redline | 671ca9c1b3c1efbe5b7f7e1e38a13cdbe387268bcde5dc8a8ebfb65e375a181f

Analysis

max time kernel
144s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2023, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

671ca9c1b3c1efbe5b7f7e1e38a13cdbe387268bcde5dc8a8ebfb65e375a181f.exe
Size

643KB
MD5

64f12a1f38d7353c58c14c1c627a90de
SHA1

d9ff003ca5692ee48d5b89c4a52d10c90c17ab15
SHA256

671ca9c1b3c1efbe5b7f7e1e38a13cdbe387268bcde5dc8a8ebfb65e375a181f
SHA512

739266162f144894892386dd2ce7afb3d3361be8178dcd00428ebbe8403b160a2957dd661852d0c04a2b6234d30fda3f188ebe67c5e51f36ffb8aaa333370296
SSDEEP

12288:DMrLy90pWA6k82wBM5PISQT6/P+FidEhY2cR8kUMuT9axh+24aj62IQPNjQUFyoH:Qycl6N2wq//m+E7i8L0xh+24ajDnPal2

Score

10^/10

redline darm discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

darm

217.196.96.56:4138

Attributes

auth_value
d88ac8ccc04ab9979b04b46313db1648

Signatures

Detects Redline Stealer samples 3 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/2180-148-0x000000000B260000-0x000000000B878000-memory.dmp	redline_stealer
behavioral2/memory/2180-157-0x000000000BBC0000-0x000000000BC26000-memory.dmp	redline_stealer
behavioral2/memory/2180-159-0x000000000C7F0000-0x000000000C9B2000-memory.dmp	redline_stealer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	h3816410.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	h3816410.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	h3816410.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	h3816410.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	h3816410.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	h3816410.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	i5171793.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 5 IoCs

pid	Process
1488	x2541255.exe
2180	g4441079.exe
3500	h3816410.exe
3740	i5171793.exe
1864	oneetx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	h3816410.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	h3816410.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	671ca9c1b3c1efbe5b7f7e1e38a13cdbe387268bcde5dc8a8ebfb65e375a181f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	671ca9c1b3c1efbe5b7f7e1e38a13cdbe387268bcde5dc8a8ebfb65e375a181f.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x2541255.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x2541255.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 26 IoCs

pid	pid_target	Process	procid_target
5088	3500	WerFault.exe	95
3436	3740	WerFault.exe	99
2032	3740	WerFault.exe	99
4012	3740	WerFault.exe	99
3312	3740	WerFault.exe	99
3420	3740	WerFault.exe	99
1100	3740	WerFault.exe	99
2172	3740	WerFault.exe	99
2160	3740	WerFault.exe	99
4832	3740	WerFault.exe	99
4120	3740	WerFault.exe	99
3908	3740	WerFault.exe	99
4304	1864	WerFault.exe	120
2588	1864	WerFault.exe	120
5000	1864	WerFault.exe	120
2336	1864	WerFault.exe	120
4612	1864	WerFault.exe	120
1160	1864	WerFault.exe	120
5096	1864	WerFault.exe	120
3400	1864	WerFault.exe	120
3752	1864	WerFault.exe	120
3212	1864	WerFault.exe	120
4416	1864	WerFault.exe	120
1892	1864	WerFault.exe	120
1172	1864	WerFault.exe	120
2308	1864	WerFault.exe	120

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
400	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2180	g4441079.exe
2180	g4441079.exe
3500	h3816410.exe
3500	h3816410.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	g4441079.exe
Token: SeDebugPrivilege	3500	h3816410.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3740	i5171793.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 1488	4920	671ca9c1b3c1efbe5b7f7e1e38a13cdbe387268bcde5dc8a8ebfb65e375a181f.exe	86
PID 4920 wrote to memory of 1488	4920	671ca9c1b3c1efbe5b7f7e1e38a13cdbe387268bcde5dc8a8ebfb65e375a181f.exe	86
PID 4920 wrote to memory of 1488	4920	671ca9c1b3c1efbe5b7f7e1e38a13cdbe387268bcde5dc8a8ebfb65e375a181f.exe	86
PID 1488 wrote to memory of 2180	1488	x2541255.exe	87
PID 1488 wrote to memory of 2180	1488	x2541255.exe	87
PID 1488 wrote to memory of 2180	1488	x2541255.exe	87
PID 1488 wrote to memory of 3500	1488	x2541255.exe	95
PID 1488 wrote to memory of 3500	1488	x2541255.exe	95
PID 1488 wrote to memory of 3500	1488	x2541255.exe	95
PID 4920 wrote to memory of 3740	4920	671ca9c1b3c1efbe5b7f7e1e38a13cdbe387268bcde5dc8a8ebfb65e375a181f.exe	99
PID 4920 wrote to memory of 3740	4920	671ca9c1b3c1efbe5b7f7e1e38a13cdbe387268bcde5dc8a8ebfb65e375a181f.exe	99
PID 4920 wrote to memory of 3740	4920	671ca9c1b3c1efbe5b7f7e1e38a13cdbe387268bcde5dc8a8ebfb65e375a181f.exe	99
PID 3740 wrote to memory of 1864	3740	i5171793.exe	120
PID 3740 wrote to memory of 1864	3740	i5171793.exe	120
PID 3740 wrote to memory of 1864	3740	i5171793.exe	120
PID 1864 wrote to memory of 400	1864	oneetx.exe	139
PID 1864 wrote to memory of 400	1864	oneetx.exe	139
PID 1864 wrote to memory of 400	1864	oneetx.exe	139
PID 1864 wrote to memory of 4108	1864	oneetx.exe	146
PID 1864 wrote to memory of 4108	1864	oneetx.exe	146
PID 1864 wrote to memory of 4108	1864	oneetx.exe	146
PID 4108 wrote to memory of 4880	4108	cmd.exe	150
PID 4108 wrote to memory of 4880	4108	cmd.exe	150
PID 4108 wrote to memory of 4880	4108	cmd.exe	150
PID 4108 wrote to memory of 1096	4108	cmd.exe	151
PID 4108 wrote to memory of 1096	4108	cmd.exe	151
PID 4108 wrote to memory of 1096	4108	cmd.exe	151
PID 4108 wrote to memory of 1360	4108	cmd.exe	152
PID 4108 wrote to memory of 1360	4108	cmd.exe	152
PID 4108 wrote to memory of 1360	4108	cmd.exe	152
PID 4108 wrote to memory of 4640	4108	cmd.exe	153
PID 4108 wrote to memory of 4640	4108	cmd.exe	153
PID 4108 wrote to memory of 4640	4108	cmd.exe	153
PID 4108 wrote to memory of 3524	4108	cmd.exe	154
PID 4108 wrote to memory of 3524	4108	cmd.exe	154
PID 4108 wrote to memory of 3524	4108	cmd.exe	154
PID 4108 wrote to memory of 2764	4108	cmd.exe	155
PID 4108 wrote to memory of 2764	4108	cmd.exe	155
PID 4108 wrote to memory of 2764	4108	cmd.exe	155

C:\Users\Admin\AppData\Local\Temp\671ca9c1b3c1efbe5b7f7e1e38a13cdbe387268bcde5dc8a8ebfb65e375a181f.exe
"C:\Users\Admin\AppData\Local\Temp\671ca9c1b3c1efbe5b7f7e1e38a13cdbe387268bcde5dc8a8ebfb65e375a181f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2541255.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2541255.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4441079.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4441079.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3816410.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3816410.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3500
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 1080
      4⤵
      Program crash
      PID:5088
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i5171793.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i5171793.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 696
    3⤵
    - Program crash
    PID:3436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 780
    3⤵
    - Program crash
    PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 860
    3⤵
    - Program crash
    PID:4012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 976
    3⤵
    - Program crash
    PID:3312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 956
    3⤵
    - Program crash
    PID:3420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 956
    3⤵
    - Program crash
    PID:1100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1220
    3⤵
    - Program crash
    PID:2172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1236
    3⤵
    - Program crash
    PID:2160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1316
    3⤵
    - Program crash
    PID:4832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1336
    3⤵
    - Program crash
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 692
      4⤵
      Program crash
      PID:4304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 908
      4⤵
      Program crash
      PID:2588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 900
      4⤵
      Program crash
      PID:5000
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 1100
      4⤵
      Program crash
      PID:2336
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 904
      4⤵
      Program crash
      PID:4612
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 1112
      4⤵
      Program crash
      PID:1160
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 1140
      4⤵
      Program crash
      PID:5096
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 1148
      4⤵
      Program crash
      PID:3400
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:400
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 1020
      4⤵
      Program crash
      PID:3752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 1216
      4⤵
      Program crash
      PID:3212
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4108
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4880
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        5⤵
        
        PID:1096
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        5⤵
        
        PID:1360
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4640
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c3912af058" /P "Admin:N"
        5⤵
        
        PID:3524
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c3912af058" /P "Admin:R" /E
        5⤵
        
        PID:2764
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 884
      4⤵
      Program crash
      PID:4416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 788
      4⤵
      Program crash
      PID:1892
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 1296
      4⤵
      Program crash
      PID:1172
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 1308
      4⤵
      Program crash
      PID:2308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 748
    3⤵
    - Program crash
    PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3500 -ip 3500
1⤵
PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3740 -ip 3740
1⤵
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3740 -ip 3740
1⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3740 -ip 3740
1⤵
PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3740 -ip 3740
1⤵
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3740 -ip 3740
1⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3740 -ip 3740
1⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3740 -ip 3740
1⤵
PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3740 -ip 3740
1⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3740 -ip 3740
1⤵
PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3740 -ip 3740
1⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3740 -ip 3740
1⤵
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1864 -ip 1864
1⤵
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1864 -ip 1864
1⤵
PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1864 -ip 1864
1⤵
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1864 -ip 1864
1⤵
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1864 -ip 1864
1⤵
PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1864 -ip 1864
1⤵
PID:764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1864 -ip 1864
1⤵
PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1864 -ip 1864
1⤵
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1864 -ip 1864
1⤵
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1864 -ip 1864
1⤵
PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1864 -ip 1864
1⤵
PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1864 -ip 1864
1⤵
PID:936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1864 -ip 1864
1⤵
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1864 -ip 1864
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i5171793.exe

Filesize
271KB

MD5
9ada6ba4571515dffd8e363e75f5b6f3

SHA1
b7517c7f8af7d9d52750a442a4b81046c56d5074

SHA256
9c6de79882a2c947037b145b0c72597ee3987c57fe6570262bf8a4909e84d4de

SHA512
2db322b0edfe5750d6825823dceedcd32de869d9ffbc1e48127feb6b1f961414de206212f87d63de6d882a905316106c3c1e08e89a4c2e7ba61f84ffe9bcdabf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i5171793.exe

Filesize
271KB

MD5
9ada6ba4571515dffd8e363e75f5b6f3

SHA1
b7517c7f8af7d9d52750a442a4b81046c56d5074

SHA256
9c6de79882a2c947037b145b0c72597ee3987c57fe6570262bf8a4909e84d4de

SHA512
2db322b0edfe5750d6825823dceedcd32de869d9ffbc1e48127feb6b1f961414de206212f87d63de6d882a905316106c3c1e08e89a4c2e7ba61f84ffe9bcdabf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2541255.exe

Filesize
383KB

MD5
3fa4b931ac56092890ef140d1a2a506a

SHA1
9a17bf77c7dda00eb3c3864c2c7e1159947f8ab0

SHA256
31dc64fec3a97e47793f95eeeb070b793cd7970995fd6c9df32b74a1af7d8807

SHA512
aaa95ce29afac9295d98d910e6e8a1a515adad4dce6fbeedf87bb66576705145de8346d82fa91dff10f50cee185aa65a78ae157d359758bd9e09daba53bcfab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2541255.exe

Filesize
383KB

MD5
3fa4b931ac56092890ef140d1a2a506a

SHA1
9a17bf77c7dda00eb3c3864c2c7e1159947f8ab0

SHA256
31dc64fec3a97e47793f95eeeb070b793cd7970995fd6c9df32b74a1af7d8807

SHA512
aaa95ce29afac9295d98d910e6e8a1a515adad4dce6fbeedf87bb66576705145de8346d82fa91dff10f50cee185aa65a78ae157d359758bd9e09daba53bcfab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4441079.exe

Filesize
168KB

MD5
459ca38a97c56fef7bf65619899d700c

SHA1
1fc16db6eb293a60c8dbed5f3cfb46c57c7f6c7b

SHA256
99687222519f913245f64bfab5b02806e31c45950164ce51e3e007fe3f72d806

SHA512
83b31ac643aa72a4f72c9641289715b19ed22b274629e1f1dd8d1ee726e9a522db19492249a520db7bc71a618980ab303cd83aa09a909f36e8ea544880292fa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4441079.exe

Filesize
168KB

MD5
459ca38a97c56fef7bf65619899d700c

SHA1
1fc16db6eb293a60c8dbed5f3cfb46c57c7f6c7b

SHA256
99687222519f913245f64bfab5b02806e31c45950164ce51e3e007fe3f72d806

SHA512
83b31ac643aa72a4f72c9641289715b19ed22b274629e1f1dd8d1ee726e9a522db19492249a520db7bc71a618980ab303cd83aa09a909f36e8ea544880292fa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3816410.exe

Filesize
291KB

MD5
a0ecf3a4b37b57c58ba8a88c12eae72b

SHA1
d4e55d1c68ebfc980d9f8f7d536152389ece5413

SHA256
36d976e3f19462375445be9ad92cac2f1c6c23e3501ffa31fd2bc85dd08168ef

SHA512
901f4482a9bd4db649050e651a49c9cc245cf20c0c148aa3fce20c8ac321e53684f05b7c73137c46d93b444befb5ff35fa8a35677a7812a2cd211adb8d198478

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3816410.exe

Filesize
291KB

MD5
a0ecf3a4b37b57c58ba8a88c12eae72b

SHA1
d4e55d1c68ebfc980d9f8f7d536152389ece5413

SHA256
36d976e3f19462375445be9ad92cac2f1c6c23e3501ffa31fd2bc85dd08168ef

SHA512
901f4482a9bd4db649050e651a49c9cc245cf20c0c148aa3fce20c8ac321e53684f05b7c73137c46d93b444befb5ff35fa8a35677a7812a2cd211adb8d198478

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
271KB

MD5
9ada6ba4571515dffd8e363e75f5b6f3

SHA1
b7517c7f8af7d9d52750a442a4b81046c56d5074

SHA256
9c6de79882a2c947037b145b0c72597ee3987c57fe6570262bf8a4909e84d4de

SHA512
2db322b0edfe5750d6825823dceedcd32de869d9ffbc1e48127feb6b1f961414de206212f87d63de6d882a905316106c3c1e08e89a4c2e7ba61f84ffe9bcdabf

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
271KB

MD5
9ada6ba4571515dffd8e363e75f5b6f3

SHA1
b7517c7f8af7d9d52750a442a4b81046c56d5074

SHA256
9c6de79882a2c947037b145b0c72597ee3987c57fe6570262bf8a4909e84d4de

SHA512
2db322b0edfe5750d6825823dceedcd32de869d9ffbc1e48127feb6b1f961414de206212f87d63de6d882a905316106c3c1e08e89a4c2e7ba61f84ffe9bcdabf

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
271KB

MD5
9ada6ba4571515dffd8e363e75f5b6f3

SHA1
b7517c7f8af7d9d52750a442a4b81046c56d5074

SHA256
9c6de79882a2c947037b145b0c72597ee3987c57fe6570262bf8a4909e84d4de

SHA512
2db322b0edfe5750d6825823dceedcd32de869d9ffbc1e48127feb6b1f961414de206212f87d63de6d882a905316106c3c1e08e89a4c2e7ba61f84ffe9bcdabf

Download Submit
memory/1864-229-0x0000000000400000-0x00000000006C3000-memory.dmp

Filesize
2.8MB

Download
memory/1864-230-0x0000000000400000-0x00000000006C3000-memory.dmp

Filesize
2.8MB

Download
memory/1864-231-0x0000000000400000-0x00000000006C3000-memory.dmp

Filesize
2.8MB

Download
memory/2180-152-0x00000000058B0000-0x00000000058C0000-memory.dmp

Filesize
64KB

Download
memory/2180-153-0x00000000058B0000-0x00000000058C0000-memory.dmp

Filesize
64KB

Download
memory/2180-154-0x000000000B900000-0x000000000B976000-memory.dmp

Filesize
472KB

Download
memory/2180-155-0x000000000BA20000-0x000000000BAB2000-memory.dmp

Filesize
584KB

Download
memory/2180-156-0x000000000C070000-0x000000000C614000-memory.dmp

Filesize
5.6MB

Download
memory/2180-157-0x000000000BBC0000-0x000000000BC26000-memory.dmp

Filesize
408KB

Download
memory/2180-158-0x000000000BC80000-0x000000000BCD0000-memory.dmp

Filesize
320KB

Download
memory/2180-159-0x000000000C7F0000-0x000000000C9B2000-memory.dmp

Filesize
1.8MB

Download
memory/2180-160-0x000000000CEF0000-0x000000000D41C000-memory.dmp

Filesize
5.2MB

Download
memory/2180-151-0x000000000AD20000-0x000000000AD5C000-memory.dmp

Filesize
240KB

Download
memory/2180-150-0x000000000ACC0000-0x000000000ACD2000-memory.dmp

Filesize
72KB

Download
memory/2180-149-0x000000000AD90000-0x000000000AE9A000-memory.dmp

Filesize
1.0MB

Download
memory/2180-148-0x000000000B260000-0x000000000B878000-memory.dmp

Filesize
6.1MB

Download
memory/2180-147-0x0000000000F50000-0x0000000000F80000-memory.dmp

Filesize
192KB

Download
memory/3500-171-0x00000000023E0000-0x00000000023F2000-memory.dmp

Filesize
72KB

Download
memory/3500-197-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/3500-179-0x00000000023E0000-0x00000000023F2000-memory.dmp

Filesize
72KB

Download
memory/3500-181-0x00000000023E0000-0x00000000023F2000-memory.dmp

Filesize
72KB

Download
memory/3500-183-0x00000000023E0000-0x00000000023F2000-memory.dmp

Filesize
72KB

Download
memory/3500-185-0x00000000023E0000-0x00000000023F2000-memory.dmp

Filesize
72KB

Download
memory/3500-187-0x00000000023E0000-0x00000000023F2000-memory.dmp

Filesize
72KB

Download
memory/3500-189-0x00000000023E0000-0x00000000023F2000-memory.dmp

Filesize
72KB

Download
memory/3500-191-0x00000000023E0000-0x00000000023F2000-memory.dmp

Filesize
72KB

Download
memory/3500-193-0x00000000023E0000-0x00000000023F2000-memory.dmp

Filesize
72KB

Download
memory/3500-194-0x0000000000720000-0x000000000074D000-memory.dmp

Filesize
180KB

Download
memory/3500-195-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/3500-196-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/3500-177-0x00000000023E0000-0x00000000023F2000-memory.dmp

Filesize
72KB

Download
memory/3500-198-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3500-199-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/3500-200-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/3500-201-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/3500-203-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3500-166-0x00000000023E0000-0x00000000023F2000-memory.dmp

Filesize
72KB

Download
memory/3500-175-0x00000000023E0000-0x00000000023F2000-memory.dmp

Filesize
72KB

Download
memory/3500-173-0x00000000023E0000-0x00000000023F2000-memory.dmp

Filesize
72KB

Download
memory/3500-167-0x00000000023E0000-0x00000000023F2000-memory.dmp

Filesize
72KB

Download
memory/3500-169-0x00000000023E0000-0x00000000023F2000-memory.dmp

Filesize
72KB

Download
memory/3740-227-0x0000000000400000-0x00000000006C3000-memory.dmp

Filesize
2.8MB

Download
memory/3740-212-0x0000000000400000-0x00000000006C3000-memory.dmp

Filesize
2.8MB

Download
memory/3740-211-0x00000000006D0000-0x0000000000705000-memory.dmp

Filesize
212KB

Download