Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
14-04-2023 08:56
Static task
static1
General
-
Target
844336701be3388c4b86a6bf6e5aaf06a4a533df6198bab420e3de51bc2028de.exe
-
Size
1.0MB
-
MD5
0818690cc1efddfcce820bbb94145922
-
SHA1
3e681fc1abdcec6143ac2d10f25db04878fdc9bd
-
SHA256
844336701be3388c4b86a6bf6e5aaf06a4a533df6198bab420e3de51bc2028de
-
SHA512
b062cff2cb676c1c4450f91561b1d871b2353a03f4311765958547fbe8ff119d40a8d117c63dc733c263ccfd3f4e5a721f77e22c4dcac3a84533cca0009c261c
-
SSDEEP
24576:Py2CRwvLT4FTYy/tAg74Kj1E91wUBcUX06B9d5P0NcuQ+McTf:a2hvLT4FTYy/J74Kj1AC2NBn5s4e
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
disa
185.161.248.90:4125
-
auth_value
93f8c4ca7000e3381dd4b6b86434de05
Signatures
-
Processes:
it858013.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it858013.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it858013.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it858013.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it858013.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it858013.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it858013.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
jr991300.exelr928101.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation jr991300.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation lr928101.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 10 IoCs
Processes:
ziHF0557.exezimC4907.exeit858013.exejr991300.exe1.exekp617406.exelr928101.exeoneetx.exeoneetx.exeoneetx.exepid process 540 ziHF0557.exe 2556 zimC4907.exe 1424 it858013.exe 644 jr991300.exe 4156 1.exe 936 kp617406.exe 4848 lr928101.exe 1500 oneetx.exe 4312 oneetx.exe 3900 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1796 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it858013.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it858013.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
844336701be3388c4b86a6bf6e5aaf06a4a533df6198bab420e3de51bc2028de.exeziHF0557.exezimC4907.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 844336701be3388c4b86a6bf6e5aaf06a4a533df6198bab420e3de51bc2028de.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 844336701be3388c4b86a6bf6e5aaf06a4a533df6198bab420e3de51bc2028de.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziHF0557.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziHF0557.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zimC4907.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zimC4907.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 27 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1004 4848 WerFault.exe lr928101.exe 4996 4848 WerFault.exe lr928101.exe 4964 4848 WerFault.exe lr928101.exe 1572 4848 WerFault.exe lr928101.exe 4452 4848 WerFault.exe lr928101.exe 440 4848 WerFault.exe lr928101.exe 836 4848 WerFault.exe lr928101.exe 3140 4848 WerFault.exe lr928101.exe 2144 4848 WerFault.exe lr928101.exe 2064 4848 WerFault.exe lr928101.exe 2004 1500 WerFault.exe oneetx.exe 4524 1500 WerFault.exe oneetx.exe 4688 1500 WerFault.exe oneetx.exe 4992 1500 WerFault.exe oneetx.exe 2828 1500 WerFault.exe oneetx.exe 3672 1500 WerFault.exe oneetx.exe 4124 1500 WerFault.exe oneetx.exe 4564 1500 WerFault.exe oneetx.exe 2556 1500 WerFault.exe oneetx.exe 2744 1500 WerFault.exe oneetx.exe 5056 1500 WerFault.exe oneetx.exe 4856 1500 WerFault.exe oneetx.exe 4224 4312 WerFault.exe oneetx.exe 2688 1500 WerFault.exe oneetx.exe 3220 1500 WerFault.exe oneetx.exe 4452 1500 WerFault.exe oneetx.exe 4940 3900 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it858013.exekp617406.exe1.exepid process 1424 it858013.exe 1424 it858013.exe 936 kp617406.exe 4156 1.exe 936 kp617406.exe 4156 1.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
it858013.exejr991300.exekp617406.exe1.exedescription pid process Token: SeDebugPrivilege 1424 it858013.exe Token: SeDebugPrivilege 644 jr991300.exe Token: SeDebugPrivilege 936 kp617406.exe Token: SeDebugPrivilege 4156 1.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr928101.exepid process 4848 lr928101.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
844336701be3388c4b86a6bf6e5aaf06a4a533df6198bab420e3de51bc2028de.exeziHF0557.exezimC4907.exejr991300.exelr928101.exeoneetx.exedescription pid process target process PID 4168 wrote to memory of 540 4168 844336701be3388c4b86a6bf6e5aaf06a4a533df6198bab420e3de51bc2028de.exe ziHF0557.exe PID 4168 wrote to memory of 540 4168 844336701be3388c4b86a6bf6e5aaf06a4a533df6198bab420e3de51bc2028de.exe ziHF0557.exe PID 4168 wrote to memory of 540 4168 844336701be3388c4b86a6bf6e5aaf06a4a533df6198bab420e3de51bc2028de.exe ziHF0557.exe PID 540 wrote to memory of 2556 540 ziHF0557.exe zimC4907.exe PID 540 wrote to memory of 2556 540 ziHF0557.exe zimC4907.exe PID 540 wrote to memory of 2556 540 ziHF0557.exe zimC4907.exe PID 2556 wrote to memory of 1424 2556 zimC4907.exe it858013.exe PID 2556 wrote to memory of 1424 2556 zimC4907.exe it858013.exe PID 2556 wrote to memory of 644 2556 zimC4907.exe jr991300.exe PID 2556 wrote to memory of 644 2556 zimC4907.exe jr991300.exe PID 2556 wrote to memory of 644 2556 zimC4907.exe jr991300.exe PID 644 wrote to memory of 4156 644 jr991300.exe 1.exe PID 644 wrote to memory of 4156 644 jr991300.exe 1.exe PID 644 wrote to memory of 4156 644 jr991300.exe 1.exe PID 540 wrote to memory of 936 540 ziHF0557.exe kp617406.exe PID 540 wrote to memory of 936 540 ziHF0557.exe kp617406.exe PID 540 wrote to memory of 936 540 ziHF0557.exe kp617406.exe PID 4168 wrote to memory of 4848 4168 844336701be3388c4b86a6bf6e5aaf06a4a533df6198bab420e3de51bc2028de.exe lr928101.exe PID 4168 wrote to memory of 4848 4168 844336701be3388c4b86a6bf6e5aaf06a4a533df6198bab420e3de51bc2028de.exe lr928101.exe PID 4168 wrote to memory of 4848 4168 844336701be3388c4b86a6bf6e5aaf06a4a533df6198bab420e3de51bc2028de.exe lr928101.exe PID 4848 wrote to memory of 1500 4848 lr928101.exe oneetx.exe PID 4848 wrote to memory of 1500 4848 lr928101.exe oneetx.exe PID 4848 wrote to memory of 1500 4848 lr928101.exe oneetx.exe PID 1500 wrote to memory of 3880 1500 oneetx.exe schtasks.exe PID 1500 wrote to memory of 3880 1500 oneetx.exe schtasks.exe PID 1500 wrote to memory of 3880 1500 oneetx.exe schtasks.exe PID 1500 wrote to memory of 1796 1500 oneetx.exe rundll32.exe PID 1500 wrote to memory of 1796 1500 oneetx.exe rundll32.exe PID 1500 wrote to memory of 1796 1500 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\844336701be3388c4b86a6bf6e5aaf06a4a533df6198bab420e3de51bc2028de.exe"C:\Users\Admin\AppData\Local\Temp\844336701be3388c4b86a6bf6e5aaf06a4a533df6198bab420e3de51bc2028de.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHF0557.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHF0557.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zimC4907.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zimC4907.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it858013.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it858013.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr991300.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr991300.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp617406.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp617406.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr928101.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr928101.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 7003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 7683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 8003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 8043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 9723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 9723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 12123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 12683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 13243⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 6964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 8884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 8844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 10564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 10764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 10764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 11444⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 10124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 7484⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 7604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 10084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 11284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 16284⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 11124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 15524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 7523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4848 -ip 48481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4848 -ip 48481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4848 -ip 48481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4848 -ip 48481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4848 -ip 48481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4848 -ip 48481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4848 -ip 48481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4848 -ip 48481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4848 -ip 48481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4848 -ip 48481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1500 -ip 15001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1500 -ip 15001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1500 -ip 15001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1500 -ip 15001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1500 -ip 15001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1500 -ip 15001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1500 -ip 15001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1500 -ip 15001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1500 -ip 15001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1500 -ip 15001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1500 -ip 15001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1500 -ip 15001⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4312 -ip 43121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1500 -ip 15001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1500 -ip 15001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1500 -ip 15001⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3900 -ip 39001⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
397KB
MD5dadc0d126524e7b28aab58226127e8a6
SHA1a383b6f22bbb8056ad743543ad54ef1707b1493a
SHA256af557e2b8545e0ae5ffb362c04a48e338b99c5e0d6227a35054581fe2075f5d8
SHA512dbafe7ad76989eb410064ac380ee2fb8494421cbd0e780663cab9eaed3f758325ce224dfd9bf16561081705c41bf903fd3d84db56148d6a5451c5a850ca59117
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
397KB
MD5dadc0d126524e7b28aab58226127e8a6
SHA1a383b6f22bbb8056ad743543ad54ef1707b1493a
SHA256af557e2b8545e0ae5ffb362c04a48e338b99c5e0d6227a35054581fe2075f5d8
SHA512dbafe7ad76989eb410064ac380ee2fb8494421cbd0e780663cab9eaed3f758325ce224dfd9bf16561081705c41bf903fd3d84db56148d6a5451c5a850ca59117
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
397KB
MD5dadc0d126524e7b28aab58226127e8a6
SHA1a383b6f22bbb8056ad743543ad54ef1707b1493a
SHA256af557e2b8545e0ae5ffb362c04a48e338b99c5e0d6227a35054581fe2075f5d8
SHA512dbafe7ad76989eb410064ac380ee2fb8494421cbd0e780663cab9eaed3f758325ce224dfd9bf16561081705c41bf903fd3d84db56148d6a5451c5a850ca59117
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
397KB
MD5dadc0d126524e7b28aab58226127e8a6
SHA1a383b6f22bbb8056ad743543ad54ef1707b1493a
SHA256af557e2b8545e0ae5ffb362c04a48e338b99c5e0d6227a35054581fe2075f5d8
SHA512dbafe7ad76989eb410064ac380ee2fb8494421cbd0e780663cab9eaed3f758325ce224dfd9bf16561081705c41bf903fd3d84db56148d6a5451c5a850ca59117
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
397KB
MD5dadc0d126524e7b28aab58226127e8a6
SHA1a383b6f22bbb8056ad743543ad54ef1707b1493a
SHA256af557e2b8545e0ae5ffb362c04a48e338b99c5e0d6227a35054581fe2075f5d8
SHA512dbafe7ad76989eb410064ac380ee2fb8494421cbd0e780663cab9eaed3f758325ce224dfd9bf16561081705c41bf903fd3d84db56148d6a5451c5a850ca59117
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr928101.exeFilesize
397KB
MD5dadc0d126524e7b28aab58226127e8a6
SHA1a383b6f22bbb8056ad743543ad54ef1707b1493a
SHA256af557e2b8545e0ae5ffb362c04a48e338b99c5e0d6227a35054581fe2075f5d8
SHA512dbafe7ad76989eb410064ac380ee2fb8494421cbd0e780663cab9eaed3f758325ce224dfd9bf16561081705c41bf903fd3d84db56148d6a5451c5a850ca59117
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr928101.exeFilesize
397KB
MD5dadc0d126524e7b28aab58226127e8a6
SHA1a383b6f22bbb8056ad743543ad54ef1707b1493a
SHA256af557e2b8545e0ae5ffb362c04a48e338b99c5e0d6227a35054581fe2075f5d8
SHA512dbafe7ad76989eb410064ac380ee2fb8494421cbd0e780663cab9eaed3f758325ce224dfd9bf16561081705c41bf903fd3d84db56148d6a5451c5a850ca59117
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHF0557.exeFilesize
724KB
MD500d68e7ce56db2b39eee409c1bbde7a7
SHA1a0e333cbf47e9967235588066cf13640d4b7cef5
SHA2560026c5231dfd8de11b96b7fe5ccab54e6cdf0627ff6b94254a12adc456c99a7a
SHA512663881f765c0debf108a400cb4f3dff0605e4851c40aaa4d22d2836d0c0f20176930678134f161df56a1df4b158cd0d62d7cb717a79566c6d4afa6c9a6ead242
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHF0557.exeFilesize
724KB
MD500d68e7ce56db2b39eee409c1bbde7a7
SHA1a0e333cbf47e9967235588066cf13640d4b7cef5
SHA2560026c5231dfd8de11b96b7fe5ccab54e6cdf0627ff6b94254a12adc456c99a7a
SHA512663881f765c0debf108a400cb4f3dff0605e4851c40aaa4d22d2836d0c0f20176930678134f161df56a1df4b158cd0d62d7cb717a79566c6d4afa6c9a6ead242
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp617406.exeFilesize
169KB
MD5669aee853566cbf1bfed3ccdb1266508
SHA1cdc76602c997c64bb79baf75e8ed5b7eab1c7dec
SHA2565539e730843387ea1cdbcf204915d8776fddd62064af1efd1f2f92d5d034da77
SHA512580a88065446dfe8339dd48c12cb8274c5a4dd1990508f135d01d89b381cbcc02b490f06ee54ea74fd9f869347de46e02b858c0e4581450d584330d982194077
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp617406.exeFilesize
169KB
MD5669aee853566cbf1bfed3ccdb1266508
SHA1cdc76602c997c64bb79baf75e8ed5b7eab1c7dec
SHA2565539e730843387ea1cdbcf204915d8776fddd62064af1efd1f2f92d5d034da77
SHA512580a88065446dfe8339dd48c12cb8274c5a4dd1990508f135d01d89b381cbcc02b490f06ee54ea74fd9f869347de46e02b858c0e4581450d584330d982194077
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zimC4907.exeFilesize
570KB
MD54161113f42af967dd1e5192003a0d60e
SHA192a6ae8454e8a1e1376b2ec5852d3370b3fc05f0
SHA2567f06b4d22ef4b2f6ab59e32fa62db7fc80f59ad8c092975d2b67afe48990f123
SHA5125dcc844c238693aff7b6d5382f9697b3495f0c66999ab6ba661e01b0a5db056d8bbda5e5065041670856de3ed3288320c4efd07ee3515fbb86855858fddc4610
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zimC4907.exeFilesize
570KB
MD54161113f42af967dd1e5192003a0d60e
SHA192a6ae8454e8a1e1376b2ec5852d3370b3fc05f0
SHA2567f06b4d22ef4b2f6ab59e32fa62db7fc80f59ad8c092975d2b67afe48990f123
SHA5125dcc844c238693aff7b6d5382f9697b3495f0c66999ab6ba661e01b0a5db056d8bbda5e5065041670856de3ed3288320c4efd07ee3515fbb86855858fddc4610
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it858013.exeFilesize
11KB
MD5da79d7584c838b8fb518181b99d7d104
SHA1811b40b7c2e23b021b2c9f25cec290590cc92e4a
SHA256a195e57f700aa491b3eb1cf2f84a98348251f69661fce9bf506ddd2620b97c9f
SHA512a3e3bdd1ec3e97af71ad7c547eae2d5960bf47b9e7a856fa24b772c1d6af02120b4d33bc3276a90490aef48b7187fb4ef0cfea0f9f5af3548f2758e9311f3160
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it858013.exeFilesize
11KB
MD5da79d7584c838b8fb518181b99d7d104
SHA1811b40b7c2e23b021b2c9f25cec290590cc92e4a
SHA256a195e57f700aa491b3eb1cf2f84a98348251f69661fce9bf506ddd2620b97c9f
SHA512a3e3bdd1ec3e97af71ad7c547eae2d5960bf47b9e7a856fa24b772c1d6af02120b4d33bc3276a90490aef48b7187fb4ef0cfea0f9f5af3548f2758e9311f3160
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr991300.exeFilesize
588KB
MD52887624971e1e06921d185e8787d9a2a
SHA1fe534828a5ae066c926ea000a7f2bfc93b0724fa
SHA2568e75baa81c3e9a8ae9775152d6e9b768464625830b5a5d302c9ad11c5a833743
SHA512b8e5fd9052a43cc09945a6cb7e89816cda5dd9d80a3c5d22f93898182da713a9eb341bc6ad54a37ab66491b9e4ecc701290dab544aaa0bfa4528f5e5a28341f5
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr991300.exeFilesize
588KB
MD52887624971e1e06921d185e8787d9a2a
SHA1fe534828a5ae066c926ea000a7f2bfc93b0724fa
SHA2568e75baa81c3e9a8ae9775152d6e9b768464625830b5a5d302c9ad11c5a833743
SHA512b8e5fd9052a43cc09945a6cb7e89816cda5dd9d80a3c5d22f93898182da713a9eb341bc6ad54a37ab66491b9e4ecc701290dab544aaa0bfa4528f5e5a28341f5
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
C:\Windows\Temp\1.exeFilesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1
-
C:\Windows\Temp\1.exeFilesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1
-
C:\Windows\Temp\1.exeFilesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1
-
memory/644-210-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-216-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-185-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/644-186-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-182-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-188-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-190-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-192-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-194-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-196-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-198-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-200-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-202-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-204-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-206-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-208-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-179-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-212-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-214-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-177-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-218-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-220-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-222-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-224-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-226-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-228-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-2315-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/644-160-0x0000000002460000-0x00000000024BB000-memory.dmpFilesize
364KB
-
memory/644-180-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/644-183-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/644-161-0x0000000005090000-0x0000000005634000-memory.dmpFilesize
5.6MB
-
memory/644-162-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-163-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-165-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-167-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-169-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-171-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-173-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/644-175-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/936-2325-0x0000000000A40000-0x0000000000A70000-memory.dmpFilesize
192KB
-
memory/936-2330-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/936-2336-0x0000000007010000-0x00000000071D2000-memory.dmpFilesize
1.8MB
-
memory/936-2338-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/936-2328-0x00000000053A0000-0x00000000053B2000-memory.dmpFilesize
72KB
-
memory/936-2329-0x0000000005400000-0x000000000543C000-memory.dmpFilesize
240KB
-
memory/936-2333-0x0000000005FC0000-0x0000000006052000-memory.dmpFilesize
584KB
-
memory/1424-154-0x0000000000C90000-0x0000000000C9A000-memory.dmpFilesize
40KB
-
memory/4156-2339-0x0000000004D10000-0x0000000004D20000-memory.dmpFilesize
64KB
-
memory/4156-2332-0x00000000050B0000-0x0000000005126000-memory.dmpFilesize
472KB
-
memory/4156-2331-0x0000000004D10000-0x0000000004D20000-memory.dmpFilesize
64KB
-
memory/4156-2334-0x0000000005270000-0x00000000052D6000-memory.dmpFilesize
408KB
-
memory/4156-2335-0x0000000005F50000-0x0000000005FA0000-memory.dmpFilesize
320KB
-
memory/4156-2327-0x0000000004E30000-0x0000000004F3A000-memory.dmpFilesize
1.0MB
-
memory/4156-2326-0x0000000005340000-0x0000000005958000-memory.dmpFilesize
6.1MB
-
memory/4156-2321-0x00000000003F0000-0x000000000041E000-memory.dmpFilesize
184KB
-
memory/4156-2337-0x00000000075D0000-0x0000000007AFC000-memory.dmpFilesize
5.2MB
-
memory/4848-2346-0x0000000000970000-0x00000000009AB000-memory.dmpFilesize
236KB