redline | 182be8be9c525edb273ef4b2cec4b9cda6eb50e1a574b2ccaf93c2df95355d3b

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2023, 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

182be8be9c525edb273ef4b2cec4b9cda6eb50e1a574b2ccaf93c2df95355d3b.exe
Size

1.2MB
MD5

4db79e92ce0ad57440fcd54c6da2a8f1
SHA1

9927dbd1e8b47725ab0b3ceb8f41cc845627a49e
SHA256

182be8be9c525edb273ef4b2cec4b9cda6eb50e1a574b2ccaf93c2df95355d3b
SHA512

444ff5a1aac771a31dea3bdb749664e6d39215933c07933d54b66a64162ed7f4766e0156a19b42c2d2477ffe8fd44d7ff4abb8e83227e7c8709dec1699c1b9f0
SSDEEP

24576:ByMXIFME02NGs3yjr/WArfjT+zAei22YbyBD42gCl0whcHgLW3jM:0MXaMEHN1AjjqAeiWyBD4rCmweHgL+j

Score

10^/10

redline discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Signatures

Detects Redline Stealer samples 3 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/4440-155-0x00000000075A0000-0x0000000007BB8000-memory.dmp	redline_stealer
behavioral2/memory/4440-161-0x0000000007DD0000-0x0000000007E36000-memory.dmp	redline_stealer
behavioral2/memory/4440-166-0x0000000008BA0000-0x0000000008D62000-memory.dmp	redline_stealer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	h1627731.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	h1627731.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	h1627731.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	h1627731.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	h1627731.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	h1627731.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	i0751411.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	j8549508.exe

Executes dropped EXE 9 IoCs

pid	Process
2136	x6230605.exe
4500	x6019604.exe
4440	g6960692.exe
3588	h1627731.exe
4200	i0751411.exe
4568	1.exe
1120	j8549508.exe
4948	oneetx.exe
3336	oneetx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	h1627731.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	h1627731.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x6230605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x6230605.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x6019604.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x6019604.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Windows\\Temp\\1.exe"	i0751411.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	182be8be9c525edb273ef4b2cec4b9cda6eb50e1a574b2ccaf93c2df95355d3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	182be8be9c525edb273ef4b2cec4b9cda6eb50e1a574b2ccaf93c2df95355d3b.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 27 IoCs

pid	pid_target	Process	procid_target
4616	3588	WerFault.exe	93
4088	4200	WerFault.exe	96
3588	1120	WerFault.exe	100
1308	1120	WerFault.exe	100
3164	1120	WerFault.exe	100
316	1120	WerFault.exe	100
368	1120	WerFault.exe	100
3812	1120	WerFault.exe	100
912	1120	WerFault.exe	100
5112	1120	WerFault.exe	100
2492	1120	WerFault.exe	100
4592	1120	WerFault.exe	100
1944	4948	WerFault.exe	119
1004	4948	WerFault.exe	119
4352	4948	WerFault.exe	119
624	4948	WerFault.exe	119
1052	4948	WerFault.exe	119
3380	4948	WerFault.exe	119
3488	4948	WerFault.exe	119
4280	4948	WerFault.exe	119
4960	4948	WerFault.exe	119
3508	4948	WerFault.exe	119
3340	4948	WerFault.exe	119
4128	4948	WerFault.exe	119
1112	4948	WerFault.exe	119
4228	3336	WerFault.exe	158
3796	4948	WerFault.exe	119

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4440	g6960692.exe
4440	g6960692.exe
3588	h1627731.exe
3588	h1627731.exe
4568	1.exe
4568	1.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4440	g6960692.exe
Token: SeDebugPrivilege	3588	h1627731.exe
Token: SeDebugPrivilege	4200	i0751411.exe
Token: SeDebugPrivilege	4568	1.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1120	j8549508.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2136	2132	182be8be9c525edb273ef4b2cec4b9cda6eb50e1a574b2ccaf93c2df95355d3b.exe	83
PID 2132 wrote to memory of 2136	2132	182be8be9c525edb273ef4b2cec4b9cda6eb50e1a574b2ccaf93c2df95355d3b.exe	83
PID 2132 wrote to memory of 2136	2132	182be8be9c525edb273ef4b2cec4b9cda6eb50e1a574b2ccaf93c2df95355d3b.exe	83
PID 2136 wrote to memory of 4500	2136	x6230605.exe	84
PID 2136 wrote to memory of 4500	2136	x6230605.exe	84
PID 2136 wrote to memory of 4500	2136	x6230605.exe	84
PID 4500 wrote to memory of 4440	4500	x6019604.exe	85
PID 4500 wrote to memory of 4440	4500	x6019604.exe	85
PID 4500 wrote to memory of 4440	4500	x6019604.exe	85
PID 4500 wrote to memory of 3588	4500	x6019604.exe	93
PID 4500 wrote to memory of 3588	4500	x6019604.exe	93
PID 4500 wrote to memory of 3588	4500	x6019604.exe	93
PID 2136 wrote to memory of 4200	2136	x6230605.exe	96
PID 2136 wrote to memory of 4200	2136	x6230605.exe	96
PID 2136 wrote to memory of 4200	2136	x6230605.exe	96
PID 4200 wrote to memory of 4568	4200	i0751411.exe	97
PID 4200 wrote to memory of 4568	4200	i0751411.exe	97
PID 4200 wrote to memory of 4568	4200	i0751411.exe	97
PID 2132 wrote to memory of 1120	2132	182be8be9c525edb273ef4b2cec4b9cda6eb50e1a574b2ccaf93c2df95355d3b.exe	100
PID 2132 wrote to memory of 1120	2132	182be8be9c525edb273ef4b2cec4b9cda6eb50e1a574b2ccaf93c2df95355d3b.exe	100
PID 2132 wrote to memory of 1120	2132	182be8be9c525edb273ef4b2cec4b9cda6eb50e1a574b2ccaf93c2df95355d3b.exe	100
PID 1120 wrote to memory of 4948	1120	j8549508.exe	119
PID 1120 wrote to memory of 4948	1120	j8549508.exe	119
PID 1120 wrote to memory of 4948	1120	j8549508.exe	119
PID 4948 wrote to memory of 532	4948	oneetx.exe	136
PID 4948 wrote to memory of 532	4948	oneetx.exe	136
PID 4948 wrote to memory of 532	4948	oneetx.exe	136
PID 4948 wrote to memory of 4440	4948	oneetx.exe	144
PID 4948 wrote to memory of 4440	4948	oneetx.exe	144
PID 4948 wrote to memory of 4440	4948	oneetx.exe	144
PID 4440 wrote to memory of 5116	4440	cmd.exe	146
PID 4440 wrote to memory of 5116	4440	cmd.exe	146
PID 4440 wrote to memory of 5116	4440	cmd.exe	146
PID 4440 wrote to memory of 4300	4440	cmd.exe	147
PID 4440 wrote to memory of 4300	4440	cmd.exe	147
PID 4440 wrote to memory of 4300	4440	cmd.exe	147
PID 4440 wrote to memory of 1124	4440	cmd.exe	148
PID 4440 wrote to memory of 1124	4440	cmd.exe	148
PID 4440 wrote to memory of 1124	4440	cmd.exe	148
PID 4440 wrote to memory of 792	4440	cmd.exe	149
PID 4440 wrote to memory of 792	4440	cmd.exe	149
PID 4440 wrote to memory of 792	4440	cmd.exe	149
PID 4440 wrote to memory of 628	4440	cmd.exe	150
PID 4440 wrote to memory of 628	4440	cmd.exe	150
PID 4440 wrote to memory of 628	4440	cmd.exe	150
PID 4440 wrote to memory of 548	4440	cmd.exe	151
PID 4440 wrote to memory of 548	4440	cmd.exe	151
PID 4440 wrote to memory of 548	4440	cmd.exe	151

C:\Users\Admin\AppData\Local\Temp\182be8be9c525edb273ef4b2cec4b9cda6eb50e1a574b2ccaf93c2df95355d3b.exe
"C:\Users\Admin\AppData\Local\Temp\182be8be9c525edb273ef4b2cec4b9cda6eb50e1a574b2ccaf93c2df95355d3b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6230605.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6230605.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6019604.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6019604.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6960692.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6960692.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h1627731.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h1627731.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3588
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1080
        5⤵
        Program crash
        
        PID:4616
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i0751411.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i0751411.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4200
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 1372
      4⤵
      Program crash
      PID:4088
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8549508.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8549508.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 696
    3⤵
    - Program crash
    PID:3588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 708
    3⤵
    - Program crash
    PID:1308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 796
    3⤵
    - Program crash
    PID:3164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 968
    3⤵
    - Program crash
    PID:316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 988
    3⤵
    - Program crash
    PID:368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 988
    3⤵
    - Program crash
    PID:3812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 1216
    3⤵
    - Program crash
    PID:912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 1248
    3⤵
    - Program crash
    PID:5112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 1316
    3⤵
    - Program crash
    PID:2492
- - C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 692
      4⤵
      Program crash
      PID:1944
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 836
      4⤵
      Program crash
      PID:1004
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 912
      4⤵
      Program crash
      PID:4352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 1052
      4⤵
      Program crash
      PID:624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 1092
      4⤵
      Program crash
      PID:1052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 1116
      4⤵
      Program crash
      PID:3380
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 1068
      4⤵
      Program crash
      PID:3488
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:532
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 992
      4⤵
      Program crash
      PID:4280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 1300
      4⤵
      Program crash
      PID:4960
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4440
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:5116
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        5⤵
        
        PID:4300
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        5⤵
        
        PID:1124
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:792
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c3912af058" /P "Admin:N"
        5⤵
        
        PID:628
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c3912af058" /P "Admin:R" /E
        5⤵
        
        PID:548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 904
      4⤵
      Program crash
      PID:3508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 1292
      4⤵
      Program crash
      PID:3340
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 792
      4⤵
      Program crash
      PID:4128
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 804
      4⤵
      Program crash
      PID:1112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 1120
      4⤵
      Program crash
      PID:3796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 1388
    3⤵
    - Program crash
    PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3588 -ip 3588
1⤵
PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4200 -ip 4200
1⤵
PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1120 -ip 1120
1⤵
PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1120 -ip 1120
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1120 -ip 1120
1⤵
PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1120 -ip 1120
1⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1120 -ip 1120
1⤵
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1120 -ip 1120
1⤵
PID:420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1120 -ip 1120
1⤵
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1120 -ip 1120
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1120 -ip 1120
1⤵
PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1120 -ip 1120
1⤵
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4948 -ip 4948
1⤵
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4948 -ip 4948
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4948 -ip 4948
1⤵
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4948 -ip 4948
1⤵
PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4948 -ip 4948
1⤵
PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4948 -ip 4948
1⤵
PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4948 -ip 4948
1⤵
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4948 -ip 4948
1⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4948 -ip 4948
1⤵
PID:676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4948 -ip 4948
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4948 -ip 4948
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4948 -ip 4948
1⤵
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4948 -ip 4948
1⤵
PID:2308

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
1⤵
- Executes dropped EXE
PID:3336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 312
  2⤵
  - Program crash
  PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3336 -ip 3336
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4948 -ip 4948
1⤵
PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8549508.exe

Filesize
339KB

MD5
e2094071bc51633b6dc4a9b3e141a531

SHA1
49e25e6c4c75c1088e44174e98455e45db6f5aee

SHA256
119bb8518b796e30b28974eeebf504de7f592fea9326c0498dccee95c98ff8ed

SHA512
8f7a20c37b73da9e713250469979e1c2cce88f3c4ec533052abd71df6adee6336acb80c29424b1cf6a4fd09c0d58e9411be11df7d2ce6fe55d1f6c87dc9190d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8549508.exe

Filesize
339KB

MD5
e2094071bc51633b6dc4a9b3e141a531

SHA1
49e25e6c4c75c1088e44174e98455e45db6f5aee

SHA256
119bb8518b796e30b28974eeebf504de7f592fea9326c0498dccee95c98ff8ed

SHA512
8f7a20c37b73da9e713250469979e1c2cce88f3c4ec533052abd71df6adee6336acb80c29424b1cf6a4fd09c0d58e9411be11df7d2ce6fe55d1f6c87dc9190d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6230605.exe

Filesize
914KB

MD5
d960f6e7892a1ebb893e5270e1703a8a

SHA1
5075d2288a3dd16bf1e0ea1665c3b95d8dfd09ed

SHA256
45410da8c1fd69babb37756ad61ba599510f5a6611cb47fd24bf053f2cb5894a

SHA512
c88b00134f6dd8bffe2e87feb7afe247a25d48b6b12847b915720fc3f6409c5910b6dde5287be3feb45944d442a654f0c0246c1fe1416f1d2bb983074eccccac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6230605.exe

Filesize
914KB

MD5
d960f6e7892a1ebb893e5270e1703a8a

SHA1
5075d2288a3dd16bf1e0ea1665c3b95d8dfd09ed

SHA256
45410da8c1fd69babb37756ad61ba599510f5a6611cb47fd24bf053f2cb5894a

SHA512
c88b00134f6dd8bffe2e87feb7afe247a25d48b6b12847b915720fc3f6409c5910b6dde5287be3feb45944d442a654f0c0246c1fe1416f1d2bb983074eccccac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i0751411.exe

Filesize
547KB

MD5
24bd0e92931e4b091940c6f3aecf96f2

SHA1
1e333ac6accf3e96bbb5cbd680b442fb53bb2e73

SHA256
7bb4f311f6ab710f81ffece9473fb487fb1b0654c439b760442974343a027bc3

SHA512
dee791cc3d334983c4d8b87c0d77974820bd27869f3e19ce48c17313a75d108ad255f52877cabddd3f0c77adf109decc7462f2e88fb6773c6bf6f41d31cb7a27

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i0751411.exe

Filesize
547KB

MD5
24bd0e92931e4b091940c6f3aecf96f2

SHA1
1e333ac6accf3e96bbb5cbd680b442fb53bb2e73

SHA256
7bb4f311f6ab710f81ffece9473fb487fb1b0654c439b760442974343a027bc3

SHA512
dee791cc3d334983c4d8b87c0d77974820bd27869f3e19ce48c17313a75d108ad255f52877cabddd3f0c77adf109decc7462f2e88fb6773c6bf6f41d31cb7a27

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6019604.exe

Filesize
416KB

MD5
b1c257311a6a4d2661974abd907644b3

SHA1
c033b5e32a4946a9f059955f23c0d260b65f184b

SHA256
019a0614078a8fe24220885dc9aea97776e6cf10521aa098e505a8629007b46c

SHA512
831375b4c957c0f603a44dce51d691cd8a81d7317251802c817a215bceeb0d6b760586dc088639d17f0d4d6f013ac09dfa890ad9fe020fa0c77cbdc5c212d42a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6019604.exe

Filesize
416KB

MD5
b1c257311a6a4d2661974abd907644b3

SHA1
c033b5e32a4946a9f059955f23c0d260b65f184b

SHA256
019a0614078a8fe24220885dc9aea97776e6cf10521aa098e505a8629007b46c

SHA512
831375b4c957c0f603a44dce51d691cd8a81d7317251802c817a215bceeb0d6b760586dc088639d17f0d4d6f013ac09dfa890ad9fe020fa0c77cbdc5c212d42a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6960692.exe

Filesize
136KB

MD5
428633935f35b956fa7264075864e0fe

SHA1
03ef9ea3f5c361a77452e80add4540023c7aad20

SHA256
c192c6e3a99d905e9515aff735b31274c9f992a70afc918b00b08ba78894244a

SHA512
48a0073c485154b99c36a2fe5f081a2fd9bcffd577ef9deb8ee618e22428c64ce9824158f47d546b6fb90e892346638c49a1783b3329376518008417228c9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6960692.exe

Filesize
136KB

MD5
428633935f35b956fa7264075864e0fe

SHA1
03ef9ea3f5c361a77452e80add4540023c7aad20

SHA256
c192c6e3a99d905e9515aff735b31274c9f992a70afc918b00b08ba78894244a

SHA512
48a0073c485154b99c36a2fe5f081a2fd9bcffd577ef9deb8ee618e22428c64ce9824158f47d546b6fb90e892346638c49a1783b3329376518008417228c9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h1627731.exe

Filesize
360KB

MD5
f7e44bbb47ce449076708defaff2bd20

SHA1
d9586fd5c7b861537ef3b48e69871aa2e88d0ce0

SHA256
50c56e4890a2f03761e77bb82d5c94caab76ce80714867ed54933496c4f66f7a

SHA512
c46c466552a44077b69804356644990bcd1184e1eff2af64f446f65978e9ffc4e6e82fbd30dc11d04fdebcd3ff310334e18d296cea7e727dfc62b74084f477d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h1627731.exe

Filesize
360KB

MD5
f7e44bbb47ce449076708defaff2bd20

SHA1
d9586fd5c7b861537ef3b48e69871aa2e88d0ce0

SHA256
50c56e4890a2f03761e77bb82d5c94caab76ce80714867ed54933496c4f66f7a

SHA512
c46c466552a44077b69804356644990bcd1184e1eff2af64f446f65978e9ffc4e6e82fbd30dc11d04fdebcd3ff310334e18d296cea7e727dfc62b74084f477d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
339KB

MD5
e2094071bc51633b6dc4a9b3e141a531

SHA1
49e25e6c4c75c1088e44174e98455e45db6f5aee

SHA256
119bb8518b796e30b28974eeebf504de7f592fea9326c0498dccee95c98ff8ed

SHA512
8f7a20c37b73da9e713250469979e1c2cce88f3c4ec533052abd71df6adee6336acb80c29424b1cf6a4fd09c0d58e9411be11df7d2ce6fe55d1f6c87dc9190d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
339KB

MD5
e2094071bc51633b6dc4a9b3e141a531

SHA1
49e25e6c4c75c1088e44174e98455e45db6f5aee

SHA256
119bb8518b796e30b28974eeebf504de7f592fea9326c0498dccee95c98ff8ed

SHA512
8f7a20c37b73da9e713250469979e1c2cce88f3c4ec533052abd71df6adee6336acb80c29424b1cf6a4fd09c0d58e9411be11df7d2ce6fe55d1f6c87dc9190d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
339KB

MD5
e2094071bc51633b6dc4a9b3e141a531

SHA1
49e25e6c4c75c1088e44174e98455e45db6f5aee

SHA256
119bb8518b796e30b28974eeebf504de7f592fea9326c0498dccee95c98ff8ed

SHA512
8f7a20c37b73da9e713250469979e1c2cce88f3c4ec533052abd71df6adee6336acb80c29424b1cf6a4fd09c0d58e9411be11df7d2ce6fe55d1f6c87dc9190d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
339KB

MD5
e2094071bc51633b6dc4a9b3e141a531

SHA1
49e25e6c4c75c1088e44174e98455e45db6f5aee

SHA256
119bb8518b796e30b28974eeebf504de7f592fea9326c0498dccee95c98ff8ed

SHA512
8f7a20c37b73da9e713250469979e1c2cce88f3c4ec533052abd71df6adee6336acb80c29424b1cf6a4fd09c0d58e9411be11df7d2ce6fe55d1f6c87dc9190d1

Download Submit
C:\Windows\Temp\1.exe

Filesize
136KB

MD5
6b4ad9c773e164effa4804bf294831a7

SHA1
6a0bfcfaf73aff765b7d515f2527773df326f2cc

SHA256
967d69ee61666a88719486692c18ba56a85516035b6b7dacfde589417d3b5c85

SHA512
accbdf423c36f8d688adeccfc683c6ac5ab983f6f5461554a1cdbfcd8dfb9cf29bfe75cdf6755dd70fa5c29f0fda4a2119f468dd0c42d80c8d0b0aee1a2137d8

Download Submit
C:\Windows\Temp\1.exe

Filesize
136KB

MD5
6b4ad9c773e164effa4804bf294831a7

SHA1
6a0bfcfaf73aff765b7d515f2527773df326f2cc

SHA256
967d69ee61666a88719486692c18ba56a85516035b6b7dacfde589417d3b5c85

SHA512
accbdf423c36f8d688adeccfc683c6ac5ab983f6f5461554a1cdbfcd8dfb9cf29bfe75cdf6755dd70fa5c29f0fda4a2119f468dd0c42d80c8d0b0aee1a2137d8

Download Submit
C:\Windows\Temp\1.exe

Filesize
136KB

MD5
6b4ad9c773e164effa4804bf294831a7

SHA1
6a0bfcfaf73aff765b7d515f2527773df326f2cc

SHA256
967d69ee61666a88719486692c18ba56a85516035b6b7dacfde589417d3b5c85

SHA512
accbdf423c36f8d688adeccfc683c6ac5ab983f6f5461554a1cdbfcd8dfb9cf29bfe75cdf6755dd70fa5c29f0fda4a2119f468dd0c42d80c8d0b0aee1a2137d8

Download Submit
memory/1120-2425-0x0000000002260000-0x0000000002295000-memory.dmp

Filesize
212KB

Download
memory/1120-2427-0x0000000002260000-0x0000000002295000-memory.dmp

Filesize
212KB

Download
memory/3588-206-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/3588-210-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/3588-174-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3588-175-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3588-177-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3588-179-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3588-181-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3588-183-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3588-185-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3588-187-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3588-189-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3588-191-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3588-193-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3588-195-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3588-198-0x0000000002340000-0x000000000236D000-memory.dmp

Filesize
180KB

Download
memory/3588-197-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3588-201-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/3588-202-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3588-199-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/3588-205-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3588-203-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/3588-211-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/3588-208-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/3588-209-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/4200-221-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-245-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download
memory/4200-2404-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download
memory/4200-252-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-216-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-217-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-219-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-250-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-223-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-225-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-227-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-229-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-231-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-233-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-235-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-237-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-239-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-241-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-243-0x00000000023B0000-0x000000000240C000-memory.dmp

Filesize
368KB

Download
memory/4200-248-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-244-0x00000000053D0000-0x0000000005431000-memory.dmp

Filesize
388KB

Download
memory/4200-247-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download
memory/4440-158-0x0000000007080000-0x00000000070BC000-memory.dmp

Filesize
240KB

Download
memory/4440-161-0x0000000007DD0000-0x0000000007E36000-memory.dmp

Filesize
408KB

Download
memory/4440-165-0x0000000008220000-0x0000000008296000-memory.dmp

Filesize
472KB

Download
memory/4440-166-0x0000000008BA0000-0x0000000008D62000-memory.dmp

Filesize
1.8MB

Download
memory/4440-164-0x0000000000A30000-0x0000000000A80000-memory.dmp

Filesize
320KB

Download
memory/4440-163-0x0000000008100000-0x0000000008192000-memory.dmp

Filesize
584KB

Download
memory/4440-162-0x00000000085F0000-0x0000000008B94000-memory.dmp

Filesize
5.6MB

Download
memory/4440-154-0x0000000000310000-0x0000000000338000-memory.dmp

Filesize
160KB

Download
memory/4440-168-0x0000000008200000-0x000000000821E000-memory.dmp

Filesize
120KB

Download
memory/4440-160-0x0000000007430000-0x0000000007440000-memory.dmp

Filesize
64KB

Download
memory/4440-155-0x00000000075A0000-0x0000000007BB8000-memory.dmp

Filesize
6.1MB

Download
memory/4440-159-0x0000000007430000-0x0000000007440000-memory.dmp

Filesize
64KB

Download
memory/4440-167-0x00000000092A0000-0x00000000097CC000-memory.dmp

Filesize
5.2MB

Download
memory/4440-157-0x0000000007150000-0x000000000725A000-memory.dmp

Filesize
1.0MB

Download
memory/4440-156-0x0000000007020000-0x0000000007032000-memory.dmp

Filesize
72KB

Download
memory/4568-2417-0x0000000007C30000-0x0000000007C40000-memory.dmp

Filesize
64KB

Download
memory/4568-2416-0x0000000000B20000-0x0000000000B48000-memory.dmp

Filesize
160KB

Download