redline | 2ca1cc33308c5659d242382bbbaefaa2fbe79a94280a433960fd80a749294e5c

Analysis

max time kernel
148s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2023, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2ca1cc33308c5659d242382bbbaefaa2fbe79a94280a433960fd80a749294e5c.exe
Size

567KB
MD5

dd76f10ea56a61daf4771201f0c7d404
SHA1

ff47594cb73469c2e3729ebb17060fa23d334c2a
SHA256

2ca1cc33308c5659d242382bbbaefaa2fbe79a94280a433960fd80a749294e5c
SHA512

9744884d77e28033d9dd1f09d07cfb2f5d621fff7ad9641f279b587265e01607d5a9e972fcbc79c88ca5515c2f34c0475a6ccba22123e71e697c324423ba281b
SSDEEP

12288:BMrxy90Hn3i0kdIzZG0XHR+hjTSj6WGoSh6lMJwnUnjq:8yMRkudfHR6jTS+BMGCnUnjq

Score

10^/10

redline darm discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

darm

217.196.96.56:4138

Attributes

auth_value
d88ac8ccc04ab9979b04b46313db1648

Signatures

Detects Redline Stealer samples 3 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/1020-148-0x0000000005AC0000-0x00000000060D8000-memory.dmp	redline_stealer
behavioral2/memory/1020-157-0x00000000061E0000-0x0000000006246000-memory.dmp	redline_stealer
behavioral2/memory/1020-158-0x00000000068A0000-0x0000000006A62000-memory.dmp	redline_stealer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	l8249326.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	l8249326.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	l8249326.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	l8249326.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	l8249326.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	l8249326.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	m2867627.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 5 IoCs

pid	Process
3720	y3949061.exe
1020	k1432945.exe
2208	l8249326.exe
1208	m2867627.exe
2464	oneetx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	l8249326.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	l8249326.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2ca1cc33308c5659d242382bbbaefaa2fbe79a94280a433960fd80a749294e5c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y3949061.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y3949061.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	2ca1cc33308c5659d242382bbbaefaa2fbe79a94280a433960fd80a749294e5c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 23 IoCs

pid	pid_target	Process	procid_target
2300	1208	WerFault.exe	86
4788	1208	WerFault.exe	86
2776	1208	WerFault.exe	86
1908	1208	WerFault.exe	86
4988	1208	WerFault.exe	86
4448	1208	WerFault.exe	86
3780	1208	WerFault.exe	86
3360	1208	WerFault.exe	86
3080	1208	WerFault.exe	86
3208	1208	WerFault.exe	86
1344	2464	WerFault.exe	106
4964	2464	WerFault.exe	106
2468	2464	WerFault.exe	106
688	2464	WerFault.exe	106
3784	2464	WerFault.exe	106
3064	2464	WerFault.exe	106
4384	2464	WerFault.exe	106
4020	2464	WerFault.exe	106
4556	2464	WerFault.exe	106
180	2464	WerFault.exe	106
428	2464	WerFault.exe	106
2500	2464	WerFault.exe	106
3088	2464	WerFault.exe	106

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1020	k1432945.exe
1020	k1432945.exe
2208	l8249326.exe
2208	l8249326.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1020	k1432945.exe
Token: SeDebugPrivilege	2208	l8249326.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1208	m2867627.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 3720	5064	2ca1cc33308c5659d242382bbbaefaa2fbe79a94280a433960fd80a749294e5c.exe	81
PID 5064 wrote to memory of 3720	5064	2ca1cc33308c5659d242382bbbaefaa2fbe79a94280a433960fd80a749294e5c.exe	81
PID 5064 wrote to memory of 3720	5064	2ca1cc33308c5659d242382bbbaefaa2fbe79a94280a433960fd80a749294e5c.exe	81
PID 3720 wrote to memory of 1020	3720	y3949061.exe	82
PID 3720 wrote to memory of 1020	3720	y3949061.exe	82
PID 3720 wrote to memory of 1020	3720	y3949061.exe	82
PID 3720 wrote to memory of 2208	3720	y3949061.exe	85
PID 3720 wrote to memory of 2208	3720	y3949061.exe	85
PID 3720 wrote to memory of 2208	3720	y3949061.exe	85
PID 5064 wrote to memory of 1208	5064	2ca1cc33308c5659d242382bbbaefaa2fbe79a94280a433960fd80a749294e5c.exe	86
PID 5064 wrote to memory of 1208	5064	2ca1cc33308c5659d242382bbbaefaa2fbe79a94280a433960fd80a749294e5c.exe	86
PID 5064 wrote to memory of 1208	5064	2ca1cc33308c5659d242382bbbaefaa2fbe79a94280a433960fd80a749294e5c.exe	86
PID 1208 wrote to memory of 2464	1208	m2867627.exe	106
PID 1208 wrote to memory of 2464	1208	m2867627.exe	106
PID 1208 wrote to memory of 2464	1208	m2867627.exe	106
PID 2464 wrote to memory of 1216	2464	oneetx.exe	123
PID 2464 wrote to memory of 1216	2464	oneetx.exe	123
PID 2464 wrote to memory of 1216	2464	oneetx.exe	123
PID 2464 wrote to memory of 2640	2464	oneetx.exe	129
PID 2464 wrote to memory of 2640	2464	oneetx.exe	129
PID 2464 wrote to memory of 2640	2464	oneetx.exe	129
PID 2640 wrote to memory of 3056	2640	cmd.exe	133
PID 2640 wrote to memory of 3056	2640	cmd.exe	133
PID 2640 wrote to memory of 3056	2640	cmd.exe	133
PID 2640 wrote to memory of 2656	2640	cmd.exe	134
PID 2640 wrote to memory of 2656	2640	cmd.exe	134
PID 2640 wrote to memory of 2656	2640	cmd.exe	134
PID 2640 wrote to memory of 4908	2640	cmd.exe	135
PID 2640 wrote to memory of 4908	2640	cmd.exe	135
PID 2640 wrote to memory of 4908	2640	cmd.exe	135
PID 2640 wrote to memory of 3524	2640	cmd.exe	137
PID 2640 wrote to memory of 3524	2640	cmd.exe	137
PID 2640 wrote to memory of 3524	2640	cmd.exe	137
PID 2640 wrote to memory of 4640	2640	cmd.exe	136
PID 2640 wrote to memory of 4640	2640	cmd.exe	136
PID 2640 wrote to memory of 4640	2640	cmd.exe	136
PID 2640 wrote to memory of 2884	2640	cmd.exe	138
PID 2640 wrote to memory of 2884	2640	cmd.exe	138
PID 2640 wrote to memory of 2884	2640	cmd.exe	138

C:\Users\Admin\AppData\Local\Temp\2ca1cc33308c5659d242382bbbaefaa2fbe79a94280a433960fd80a749294e5c.exe
"C:\Users\Admin\AppData\Local\Temp\2ca1cc33308c5659d242382bbbaefaa2fbe79a94280a433960fd80a749294e5c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3949061.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3949061.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1432945.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1432945.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8249326.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8249326.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m2867627.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m2867627.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 696
    3⤵
    - Program crash
    PID:2300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 780
    3⤵
    - Program crash
    PID:4788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 860
    3⤵
    - Program crash
    PID:2776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 972
    3⤵
    - Program crash
    PID:1908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 1012
    3⤵
    - Program crash
    PID:4988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 988
    3⤵
    - Program crash
    PID:4448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 1152
    3⤵
    - Program crash
    PID:3780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 1244
    3⤵
    - Program crash
    PID:3360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 1316
    3⤵
    - Program crash
    PID:3080
- - C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 692
      4⤵
      Program crash
      PID:1344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 884
      4⤵
      Program crash
      PID:4964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 884
      4⤵
      Program crash
      PID:2468
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 1052
      4⤵
      Program crash
      PID:688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 1052
      4⤵
      Program crash
      PID:3784
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 1052
      4⤵
      Program crash
      PID:3064
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 1128
      4⤵
      Program crash
      PID:4384
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:1216
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 992
      4⤵
      Program crash
      PID:4020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 756
      4⤵
      Program crash
      PID:4556
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:3056
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        5⤵
        
        PID:2656
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        5⤵
        
        PID:4908
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c3912af058" /P "Admin:N"
        5⤵
        
        PID:4640
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:3524
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c3912af058" /P "Admin:R" /E
        5⤵
        
        PID:2884
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 728
      4⤵
      Program crash
      PID:180
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 752
      4⤵
      Program crash
      PID:428
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 764
      4⤵
      Program crash
      PID:2500
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 1216
      4⤵
      Program crash
      PID:3088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 1356
    3⤵
    - Program crash
    PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1208 -ip 1208
1⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1208 -ip 1208
1⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1208 -ip 1208
1⤵
PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1208 -ip 1208
1⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1208 -ip 1208
1⤵
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1208 -ip 1208
1⤵
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1208 -ip 1208
1⤵
PID:2676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1208 -ip 1208
1⤵
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1208 -ip 1208
1⤵
PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1208 -ip 1208
1⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2464 -ip 2464
1⤵
PID:780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2464 -ip 2464
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2464 -ip 2464
1⤵
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2464 -ip 2464
1⤵
PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2464 -ip 2464
1⤵
PID:968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2464 -ip 2464
1⤵
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2464 -ip 2464
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2464 -ip 2464
1⤵
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2464 -ip 2464
1⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2464 -ip 2464
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2464 -ip 2464
1⤵
PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 2464 -ip 2464
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2464 -ip 2464
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m2867627.exe

Filesize
271KB

MD5
3759b1957286fe85032423d30e54361e

SHA1
d23ecf62ee10a1259b078efc9cba20a023f202f6

SHA256
91c9590977e63873815173bbf2f1c161e9f31dfbfef4b557685d2a3123a7535e

SHA512
b35807f12787ecf9174fb1a75ce8f19981dfc8233bd5ecec4f12a711429e1aceee620320a57d58e12ba30f8a4229f4104d7b5b2ad7de3ec1f1a9d7f6d10de671

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m2867627.exe

Filesize
271KB

MD5
3759b1957286fe85032423d30e54361e

SHA1
d23ecf62ee10a1259b078efc9cba20a023f202f6

SHA256
91c9590977e63873815173bbf2f1c161e9f31dfbfef4b557685d2a3123a7535e

SHA512
b35807f12787ecf9174fb1a75ce8f19981dfc8233bd5ecec4f12a711429e1aceee620320a57d58e12ba30f8a4229f4104d7b5b2ad7de3ec1f1a9d7f6d10de671

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3949061.exe

Filesize
307KB

MD5
e0c1028a27cc2bc37135cdea785518a7

SHA1
4cf5461739106820f4928e8f4f2e03eca0bca04d

SHA256
18b1f9a35471e12347ca8ad1cfbb74f3de9789f1108fc14f0356622d6635415a

SHA512
f5aba63bed774ecbd82404147e9088adbb3aa37b9e28af0e3b349d2cc9200c37ab640512f1fbc1d64f0b2f4fe48cae54196a212fddb5e15885dcae8059cd34ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3949061.exe

Filesize
307KB

MD5
e0c1028a27cc2bc37135cdea785518a7

SHA1
4cf5461739106820f4928e8f4f2e03eca0bca04d

SHA256
18b1f9a35471e12347ca8ad1cfbb74f3de9789f1108fc14f0356622d6635415a

SHA512
f5aba63bed774ecbd82404147e9088adbb3aa37b9e28af0e3b349d2cc9200c37ab640512f1fbc1d64f0b2f4fe48cae54196a212fddb5e15885dcae8059cd34ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1432945.exe

Filesize
168KB

MD5
a58d88523c9d687caed53d6d1cbb155a

SHA1
8c3b67ddd2c32633c0e25e0d7859043b366fe74f

SHA256
bee636368463b1636b9d0dfc9000242ffef582c6b9c39ca72223ab31fb99aaad

SHA512
0393f511fadca02afec41efcab75a4867ca1d930c6478702487c3f4ac4d372fb22a28ad0525b21f363792b643acbc3979e3fad4b6f24e53842280da9b505794e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1432945.exe

Filesize
168KB

MD5
a58d88523c9d687caed53d6d1cbb155a

SHA1
8c3b67ddd2c32633c0e25e0d7859043b366fe74f

SHA256
bee636368463b1636b9d0dfc9000242ffef582c6b9c39ca72223ab31fb99aaad

SHA512
0393f511fadca02afec41efcab75a4867ca1d930c6478702487c3f4ac4d372fb22a28ad0525b21f363792b643acbc3979e3fad4b6f24e53842280da9b505794e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8249326.exe

Filesize
177KB

MD5
4d4f60e85058f29bada4601bb291fd76

SHA1
52d11f5d1c4473c66fb036c38014e406ecb38dc1

SHA256
e79819de52f5b817e2a5cafacfaa1f957bb947a31f38d07c55b263dbb8f39f96

SHA512
d3b422267a501891053e52fb736a07e51a0ebe48da1d82fae23f282a67d738ee99fb8c8f00fe6b046e1645bef98f5cc197cfb9181209e38f3f77b3e8973ab8d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8249326.exe

Filesize
177KB

MD5
4d4f60e85058f29bada4601bb291fd76

SHA1
52d11f5d1c4473c66fb036c38014e406ecb38dc1

SHA256
e79819de52f5b817e2a5cafacfaa1f957bb947a31f38d07c55b263dbb8f39f96

SHA512
d3b422267a501891053e52fb736a07e51a0ebe48da1d82fae23f282a67d738ee99fb8c8f00fe6b046e1645bef98f5cc197cfb9181209e38f3f77b3e8973ab8d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
271KB

MD5
3759b1957286fe85032423d30e54361e

SHA1
d23ecf62ee10a1259b078efc9cba20a023f202f6

SHA256
91c9590977e63873815173bbf2f1c161e9f31dfbfef4b557685d2a3123a7535e

SHA512
b35807f12787ecf9174fb1a75ce8f19981dfc8233bd5ecec4f12a711429e1aceee620320a57d58e12ba30f8a4229f4104d7b5b2ad7de3ec1f1a9d7f6d10de671

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
271KB

MD5
3759b1957286fe85032423d30e54361e

SHA1
d23ecf62ee10a1259b078efc9cba20a023f202f6

SHA256
91c9590977e63873815173bbf2f1c161e9f31dfbfef4b557685d2a3123a7535e

SHA512
b35807f12787ecf9174fb1a75ce8f19981dfc8233bd5ecec4f12a711429e1aceee620320a57d58e12ba30f8a4229f4104d7b5b2ad7de3ec1f1a9d7f6d10de671

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
271KB

MD5
3759b1957286fe85032423d30e54361e

SHA1
d23ecf62ee10a1259b078efc9cba20a023f202f6

SHA256
91c9590977e63873815173bbf2f1c161e9f31dfbfef4b557685d2a3123a7535e

SHA512
b35807f12787ecf9174fb1a75ce8f19981dfc8233bd5ecec4f12a711429e1aceee620320a57d58e12ba30f8a4229f4104d7b5b2ad7de3ec1f1a9d7f6d10de671

Download Submit
memory/1020-153-0x0000000005390000-0x00000000053A0000-memory.dmp

Filesize
64KB

Download
memory/1020-159-0x0000000008D50000-0x000000000927C000-memory.dmp

Filesize
5.2MB

Download
memory/1020-152-0x0000000005390000-0x00000000053A0000-memory.dmp

Filesize
64KB

Download
memory/1020-147-0x0000000000AD0000-0x0000000000B00000-memory.dmp

Filesize
192KB

Download
memory/1020-154-0x00000000058D0000-0x0000000005946000-memory.dmp

Filesize
472KB

Download
memory/1020-155-0x00000000059F0000-0x0000000005A82000-memory.dmp

Filesize
584KB

Download
memory/1020-156-0x0000000006B80000-0x0000000007124000-memory.dmp

Filesize
5.6MB

Download
memory/1020-157-0x00000000061E0000-0x0000000006246000-memory.dmp

Filesize
408KB

Download
memory/1020-158-0x00000000068A0000-0x0000000006A62000-memory.dmp

Filesize
1.8MB

Download
memory/1020-151-0x0000000005350000-0x000000000538C000-memory.dmp

Filesize
240KB

Download
memory/1020-160-0x0000000006750000-0x00000000067A0000-memory.dmp

Filesize
320KB

Download
memory/1020-148-0x0000000005AC0000-0x00000000060D8000-memory.dmp

Filesize
6.1MB

Download
memory/1020-149-0x00000000055B0000-0x00000000056BA000-memory.dmp

Filesize
1.0MB

Download
memory/1020-150-0x0000000005330000-0x0000000005342000-memory.dmp

Filesize
72KB

Download
memory/1208-223-0x0000000000400000-0x00000000006C3000-memory.dmp

Filesize
2.8MB

Download
memory/1208-204-0x00000000006D0000-0x0000000000705000-memory.dmp

Filesize
212KB

Download
memory/1208-205-0x0000000000400000-0x00000000006C3000-memory.dmp

Filesize
2.8MB

Download
memory/1208-206-0x00000000006D0000-0x0000000000705000-memory.dmp

Filesize
212KB

Download
memory/2208-170-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/2208-178-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/2208-180-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/2208-182-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/2208-184-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/2208-188-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/2208-186-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/2208-190-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/2208-192-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/2208-193-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/2208-194-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/2208-195-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/2208-176-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/2208-174-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/2208-172-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/2208-168-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/2208-166-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/2208-165-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/2208-196-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/2208-197-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/2208-199-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/2464-224-0x0000000000400000-0x00000000006C3000-memory.dmp

Filesize
2.8MB

Download
memory/2464-227-0x0000000000400000-0x00000000006C3000-memory.dmp

Filesize
2.8MB

Download
memory/2464-228-0x0000000000400000-0x00000000006C3000-memory.dmp

Filesize
2.8MB

Download