redline | 00bbdcb562dee11d2bfcc778bf76f6d6a0f0f9ee3dd05b0b648ac35fea70a500

Analysis

max time kernel
145s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2023 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00bbdcb562dee11d2bfcc778bf76f6d6a0f0f9ee3dd05b0b648ac35fea70a500.exe
Size

567KB
MD5

6537fcba56f14d24307f6ad585de7e1e
SHA1

3dcd221fdb4bde6589ca6c850c31dc6e4e737e2a
SHA256

00bbdcb562dee11d2bfcc778bf76f6d6a0f0f9ee3dd05b0b648ac35fea70a500
SHA512

fd4c5c0676298fed1befebf194d2e6a4302ee7c211e554de53fef17066ba311c7da199f7f106ae7b6c2058ac430a8be9ea2f7807e8470005658f7306a9bb7314
SSDEEP

12288:6Mrky90myWPk0BFWXQ2dFT0ou8XW7nADmES4GRRBZfmFz:Oy/yWHBFWg2XT0z7nADmES4G1ZfmFz

Score

10^/10

redline darm discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

darm

217.196.96.56:4138

Attributes

auth_value
d88ac8ccc04ab9979b04b46313db1648

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	l0407071.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	l0407071.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	l0407071.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	l0407071.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	l0407071.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	l0407071.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	m1643053.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 7 IoCs

pid	Process
4356	y8325341.exe
2376	k3295896.exe
3300	l0407071.exe
2744	m1643053.exe
4488	oneetx.exe
1700	oneetx.exe
2260	oneetx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	l0407071.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	l0407071.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y8325341.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	00bbdcb562dee11d2bfcc778bf76f6d6a0f0f9ee3dd05b0b648ac35fea70a500.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	00bbdcb562dee11d2bfcc778bf76f6d6a0f0f9ee3dd05b0b648ac35fea70a500.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y8325341.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 30 IoCs

pid	pid_target	Process	procid_target
1136	2744	WerFault.exe	94
3560	2744	WerFault.exe	94
4024	2744	WerFault.exe	94
3572	2744	WerFault.exe	94
4952	2744	WerFault.exe	94
400	2744	WerFault.exe	94
1072	2744	WerFault.exe	94
4640	2744	WerFault.exe	94
5008	2744	WerFault.exe	94
3444	2744	WerFault.exe	94
1508	4488	WerFault.exe	113
2200	4488	WerFault.exe	113
100	4488	WerFault.exe	113
784	4488	WerFault.exe	113
1828	4488	WerFault.exe	113
2860	4488	WerFault.exe	113
4892	4488	WerFault.exe	113
2732	4488	WerFault.exe	113
4904	4488	WerFault.exe	113
5000	4488	WerFault.exe	113
4368	4488	WerFault.exe	113
4692	4488	WerFault.exe	113
1300	4488	WerFault.exe	113
952	4488	WerFault.exe	113
1080	1700	WerFault.exe	154
3304	4488	WerFault.exe	113
3560	4488	WerFault.exe	113
4436	4488	WerFault.exe	113
4556	2260	WerFault.exe	164
2656	4488	WerFault.exe	113

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2376	k3295896.exe
2376	k3295896.exe
3300	l0407071.exe
3300	l0407071.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	k3295896.exe
Token: SeDebugPrivilege	3300	l0407071.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2744	m1643053.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 4356	1664	00bbdcb562dee11d2bfcc778bf76f6d6a0f0f9ee3dd05b0b648ac35fea70a500.exe	84
PID 1664 wrote to memory of 4356	1664	00bbdcb562dee11d2bfcc778bf76f6d6a0f0f9ee3dd05b0b648ac35fea70a500.exe	84
PID 1664 wrote to memory of 4356	1664	00bbdcb562dee11d2bfcc778bf76f6d6a0f0f9ee3dd05b0b648ac35fea70a500.exe	84
PID 4356 wrote to memory of 2376	4356	y8325341.exe	85
PID 4356 wrote to memory of 2376	4356	y8325341.exe	85
PID 4356 wrote to memory of 2376	4356	y8325341.exe	85
PID 4356 wrote to memory of 3300	4356	y8325341.exe	92
PID 4356 wrote to memory of 3300	4356	y8325341.exe	92
PID 4356 wrote to memory of 3300	4356	y8325341.exe	92
PID 1664 wrote to memory of 2744	1664	00bbdcb562dee11d2bfcc778bf76f6d6a0f0f9ee3dd05b0b648ac35fea70a500.exe	94
PID 1664 wrote to memory of 2744	1664	00bbdcb562dee11d2bfcc778bf76f6d6a0f0f9ee3dd05b0b648ac35fea70a500.exe	94
PID 1664 wrote to memory of 2744	1664	00bbdcb562dee11d2bfcc778bf76f6d6a0f0f9ee3dd05b0b648ac35fea70a500.exe	94
PID 2744 wrote to memory of 4488	2744	m1643053.exe	113
PID 2744 wrote to memory of 4488	2744	m1643053.exe	113
PID 2744 wrote to memory of 4488	2744	m1643053.exe	113
PID 552 wrote to memory of 4948	552	cmd.exe	140
PID 552 wrote to memory of 4948	552	cmd.exe	140
PID 552 wrote to memory of 4948	552	cmd.exe	140
PID 552 wrote to memory of 4680	552	cmd.exe	141
PID 552 wrote to memory of 4680	552	cmd.exe	141
PID 552 wrote to memory of 4680	552	cmd.exe	141
PID 552 wrote to memory of 4528	552	cmd.exe	142
PID 552 wrote to memory of 4528	552	cmd.exe	142
PID 552 wrote to memory of 4528	552	cmd.exe	142
PID 552 wrote to memory of 5024	552	cmd.exe	143
PID 552 wrote to memory of 5024	552	cmd.exe	143
PID 552 wrote to memory of 5024	552	cmd.exe	143
PID 552 wrote to memory of 2388	552	cmd.exe	144
PID 552 wrote to memory of 2388	552	cmd.exe	144
PID 552 wrote to memory of 2388	552	cmd.exe	144
PID 552 wrote to memory of 4656	552	cmd.exe	145
PID 552 wrote to memory of 4656	552	cmd.exe	145
PID 552 wrote to memory of 4656	552	cmd.exe	145

C:\Users\Admin\AppData\Local\Temp\00bbdcb562dee11d2bfcc778bf76f6d6a0f0f9ee3dd05b0b648ac35fea70a500.exe
"C:\Users\Admin\AppData\Local\Temp\00bbdcb562dee11d2bfcc778bf76f6d6a0f0f9ee3dd05b0b648ac35fea70a500.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8325341.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8325341.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3295896.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3295896.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2376
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0407071.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0407071.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3300
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m1643053.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m1643053.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 680
    3⤵
    - Program crash
    PID:1136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 780
    3⤵
    - Program crash
    PID:3560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 796
    3⤵
    - Program crash
    PID:4024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 812
    3⤵
    - Program crash
    PID:3572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 960
    3⤵
    - Program crash
    PID:4952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 964
    3⤵
    - Program crash
    PID:400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 1220
    3⤵
    - Program crash
    PID:1072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 1248
    3⤵
    - Program crash
    PID:4640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 1316
    3⤵
    - Program crash
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:4488
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 692
      4⤵
      Program crash
      PID:1508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 820
      4⤵
      Program crash
      PID:2200
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 892
      4⤵
      Program crash
      PID:100
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1052
      4⤵
      Program crash
      PID:784
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1072
      4⤵
      Program crash
      PID:1828
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1108
      4⤵
      Program crash
      PID:2860
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1116
      4⤵
      Program crash
      PID:4892
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:3660
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 996
      4⤵
      Program crash
      PID:2732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 776
      4⤵
      Program crash
      PID:4904
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:552
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4948
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        5⤵
        
        PID:4680
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        5⤵
        
        PID:4528
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:5024
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c3912af058" /P "Admin:N"
        5⤵
        
        PID:2388
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c3912af058" /P "Admin:R" /E
        5⤵
        
        PID:4656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 924
      4⤵
      Program crash
      PID:5000
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 756
      4⤵
      Program crash
      PID:4368
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 760
      4⤵
      Program crash
      PID:4692
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1268
      4⤵
      Program crash
      PID:1300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1456
      4⤵
      Program crash
      PID:952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1176
      4⤵
      Program crash
      PID:3304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1696
      4⤵
      Program crash
      PID:3560
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      PID:1064
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1632
      4⤵
      Program crash
      PID:4436
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1712
      4⤵
      Program crash
      PID:2656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 1720
    3⤵
    - Program crash
    PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2744 -ip 2744
1⤵
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2744 -ip 2744
1⤵
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 2744 -ip 2744
1⤵
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2744 -ip 2744
1⤵
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2744 -ip 2744
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 2744 -ip 2744
1⤵
PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2744 -ip 2744
1⤵
PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2744 -ip 2744
1⤵
PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2744 -ip 2744
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2744 -ip 2744
1⤵
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4488 -ip 4488
1⤵
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4488 -ip 4488
1⤵
PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4488 -ip 4488
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4488 -ip 4488
1⤵
PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4488 -ip 4488
1⤵
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4488 -ip 4488
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4488 -ip 4488
1⤵
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4488 -ip 4488
1⤵
PID:3332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4488 -ip 4488
1⤵
PID:3808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4488 -ip 4488
1⤵
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4488 -ip 4488
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4488 -ip 4488
1⤵
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 4488 -ip 4488
1⤵
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4488 -ip 4488
1⤵
PID:4448

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
1⤵
- Executes dropped EXE
PID:1700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 312
  2⤵
  - Program crash
  PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1700 -ip 1700
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4488 -ip 4488
1⤵
PID:3788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4488 -ip 4488
1⤵
PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4488 -ip 4488
1⤵
PID:2092

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
1⤵
- Executes dropped EXE
PID:2260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 312
  2⤵
  - Program crash
  PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2260 -ip 2260
1⤵
PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4488 -ip 4488
1⤵
PID:4120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m1643053.exe

Filesize
271KB

MD5
709586e0cc14a9bb62b7bc5d30515b4d

SHA1
388f8aaec07192a62af8d3de9d81669b3d2c740e

SHA256
1470c7893a69a1eca1639d357d3397f83e919eb6eae10d2d69002d9cb92a1ec5

SHA512
09665012f732835d874c9df4506e5ebcf32ca68b20cfcb567c7a007747c8e5a17f520cc4614d47c6b0d0863f99e1f0095352cde37e0bf60073003435ef56b719

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m1643053.exe

Filesize
271KB

MD5
709586e0cc14a9bb62b7bc5d30515b4d

SHA1
388f8aaec07192a62af8d3de9d81669b3d2c740e

SHA256
1470c7893a69a1eca1639d357d3397f83e919eb6eae10d2d69002d9cb92a1ec5

SHA512
09665012f732835d874c9df4506e5ebcf32ca68b20cfcb567c7a007747c8e5a17f520cc4614d47c6b0d0863f99e1f0095352cde37e0bf60073003435ef56b719

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8325341.exe

Filesize
307KB

MD5
939b6625a8295097831eb78924669df6

SHA1
e16abf7e91e4d4a5209ad91301ec657a0e98966f

SHA256
60579b0c977f90646085e65f2992ec97983b3902b5898ab7bcf91b1d82d8650d

SHA512
872601f4aee09423806beac34099401e4e056062a58042f60495d9e10ffc7f8b73dc9d37f1ee4d5436ecad5f99eb3991348e56501ccd9e04c8574ee5ac2ce127

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8325341.exe

Filesize
307KB

MD5
939b6625a8295097831eb78924669df6

SHA1
e16abf7e91e4d4a5209ad91301ec657a0e98966f

SHA256
60579b0c977f90646085e65f2992ec97983b3902b5898ab7bcf91b1d82d8650d

SHA512
872601f4aee09423806beac34099401e4e056062a58042f60495d9e10ffc7f8b73dc9d37f1ee4d5436ecad5f99eb3991348e56501ccd9e04c8574ee5ac2ce127

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3295896.exe

Filesize
168KB

MD5
d29919f12a934ce43fc0e805f6322a31

SHA1
ba0f60b9d1f9640ddc3837583bf1c97148cfa8fc

SHA256
b0eeefb81c3b28c3f6d96c34acf115fe26f26ad7c6082eb248cb2209b89d5a3f

SHA512
fc0678d772a042dfd835476ec5a7b32ee5f2c73d3a644b640beb4d338212aa4dff83e3d5204043c51dd93901549911516f3ca2ef65359970661043380d64ccec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3295896.exe

Filesize
168KB

MD5
d29919f12a934ce43fc0e805f6322a31

SHA1
ba0f60b9d1f9640ddc3837583bf1c97148cfa8fc

SHA256
b0eeefb81c3b28c3f6d96c34acf115fe26f26ad7c6082eb248cb2209b89d5a3f

SHA512
fc0678d772a042dfd835476ec5a7b32ee5f2c73d3a644b640beb4d338212aa4dff83e3d5204043c51dd93901549911516f3ca2ef65359970661043380d64ccec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0407071.exe

Filesize
177KB

MD5
cefe4e9cb9975cc27e11b22561d179c9

SHA1
60380aea57eae2bba8f0c590859d50c6351e81d2

SHA256
698d06bccf6909e8f2f759e73952d47e8849e8d501ff69666fc30e5dbb0ef30c

SHA512
0a6d78e825b79e4a8496f63f7264a9130d70039716e029455674439b764cd95c4292f09fdf8e06fe94cd0a40ca15b9c3586eeb7b46425c0cb3240b05f5b3132b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0407071.exe

Filesize
177KB

MD5
cefe4e9cb9975cc27e11b22561d179c9

SHA1
60380aea57eae2bba8f0c590859d50c6351e81d2

SHA256
698d06bccf6909e8f2f759e73952d47e8849e8d501ff69666fc30e5dbb0ef30c

SHA512
0a6d78e825b79e4a8496f63f7264a9130d70039716e029455674439b764cd95c4292f09fdf8e06fe94cd0a40ca15b9c3586eeb7b46425c0cb3240b05f5b3132b

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
271KB

MD5
709586e0cc14a9bb62b7bc5d30515b4d

SHA1
388f8aaec07192a62af8d3de9d81669b3d2c740e

SHA256
1470c7893a69a1eca1639d357d3397f83e919eb6eae10d2d69002d9cb92a1ec5

SHA512
09665012f732835d874c9df4506e5ebcf32ca68b20cfcb567c7a007747c8e5a17f520cc4614d47c6b0d0863f99e1f0095352cde37e0bf60073003435ef56b719

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
271KB

MD5
709586e0cc14a9bb62b7bc5d30515b4d

SHA1
388f8aaec07192a62af8d3de9d81669b3d2c740e

SHA256
1470c7893a69a1eca1639d357d3397f83e919eb6eae10d2d69002d9cb92a1ec5

SHA512
09665012f732835d874c9df4506e5ebcf32ca68b20cfcb567c7a007747c8e5a17f520cc4614d47c6b0d0863f99e1f0095352cde37e0bf60073003435ef56b719

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
271KB

MD5
709586e0cc14a9bb62b7bc5d30515b4d

SHA1
388f8aaec07192a62af8d3de9d81669b3d2c740e

SHA256
1470c7893a69a1eca1639d357d3397f83e919eb6eae10d2d69002d9cb92a1ec5

SHA512
09665012f732835d874c9df4506e5ebcf32ca68b20cfcb567c7a007747c8e5a17f520cc4614d47c6b0d0863f99e1f0095352cde37e0bf60073003435ef56b719

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
271KB

MD5
709586e0cc14a9bb62b7bc5d30515b4d

SHA1
388f8aaec07192a62af8d3de9d81669b3d2c740e

SHA256
1470c7893a69a1eca1639d357d3397f83e919eb6eae10d2d69002d9cb92a1ec5

SHA512
09665012f732835d874c9df4506e5ebcf32ca68b20cfcb567c7a007747c8e5a17f520cc4614d47c6b0d0863f99e1f0095352cde37e0bf60073003435ef56b719

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
271KB

MD5
709586e0cc14a9bb62b7bc5d30515b4d

SHA1
388f8aaec07192a62af8d3de9d81669b3d2c740e

SHA256
1470c7893a69a1eca1639d357d3397f83e919eb6eae10d2d69002d9cb92a1ec5

SHA512
09665012f732835d874c9df4506e5ebcf32ca68b20cfcb567c7a007747c8e5a17f520cc4614d47c6b0d0863f99e1f0095352cde37e0bf60073003435ef56b719

Download Submit
memory/1700-222-0x0000000000400000-0x00000000006C3000-memory.dmp

Filesize
2.8MB

Download
memory/2260-231-0x0000000000400000-0x00000000006C3000-memory.dmp

Filesize
2.8MB

Download
memory/2376-150-0x000000000A600000-0x000000000A612000-memory.dmp

Filesize
72KB

Download
memory/2376-154-0x000000000AA90000-0x000000000AB22000-memory.dmp

Filesize
584KB

Download
memory/2376-160-0x000000000BE30000-0x000000000BE80000-memory.dmp

Filesize
320KB

Download
memory/2376-158-0x000000000C700000-0x000000000CC2C000-memory.dmp

Filesize
5.2MB

Download
memory/2376-157-0x000000000C000000-0x000000000C1C2000-memory.dmp

Filesize
1.8MB

Download
memory/2376-156-0x000000000AB30000-0x000000000AB96000-memory.dmp

Filesize
408KB

Download
memory/2376-155-0x000000000B880000-0x000000000BE24000-memory.dmp

Filesize
5.6MB

Download
memory/2376-159-0x0000000005100000-0x0000000005110000-memory.dmp

Filesize
64KB

Download
memory/2376-153-0x000000000A970000-0x000000000A9E6000-memory.dmp

Filesize
472KB

Download
memory/2376-152-0x000000000A660000-0x000000000A69C000-memory.dmp

Filesize
240KB

Download
memory/2376-147-0x0000000000750000-0x0000000000780000-memory.dmp

Filesize
192KB

Download
memory/2376-151-0x0000000005100000-0x0000000005110000-memory.dmp

Filesize
64KB

Download
memory/2376-149-0x000000000A6D0000-0x000000000A7DA000-memory.dmp

Filesize
1.0MB

Download
memory/2376-148-0x000000000ABB0000-0x000000000B1C8000-memory.dmp

Filesize
6.1MB

Download
memory/2744-203-0x00000000006D0000-0x0000000000705000-memory.dmp

Filesize
212KB

Download
memory/2744-216-0x0000000000400000-0x00000000006C3000-memory.dmp

Filesize
2.8MB

Download
memory/3300-173-0x0000000004F20000-0x0000000004F32000-memory.dmp

Filesize
72KB

Download
memory/3300-179-0x0000000004F20000-0x0000000004F32000-memory.dmp

Filesize
72KB

Download
memory/3300-187-0x0000000004F20000-0x0000000004F32000-memory.dmp

Filesize
72KB

Download
memory/3300-189-0x0000000004F20000-0x0000000004F32000-memory.dmp

Filesize
72KB

Download
memory/3300-191-0x0000000004F20000-0x0000000004F32000-memory.dmp

Filesize
72KB

Download
memory/3300-193-0x0000000004F20000-0x0000000004F32000-memory.dmp

Filesize
72KB

Download
memory/3300-195-0x0000000004F20000-0x0000000004F32000-memory.dmp

Filesize
72KB

Download
memory/3300-196-0x0000000004960000-0x0000000004970000-memory.dmp

Filesize
64KB

Download
memory/3300-197-0x0000000004960000-0x0000000004970000-memory.dmp

Filesize
64KB

Download
memory/3300-183-0x0000000004F20000-0x0000000004F32000-memory.dmp

Filesize
72KB

Download
memory/3300-181-0x0000000004F20000-0x0000000004F32000-memory.dmp

Filesize
72KB

Download
memory/3300-185-0x0000000004F20000-0x0000000004F32000-memory.dmp

Filesize
72KB

Download
memory/3300-177-0x0000000004F20000-0x0000000004F32000-memory.dmp

Filesize
72KB

Download
memory/3300-175-0x0000000004F20000-0x0000000004F32000-memory.dmp

Filesize
72KB

Download
memory/3300-171-0x0000000004F20000-0x0000000004F32000-memory.dmp

Filesize
72KB

Download
memory/3300-166-0x0000000004960000-0x0000000004970000-memory.dmp

Filesize
64KB

Download
memory/3300-165-0x0000000004960000-0x0000000004970000-memory.dmp

Filesize
64KB

Download
memory/3300-168-0x0000000004F20000-0x0000000004F32000-memory.dmp

Filesize
72KB

Download
memory/3300-169-0x0000000004960000-0x0000000004970000-memory.dmp

Filesize
64KB

Download
memory/3300-167-0x0000000004F20000-0x0000000004F32000-memory.dmp

Filesize
72KB

Download
memory/4488-227-0x0000000000400000-0x00000000006C3000-memory.dmp

Filesize
2.8MB

Download
memory/4488-219-0x0000000000400000-0x00000000006C3000-memory.dmp

Filesize
2.8MB

Download