Analysis
-
max time kernel
144s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 20:56
Static task
static1
General
-
Target
cd69f6827ee998d4b6c0b40fdfb225336d71c44201fabfc85e832abce322fb55.exe
-
Size
939KB
-
MD5
a2e3fb2614d5a88c2ca5a69ad2c3728f
-
SHA1
70770255a7901d7818c6f02a910d9e858bf5ce4c
-
SHA256
cd69f6827ee998d4b6c0b40fdfb225336d71c44201fabfc85e832abce322fb55
-
SHA512
5156300400462154521b17f114ad9ab3fd129d59af1fdaa31a745946670d79ec3067bfdadee68dd4bcbb6aaec266150cc6254a4b9b480bb8b7ad5154a8b1cb5e
-
SSDEEP
12288:zMryy90N81qYNQ4XGyGEmZucSxvexQSJb5w5BqPKoCLLIPUdZXm2V7Ll3dl7SSNB:hyIOQ2GyGEGSCgQPgLLIPULmm3jSGYA
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
pr803901.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr803901.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr803901.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr803901.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr803901.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr803901.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr803901.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2124-199-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2124-200-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2124-202-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2124-204-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2124-208-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2124-209-0x0000000004B10000-0x0000000004B20000-memory.dmp family_redline behavioral1/memory/2124-211-0x0000000004B10000-0x0000000004B20000-memory.dmp family_redline behavioral1/memory/2124-212-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2124-214-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2124-216-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2124-218-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2124-220-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2124-222-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2124-224-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2124-226-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2124-228-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2124-230-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2124-232-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2124-234-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
oneetx.exesi914227.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation si914227.exe -
Executes dropped EXE 9 IoCs
Processes:
un429917.exeun881757.exepr803901.exequ984665.exerk566206.exesi914227.exeoneetx.exeoneetx.exeoneetx.exepid process 5056 un429917.exe 4864 un881757.exe 5036 pr803901.exe 2124 qu984665.exe 2404 rk566206.exe 2716 si914227.exe 4584 oneetx.exe 1376 oneetx.exe 4868 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 980 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pr803901.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr803901.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr803901.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
cd69f6827ee998d4b6c0b40fdfb225336d71c44201fabfc85e832abce322fb55.exeun429917.exeun881757.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cd69f6827ee998d4b6c0b40fdfb225336d71c44201fabfc85e832abce322fb55.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un429917.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un429917.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un881757.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un881757.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cd69f6827ee998d4b6c0b40fdfb225336d71c44201fabfc85e832abce322fb55.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 29 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2112 5036 WerFault.exe pr803901.exe 4072 2124 WerFault.exe qu984665.exe 4772 2716 WerFault.exe si914227.exe 4908 2716 WerFault.exe si914227.exe 4368 2716 WerFault.exe si914227.exe 3860 2716 WerFault.exe si914227.exe 3812 2716 WerFault.exe si914227.exe 4948 2716 WerFault.exe si914227.exe 484 2716 WerFault.exe si914227.exe 1084 2716 WerFault.exe si914227.exe 1724 2716 WerFault.exe si914227.exe 3840 2716 WerFault.exe si914227.exe 3228 4584 WerFault.exe oneetx.exe 5100 4584 WerFault.exe oneetx.exe 3536 4584 WerFault.exe oneetx.exe 1176 4584 WerFault.exe oneetx.exe 5068 4584 WerFault.exe oneetx.exe 3960 4584 WerFault.exe oneetx.exe 336 4584 WerFault.exe oneetx.exe 3428 4584 WerFault.exe oneetx.exe 3932 4584 WerFault.exe oneetx.exe 3808 4584 WerFault.exe oneetx.exe 3440 4584 WerFault.exe oneetx.exe 2972 4584 WerFault.exe oneetx.exe 4856 1376 WerFault.exe oneetx.exe 2176 4584 WerFault.exe oneetx.exe 3984 4584 WerFault.exe oneetx.exe 3656 4584 WerFault.exe oneetx.exe 4232 4868 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pr803901.exequ984665.exerk566206.exepid process 5036 pr803901.exe 5036 pr803901.exe 2124 qu984665.exe 2124 qu984665.exe 2404 rk566206.exe 2404 rk566206.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pr803901.exequ984665.exerk566206.exedescription pid process Token: SeDebugPrivilege 5036 pr803901.exe Token: SeDebugPrivilege 2124 qu984665.exe Token: SeDebugPrivilege 2404 rk566206.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
si914227.exepid process 2716 si914227.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
cd69f6827ee998d4b6c0b40fdfb225336d71c44201fabfc85e832abce322fb55.exeun429917.exeun881757.exesi914227.exeoneetx.exedescription pid process target process PID 3924 wrote to memory of 5056 3924 cd69f6827ee998d4b6c0b40fdfb225336d71c44201fabfc85e832abce322fb55.exe un429917.exe PID 3924 wrote to memory of 5056 3924 cd69f6827ee998d4b6c0b40fdfb225336d71c44201fabfc85e832abce322fb55.exe un429917.exe PID 3924 wrote to memory of 5056 3924 cd69f6827ee998d4b6c0b40fdfb225336d71c44201fabfc85e832abce322fb55.exe un429917.exe PID 5056 wrote to memory of 4864 5056 un429917.exe un881757.exe PID 5056 wrote to memory of 4864 5056 un429917.exe un881757.exe PID 5056 wrote to memory of 4864 5056 un429917.exe un881757.exe PID 4864 wrote to memory of 5036 4864 un881757.exe pr803901.exe PID 4864 wrote to memory of 5036 4864 un881757.exe pr803901.exe PID 4864 wrote to memory of 5036 4864 un881757.exe pr803901.exe PID 4864 wrote to memory of 2124 4864 un881757.exe qu984665.exe PID 4864 wrote to memory of 2124 4864 un881757.exe qu984665.exe PID 4864 wrote to memory of 2124 4864 un881757.exe qu984665.exe PID 5056 wrote to memory of 2404 5056 un429917.exe rk566206.exe PID 5056 wrote to memory of 2404 5056 un429917.exe rk566206.exe PID 5056 wrote to memory of 2404 5056 un429917.exe rk566206.exe PID 3924 wrote to memory of 2716 3924 cd69f6827ee998d4b6c0b40fdfb225336d71c44201fabfc85e832abce322fb55.exe si914227.exe PID 3924 wrote to memory of 2716 3924 cd69f6827ee998d4b6c0b40fdfb225336d71c44201fabfc85e832abce322fb55.exe si914227.exe PID 3924 wrote to memory of 2716 3924 cd69f6827ee998d4b6c0b40fdfb225336d71c44201fabfc85e832abce322fb55.exe si914227.exe PID 2716 wrote to memory of 4584 2716 si914227.exe oneetx.exe PID 2716 wrote to memory of 4584 2716 si914227.exe oneetx.exe PID 2716 wrote to memory of 4584 2716 si914227.exe oneetx.exe PID 4584 wrote to memory of 4500 4584 oneetx.exe schtasks.exe PID 4584 wrote to memory of 4500 4584 oneetx.exe schtasks.exe PID 4584 wrote to memory of 4500 4584 oneetx.exe schtasks.exe PID 4584 wrote to memory of 980 4584 oneetx.exe rundll32.exe PID 4584 wrote to memory of 980 4584 oneetx.exe rundll32.exe PID 4584 wrote to memory of 980 4584 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd69f6827ee998d4b6c0b40fdfb225336d71c44201fabfc85e832abce322fb55.exe"C:\Users\Admin\AppData\Local\Temp\cd69f6827ee998d4b6c0b40fdfb225336d71c44201fabfc85e832abce322fb55.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un429917.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un429917.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un881757.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un881757.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr803901.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr803901.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 10285⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu984665.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu984665.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 13485⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk566206.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk566206.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si914227.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si914227.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 7683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 9563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 9883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 9883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 12043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 12243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 8484⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 8764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 10884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 10884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 10764⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 9924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 12524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 7804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 8444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 14324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 10644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 16484⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 14404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 8643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5036 -ip 50361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2124 -ip 21241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2716 -ip 27161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2716 -ip 27161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2716 -ip 27161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2716 -ip 27161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2716 -ip 27161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2716 -ip 27161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2716 -ip 27161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2716 -ip 27161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2716 -ip 27161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2716 -ip 27161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4584 -ip 45841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4584 -ip 45841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4584 -ip 45841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4584 -ip 45841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4584 -ip 45841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 4584 -ip 45841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4584 -ip 45841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4584 -ip 45841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4584 -ip 45841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4584 -ip 45841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4584 -ip 45841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4584 -ip 45841⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 2162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1376 -ip 13761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4584 -ip 45841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4584 -ip 45841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4584 -ip 45841⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4868 -ip 48681⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si914227.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si914227.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un429917.exeFilesize
674KB
MD51d895cad4e6d0d8846ae7bee04d9d89a
SHA1661e0cfd1c35ef5e1194ace01797fcd09a217ab1
SHA256bb67926b586a2273f9110b6193982cb15bfe3f280d2fd4fc43ebb20b291bdca5
SHA51272594223a3b3cd1d16eb7e89b40ff3e16d67e39703fc32992d33e9d83d1ea16fe63e12c214adfd284eface35c7edf6f77dc1d4a04fb05a1c32383aa57ef02c21
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un429917.exeFilesize
674KB
MD51d895cad4e6d0d8846ae7bee04d9d89a
SHA1661e0cfd1c35ef5e1194ace01797fcd09a217ab1
SHA256bb67926b586a2273f9110b6193982cb15bfe3f280d2fd4fc43ebb20b291bdca5
SHA51272594223a3b3cd1d16eb7e89b40ff3e16d67e39703fc32992d33e9d83d1ea16fe63e12c214adfd284eface35c7edf6f77dc1d4a04fb05a1c32383aa57ef02c21
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk566206.exeFilesize
169KB
MD538a9d892b12209809fe48be8685b934c
SHA1c2508e32c23fb932a31f7179dd221dc45f7efbd5
SHA256c47627f1f3111e8baeab7b81c8facf36c275381357bd014a4be3cf63ff690b11
SHA5120e4f17fde678e9fa51b37e557f3ca2c33aa3c960cd61213e3c481f0b9746b3e92cc3d1eb06d5a499b64c6b0ba5bfe75ac97045c8a41a47417c5bdf377a631ea6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk566206.exeFilesize
169KB
MD538a9d892b12209809fe48be8685b934c
SHA1c2508e32c23fb932a31f7179dd221dc45f7efbd5
SHA256c47627f1f3111e8baeab7b81c8facf36c275381357bd014a4be3cf63ff690b11
SHA5120e4f17fde678e9fa51b37e557f3ca2c33aa3c960cd61213e3c481f0b9746b3e92cc3d1eb06d5a499b64c6b0ba5bfe75ac97045c8a41a47417c5bdf377a631ea6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un881757.exeFilesize
520KB
MD52f80504da72d995cd5a5664c05a5799e
SHA120908d24249205847eb11b29e776bb3c4f639e71
SHA256279d21fb4245e8917c2333b73b88c3867fc40be35e301505ca5003023ed1f5b9
SHA512b924f54bd6f3095ab2b442a9e829d79336ef5420d5aa4582cdc66fe185d03ab92abae1886f5200b8439a7700139705f9ec617a6f5f85fe3fb9e4897c0e6f1221
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un881757.exeFilesize
520KB
MD52f80504da72d995cd5a5664c05a5799e
SHA120908d24249205847eb11b29e776bb3c4f639e71
SHA256279d21fb4245e8917c2333b73b88c3867fc40be35e301505ca5003023ed1f5b9
SHA512b924f54bd6f3095ab2b442a9e829d79336ef5420d5aa4582cdc66fe185d03ab92abae1886f5200b8439a7700139705f9ec617a6f5f85fe3fb9e4897c0e6f1221
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr803901.exeFilesize
239KB
MD51478f9060d540b9ce778d950d6270998
SHA197561fc9b9c9c0efb63db36a642abec79dbeb0ec
SHA256376d1f9dc72e801b9a1fae999033d9a33c2d6685fbb7ec3d6f232b88121a6398
SHA512a3f58495f76c88b9270a7840db1c6a0cb6255ac54632062ef441e00f31b64178d90466f0c64da558ad5049cf88b069acecfb4e9b8450f027d55a097892faa878
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr803901.exeFilesize
239KB
MD51478f9060d540b9ce778d950d6270998
SHA197561fc9b9c9c0efb63db36a642abec79dbeb0ec
SHA256376d1f9dc72e801b9a1fae999033d9a33c2d6685fbb7ec3d6f232b88121a6398
SHA512a3f58495f76c88b9270a7840db1c6a0cb6255ac54632062ef441e00f31b64178d90466f0c64da558ad5049cf88b069acecfb4e9b8450f027d55a097892faa878
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu984665.exeFilesize
297KB
MD592fc92805b133128a079ec9612be9819
SHA108bfd4d34fb1b5bf4b88b8bfd35f3fb778c9ced8
SHA25609a66e9607a8fc8395e9d7da72d4a08b490db73424446e3f8de01b3d6754767e
SHA5121655a621d9900bcd2b3cccf997ea3a7c5e1c3429edca8f459c3ed15ad2982c12985c971551c6d1a968fa93493be80c33ec27c1fcca157c28135cc3d6ad44964a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu984665.exeFilesize
297KB
MD592fc92805b133128a079ec9612be9819
SHA108bfd4d34fb1b5bf4b88b8bfd35f3fb778c9ced8
SHA25609a66e9607a8fc8395e9d7da72d4a08b490db73424446e3f8de01b3d6754767e
SHA5121655a621d9900bcd2b3cccf997ea3a7c5e1c3429edca8f459c3ed15ad2982c12985c971551c6d1a968fa93493be80c33ec27c1fcca157c28135cc3d6ad44964a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/2124-1119-0x0000000004B10000-0x0000000004B20000-memory.dmpFilesize
64KB
-
memory/2124-232-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2124-1124-0x0000000006FC0000-0x0000000007010000-memory.dmpFilesize
320KB
-
memory/2124-1123-0x0000000006F40000-0x0000000006FB6000-memory.dmpFilesize
472KB
-
memory/2124-1122-0x0000000004B10000-0x0000000004B20000-memory.dmpFilesize
64KB
-
memory/2124-1120-0x0000000004B10000-0x0000000004B20000-memory.dmpFilesize
64KB
-
memory/2124-1121-0x0000000004B10000-0x0000000004B20000-memory.dmpFilesize
64KB
-
memory/2124-1118-0x0000000006680000-0x0000000006BAC000-memory.dmpFilesize
5.2MB
-
memory/2124-1117-0x00000000064B0000-0x0000000006672000-memory.dmpFilesize
1.8MB
-
memory/2124-1116-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/2124-1114-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/2124-1113-0x0000000004B10000-0x0000000004B20000-memory.dmpFilesize
64KB
-
memory/2124-199-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2124-200-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2124-202-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2124-204-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2124-205-0x0000000001E70000-0x0000000001EBB000-memory.dmpFilesize
300KB
-
memory/2124-208-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2124-209-0x0000000004B10000-0x0000000004B20000-memory.dmpFilesize
64KB
-
memory/2124-211-0x0000000004B10000-0x0000000004B20000-memory.dmpFilesize
64KB
-
memory/2124-207-0x0000000004B10000-0x0000000004B20000-memory.dmpFilesize
64KB
-
memory/2124-212-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2124-214-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2124-216-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2124-218-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2124-220-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2124-222-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2124-224-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2124-226-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2124-228-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2124-230-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2124-1112-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/2124-234-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2124-1109-0x0000000005210000-0x0000000005828000-memory.dmpFilesize
6.1MB
-
memory/2124-1110-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/2124-1111-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/2404-1130-0x00000000008A0000-0x00000000008D0000-memory.dmpFilesize
192KB
-
memory/2404-1131-0x0000000005070000-0x0000000005080000-memory.dmpFilesize
64KB
-
memory/2716-1137-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/5036-189-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/5036-169-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5036-190-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/5036-175-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5036-181-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5036-188-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/5036-187-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5036-185-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5036-183-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5036-173-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5036-171-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5036-193-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/5036-179-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5036-191-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/5036-165-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5036-177-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5036-167-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5036-163-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5036-161-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5036-160-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5036-159-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/5036-158-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/5036-157-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/5036-156-0x0000000000590000-0x00000000005BD000-memory.dmpFilesize
180KB
-
memory/5036-155-0x0000000004BF0000-0x0000000005194000-memory.dmpFilesize
5.6MB