Analysis
-
max time kernel
148s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 20:54
Static task
static1
General
-
Target
b4abe3c9af1477bd8c7ce1ebdd2b30bba9510c0d6c7eaecd2dd926780aaf670c.exe
-
Size
940KB
-
MD5
ea261677dbb1383a5b5e1f325f534325
-
SHA1
a008e1e6c54d47d0d6d848288eb77ccfea8f6200
-
SHA256
b4abe3c9af1477bd8c7ce1ebdd2b30bba9510c0d6c7eaecd2dd926780aaf670c
-
SHA512
a719757ae7aec6e1d448dba8c31bbfb7083c63575f6d91402f378e72b8cf6ea050b1e1447713abaa76575f9ba4b749dc728ea4f5eeaa62113692dc9869c54f88
-
SSDEEP
24576:6yH5JTUK68kLlPt2pm+GKdkyX0zuPq5HIuUtUNHZvWC2LlDuDeK:By8WPt2pmD3yX0zuP0nRWCKl
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
pr117472.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr117472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr117472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr117472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr117472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr117472.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr117472.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/3872-198-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-199-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-201-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-203-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-205-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-207-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-209-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-211-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-213-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-215-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-217-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-219-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-221-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-223-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-225-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-227-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-229-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-231-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/3872-334-0x0000000002150000-0x0000000002160000-memory.dmp family_redline behavioral1/memory/3872-1117-0x0000000002150000-0x0000000002160000-memory.dmp family_redline behavioral1/memory/3872-1118-0x0000000002150000-0x0000000002160000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
si399075.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation si399075.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
un865283.exeun193903.exepr117472.exequ821430.exerk572988.exesi399075.exeoneetx.exeoneetx.exeoneetx.exepid process 760 un865283.exe 3200 un193903.exe 1056 pr117472.exe 3872 qu821430.exe 2224 rk572988.exe 3588 si399075.exe 1052 oneetx.exe 4360 oneetx.exe 2444 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1600 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pr117472.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr117472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr117472.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
b4abe3c9af1477bd8c7ce1ebdd2b30bba9510c0d6c7eaecd2dd926780aaf670c.exeun865283.exeun193903.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b4abe3c9af1477bd8c7ce1ebdd2b30bba9510c0d6c7eaecd2dd926780aaf670c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b4abe3c9af1477bd8c7ce1ebdd2b30bba9510c0d6c7eaecd2dd926780aaf670c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un865283.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un865283.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un193903.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un193903.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 29 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2772 1056 WerFault.exe pr117472.exe 1644 3872 WerFault.exe qu821430.exe 3164 3588 WerFault.exe si399075.exe 4632 3588 WerFault.exe si399075.exe 2368 3588 WerFault.exe si399075.exe 4300 3588 WerFault.exe si399075.exe 2244 3588 WerFault.exe si399075.exe 3952 3588 WerFault.exe si399075.exe 2944 3588 WerFault.exe si399075.exe 4264 3588 WerFault.exe si399075.exe 4272 3588 WerFault.exe si399075.exe 1344 3588 WerFault.exe si399075.exe 5016 1052 WerFault.exe oneetx.exe 3736 1052 WerFault.exe oneetx.exe 3560 1052 WerFault.exe oneetx.exe 216 1052 WerFault.exe oneetx.exe 2404 1052 WerFault.exe oneetx.exe 2260 1052 WerFault.exe oneetx.exe 4880 1052 WerFault.exe oneetx.exe 1808 1052 WerFault.exe oneetx.exe 3924 1052 WerFault.exe oneetx.exe 3464 1052 WerFault.exe oneetx.exe 668 1052 WerFault.exe oneetx.exe 1652 4360 WerFault.exe oneetx.exe 4576 1052 WerFault.exe oneetx.exe 4188 1052 WerFault.exe oneetx.exe 2392 1052 WerFault.exe oneetx.exe 1400 2444 WerFault.exe oneetx.exe 1220 1052 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pr117472.exequ821430.exerk572988.exepid process 1056 pr117472.exe 1056 pr117472.exe 3872 qu821430.exe 3872 qu821430.exe 2224 rk572988.exe 2224 rk572988.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pr117472.exequ821430.exerk572988.exedescription pid process Token: SeDebugPrivilege 1056 pr117472.exe Token: SeDebugPrivilege 3872 qu821430.exe Token: SeDebugPrivilege 2224 rk572988.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
si399075.exepid process 3588 si399075.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
b4abe3c9af1477bd8c7ce1ebdd2b30bba9510c0d6c7eaecd2dd926780aaf670c.exeun865283.exeun193903.exesi399075.exeoneetx.exedescription pid process target process PID 444 wrote to memory of 760 444 b4abe3c9af1477bd8c7ce1ebdd2b30bba9510c0d6c7eaecd2dd926780aaf670c.exe un865283.exe PID 444 wrote to memory of 760 444 b4abe3c9af1477bd8c7ce1ebdd2b30bba9510c0d6c7eaecd2dd926780aaf670c.exe un865283.exe PID 444 wrote to memory of 760 444 b4abe3c9af1477bd8c7ce1ebdd2b30bba9510c0d6c7eaecd2dd926780aaf670c.exe un865283.exe PID 760 wrote to memory of 3200 760 un865283.exe un193903.exe PID 760 wrote to memory of 3200 760 un865283.exe un193903.exe PID 760 wrote to memory of 3200 760 un865283.exe un193903.exe PID 3200 wrote to memory of 1056 3200 un193903.exe pr117472.exe PID 3200 wrote to memory of 1056 3200 un193903.exe pr117472.exe PID 3200 wrote to memory of 1056 3200 un193903.exe pr117472.exe PID 3200 wrote to memory of 3872 3200 un193903.exe qu821430.exe PID 3200 wrote to memory of 3872 3200 un193903.exe qu821430.exe PID 3200 wrote to memory of 3872 3200 un193903.exe qu821430.exe PID 760 wrote to memory of 2224 760 un865283.exe rk572988.exe PID 760 wrote to memory of 2224 760 un865283.exe rk572988.exe PID 760 wrote to memory of 2224 760 un865283.exe rk572988.exe PID 444 wrote to memory of 3588 444 b4abe3c9af1477bd8c7ce1ebdd2b30bba9510c0d6c7eaecd2dd926780aaf670c.exe si399075.exe PID 444 wrote to memory of 3588 444 b4abe3c9af1477bd8c7ce1ebdd2b30bba9510c0d6c7eaecd2dd926780aaf670c.exe si399075.exe PID 444 wrote to memory of 3588 444 b4abe3c9af1477bd8c7ce1ebdd2b30bba9510c0d6c7eaecd2dd926780aaf670c.exe si399075.exe PID 3588 wrote to memory of 1052 3588 si399075.exe oneetx.exe PID 3588 wrote to memory of 1052 3588 si399075.exe oneetx.exe PID 3588 wrote to memory of 1052 3588 si399075.exe oneetx.exe PID 1052 wrote to memory of 3520 1052 oneetx.exe schtasks.exe PID 1052 wrote to memory of 3520 1052 oneetx.exe schtasks.exe PID 1052 wrote to memory of 3520 1052 oneetx.exe schtasks.exe PID 1052 wrote to memory of 1600 1052 oneetx.exe rundll32.exe PID 1052 wrote to memory of 1600 1052 oneetx.exe rundll32.exe PID 1052 wrote to memory of 1600 1052 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4abe3c9af1477bd8c7ce1ebdd2b30bba9510c0d6c7eaecd2dd926780aaf670c.exe"C:\Users\Admin\AppData\Local\Temp\b4abe3c9af1477bd8c7ce1ebdd2b30bba9510c0d6c7eaecd2dd926780aaf670c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un865283.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un865283.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un193903.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un193903.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr117472.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr117472.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 10805⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu821430.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu821430.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 18645⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk572988.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk572988.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si399075.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si399075.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 7723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 7963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 9723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 9763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 9963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 12163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 12043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 8444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 8924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 11324⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 10004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 7764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 7684⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 13244⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 10884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 16044⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 15644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 16204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 14243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1056 -ip 10561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3872 -ip 38721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3588 -ip 35881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3588 -ip 35881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3588 -ip 35881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3588 -ip 35881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3588 -ip 35881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3588 -ip 35881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3588 -ip 35881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3588 -ip 35881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3588 -ip 35881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3588 -ip 35881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1052 -ip 10521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1052 -ip 10521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1052 -ip 10521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1052 -ip 10521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1052 -ip 10521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1052 -ip 10521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1052 -ip 10521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1052 -ip 10521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1052 -ip 10521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1052 -ip 10521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1052 -ip 10521⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4360 -ip 43601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1052 -ip 10521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1052 -ip 10521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1052 -ip 10521⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 2162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2444 -ip 24441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1052 -ip 10521⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si399075.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si399075.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un865283.exeFilesize
674KB
MD5764e0a49ef802db6219a275a6afa4589
SHA1b46b2f1c3299fc58927dca51c2957f79ae1427b8
SHA256317c00353fb80a314fcd1dcc1f3b7545cfe764d14350fe0974cbf56e844f968a
SHA5124520b7218b037364b677ad9a8b48a2480f6061b9aa084b6eb999bc0680898f469e1fe60997c1dd160aabcad5d7dbea55be2994c40c3f2d17bbe76a0999e9493d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un865283.exeFilesize
674KB
MD5764e0a49ef802db6219a275a6afa4589
SHA1b46b2f1c3299fc58927dca51c2957f79ae1427b8
SHA256317c00353fb80a314fcd1dcc1f3b7545cfe764d14350fe0974cbf56e844f968a
SHA5124520b7218b037364b677ad9a8b48a2480f6061b9aa084b6eb999bc0680898f469e1fe60997c1dd160aabcad5d7dbea55be2994c40c3f2d17bbe76a0999e9493d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk572988.exeFilesize
169KB
MD548e9e482c1ed8706428bc3bcddef5323
SHA102d107d23d1d41ea1f02182994be2f6cdb2eea92
SHA2560a18ca7ea21e7fa214f4f5b4e9764c7cb078932bd6eabc2e98e2417ced844851
SHA512c6abd69d321253a5e8039e1af100ea4234404ba67fed4e0213c2e90dec642c1b5fc9055ae4fec972521b025c8d721b2cc4761ef3c02f957fb415fc40ba623a5b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk572988.exeFilesize
169KB
MD548e9e482c1ed8706428bc3bcddef5323
SHA102d107d23d1d41ea1f02182994be2f6cdb2eea92
SHA2560a18ca7ea21e7fa214f4f5b4e9764c7cb078932bd6eabc2e98e2417ced844851
SHA512c6abd69d321253a5e8039e1af100ea4234404ba67fed4e0213c2e90dec642c1b5fc9055ae4fec972521b025c8d721b2cc4761ef3c02f957fb415fc40ba623a5b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un193903.exeFilesize
520KB
MD569319b7e582d17ded33b716d157f1f6a
SHA11928b2046d7c1f20f65807cd7a84b8985bb5058d
SHA256e79ab2bd8cb06d721cb5d97ba96c25023420ae66460813a2ae46bbe3d8161377
SHA5121d536e831aba35c003badbe26c9effefb1bc8791e56f8b7bfe68a5b832793fd38a0af2f08561c79e271d9f67429b597e85ec53957715200141f4a993adfe83e4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un193903.exeFilesize
520KB
MD569319b7e582d17ded33b716d157f1f6a
SHA11928b2046d7c1f20f65807cd7a84b8985bb5058d
SHA256e79ab2bd8cb06d721cb5d97ba96c25023420ae66460813a2ae46bbe3d8161377
SHA5121d536e831aba35c003badbe26c9effefb1bc8791e56f8b7bfe68a5b832793fd38a0af2f08561c79e271d9f67429b597e85ec53957715200141f4a993adfe83e4
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr117472.exeFilesize
239KB
MD56958bc152cc5ffb032593300088a6bbd
SHA132d7096e4da13d58759b392239ab120a2706ac1d
SHA2568077c8e0efae5a5ee9723daa9cb87b3de4480d71e95f0a81d285d3a399e98f9f
SHA512c384d75ad78279e183a55463b9058df33156d4b16c18dc3023e28fe1e68f76f9a9e832cc2ea49a7c590c2c1363b50d7bbcd23172b6904b7d11f6a33adbde3d10
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr117472.exeFilesize
239KB
MD56958bc152cc5ffb032593300088a6bbd
SHA132d7096e4da13d58759b392239ab120a2706ac1d
SHA2568077c8e0efae5a5ee9723daa9cb87b3de4480d71e95f0a81d285d3a399e98f9f
SHA512c384d75ad78279e183a55463b9058df33156d4b16c18dc3023e28fe1e68f76f9a9e832cc2ea49a7c590c2c1363b50d7bbcd23172b6904b7d11f6a33adbde3d10
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu821430.exeFilesize
297KB
MD5ad5b07a8807b458371c129757cf4fb28
SHA17c32426092420a35f39f212ca8640499fd46ea17
SHA2563a4be7a36d4c92dfd296b7324ee83fb1a21d1ac4d7caf69ac7fc3bdf7d3d9c45
SHA51223d383453a41b187717d8f8d2f624c642022fffc9b0236deff4e77fe04b08b178924be1581c3081bceb2c38a2654c5ee73c595f83820ff14c201ce4727d7c97f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu821430.exeFilesize
297KB
MD5ad5b07a8807b458371c129757cf4fb28
SHA17c32426092420a35f39f212ca8640499fd46ea17
SHA2563a4be7a36d4c92dfd296b7324ee83fb1a21d1ac4d7caf69ac7fc3bdf7d3d9c45
SHA51223d383453a41b187717d8f8d2f624c642022fffc9b0236deff4e77fe04b08b178924be1581c3081bceb2c38a2654c5ee73c595f83820ff14c201ce4727d7c97f
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1056-157-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/1056-174-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/1056-178-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/1056-180-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/1056-182-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/1056-184-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/1056-185-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1056-186-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1056-187-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1056-188-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/1056-189-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1056-190-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1056-191-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1056-193-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/1056-155-0x0000000000580000-0x00000000005AD000-memory.dmpFilesize
180KB
-
memory/1056-176-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/1056-172-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/1056-170-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/1056-168-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/1056-166-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/1056-164-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/1056-162-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/1056-160-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/1056-158-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/1056-156-0x0000000004C10000-0x00000000051B4000-memory.dmpFilesize
5.6MB
-
memory/2224-1129-0x0000000004FE0000-0x0000000004FF0000-memory.dmpFilesize
64KB
-
memory/2224-1128-0x00000000006D0000-0x0000000000700000-memory.dmpFilesize
192KB
-
memory/2224-1131-0x0000000004FE0000-0x0000000004FF0000-memory.dmpFilesize
64KB
-
memory/3588-1136-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/3872-209-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-227-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-229-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-231-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-332-0x00000000004C0000-0x000000000050B000-memory.dmpFilesize
300KB
-
memory/3872-334-0x0000000002150000-0x0000000002160000-memory.dmpFilesize
64KB
-
memory/3872-336-0x0000000002150000-0x0000000002160000-memory.dmpFilesize
64KB
-
memory/3872-1107-0x00000000050C0000-0x00000000056D8000-memory.dmpFilesize
6.1MB
-
memory/3872-1108-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/3872-1109-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/3872-1110-0x0000000002150000-0x0000000002160000-memory.dmpFilesize
64KB
-
memory/3872-1111-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/3872-1112-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/3872-1113-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/3872-1115-0x0000000006470000-0x0000000006632000-memory.dmpFilesize
1.8MB
-
memory/3872-1116-0x0000000006680000-0x0000000006BAC000-memory.dmpFilesize
5.2MB
-
memory/3872-1117-0x0000000002150000-0x0000000002160000-memory.dmpFilesize
64KB
-
memory/3872-1118-0x0000000002150000-0x0000000002160000-memory.dmpFilesize
64KB
-
memory/3872-1119-0x0000000002150000-0x0000000002160000-memory.dmpFilesize
64KB
-
memory/3872-225-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-223-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-221-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-219-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-217-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-215-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-213-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-211-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-207-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-205-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-203-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-201-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-199-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-198-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/3872-1120-0x0000000002150000-0x0000000002160000-memory.dmpFilesize
64KB
-
memory/3872-1121-0x0000000007FB0000-0x0000000008026000-memory.dmpFilesize
472KB
-
memory/3872-1122-0x0000000008030000-0x0000000008080000-memory.dmpFilesize
320KB