000000006766000-memory.dmpFilesize
472KB
-
memory/2308-1084-0x0000000006780000-0x00000000067D0000-memory.dmpFilesize
320KB
-
memory/2308-1085-0x00000000067E0000-0x00000000069A2000-memory.dmpFilesize
1.8MB
-
memory/2308-1086-0x00000000069B0000-0x0000000006EDC000-memory.dmpFilesize
5.2MB
-
memory/2308-160-0x0000000000750000-0x000000000079B000-memory.dmpFilesize
300KB
-
memory/2308-161-0x0000000004B50000-0x00000000050F4000-memory.dmpFilesize
5.6MB
-
memory/2308-175-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2308-173-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-171-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-169-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-165-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-167-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-163-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2308-162-0x0000000005160000-0x000000000519F000-memory.dmpFilesize
252KB
-
memory/2724-154-0x0000000000E20000-0x0000000000E2A000-memory.dmpFilesize
40KB
-
memory/4220-1092-0x00000000006C0000-0x00000000006F0000-memory.dmpFilesize
192KB
-
memory/4220-1093-0x0000000005070000-0x0000000005080000-memory.dmpFilesize
64KB