Analysis
-
max time kernel
147s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-04-2023 08:55
Static task
static1
General
-
Target
ec2e50191e546eff93e4f1a4d5b174b24ed3bd7e2bc3a8b5ab160b02cdb110fc.exe
-
Size
1.2MB
-
MD5
98ee98257027eabbd3233a1d2a18dc9f
-
SHA1
86c48903dbda2920587e1821202160a6265ef783
-
SHA256
ec2e50191e546eff93e4f1a4d5b174b24ed3bd7e2bc3a8b5ab160b02cdb110fc
-
SHA512
6dfdab47cb3b015d1a7db79a8a47ab1abc1c3620b3710334a145386015ab9094fe730b3e4e40cc67b687184a4eed11cbe5a74c478c4332f12d7f454238754c5e
-
SSDEEP
24576:2yBH7MhISguBa6xnuUDOG71n9NpOmvfmh3RINcEOik+yz:FBHqISfa6POG719HVmhGSViz
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
disa
185.161.248.90:4125
-
auth_value
93f8c4ca7000e3381dd4b6b86434de05
Signatures
-
Processes:
pr794170.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr794170.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr794170.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr794170.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr794170.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr794170.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr794170.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
qu145449.exesi300438.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation qu145449.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation si300438.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
un901768.exeun763126.exepr794170.exequ145449.exe1.exerk475817.exesi300438.exeoneetx.exeoneetx.exepid process 4232 un901768.exe 2912 un763126.exe 4368 pr794170.exe 4320 qu145449.exe 632 1.exe 4604 rk475817.exe 1676 si300438.exe 3228 oneetx.exe 448 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3204 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pr794170.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr794170.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr794170.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
ec2e50191e546eff93e4f1a4d5b174b24ed3bd7e2bc3a8b5ab160b02cdb110fc.exeun901768.exeun763126.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ec2e50191e546eff93e4f1a4d5b174b24ed3bd7e2bc3a8b5ab160b02cdb110fc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un901768.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un901768.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un763126.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un763126.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ec2e50191e546eff93e4f1a4d5b174b24ed3bd7e2bc3a8b5ab160b02cdb110fc.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 27 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4580 1676 WerFault.exe si300438.exe 4664 1676 WerFault.exe si300438.exe 4412 1676 WerFault.exe si300438.exe 3888 1676 WerFault.exe si300438.exe 5004 1676 WerFault.exe si300438.exe 4504 1676 WerFault.exe si300438.exe 2480 1676 WerFault.exe si300438.exe 3736 1676 WerFault.exe si300438.exe 3920 1676 WerFault.exe si300438.exe 4612 1676 WerFault.exe si300438.exe 4768 3228 WerFault.exe oneetx.exe 4912 3228 WerFault.exe oneetx.exe 1668 3228 WerFault.exe oneetx.exe 2092 3228 WerFault.exe oneetx.exe 1768 3228 WerFault.exe oneetx.exe 4056 3228 WerFault.exe oneetx.exe 216 3228 WerFault.exe oneetx.exe 2492 3228 WerFault.exe oneetx.exe 2804 3228 WerFault.exe oneetx.exe 3136 3228 WerFault.exe oneetx.exe 1184 3228 WerFault.exe oneetx.exe 3200 3228 WerFault.exe oneetx.exe 64 3228 WerFault.exe oneetx.exe 3420 3228 WerFault.exe oneetx.exe 3468 3228 WerFault.exe oneetx.exe 4808 448 WerFault.exe oneetx.exe 1648 3228 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pr794170.exe1.exerk475817.exepid process 4368 pr794170.exe 4368 pr794170.exe 632 1.exe 4604 rk475817.exe 632 1.exe 4604 rk475817.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
pr794170.exequ145449.exe1.exerk475817.exedescription pid process Token: SeDebugPrivilege 4368 pr794170.exe Token: SeDebugPrivilege 4320 qu145449.exe Token: SeDebugPrivilege 632 1.exe Token: SeDebugPrivilege 4604 rk475817.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
si300438.exepid process 1676 si300438.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
ec2e50191e546eff93e4f1a4d5b174b24ed3bd7e2bc3a8b5ab160b02cdb110fc.exeun901768.exeun763126.exequ145449.exesi300438.exeoneetx.exedescription pid process target process PID 1268 wrote to memory of 4232 1268 ec2e50191e546eff93e4f1a4d5b174b24ed3bd7e2bc3a8b5ab160b02cdb110fc.exe un901768.exe PID 1268 wrote to memory of 4232 1268 ec2e50191e546eff93e4f1a4d5b174b24ed3bd7e2bc3a8b5ab160b02cdb110fc.exe un901768.exe PID 1268 wrote to memory of 4232 1268 ec2e50191e546eff93e4f1a4d5b174b24ed3bd7e2bc3a8b5ab160b02cdb110fc.exe un901768.exe PID 4232 wrote to memory of 2912 4232 un901768.exe un763126.exe PID 4232 wrote to memory of 2912 4232 un901768.exe un763126.exe PID 4232 wrote to memory of 2912 4232 un901768.exe un763126.exe PID 2912 wrote to memory of 4368 2912 un763126.exe pr794170.exe PID 2912 wrote to memory of 4368 2912 un763126.exe pr794170.exe PID 2912 wrote to memory of 4368 2912 un763126.exe pr794170.exe PID 2912 wrote to memory of 4320 2912 un763126.exe qu145449.exe PID 2912 wrote to memory of 4320 2912 un763126.exe qu145449.exe PID 2912 wrote to memory of 4320 2912 un763126.exe qu145449.exe PID 4320 wrote to memory of 632 4320 qu145449.exe 1.exe PID 4320 wrote to memory of 632 4320 qu145449.exe 1.exe PID 4320 wrote to memory of 632 4320 qu145449.exe 1.exe PID 4232 wrote to memory of 4604 4232 un901768.exe rk475817.exe PID 4232 wrote to memory of 4604 4232 un901768.exe rk475817.exe PID 4232 wrote to memory of 4604 4232 un901768.exe rk475817.exe PID 1268 wrote to memory of 1676 1268 ec2e50191e546eff93e4f1a4d5b174b24ed3bd7e2bc3a8b5ab160b02cdb110fc.exe si300438.exe PID 1268 wrote to memory of 1676 1268 ec2e50191e546eff93e4f1a4d5b174b24ed3bd7e2bc3a8b5ab160b02cdb110fc.exe si300438.exe PID 1268 wrote to memory of 1676 1268 ec2e50191e546eff93e4f1a4d5b174b24ed3bd7e2bc3a8b5ab160b02cdb110fc.exe si300438.exe PID 1676 wrote to memory of 3228 1676 si300438.exe oneetx.exe PID 1676 wrote to memory of 3228 1676 si300438.exe oneetx.exe PID 1676 wrote to memory of 3228 1676 si300438.exe oneetx.exe PID 3228 wrote to memory of 320 3228 oneetx.exe schtasks.exe PID 3228 wrote to memory of 320 3228 oneetx.exe schtasks.exe PID 3228 wrote to memory of 320 3228 oneetx.exe schtasks.exe PID 3228 wrote to memory of 3204 3228 oneetx.exe rundll32.exe PID 3228 wrote to memory of 3204 3228 oneetx.exe rundll32.exe PID 3228 wrote to memory of 3204 3228 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec2e50191e546eff93e4f1a4d5b174b24ed3bd7e2bc3a8b5ab160b02cdb110fc.exe"C:\Users\Admin\AppData\Local\Temp\ec2e50191e546eff93e4f1a4d5b174b24ed3bd7e2bc3a8b5ab160b02cdb110fc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un901768.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un901768.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un763126.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un763126.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr794170.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr794170.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu145449.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu145449.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk475817.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk475817.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si300438.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si300438.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 7003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 7763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 8643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 9763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 10123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 10123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 12163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 12283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 6964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 8844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 9204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 10564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 10644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 10764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 10844⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 9964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 9084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 12764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 7684⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 14284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 11364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 16444⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 11124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 16524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 7923⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1676 -ip 16761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1676 -ip 16761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1676 -ip 16761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1676 -ip 16761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1676 -ip 16761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1676 -ip 16761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1676 -ip 16761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1676 -ip 16761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1676 -ip 16761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1676 -ip 16761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3228 -ip 32281⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 448 -ip 4481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3228 -ip 32281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
397KB
MD5dadc0d126524e7b28aab58226127e8a6
SHA1a383b6f22bbb8056ad743543ad54ef1707b1493a
SHA256af557e2b8545e0ae5ffb362c04a48e338b99c5e0d6227a35054581fe2075f5d8
SHA512dbafe7ad76989eb410064ac380ee2fb8494421cbd0e780663cab9eaed3f758325ce224dfd9bf16561081705c41bf903fd3d84db56148d6a5451c5a850ca59117
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
397KB
MD5dadc0d126524e7b28aab58226127e8a6
SHA1a383b6f22bbb8056ad743543ad54ef1707b1493a
SHA256af557e2b8545e0ae5ffb362c04a48e338b99c5e0d6227a35054581fe2075f5d8
SHA512dbafe7ad76989eb410064ac380ee2fb8494421cbd0e780663cab9eaed3f758325ce224dfd9bf16561081705c41bf903fd3d84db56148d6a5451c5a850ca59117
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
397KB
MD5dadc0d126524e7b28aab58226127e8a6
SHA1a383b6f22bbb8056ad743543ad54ef1707b1493a
SHA256af557e2b8545e0ae5ffb362c04a48e338b99c5e0d6227a35054581fe2075f5d8
SHA512dbafe7ad76989eb410064ac380ee2fb8494421cbd0e780663cab9eaed3f758325ce224dfd9bf16561081705c41bf903fd3d84db56148d6a5451c5a850ca59117
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
397KB
MD5dadc0d126524e7b28aab58226127e8a6
SHA1a383b6f22bbb8056ad743543ad54ef1707b1493a
SHA256af557e2b8545e0ae5ffb362c04a48e338b99c5e0d6227a35054581fe2075f5d8
SHA512dbafe7ad76989eb410064ac380ee2fb8494421cbd0e780663cab9eaed3f758325ce224dfd9bf16561081705c41bf903fd3d84db56148d6a5451c5a850ca59117
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si300438.exeFilesize
397KB
MD5dadc0d126524e7b28aab58226127e8a6
SHA1a383b6f22bbb8056ad743543ad54ef1707b1493a
SHA256af557e2b8545e0ae5ffb362c04a48e338b99c5e0d6227a35054581fe2075f5d8
SHA512dbafe7ad76989eb410064ac380ee2fb8494421cbd0e780663cab9eaed3f758325ce224dfd9bf16561081705c41bf903fd3d84db56148d6a5451c5a850ca59117
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si300438.exeFilesize
397KB
MD5dadc0d126524e7b28aab58226127e8a6
SHA1a383b6f22bbb8056ad743543ad54ef1707b1493a
SHA256af557e2b8545e0ae5ffb362c04a48e338b99c5e0d6227a35054581fe2075f5d8
SHA512dbafe7ad76989eb410064ac380ee2fb8494421cbd0e780663cab9eaed3f758325ce224dfd9bf16561081705c41bf903fd3d84db56148d6a5451c5a850ca59117
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un901768.exeFilesize
862KB
MD5bd9f7b39a2e524b9156c42db38f4e31d
SHA16b66fd201c4abc1917bbe81a03b630d109d5c354
SHA256cc57c9f75013317a97ff4378a207df64c6594ab63eba4bc6293b4b70f8cc3de9
SHA5128216b33115c1e52bd5c21802b2cf53f476966756da4c556870be1aaf2a94acaa2846cd052c190722a9144b57af5b6358fb5a9f72698c9003a48ae9fdd7fb3f32
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un901768.exeFilesize
862KB
MD5bd9f7b39a2e524b9156c42db38f4e31d
SHA16b66fd201c4abc1917bbe81a03b630d109d5c354
SHA256cc57c9f75013317a97ff4378a207df64c6594ab63eba4bc6293b4b70f8cc3de9
SHA5128216b33115c1e52bd5c21802b2cf53f476966756da4c556870be1aaf2a94acaa2846cd052c190722a9144b57af5b6358fb5a9f72698c9003a48ae9fdd7fb3f32
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk475817.exeFilesize
169KB
MD578149ec1cc40fbc4c969bca2074beb66
SHA17a0503b061aa6794269968f592266c6120e64a93
SHA2563f98e5bf53d61f825594a7d284065fe62dfff9efa8301878db22e8aea4504aeb
SHA512fec1981713280043646dd18a2e5f239ff36abd5473eaee7fe0487f0267555a9c8d02fd59de319580c995e742840194901b0587dd68fd5a4b87ee5b9eb89800fb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk475817.exeFilesize
169KB
MD578149ec1cc40fbc4c969bca2074beb66
SHA17a0503b061aa6794269968f592266c6120e64a93
SHA2563f98e5bf53d61f825594a7d284065fe62dfff9efa8301878db22e8aea4504aeb
SHA512fec1981713280043646dd18a2e5f239ff36abd5473eaee7fe0487f0267555a9c8d02fd59de319580c995e742840194901b0587dd68fd5a4b87ee5b9eb89800fb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un763126.exeFilesize
709KB
MD53fc63d386bca8549cb7fc7f7fce956eb
SHA1b3796d5be5e7280f3cd911866c8de9ee5bc407eb
SHA2562b10a269074f28decffe69859870363f1afdae9667d26c44560e33987ce71056
SHA5123001acf2cc37ba345f9070207d27052e94f767ed28300d11af2d135b3d43343ab51b1c23c44dd9663f6ad7d8c24d20715332139cd493abf0a8d04fb0d3c6710f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un763126.exeFilesize
709KB
MD53fc63d386bca8549cb7fc7f7fce956eb
SHA1b3796d5be5e7280f3cd911866c8de9ee5bc407eb
SHA2562b10a269074f28decffe69859870363f1afdae9667d26c44560e33987ce71056
SHA5123001acf2cc37ba345f9070207d27052e94f767ed28300d11af2d135b3d43343ab51b1c23c44dd9663f6ad7d8c24d20715332139cd493abf0a8d04fb0d3c6710f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr794170.exeFilesize
404KB
MD54371a0dd0750a40f68070d79477af222
SHA1c700a5e8405b9c5d3e661995713e527ec698516a
SHA2566e53f6d4fcfba6091626c3afebd36083e9dd251f18122c86d1ceecc90e0fb012
SHA5121355644c0d91a42f509cf3258e06ac6ed804fc32d54788ade80d7263be3aafef28b7db3fceb70274dda8c0082d96059975d827eb22517a1ce415bdd65018fe6f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr794170.exeFilesize
404KB
MD54371a0dd0750a40f68070d79477af222
SHA1c700a5e8405b9c5d3e661995713e527ec698516a
SHA2566e53f6d4fcfba6091626c3afebd36083e9dd251f18122c86d1ceecc90e0fb012
SHA5121355644c0d91a42f509cf3258e06ac6ed804fc32d54788ade80d7263be3aafef28b7db3fceb70274dda8c0082d96059975d827eb22517a1ce415bdd65018fe6f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu145449.exeFilesize
588KB
MD5ecd57a860618e3ff5f5105d489d897ce
SHA17fc1f860dbd8e745e4751d50a231aebb198961b9
SHA2566adad3b3c797834768fb1ce1de457a7a526c47d065bf29ee242883aba74f3b3f
SHA512d5e484181976c428da60a9e1822fc158a8fa0d78691be387fb1bbd6b1e8cbc330e0f437e9503621f3082eebe6eb5be5b35bac3d71bf9bbdb4f770fffcfc5926d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu145449.exeFilesize
588KB
MD5ecd57a860618e3ff5f5105d489d897ce
SHA17fc1f860dbd8e745e4751d50a231aebb198961b9
SHA2566adad3b3c797834768fb1ce1de457a7a526c47d065bf29ee242883aba74f3b3f
SHA512d5e484181976c428da60a9e1822fc158a8fa0d78691be387fb1bbd6b1e8cbc330e0f437e9503621f3082eebe6eb5be5b35bac3d71bf9bbdb4f770fffcfc5926d
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
C:\Windows\Temp\1.exeFilesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1
-
C:\Windows\Temp\1.exeFilesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1
-
C:\Windows\Temp\1.exeFilesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1
-
memory/632-2371-0x0000000005A30000-0x0000000005A96000-memory.dmpFilesize
408KB
-
memory/632-2367-0x00000000055F0000-0x0000000005600000-memory.dmpFilesize
64KB
-
memory/632-2363-0x0000000005710000-0x000000000581A000-memory.dmpFilesize
1.0MB
-
memory/632-2368-0x00000000059B0000-0x0000000005A26000-memory.dmpFilesize
472KB
-
memory/632-2374-0x00000000055F0000-0x0000000005600000-memory.dmpFilesize
64KB
-
memory/632-2357-0x0000000000D00000-0x0000000000D2E000-memory.dmpFilesize
184KB
-
memory/632-2375-0x0000000006BA0000-0x0000000006D62000-memory.dmpFilesize
1.8MB
-
memory/632-2376-0x0000000008EC0000-0x00000000093EC000-memory.dmpFilesize
5.2MB
-
memory/1676-2383-0x0000000002460000-0x000000000249B000-memory.dmpFilesize
236KB
-
memory/3228-2399-0x00000000009B0000-0x00000000009EB000-memory.dmpFilesize
236KB
-
memory/4320-207-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-219-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-199-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-203-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-205-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-198-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-209-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-211-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-213-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-215-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-217-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-201-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-221-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-223-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-225-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-227-0x00000000023A0000-0x00000000023FB000-memory.dmpFilesize
364KB
-
memory/4320-228-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-232-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-234-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/4320-235-0x0000000005560000-0x00000000055C0000-memory.dmpFilesize
384KB
-
memory/4320-229-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/4320-231-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/4368-184-0x00000000027C0000-0x00000000027D2000-memory.dmpFilesize
72KB
-
memory/4368-186-0x0000000002560000-0x0000000002570000-memory.dmpFilesize
64KB
-
memory/4368-191-0x0000000002560000-0x0000000002570000-memory.dmpFilesize
64KB
-
memory/4368-190-0x0000000002560000-0x0000000002570000-memory.dmpFilesize
64KB
-
memory/4368-189-0x0000000002560000-0x0000000002570000-memory.dmpFilesize
64KB
-
memory/4368-188-0x0000000000400000-0x000000000080A000-memory.dmpFilesize
4.0MB
-
memory/4368-155-0x0000000002450000-0x000000000247D000-memory.dmpFilesize
180KB
-
memory/4368-156-0x0000000005000000-0x00000000055A4000-memory.dmpFilesize
5.6MB
-
memory/4368-187-0x0000000002560000-0x0000000002570000-memory.dmpFilesize
64KB
-
memory/4368-193-0x0000000000400000-0x000000000080A000-memory.dmpFilesize
4.0MB
-
memory/4368-158-0x00000000027C0000-0x00000000027D2000-memory.dmpFilesize
72KB
-
memory/4368-157-0x00000000027C0000-0x00000000027D2000-memory.dmpFilesize
72KB
-
memory/4368-185-0x0000000002560000-0x0000000002570000-memory.dmpFilesize
64KB
-
memory/4368-168-0x00000000027C0000-0x00000000027D2000-memory.dmpFilesize
72KB
-
memory/4368-160-0x00000000027C0000-0x00000000027D2000-memory.dmpFilesize
72KB
-
memory/4368-162-0x00000000027C0000-0x00000000027D2000-memory.dmpFilesize
72KB
-
memory/4368-182-0x00000000027C0000-0x00000000027D2000-memory.dmpFilesize
72KB
-
memory/4368-164-0x00000000027C0000-0x00000000027D2000-memory.dmpFilesize
72KB
-
memory/4368-166-0x00000000027C0000-0x00000000027D2000-memory.dmpFilesize
72KB
-
memory/4368-180-0x00000000027C0000-0x00000000027D2000-memory.dmpFilesize
72KB
-
memory/4368-178-0x00000000027C0000-0x00000000027D2000-memory.dmpFilesize
72KB
-
memory/4368-176-0x00000000027C0000-0x00000000027D2000-memory.dmpFilesize
72KB
-
memory/4368-174-0x00000000027C0000-0x00000000027D2000-memory.dmpFilesize
72KB
-
memory/4368-172-0x00000000027C0000-0x00000000027D2000-memory.dmpFilesize
72KB
-
memory/4368-170-0x00000000027C0000-0x00000000027D2000-memory.dmpFilesize
72KB
-
memory/4604-2364-0x0000000004980000-0x0000000004992000-memory.dmpFilesize
72KB
-
memory/4604-2373-0x0000000004800000-0x0000000004810000-memory.dmpFilesize
64KB
-
memory/4604-2372-0x0000000005CC0000-0x0000000005D10000-memory.dmpFilesize
320KB
-
memory/4604-2370-0x0000000004E10000-0x0000000004EA2000-memory.dmpFilesize
584KB
-
memory/4604-2369-0x0000000004CF0000-0x0000000004D66000-memory.dmpFilesize
472KB
-
memory/4604-2366-0x0000000004800000-0x0000000004810000-memory.dmpFilesize
64KB
-
memory/4604-2365-0x00000000049E0000-0x0000000004A1C000-memory.dmpFilesize
240KB
-
memory/4604-2362-0x0000000004F70000-0x0000000005588000-memory.dmpFilesize
6.1MB
-
memory/4604-2361-0x0000000000030000-0x0000000000060000-memory.dmpFilesize
192KB