redline | 135257fe458194d7d210a195226d01604562ea055730d6971c5da87e89c1d0fb

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2023 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

135257fe458194d7d210a195226d01604562ea055730d6971c5da87e89c1d0fb.exe
Size

1.0MB
MD5

58cfee6b230bea3aa08289550f453c8e
SHA1

0f6d48e44aeffb790aed267115cbbd4a651ae650
SHA256

135257fe458194d7d210a195226d01604562ea055730d6971c5da87e89c1d0fb
SHA512

29d77a3e23932f188dd17ae21ec70c3bae55d8584931f2271255a09ed929cc536c704dace5344762729d2e6afc59af73488e8d8b6cc04f8aced3d88a43e9c465
SSDEEP

24576:ZyCeCcsPM0lhQZVjo3IJmi7AxdJM5wpoYe6B:MCeCcykXmUmi7AxduPYe6

Score

10^/10

redline dix discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

dix

77.91.124.251:19065

Attributes

auth_value
9b544b3d9c88af32e2f5bf8705f9a2fb

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

g3579801.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	g3579801.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	g3579801.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	g3579801.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	g3579801.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	g3579801.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	g3579801.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2836-219-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/2836-220-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/2836-222-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/2836-224-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/2836-226-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/2836-228-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/2836-230-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/2836-232-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/2836-234-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/2836-236-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/2836-238-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/2836-240-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/2836-242-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/2836-244-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/2836-246-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/2836-248-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/2836-250-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/208-427-0x0000000006F80000-0x0000000006F90000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

h6835038.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	h6835038.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 14 IoCs

Processes:

x9343926.exex8869877.exef6115547.exeg3579801.exeh6835038.exeh6835038.exeh6835038.exei7988392.exeoneetx.exeoneetx.exeoneetx.exeoneetx.exeoneetx.exeoneetx.exe

pid	process
112	x9343926.exe
4324	x8869877.exe
3888	f6115547.exe
1384	g3579801.exe
4908	h6835038.exe
4860	h6835038.exe
4728	h6835038.exe
2836	i7988392.exe
208	oneetx.exe
4272	oneetx.exe
4588	oneetx.exe
2584	oneetx.exe
2084	oneetx.exe
2244	oneetx.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1860 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1860	rundll32.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

g3579801.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	g3579801.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	g3579801.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

135257fe458194d7d210a195226d01604562ea055730d6971c5da87e89c1d0fb.exex9343926.exex8869877.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	135257fe458194d7d210a195226d01604562ea055730d6971c5da87e89c1d0fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	135257fe458194d7d210a195226d01604562ea055730d6971c5da87e89c1d0fb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x9343926.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x9343926.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x8869877.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x8869877.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 4 IoCs

Processes:

h6835038.exeoneetx.exeoneetx.exeoneetx.exe

description	pid	process	target process
PID 4908 set thread context of 4728	4908	h6835038.exe	h6835038.exe
PID 208 set thread context of 4272	208	oneetx.exe	oneetx.exe
PID 4588 set thread context of 2584	4588	oneetx.exe	oneetx.exe
PID 2084 set thread context of 2244	2084	oneetx.exe	oneetx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4916 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

f6115547.exeg3579801.exei7988392.exe

pid process

3888 f6115547.exe
3888 f6115547.exe
1384 g3579801.exe
1384 g3579801.exe
2836 i7988392.exe
2836 i7988392.exe

pid	process
4916	schtasks.exe

pid	process
3888	f6115547.exe
3888	f6115547.exe
1384	g3579801.exe
1384	g3579801.exe
2836	i7988392.exe
2836	i7988392.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

f6115547.exeg3579801.exeh6835038.exei7988392.exeoneetx.exeoneetx.exeoneetx.exe

description	pid	process
Token: SeDebugPrivilege	3888	f6115547.exe
Token: SeDebugPrivilege	1384	g3579801.exe
Token: SeDebugPrivilege	4908	h6835038.exe
Token: SeDebugPrivilege	2836	i7988392.exe
Token: SeDebugPrivilege	208	oneetx.exe
Token: SeDebugPrivilege	4588	oneetx.exe
Token: SeDebugPrivilege	2084	oneetx.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

h6835038.exe

pid process

4728 h6835038.exe

pid	process
4728	h6835038.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

135257fe458194d7d210a195226d01604562ea055730d6971c5da87e89c1d0fb.exex9343926.exex8869877.exeh6835038.exeh6835038.exeoneetx.exeoneetx.execmd.exe

description	pid	process	target process
PID 2672 wrote to memory of 112	2672	135257fe458194d7d210a195226d01604562ea055730d6971c5da87e89c1d0fb.exe	x9343926.exe
PID 2672 wrote to memory of 112	2672	135257fe458194d7d210a195226d01604562ea055730d6971c5da87e89c1d0fb.exe	x9343926.exe
PID 2672 wrote to memory of 112	2672	135257fe458194d7d210a195226d01604562ea055730d6971c5da87e89c1d0fb.exe	x9343926.exe
PID 112 wrote to memory of 4324	112	x9343926.exe	x8869877.exe
PID 112 wrote to memory of 4324	112	x9343926.exe	x8869877.exe
PID 112 wrote to memory of 4324	112	x9343926.exe	x8869877.exe
PID 4324 wrote to memory of 3888	4324	x8869877.exe	f6115547.exe
PID 4324 wrote to memory of 3888	4324	x8869877.exe	f6115547.exe
PID 4324 wrote to memory of 3888	4324	x8869877.exe	f6115547.exe
PID 4324 wrote to memory of 1384	4324	x8869877.exe	g3579801.exe
PID 4324 wrote to memory of 1384	4324	x8869877.exe	g3579801.exe
PID 4324 wrote to memory of 1384	4324	x8869877.exe	g3579801.exe
PID 112 wrote to memory of 4908	112	x9343926.exe	h6835038.exe
PID 112 wrote to memory of 4908	112	x9343926.exe	h6835038.exe
PID 112 wrote to memory of 4908	112	x9343926.exe	h6835038.exe
PID 4908 wrote to memory of 4860	4908	h6835038.exe	h6835038.exe
PID 4908 wrote to memory of 4860	4908	h6835038.exe	h6835038.exe
PID 4908 wrote to memory of 4860	4908	h6835038.exe	h6835038.exe
PID 4908 wrote to memory of 4860	4908	h6835038.exe	h6835038.exe
PID 4908 wrote to memory of 4728	4908	h6835038.exe	h6835038.exe
PID 4908 wrote to memory of 4728	4908	h6835038.exe	h6835038.exe
PID 4908 wrote to memory of 4728	4908	h6835038.exe	h6835038.exe
PID 4908 wrote to memory of 4728	4908	h6835038.exe	h6835038.exe
PID 4908 wrote to memory of 4728	4908	h6835038.exe	h6835038.exe
PID 4908 wrote to memory of 4728	4908	h6835038.exe	h6835038.exe
PID 4908 wrote to memory of 4728	4908	h6835038.exe	h6835038.exe
PID 4908 wrote to memory of 4728	4908	h6835038.exe	h6835038.exe
PID 4908 wrote to memory of 4728	4908	h6835038.exe	h6835038.exe
PID 4908 wrote to memory of 4728	4908	h6835038.exe	h6835038.exe
PID 2672 wrote to memory of 2836	2672	135257fe458194d7d210a195226d01604562ea055730d6971c5da87e89c1d0fb.exe	i7988392.exe
PID 2672 wrote to memory of 2836	2672	135257fe458194d7d210a195226d01604562ea055730d6971c5da87e89c1d0fb.exe	i7988392.exe
PID 2672 wrote to memory of 2836	2672	135257fe458194d7d210a195226d01604562ea055730d6971c5da87e89c1d0fb.exe	i7988392.exe
PID 4728 wrote to memory of 208	4728	h6835038.exe	oneetx.exe
PID 4728 wrote to memory of 208	4728	h6835038.exe	oneetx.exe
PID 4728 wrote to memory of 208	4728	h6835038.exe	oneetx.exe
PID 208 wrote to memory of 4272	208	oneetx.exe	oneetx.exe
PID 208 wrote to memory of 4272	208	oneetx.exe	oneetx.exe
PID 208 wrote to memory of 4272	208	oneetx.exe	oneetx.exe
PID 208 wrote to memory of 4272	208	oneetx.exe	oneetx.exe
PID 208 wrote to memory of 4272	208	oneetx.exe	oneetx.exe
PID 208 wrote to memory of 4272	208	oneetx.exe	oneetx.exe
PID 208 wrote to memory of 4272	208	oneetx.exe	oneetx.exe
PID 208 wrote to memory of 4272	208	oneetx.exe	oneetx.exe
PID 208 wrote to memory of 4272	208	oneetx.exe	oneetx.exe
PID 208 wrote to memory of 4272	208	oneetx.exe	oneetx.exe
PID 4272 wrote to memory of 4916	4272	oneetx.exe	schtasks.exe
PID 4272 wrote to memory of 4916	4272	oneetx.exe	schtasks.exe
PID 4272 wrote to memory of 4916	4272	oneetx.exe	schtasks.exe
PID 4272 wrote to memory of 4860	4272	oneetx.exe	cmd.exe
PID 4272 wrote to memory of 4860	4272	oneetx.exe	cmd.exe
PID 4272 wrote to memory of 4860	4272	oneetx.exe	cmd.exe
PID 4860 wrote to memory of 4624	4860	cmd.exe	cmd.exe
PID 4860 wrote to memory of 4624	4860	cmd.exe	cmd.exe
PID 4860 wrote to memory of 4624	4860	cmd.exe	cmd.exe
PID 4860 wrote to memory of 3212	4860	cmd.exe	cacls.exe
PID 4860 wrote to memory of 3212	4860	cmd.exe	cacls.exe
PID 4860 wrote to memory of 3212	4860	cmd.exe	cacls.exe
PID 4860 wrote to memory of 4436	4860	cmd.exe	cacls.exe
PID 4860 wrote to memory of 4436	4860	cmd.exe	cacls.exe
PID 4860 wrote to memory of 4436	4860	cmd.exe	cacls.exe
PID 4860 wrote to memory of 2432	4860	cmd.exe	cmd.exe
PID 4860 wrote to memory of 2432	4860	cmd.exe	cmd.exe
PID 4860 wrote to memory of 2432	4860	cmd.exe	cmd.exe
PID 4860 wrote to memory of 3092	4860	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\135257fe458194d7d210a195226d01604562ea055730d6971c5da87e89c1d0fb.exe
"C:\Users\Admin\AppData\Local\Temp\135257fe458194d7d210a195226d01604562ea055730d6971c5da87e89c1d0fb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2672

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9343926.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9343926.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:112

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8869877.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8869877.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4324

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6115547.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6115547.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3888

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g3579801.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g3579801.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6835038.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6835038.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6835038.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6835038.exe
4⤵
- Executes dropped EXE
PID:4860

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6835038.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6835038.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4728

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:208

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
7⤵
- Creates scheduled task(s)
PID:4916

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
7⤵
- Suspicious use of WriteProcessMemory
PID:4860

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
8⤵
PID:4624

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:N"
8⤵
PID:3212

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:R" /E
8⤵
PID:4436

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
8⤵
PID:2432

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c3912af058" /P "Admin:N"
8⤵
PID:3092

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c3912af058" /P "Admin:R" /E
8⤵
PID:636

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
7⤵
- Loads dropped DLL
PID:1860

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7988392.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7988392.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
2⤵
- Executes dropped EXE
PID:2584

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
2⤵
- Executes dropped EXE
PID:2244

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oneetx.exe.log
Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7988392.exe
Filesize
284KB

MD5
4906869368f4d1a8e575dbaf42890a10

SHA1
725a7eb75e5e66b3d64ca21a1339afc4ee037cb7

SHA256
3d59c5c7363f21cc1c2cfa1193990cf449cc6a7784caab1ebf80e7109b4f2830

SHA512
324c25bddad9b51ae5df277efa7641c472b55537206cf44f3b87621360f60042f297c44552d39d61268ac8af663ebc090d6680ba5f274ce5336b3fd729c43d80

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7988392.exe
Filesize
284KB

MD5
4906869368f4d1a8e575dbaf42890a10

SHA1
725a7eb75e5e66b3d64ca21a1339afc4ee037cb7

SHA256
3d59c5c7363f21cc1c2cfa1193990cf449cc6a7784caab1ebf80e7109b4f2830

SHA512
324c25bddad9b51ae5df277efa7641c472b55537206cf44f3b87621360f60042f297c44552d39d61268ac8af663ebc090d6680ba5f274ce5336b3fd729c43d80

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9343926.exe
Filesize
750KB

MD5
e9b80db033444c8b870fa3b3560f5190

SHA1
78d343fab824a4d47080c4e6067182f77fdfb057

SHA256
e356424bf3475c1e598a76b5b7cc415330ed43af85d5b64cc92359a1f02174c0

SHA512
7ef5699f35d8e73661a94ce7b06c578aca8493f2bf88220d7a9e9c0a61f67bfe861a07681bae3da1881ec092ecde6dbeb591b59548199e0a29289966ef531b35

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9343926.exe
Filesize
750KB

MD5
e9b80db033444c8b870fa3b3560f5190

SHA1
78d343fab824a4d47080c4e6067182f77fdfb057

SHA256
e356424bf3475c1e598a76b5b7cc415330ed43af85d5b64cc92359a1f02174c0

SHA512
7ef5699f35d8e73661a94ce7b06c578aca8493f2bf88220d7a9e9c0a61f67bfe861a07681bae3da1881ec092ecde6dbeb591b59548199e0a29289966ef531b35

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6835038.exe
Filesize
966KB

MD5
9c920f753877d9d3a662462a7c8f4be8

SHA1
bb9c3ce25f699203350664ce76bfbe47a629da80

SHA256
81f75f561ce27d28c38dd81cca46caea8454d7f073e551c0e8d914e18a726288

SHA512
842833e74623c6c5d3aed4eafdfdf0838fea3028e0cea87c6c9490c049aaf7181296ff8c483eda4c3d2afdcb363368674073e91059e34fbb2b6bb7aa0f3cf3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6835038.exe
Filesize
966KB

MD5
9c920f753877d9d3a662462a7c8f4be8

SHA1
bb9c3ce25f699203350664ce76bfbe47a629da80

SHA256
81f75f561ce27d28c38dd81cca46caea8454d7f073e551c0e8d914e18a726288

SHA512
842833e74623c6c5d3aed4eafdfdf0838fea3028e0cea87c6c9490c049aaf7181296ff8c483eda4c3d2afdcb363368674073e91059e34fbb2b6bb7aa0f3cf3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6835038.exe
Filesize
966KB

MD5
9c920f753877d9d3a662462a7c8f4be8

SHA1
bb9c3ce25f699203350664ce76bfbe47a629da80

SHA256
81f75f561ce27d28c38dd81cca46caea8454d7f073e551c0e8d914e18a726288

SHA512
842833e74623c6c5d3aed4eafdfdf0838fea3028e0cea87c6c9490c049aaf7181296ff8c483eda4c3d2afdcb363368674073e91059e34fbb2b6bb7aa0f3cf3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6835038.exe
Filesize
966KB

MD5
9c920f753877d9d3a662462a7c8f4be8

SHA1
bb9c3ce25f699203350664ce76bfbe47a629da80

SHA256
81f75f561ce27d28c38dd81cca46caea8454d7f073e551c0e8d914e18a726288

SHA512
842833e74623c6c5d3aed4eafdfdf0838fea3028e0cea87c6c9490c049aaf7181296ff8c483eda4c3d2afdcb363368674073e91059e34fbb2b6bb7aa0f3cf3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8869877.exe
Filesize
305KB

MD5
95fcd2295a277f99b74321a407ec3253

SHA1
1442bff9e60d69a782d47abdd502deaee230c7ec

SHA256
2a0a027e77954b717f0c48aa254f124cf6bb9547bbb5ee3982ae42fd27b84434

SHA512
adcb4aa648b9f172efe47931b90351369de05471162443df4728244ce92944f8a13c422f80e33b6e5a2f753881403397ba4de2dc08817b82275d881f78fa7d5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8869877.exe
Filesize
305KB

MD5
95fcd2295a277f99b74321a407ec3253

SHA1
1442bff9e60d69a782d47abdd502deaee230c7ec

SHA256
2a0a027e77954b717f0c48aa254f124cf6bb9547bbb5ee3982ae42fd27b84434

SHA512
adcb4aa648b9f172efe47931b90351369de05471162443df4728244ce92944f8a13c422f80e33b6e5a2f753881403397ba4de2dc08817b82275d881f78fa7d5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6115547.exe
Filesize
145KB

MD5
40af0b381c21f8d01423e1b909a832e1

SHA1
ad6c96611f25cfc8f616e82172098ea385a9a6c1

SHA256
de130e41580b067c288bb82843899a98a27f327b72d13128e0a3bbc4a7df31af

SHA512
43a97b1451a96781c6f34f70c000482b5a9dde62569d54fd90948047e8957833f7d267fa848b807eb49739e319dca316737e909a2250e5cc2d5b2e95ee583d40

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6115547.exe
Filesize
145KB

MD5
40af0b381c21f8d01423e1b909a832e1

SHA1
ad6c96611f25cfc8f616e82172098ea385a9a6c1

SHA256
de130e41580b067c288bb82843899a98a27f327b72d13128e0a3bbc4a7df31af

SHA512
43a97b1451a96781c6f34f70c000482b5a9dde62569d54fd90948047e8957833f7d267fa848b807eb49739e319dca316737e909a2250e5cc2d5b2e95ee583d40

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g3579801.exe
Filesize
184KB

MD5
d83170d3eecc6ac210694f8d4e6230f9

SHA1
bbfcc87e1264094d04dd5e120148804f0dbde88f

SHA256
23c6f88d3a2454dee49c4b668127c0bd5f26b9fe2a30a79fcd0116c8024edb19

SHA512
fec13edd4230178089f4e7057ed98827328095282d4effc0ccda7a833fe5a7f1a7e76e159be0dfe43f4442c844d2051855862b8b67b9835bfbf40487e20bef53

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g3579801.exe
Filesize
184KB

MD5
d83170d3eecc6ac210694f8d4e6230f9

SHA1
bbfcc87e1264094d04dd5e120148804f0dbde88f

SHA256
23c6f88d3a2454dee49c4b668127c0bd5f26b9fe2a30a79fcd0116c8024edb19

SHA512
fec13edd4230178089f4e7057ed98827328095282d4effc0ccda7a833fe5a7f1a7e76e159be0dfe43f4442c844d2051855862b8b67b9835bfbf40487e20bef53

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
Filesize
966KB

MD5
9c920f753877d9d3a662462a7c8f4be8

SHA1
bb9c3ce25f699203350664ce76bfbe47a629da80

SHA256
81f75f561ce27d28c38dd81cca46caea8454d7f073e551c0e8d914e18a726288

SHA512
842833e74623c6c5d3aed4eafdfdf0838fea3028e0cea87c6c9490c049aaf7181296ff8c483eda4c3d2afdcb363368674073e91059e34fbb2b6bb7aa0f3cf3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
Filesize
966KB

MD5
9c920f753877d9d3a662462a7c8f4be8

SHA1
bb9c3ce25f699203350664ce76bfbe47a629da80

SHA256
81f75f561ce27d28c38dd81cca46caea8454d7f073e551c0e8d914e18a726288

SHA512
842833e74623c6c5d3aed4eafdfdf0838fea3028e0cea87c6c9490c049aaf7181296ff8c483eda4c3d2afdcb363368674073e91059e34fbb2b6bb7aa0f3cf3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
Filesize
966KB

MD5
9c920f753877d9d3a662462a7c8f4be8

SHA1
bb9c3ce25f699203350664ce76bfbe47a629da80

SHA256
81f75f561ce27d28c38dd81cca46caea8454d7f073e551c0e8d914e18a726288

SHA512
842833e74623c6c5d3aed4eafdfdf0838fea3028e0cea87c6c9490c049aaf7181296ff8c483eda4c3d2afdcb363368674073e91059e34fbb2b6bb7aa0f3cf3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
Filesize
966KB

MD5
9c920f753877d9d3a662462a7c8f4be8

SHA1
bb9c3ce25f699203350664ce76bfbe47a629da80

SHA256
81f75f561ce27d28c38dd81cca46caea8454d7f073e551c0e8d914e18a726288

SHA512
842833e74623c6c5d3aed4eafdfdf0838fea3028e0cea87c6c9490c049aaf7181296ff8c483eda4c3d2afdcb363368674073e91059e34fbb2b6bb7aa0f3cf3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
Filesize
966KB

MD5
9c920f753877d9d3a662462a7c8f4be8

SHA1
bb9c3ce25f699203350664ce76bfbe47a629da80

SHA256
81f75f561ce27d28c38dd81cca46caea8454d7f073e551c0e8d914e18a726288

SHA512
842833e74623c6c5d3aed4eafdfdf0838fea3028e0cea87c6c9490c049aaf7181296ff8c483eda4c3d2afdcb363368674073e91059e34fbb2b6bb7aa0f3cf3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
Filesize
966KB

MD5
9c920f753877d9d3a662462a7c8f4be8

SHA1
bb9c3ce25f699203350664ce76bfbe47a629da80

SHA256
81f75f561ce27d28c38dd81cca46caea8454d7f073e551c0e8d914e18a726288

SHA512
842833e74623c6c5d3aed4eafdfdf0838fea3028e0cea87c6c9490c049aaf7181296ff8c483eda4c3d2afdcb363368674073e91059e34fbb2b6bb7aa0f3cf3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
Filesize
966KB

MD5
9c920f753877d9d3a662462a7c8f4be8

SHA1
bb9c3ce25f699203350664ce76bfbe47a629da80

SHA256
81f75f561ce27d28c38dd81cca46caea8454d7f073e551c0e8d914e18a726288

SHA512
842833e74623c6c5d3aed4eafdfdf0838fea3028e0cea87c6c9490c049aaf7181296ff8c483eda4c3d2afdcb363368674073e91059e34fbb2b6bb7aa0f3cf3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
Filesize
966KB

MD5
9c920f753877d9d3a662462a7c8f4be8

SHA1
bb9c3ce25f699203350664ce76bfbe47a629da80

SHA256
81f75f561ce27d28c38dd81cca46caea8454d7f073e551c0e8d914e18a726288

SHA512
842833e74623c6c5d3aed4eafdfdf0838fea3028e0cea87c6c9490c049aaf7181296ff8c483eda4c3d2afdcb363368674073e91059e34fbb2b6bb7aa0f3cf3c2

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/208-427-0x0000000006F80000-0x0000000006F90000-memory.dmp

Filesize
64KB

Download
memory/1384-175-0x0000000002650000-0x0000000002666000-memory.dmp

Filesize
88KB

Download
memory/1384-200-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/1384-187-0x0000000002650000-0x0000000002666000-memory.dmp

Filesize
88KB

Download
memory/1384-189-0x0000000002650000-0x0000000002666000-memory.dmp

Filesize
88KB

Download
memory/1384-191-0x0000000002650000-0x0000000002666000-memory.dmp

Filesize
88KB

Download
memory/1384-193-0x0000000002650000-0x0000000002666000-memory.dmp

Filesize
88KB

Download
memory/1384-195-0x0000000002650000-0x0000000002666000-memory.dmp

Filesize
88KB

Download
memory/1384-197-0x0000000002650000-0x0000000002666000-memory.dmp

Filesize
88KB

Download
memory/1384-199-0x0000000002650000-0x0000000002666000-memory.dmp

Filesize
88KB

Download
memory/1384-172-0x0000000002650000-0x0000000002666000-memory.dmp

Filesize
88KB

Download
memory/1384-201-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/1384-202-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/1384-183-0x0000000002650000-0x0000000002666000-memory.dmp

Filesize
88KB

Download
memory/1384-181-0x0000000002650000-0x0000000002666000-memory.dmp

Filesize
88KB

Download
memory/1384-173-0x0000000002650000-0x0000000002666000-memory.dmp

Filesize
88KB

Download
memory/1384-177-0x0000000002650000-0x0000000002666000-memory.dmp

Filesize
88KB

Download
memory/1384-179-0x0000000002650000-0x0000000002666000-memory.dmp

Filesize
88KB

Download
memory/1384-185-0x0000000002650000-0x0000000002666000-memory.dmp

Filesize
88KB

Download
memory/2244-1194-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2584-1188-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2836-238-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/2836-1158-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/2836-1157-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/2836-219-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/2836-220-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/2836-222-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/2836-224-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/2836-226-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/2836-228-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/2836-230-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/2836-232-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/2836-234-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/2836-236-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/2836-1156-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/2836-240-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/2836-242-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/2836-244-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/2836-246-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/2836-248-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/2836-1146-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/2836-250-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/2836-256-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/2836-255-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/2836-253-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/3888-162-0x0000000006820000-0x0000000006DC4000-memory.dmp

Filesize
5.6MB

Download
memory/3888-155-0x0000000005800000-0x0000000005E18000-memory.dmp

Filesize
6.1MB

Download
memory/3888-165-0x0000000006760000-0x00000000067D6000-memory.dmp

Filesize
472KB

Download
memory/3888-154-0x00000000008E0000-0x000000000090A000-memory.dmp

Filesize
168KB

Download
memory/3888-164-0x0000000007300000-0x000000000782C000-memory.dmp

Filesize
5.2MB

Download
memory/3888-156-0x0000000005380000-0x000000000548A000-memory.dmp

Filesize
1.0MB

Download
memory/3888-163-0x0000000006590000-0x0000000006752000-memory.dmp

Filesize
1.8MB

Download
memory/3888-157-0x00000000052B0000-0x00000000052C2000-memory.dmp

Filesize
72KB

Download
memory/3888-158-0x0000000005310000-0x000000000534C000-memory.dmp

Filesize
240KB

Download
memory/3888-159-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/3888-160-0x0000000005620000-0x0000000005686000-memory.dmp

Filesize
408KB

Download
memory/3888-166-0x0000000006510000-0x0000000006560000-memory.dmp

Filesize
320KB

Download
memory/3888-167-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/3888-161-0x00000000061D0000-0x0000000006262000-memory.dmp

Filesize
584KB

Download
memory/4272-1153-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4272-1160-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4588-1163-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/4728-213-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4728-210-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4728-251-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4728-283-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4728-214-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4908-207-0x0000000000CC0000-0x0000000000DB8000-memory.dmp

Filesize
992KB

Download
memory/4908-208-0x0000000007BD0000-0x0000000007BE0000-memory.dmp

Filesize
64KB

Download