healer | b5b03c05d56b79a9f4a56c2f96ad20feeb2a1cda9ee7d011e6a53c98cfdd35b4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5b03c05d56b79a9f4a56c2f96ad20feeb2a1cda9ee7d011e6a53c98cfdd35b4.exe
Size

1.0MB
MD5

6115287af96b0be31a40949f2e3bef0c
SHA1

ef8ca652fd03a1de344f024e3066fb7efbfc5940
SHA256

b5b03c05d56b79a9f4a56c2f96ad20feeb2a1cda9ee7d011e6a53c98cfdd35b4
SHA512

67a629c976572f3a1b3868db05780e2baed866d613f4685a737dbb3e7b6c8037ac0287daa2bfbe98f1ba3d4df23f7d557b655f6bf4bbbb65e70ff12f59c3ad89
SSDEEP

24576:kyUn0tDSXRb0pIKlDZjsm0SX3pzPGX00rfQ9ZMgY:zUmDGRhA4m0SNGJrSR

Score

10^/10

healer redline dozi norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

dozi

77.91.124.145:4125

Attributes

auth_value
7679b0fc076a24b4239e8d0b3bb429af

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3876-25-0x0000000002560000-0x000000000257A000-memory.dmp	healer
behavioral1/memory/3876-27-0x0000000002700000-0x0000000002718000-memory.dmp	healer
behavioral1/memory/3876-55-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/3876-53-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/3876-51-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/3876-49-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/3876-47-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/3876-45-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/3876-44-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/3876-41-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/3876-39-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/3876-37-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/3876-36-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/3876-33-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/3876-31-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/3876-29-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/3876-28-0x0000000002700000-0x0000000002712000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr537248.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr537248.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr537248.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr537248.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr537248.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr537248.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/3976-2148-0x0000000005400000-0x0000000005432000-memory.dmp	family_redline
behavioral1/files/0x0011000000023b10-2153.dat	family_redline
behavioral1/memory/5624-2161-0x0000000000630000-0x0000000000660000-memory.dmp	family_redline
behavioral1/files/0x0008000000023c49-2170.dat	family_redline
behavioral1/memory/2932-2172-0x0000000000B70000-0x0000000000B9E000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	si968622.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	qu117117.exe

Executes dropped EXE 10 IoCs

pid	Process
4496	un908616.exe
4628	un067586.exe
3876	pr537248.exe
3976	qu117117.exe
5624	1.exe
2932	rk365715.exe
1624	si968622.exe
2328	oneetx.exe
5300	oneetx.exe
7016	oneetx.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr537248.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr537248.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b5b03c05d56b79a9f4a56c2f96ad20feeb2a1cda9ee7d011e6a53c98cfdd35b4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un908616.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un067586.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 27 IoCs

pid	pid_target	Process	procid_target
4708	3876	WerFault.exe	86
5944	3976	WerFault.exe	101
6088	2932	WerFault.exe	105
1832	1624	WerFault.exe	108
6168	1624	WerFault.exe	108
6328	1624	WerFault.exe	108
5716	1624	WerFault.exe	108
5940	1624	WerFault.exe	108
2872	1624	WerFault.exe	108
3500	1624	WerFault.exe	108
372	1624	WerFault.exe	108
1320	1624	WerFault.exe	108
1020	1624	WerFault.exe	108
5284	2328	WerFault.exe	127
2468	2328	WerFault.exe	127
4912	2328	WerFault.exe	127
1656	2328	WerFault.exe	127
1728	2328	WerFault.exe	127
2728	2328	WerFault.exe	127
5280	2328	WerFault.exe	127
5600	2328	WerFault.exe	127
5780	2328	WerFault.exe	127
5996	2328	WerFault.exe	127
6136	2328	WerFault.exe	127
4208	2328	WerFault.exe	127
6304	5300	WerFault.exe	166
7104	7016	WerFault.exe	170

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rk365715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	si968622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5b03c05d56b79a9f4a56c2f96ad20feeb2a1cda9ee7d011e6a53c98cfdd35b4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un908616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un067586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu117117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pr537248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3876	pr537248.exe
3876	pr537248.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3876	pr537248.exe
Token: SeDebugPrivilege	3976	qu117117.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1624	si968622.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 4496	316	b5b03c05d56b79a9f4a56c2f96ad20feeb2a1cda9ee7d011e6a53c98cfdd35b4.exe	83
PID 316 wrote to memory of 4496	316	b5b03c05d56b79a9f4a56c2f96ad20feeb2a1cda9ee7d011e6a53c98cfdd35b4.exe	83
PID 316 wrote to memory of 4496	316	b5b03c05d56b79a9f4a56c2f96ad20feeb2a1cda9ee7d011e6a53c98cfdd35b4.exe	83
PID 4496 wrote to memory of 4628	4496	un908616.exe	84
PID 4496 wrote to memory of 4628	4496	un908616.exe	84
PID 4496 wrote to memory of 4628	4496	un908616.exe	84
PID 4628 wrote to memory of 3876	4628	un067586.exe	86
PID 4628 wrote to memory of 3876	4628	un067586.exe	86
PID 4628 wrote to memory of 3876	4628	un067586.exe	86
PID 4628 wrote to memory of 3976	4628	un067586.exe	101
PID 4628 wrote to memory of 3976	4628	un067586.exe	101
PID 4628 wrote to memory of 3976	4628	un067586.exe	101
PID 3976 wrote to memory of 5624	3976	qu117117.exe	102
PID 3976 wrote to memory of 5624	3976	qu117117.exe	102
PID 3976 wrote to memory of 5624	3976	qu117117.exe	102
PID 4496 wrote to memory of 2932	4496	un908616.exe	105
PID 4496 wrote to memory of 2932	4496	un908616.exe	105
PID 4496 wrote to memory of 2932	4496	un908616.exe	105
PID 316 wrote to memory of 1624	316	b5b03c05d56b79a9f4a56c2f96ad20feeb2a1cda9ee7d011e6a53c98cfdd35b4.exe	108
PID 316 wrote to memory of 1624	316	b5b03c05d56b79a9f4a56c2f96ad20feeb2a1cda9ee7d011e6a53c98cfdd35b4.exe	108
PID 316 wrote to memory of 1624	316	b5b03c05d56b79a9f4a56c2f96ad20feeb2a1cda9ee7d011e6a53c98cfdd35b4.exe	108
PID 1624 wrote to memory of 2328	1624	si968622.exe	127
PID 1624 wrote to memory of 2328	1624	si968622.exe	127
PID 1624 wrote to memory of 2328	1624	si968622.exe	127
PID 2328 wrote to memory of 5372	2328	oneetx.exe	144
PID 2328 wrote to memory of 5372	2328	oneetx.exe	144
PID 2328 wrote to memory of 5372	2328	oneetx.exe	144

C:\Users\Admin\AppData\Local\Temp\b5b03c05d56b79a9f4a56c2f96ad20feeb2a1cda9ee7d011e6a53c98cfdd35b4.exe
"C:\Users\Admin\AppData\Local\Temp\b5b03c05d56b79a9f4a56c2f96ad20feeb2a1cda9ee7d011e6a53c98cfdd35b4.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:316
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un908616.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un908616.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un067586.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un067586.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr537248.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr537248.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3876
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 1080
        5⤵
        Program crash
        
        PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu117117.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu117117.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3976
    - - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5624
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 1204
        5⤵
        Program crash
        
        PID:5944
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk365715.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk365715.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 912
      4⤵
      Program crash
      PID:6088
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si968622.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si968622.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 696
    3⤵
    - Program crash
    PID:1832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 792
    3⤵
    - Program crash
    PID:6168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 856
    3⤵
    - Program crash
    PID:6328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 968
    3⤵
    - Program crash
    PID:5716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 964
    3⤵
    - Program crash
    PID:5940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 1008
    3⤵
    - Program crash
    PID:2872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 1220
    3⤵
    - Program crash
    PID:3500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 1212
    3⤵
    - Program crash
    PID:372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 1316
    3⤵
    - Program crash
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 692
      4⤵
      Program crash
      PID:5284
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 876
      4⤵
      Program crash
      PID:2468
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 936
      4⤵
      Program crash
      PID:4912
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 1052
      4⤵
      Program crash
      PID:1656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 1072
      4⤵
      Program crash
      PID:1728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 1052
      4⤵
      Program crash
      PID:2728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 1092
      4⤵
      Program crash
      PID:5280
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5372
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 876
      4⤵
      Program crash
      PID:5600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 1296
      4⤵
      Program crash
      PID:5780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 1312
      4⤵
      Program crash
      PID:5996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 780
      4⤵
      Program crash
      PID:6136
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 1112
      4⤵
      Program crash
      PID:4208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 1332
    3⤵
    - Program crash
    PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3876 -ip 3876
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3976 -ip 3976
1⤵
PID:5836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2932 -ip 2932
1⤵
PID:5832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1624 -ip 1624
1⤵
PID:5320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1624 -ip 1624
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1624 -ip 1624
1⤵
PID:6240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1624 -ip 1624
1⤵
PID:5648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1624 -ip 1624
1⤵
PID:5840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1624 -ip 1624
1⤵
PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1624 -ip 1624
1⤵
PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1624 -ip 1624
1⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1624 -ip 1624
1⤵
PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1624 -ip 1624
1⤵
PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2328 -ip 2328
1⤵
PID:5232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2328 -ip 2328
1⤵
PID:5824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2328 -ip 2328
1⤵
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2328 -ip 2328
1⤵
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2328 -ip 2328
1⤵
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2328 -ip 2328
1⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2328 -ip 2328
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2328 -ip 2328
1⤵
PID:5388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2328 -ip 2328
1⤵
PID:5712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2328 -ip 2328
1⤵
PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2328 -ip 2328
1⤵
PID:6080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2328 -ip 2328
1⤵
PID:5020

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:5300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5300 -s 320
  2⤵
  - Program crash
  PID:6304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 5300 -ip 5300
1⤵
PID:6208

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:7016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7016 -s 320
  2⤵
  - Program crash
  PID:7104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 7016 -ip 7016
1⤵
PID:7056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si968622.exe

Filesize
234KB

MD5
6a93e4362b549db8c8a476c87bf29e0d

SHA1
9b32151488236aea11679f855d3ba1e61b4d9b3e

SHA256
293be4f75def1fe34e44a437d1285dd7fad697481262dae10ccd151c006e55ce

SHA512
e0ef731460a80f66879b1d7f87427e174365d8892d09b9a678c7e50fa4f34a987321b59b2bf4b083b0d60244d33320870e94569c223767fadc009b4b473f4d19

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un908616.exe

Filesize
798KB

MD5
49bfc2404fc98cfbdeab190dd15f37f7

SHA1
c58692cab3f3ccda4400dd5a5ec1583993b9cd4a

SHA256
99a7eb494d5be978e9f66d7ecc7be6e1fb84ffcab54d4d6dd7faea5f846b0417

SHA512
43ae1174bbd61e871294737628dcc8224fb09727683601e5499e393431b01fd603e74d8ee953315871946af52eeb2e796079d0096afc08a3aed94a55a4f25e74

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk365715.exe

Filesize
168KB

MD5
37d2c40d2c24ac435794291a5d42089b

SHA1
5e792136ae7ef19458237cbd5c50135ca58b9c36

SHA256
2351c4e72c9f7e5c4bf79ebffc2252073fdfd4ea3424fef9eb4a31aa92e0b641

SHA512
b07d0391a2d176060a463c9375b2e3920acd3fd67eee61ebbe1a5c04f7f1b36a5e5b6417729ad7c9dc8bda36c64ecca1e9b44c28215945e606b95c82cc77e831

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un067586.exe

Filesize
644KB

MD5
e57ea1e27c989eca1e35add96cceec30

SHA1
a271c823a8f8518b676ff2b49b34a1bd1076d363

SHA256
4cbe27ff2ed66e3d6d78a962b3070f24e7f2c807c0671bbfac0fd96f822fbc2c

SHA512
c56ccc3d3ef933ce62409b3a08fc84ad860b9692736e0e5e0bef2a23771da439a2fc690d205aec9243282b7c8d7508385eb239546c48355f32cc5c81888dd177

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr537248.exe

Filesize
243KB

MD5
ff3eb51f0a01e04a2cf7effd3eae1415

SHA1
46994dcfee77b1fa322f009413ec97d11feb7b4f

SHA256
a39f24b75f4f8f5074c933e708389f2188d0a30ebbb9b684d2f7622fa0d36eca

SHA512
ed4b9459d5f29a8f1f12c381e471fca44f9b6854b69fcf9f6c991866ab8b622414f22c4cb73e7c7448163568d9d2103972752030f72dbe2eddc68eb85b355ac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu117117.exe

Filesize
426KB

MD5
4af6120a0ff3ef34548ade0a09fdb327

SHA1
95e12aa8070acfd3d53927285007fc64b4d6198e

SHA256
ec924f9844c24714c0c6dba500cc219f0e628e7c98eb3f5e904bb87d1c1ef593

SHA512
8ec6d39ab444c165f4d08f38035c3b285d6ee3b2c07a8811c1accbda67a2c087a4caae5ef0826865f372df9e9db935599f837fb118cce43a019b3c96da21b562

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/2932-2172-0x0000000000B70000-0x0000000000B9E000-memory.dmp

Filesize
184KB

Download
memory/3876-57-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3876-24-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3876-23-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3876-25-0x0000000002560000-0x000000000257A000-memory.dmp

Filesize
104KB

Download
memory/3876-26-0x0000000004AD0000-0x0000000005074000-memory.dmp

Filesize
5.6MB

Download
memory/3876-27-0x0000000002700000-0x0000000002718000-memory.dmp

Filesize
96KB

Download
memory/3876-55-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/3876-53-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/3876-51-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/3876-49-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/3876-47-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/3876-45-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/3876-44-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/3876-41-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/3876-39-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/3876-37-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/3876-36-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/3876-33-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/3876-31-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/3876-29-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/3876-28-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/3876-56-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/3876-22-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/3876-58-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3876-60-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3876-61-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3976-67-0x00000000051C0000-0x0000000005226000-memory.dmp

Filesize
408KB

Download
memory/3976-75-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-77-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-87-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-101-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-97-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-96-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-93-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-91-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-85-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-83-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-81-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-79-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-66-0x0000000004BA0000-0x0000000004C06000-memory.dmp

Filesize
408KB

Download
memory/3976-73-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-99-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-89-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-71-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-69-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-68-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/3976-2148-0x0000000005400000-0x0000000005432000-memory.dmp

Filesize
200KB

Download
memory/5624-2161-0x0000000000630000-0x0000000000660000-memory.dmp

Filesize
192KB

Download
memory/5624-2162-0x00000000026F0000-0x00000000026F6000-memory.dmp

Filesize
24KB

Download
memory/5624-2163-0x0000000005560000-0x0000000005B78000-memory.dmp

Filesize
6.1MB

Download
memory/5624-2164-0x0000000005080000-0x000000000518A000-memory.dmp

Filesize
1.0MB

Download
memory/5624-2165-0x0000000004FB0000-0x0000000004FC2000-memory.dmp

Filesize
72KB

Download
memory/5624-2166-0x0000000005010000-0x000000000504C000-memory.dmp

Filesize
240KB

Download
memory/5624-2167-0x0000000005190000-0x00000000051DC000-memory.dmp

Filesize
304KB

Download