Windows Analysis Report
Mcb5K3TOWT.exe

Overview

General Information

Sample name: Mcb5K3TOWT.exe
renamed because original name is a hash value
Original sample name: 97e5f2c04baad060d0169b7d76cfa5de.exe
Analysis ID: 1417384
MD5: 97e5f2c04baad060d0169b7d76cfa5de
SHA1: 00d5d0699bf1ccddf28fbd9eeb6ed9aaa8bc320b
SHA256: bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35
Tags: 32CMSBruteexetrojan
Infos:

Detection

Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Contains functionality to inject code into remote processes
Drops PE files with benign system names
Found Tor onion address
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May use the Tor software to hide its network traffic
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Suspicious Process Parents
Sigma detected: System File Execution Location Anomaly
Connects to several IPs in different countries
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Communication To Uncommon Destination Ports
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Mcb5K3TOWT.exe Avira: detected
Antivirus detection for dropped file
Source: C:\ProgramData\Drivers\csrss.exe Avira: detection malicious, Label: HEUR/AGEN.1313019
Multi AV Scanner detection for dropped file
Source: C:\ProgramData\Drivers\csrss.exe ReversingLabs: Detection: 38%
Source: C:\ProgramData\Drivers\csrss.exe Virustotal: Detection: 44% Perma Link
Multi AV Scanner detection for submitted file
Source: Mcb5K3TOWT.exe ReversingLabs: Detection: 38%
Source: Mcb5K3TOWT.exe Virustotal: Detection: 44% Perma Link
Machine Learning detection for dropped file
Source: C:\ProgramData\Drivers\csrss.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: Mcb5K3TOWT.exe Joe Sandbox ML: detected
Source: Mcb5K3TOWT.exe, 00000001.00000002.4085798664.0000000000400000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_86043cfe-e
Uses 32bit PE files
Source: Mcb5K3TOWT.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 209.58.180.90:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 86.59.21.38:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 198.50.191.95:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 31.13.195.248:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown HTTPS traffic detected: 86.59.21.38:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.247.74.201:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown HTTPS traffic detected: 195.154.106.60:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.65.205.10:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown HTTPS traffic detected: 195.201.94.113:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown HTTPS traffic detected: 86.59.21.38:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.4:49809 version: TLS 1.2
Source: unknown HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown HTTPS traffic detected: 86.59.21.38:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown HTTPS traffic detected: 91.213.233.138:443 -> 192.168.2.4:49817 version: TLS 1.2
Source: unknown HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown HTTPS traffic detected: 86.59.21.38:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49826 version: TLS 1.2
Source: unknown HTTPS traffic detected: 86.59.21.38:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49831 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown HTTPS traffic detected: 85.10.240.250:443 -> 192.168.2.4:49833 version: TLS 1.2
Source: unknown HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown HTTPS traffic detected: 217.12.203.242:443 -> 192.168.2.4:49835 version: TLS 1.2
Source: unknown HTTPS traffic detected: 192.42.116.17:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown HTTPS traffic detected: 192.36.38.33:443 -> 192.168.2.4:49879 version: TLS 1.2
Source: Binary string: C:\dukusixurageru32\wabipajomali_fafutaf\bebut\j.pdb source: Mcb5K3TOWT.exe, csrss.exe.1.dr

Networking
barindex
Found Tor onion address
Source: Mcb5K3TOWT.exe, 00000001.00000002.4085798664.0000000000824000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: Referer: X-Requested-With: XMLHttpRequest Content-Type: application/json;127.0.0.1:--ignore-missing-torrcect[] = --SOCKSPort--DataDirectory--bridgehttp://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/rep.phperr.php?&n=v=b=p=repsf=e=nocache=SEH exceptionSEHSTD: C++.dll4kPv6aJG8e\!update!sleep !regcheckcreateObjectwp-login.phpwp-admin/name="loginform"ionW[] = id="loginform"name="log"id="user_login"name="pwd"id="user_pass"administrator/administrator/index.php ] = id="form-login"action="/administrator= = id="mod-login-username"nd[] = name="username"id="mod-login-password" name="passwd"admin.phpDataLifesubactionusernamepasswordOK{
Source: csrss.exe, 00000003.00000002.4085831673.0000000000824000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: Referer: X-Requested-With: XMLHttpRequest Content-Type: application/json;127.0.0.1:--ignore-missing-torrcect[] = --SOCKSPort--DataDirectory--bridgehttp://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/rep.phperr.php?&n=v=b=p=repsf=e=nocache=SEH exceptionSEHSTD: C++.dll4kPv6aJG8e\!update!sleep !regcheckcreateObjectwp-login.phpwp-admin/name="loginform"ionW[] = id="loginform"name="log"id="user_login"name="pwd"id="user_pass"administrator/administrator/index.php ] = id="form-login"action="/administrator= = id="mod-login-username"nd[] = name="username"id="mod-login-password" name="passwd"admin.phpDataLifesubactionusernamepasswordOK{
Connects to several IPs in different countries
Source: unknown Network traffic detected: IP country count 24
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49733 -> 31.127.34.9:9001
Source: global traffic TCP traffic: 192.168.2.4:49744 -> 128.31.0.39:9101
Source: global traffic TCP traffic: 192.168.2.4:49745 -> 198.98.52.143:9001
Source: global traffic TCP traffic: 192.168.2.4:49749 -> 176.31.116.155:8443
Source: global traffic TCP traffic: 192.168.2.4:49751 -> 37.191.206.197:8443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 185.220.100.251:9000
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 45.14.150.182:9001
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 213.144.142.24:9001
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 195.123.209.91:5092
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 91.121.181.6:9001
Source: global traffic TCP traffic: 192.168.2.4:49765 -> 185.220.101.205:10205
Source: global traffic TCP traffic: 192.168.2.4:49767 -> 62.78.194.4:9001
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 104.149.139.42:8080
Source: global traffic TCP traffic: 192.168.2.4:49770 -> 185.251.165.74:9001
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 5.2.78.69:9001
Source: global traffic TCP traffic: 192.168.2.4:49785 -> 91.121.86.59:993
Source: global traffic TCP traffic: 192.168.2.4:49789 -> 173.249.63.227:9001
Source: global traffic TCP traffic: 192.168.2.4:49795 -> 47.254.134.152:9001
Source: global traffic TCP traffic: 192.168.2.4:49796 -> 47.56.94.99:9001
Source: global traffic TCP traffic: 192.168.2.4:49801 -> 149.56.98.216:9001
Source: global traffic TCP traffic: 192.168.2.4:49802 -> 103.253.41.98:9001
Source: global traffic TCP traffic: 192.168.2.4:49806 -> 54.36.112.239:9001
Source: global traffic TCP traffic: 192.168.2.4:49811 -> 91.121.160.6:9001
Source: global traffic TCP traffic: 192.168.2.4:49819 -> 37.139.22.180:9001
Source: global traffic TCP traffic: 192.168.2.4:49824 -> 140.186.205.68:9001
Source: global traffic TCP traffic: 192.168.2.4:49836 -> 162.212.158.82:9001
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 184.105.220.24:9001
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 185.220.101.1:30001
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 176.67.170.192:9001
Source: global traffic TCP traffic: 192.168.2.4:49841 -> 149.34.27.137:9001
Source: global traffic TCP traffic: 192.168.2.4:49842 -> 51.195.124.251:9001
Source: global traffic TCP traffic: 192.168.2.4:49843 -> 185.220.101.143:10143
Source: global traffic TCP traffic: 192.168.2.4:49844 -> 185.233.252.14:9001
Source: global traffic TCP traffic: 192.168.2.4:49845 -> 62.216.85.110:34049
Source: global traffic TCP traffic: 192.168.2.4:49846 -> 185.213.155.169:5753
Source: global traffic TCP traffic: 192.168.2.4:49847 -> 185.220.101.20:10020
Source: global traffic TCP traffic: 192.168.2.4:49849 -> 94.142.241.226:9443
Source: global traffic TCP traffic: 192.168.2.4:49851 -> 145.239.158.234:9001
Source: global traffic TCP traffic: 192.168.2.4:49852 -> 194.55.13.50:9001
Source: global traffic TCP traffic: 192.168.2.4:49853 -> 78.46.174.72:9001
Source: global traffic TCP traffic: 192.168.2.4:49854 -> 212.47.227.71:9001
Source: global traffic TCP traffic: 192.168.2.4:49856 -> 8.209.79.125:9001
Source: global traffic TCP traffic: 192.168.2.4:49857 -> 212.8.243.229:9001
Source: global traffic TCP traffic: 192.168.2.4:49858 -> 45.125.65.112:9001
Source: global traffic TCP traffic: 192.168.2.4:49859 -> 185.220.101.198:10198
Source: global traffic TCP traffic: 192.168.2.4:49862 -> 45.151.167.10:8443
Source: global traffic TCP traffic: 192.168.2.4:49863 -> 143.107.229.210:42256
Source: global traffic TCP traffic: 192.168.2.4:49865 -> 62.210.105.46:9001
Source: global traffic TCP traffic: 192.168.2.4:49866 -> 185.220.101.23:30023
Source: global traffic TCP traffic: 192.168.2.4:49867 -> 116.12.180.234:9443
Source: global traffic TCP traffic: 192.168.2.4:49869 -> 185.220.101.206:30206
Source: global traffic TCP traffic: 192.168.2.4:49871 -> 198.58.107.53:9001
Source: global traffic TCP traffic: 192.168.2.4:49872 -> 5.181.51.52:9001
Source: global traffic TCP traffic: 192.168.2.4:49875 -> 88.198.112.25:9001
Source: global traffic TCP traffic: 192.168.2.4:49880 -> 143.107.229.120:40233
Source: global traffic TCP traffic: 192.168.2.4:49882 -> 71.200.64.77:9001
Source: global traffic TCP traffic: 192.168.2.4:49883 -> 185.82.217.49:9001
Source: global traffic TCP traffic: 192.168.2.4:49884 -> 80.66.135.13:9001
Source: global traffic TCP traffic: 192.168.2.4:49885 -> 147.92.88.67:9001
Source: global traffic TCP traffic: 192.168.2.4:49886 -> 176.123.3.222:9001
Source: global traffic TCP traffic: 192.168.2.4:49887 -> 194.140.117.58:993
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 171.25.193.9 171.25.193.9
Source: Joe Sandbox View IP Address: 171.25.193.9 171.25.193.9
Source: Joe Sandbox View IP Address: 198.50.191.95 198.50.191.95
Source: Joe Sandbox View IP Address: 178.20.55.18 178.20.55.18
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 83d60721ecc423892660e275acc4dffd
Source: unknown TCP traffic detected without corresponding DNS query: 178.17.174.10
Source: unknown TCP traffic detected without corresponding DNS query: 178.17.174.10
Source: unknown TCP traffic detected without corresponding DNS query: 178.17.174.10
Source: unknown TCP traffic detected without corresponding DNS query: 31.127.34.9
Source: unknown TCP traffic detected without corresponding DNS query: 31.127.34.9
Source: unknown TCP traffic detected without corresponding DNS query: 204.13.164.118
Source: unknown TCP traffic detected without corresponding DNS query: 204.13.164.118
Source: unknown TCP traffic detected without corresponding DNS query: 204.13.164.118
Source: unknown TCP traffic detected without corresponding DNS query: 204.13.164.118
Source: unknown TCP traffic detected without corresponding DNS query: 204.13.164.118
Source: unknown TCP traffic detected without corresponding DNS query: 204.13.164.118
Source: unknown TCP traffic detected without corresponding DNS query: 31.127.34.9
Source: unknown TCP traffic detected without corresponding DNS query: 31.127.34.9
Source: unknown TCP traffic detected without corresponding DNS query: 31.127.34.9
Source: unknown TCP traffic detected without corresponding DNS query: 192.0.128.86
Source: unknown TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown TCP traffic detected without corresponding DNS query: 192.0.128.86
Source: unknown TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown TCP traffic detected without corresponding DNS query: 192.0.128.86
Source: unknown TCP traffic detected without corresponding DNS query: 192.0.128.86
Source: unknown TCP traffic detected without corresponding DNS query: 192.0.128.86
Source: unknown TCP traffic detected without corresponding DNS query: 198.98.52.143
Source: unknown TCP traffic detected without corresponding DNS query: 154.35.175.225
Source: unknown TCP traffic detected without corresponding DNS query: 154.35.175.225
Source: unknown TCP traffic detected without corresponding DNS query: 154.35.175.225
Source: unknown TCP traffic detected without corresponding DNS query: 198.98.52.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.98.52.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.98.52.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.98.52.143
Source: unknown TCP traffic detected without corresponding DNS query: 209.58.180.90
Source: unknown TCP traffic detected without corresponding DNS query: 209.58.180.90
Source: unknown TCP traffic detected without corresponding DNS query: 209.58.180.90
Source: unknown TCP traffic detected without corresponding DNS query: 209.58.180.90
Source: unknown TCP traffic detected without corresponding DNS query: 209.58.180.90
Source: unknown TCP traffic detected without corresponding DNS query: 209.58.180.90
Source: unknown TCP traffic detected without corresponding DNS query: 176.31.116.155
Source: unknown TCP traffic detected without corresponding DNS query: 131.188.40.189
Source: unknown TCP traffic detected without corresponding DNS query: 131.188.40.189
Source: unknown TCP traffic detected without corresponding DNS query: 131.188.40.189
Source: unknown TCP traffic detected without corresponding DNS query: 131.188.40.189
Source: unknown TCP traffic detected without corresponding DNS query: 131.188.40.189
Source: unknown TCP traffic detected without corresponding DNS query: 131.188.40.189
Source: unknown TCP traffic detected without corresponding DNS query: 176.31.116.155
Source: unknown TCP traffic detected without corresponding DNS query: 176.31.116.155
Source: unknown TCP traffic detected without corresponding DNS query: 131.188.40.189
Source: unknown TCP traffic detected without corresponding DNS query: 131.188.40.189
Source: unknown TCP traffic detected without corresponding DNS query: 154.35.175.225
Source: Mcb5K3TOWT.exe, 00000001.00000002.4085798664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000003.00000002.4085831673.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: www.google.com,www.mit.edu,www.yahoo.com,www.slashdot.org equals www.yahoo.com (Yahoo)
Source: Mcb5K3TOWT.exe, 00000001.00000002.4087569548.00000000025A5000.00000004.00000020.00020000.00000000.sdmp, csrss.exe, 00000003.00000002.4087672879.0000000002812000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo)
Source: Mcb5K3TOWT.exe, 00000001.00000002.4087569548.00000000025A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.yahoo.com}P equals www.yahoo.com (Yahoo)
Source: Mcb5K3TOWT.exe, 00000001.00000002.4085798664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000003.00000002.4085831673.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://www.openssl.org/support/faq.html
Source: Mcb5K3TOWT.exe, 00000001.00000002.4085798664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000003.00000002.4085831673.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://www.openssl.org/support/faq.htmlTYPE=2OpenSSL
Source: Mcb5K3TOWT.exe, 00000001.00000002.4085798664.0000000000824000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000003.00000002.4085831673.0000000000824000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/re
Source: Mcb5K3TOWT.exe, 00000001.00000002.4085798664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000003.00000002.4085831673.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https:///phpMyAdmin//PhpMyAdmin//pma/rootmysqlimapssmtpspop3sscp://your_IP_is_greylisted_README.txt2
Source: Mcb5K3TOWT.exe, 00000001.00000002.4085798664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000003.00000002.4085831673.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: csrss.exe, 00000003.00000002.4085831673.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: Mcb5K3TOWT.exe, 00000001.00000002.4085798664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000003.00000002.4085831673.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: Mcb5K3TOWT.exe, 00000001.00000002.4085798664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000003.00000002.4085831673.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://trac.torproject.org/projects/tor/ticket/14917.
Source: Mcb5K3TOWT.exe, 00000001.00000002.4085798664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000003.00000002.4085831673.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.torproject.org/
Source: csrss.exe, 00000003.00000002.4085831673.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.torproject.org/documentation.html
Source: unknown Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 209.58.180.90:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 86.59.21.38:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 198.50.191.95:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 31.13.195.248:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown HTTPS traffic detected: 86.59.21.38:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.247.74.201:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown HTTPS traffic detected: 195.154.106.60:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.65.205.10:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown HTTPS traffic detected: 195.201.94.113:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown HTTPS traffic detected: 86.59.21.38:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.4:49809 version: TLS 1.2
Source: unknown HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown HTTPS traffic detected: 86.59.21.38:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown HTTPS traffic detected: 91.213.233.138:443 -> 192.168.2.4:49817 version: TLS 1.2
Source: unknown HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown HTTPS traffic detected: 86.59.21.38:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49826 version: TLS 1.2
Source: unknown HTTPS traffic detected: 86.59.21.38:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49831 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown HTTPS traffic detected: 85.10.240.250:443 -> 192.168.2.4:49833 version: TLS 1.2
Source: unknown HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown HTTPS traffic detected: 217.12.203.242:443 -> 192.168.2.4:49835 version: TLS 1.2
Source: unknown HTTPS traffic detected: 192.42.116.17:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown HTTPS traffic detected: 192.36.38.33:443 -> 192.168.2.4:49879 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000002.00000002.1734753448.0000000002E00000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1631676309.00000000029C8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_02B90110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess, 0_2_02B90110
Source: C:\ProgramData\Drivers\csrss.exe Code function: 2_2_03000110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess, 2_2_03000110
Detected potential crypto function
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_00406FA0 0_2_00406FA0
Sample file is different than original file name gathered from version info
Source: Mcb5K3TOWT.exe Binary or memory string: OriginalFilename vs Mcb5K3TOWT.exe
Source: Mcb5K3TOWT.exe, 00000000.00000002.1631393059.0000000000C85000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameWell2 vs Mcb5K3TOWT.exe
Source: Mcb5K3TOWT.exe, 00000001.00000003.1632887221.0000000002BD0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWell2 vs Mcb5K3TOWT.exe
Source: Mcb5K3TOWT.exe, 00000001.00000002.4085798664.0000000000843000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCSRSS.Exej% vs Mcb5K3TOWT.exe
Source: Mcb5K3TOWT.exe, 00000001.00000000.1630209987.0000000000C85000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameWell2 vs Mcb5K3TOWT.exe
Source: Mcb5K3TOWT.exe Binary or memory string: OriginalFilenameWell2 vs Mcb5K3TOWT.exe
Tries to load missing DLLs
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: csunsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: swift.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: nfhwcrhk.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: surewarehook.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: csunsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: aep.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: atasi.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: swift.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: nfhwcrhk.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: nuronssl.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: surewarehook.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: ubsec.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: aep.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: atasi.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: swift.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: nfhwcrhk.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: nuronssl.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: surewarehook.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: ubsec.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Section loaded: srvcli.dll Jump to behavior
Uses 32bit PE files
Source: Mcb5K3TOWT.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 00000002.00000002.1734753448.0000000002E00000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1631676309.00000000029C8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: classification engine Classification label: mal100.evad.winEXE@6/3@0/100
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_029C87C6 CreateToolhelp32Snapshot,Module32First, 0_2_029C87C6
Source: C:\ProgramData\Drivers\csrss.exe Mutant created: NULL
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe File created: C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\ Jump to behavior
Source: Mcb5K3TOWT.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Mcb5K3TOWT.exe ReversingLabs: Detection: 38%
Source: Mcb5K3TOWT.exe Virustotal: Detection: 44%
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe File read: C:\Users\user\Desktop\Mcb5K3TOWT.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Mcb5K3TOWT.exe "C:\Users\user\Desktop\Mcb5K3TOWT.exe"
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Process created: C:\Users\user\Desktop\Mcb5K3TOWT.exe "C:\Users\user\Desktop\Mcb5K3TOWT.exe"
Source: unknown Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\ProgramData\Drivers\csrss.exe Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Process created: C:\Users\user\Desktop\Mcb5K3TOWT.exe "C:\Users\user\Desktop\Mcb5K3TOWT.exe" Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe" Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: Mcb5K3TOWT.exe Static file information: File size 1981440 > 1048576
Source: Mcb5K3TOWT.exe Static PE information: Raw size of .data is bigger than: 0x100000 < 0x1c6c00
Source: Mcb5K3TOWT.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\dukusixurageru32\wabipajomali_fafutaf\bebut\j.pdb source: Mcb5K3TOWT.exe, csrss.exe.1.dr
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 1_2_0069D030 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer, 1_2_0069D030
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_00406CD5 push ecx; ret 0_2_00406CE8
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_02B22AB0 push A7EF5AB4h; ret 0_2_02B22AB7
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_02B16AE0 push esi; iretd 0_2_02B16AEB
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_02A3B2C0 push eax; iretd 0_2_02A3B2C9
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_02A6FA35 push ds; ret 0_2_02A6FA36
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_02B22A51 push eax; retf 0_2_02B22A53
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_02A533F1 push edx; ret 0_2_02A533F3
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 1_2_00696299 push ecx; ret 1_2_006962AC
Source: C:\ProgramData\Drivers\csrss.exe Code function: 2_2_02F4EAC0 push esi; iretd 2_2_02F4EACB
Source: C:\ProgramData\Drivers\csrss.exe Code function: 2_2_02E732A0 push eax; iretd 2_2_02E732A9
Source: C:\ProgramData\Drivers\csrss.exe Code function: 2_2_02F5AA90 push A7EF5AB4h; ret 2_2_02F5AA97
Source: C:\ProgramData\Drivers\csrss.exe Code function: 2_2_02F5AA31 push eax; retf 2_2_02F5AA33
Source: C:\ProgramData\Drivers\csrss.exe Code function: 2_2_02EA7A15 push ds; ret 2_2_02EA7A16
Source: C:\ProgramData\Drivers\csrss.exe Code function: 2_2_02E8B3D1 push edx; ret 2_2_02E8B3D3
Source: C:\ProgramData\Drivers\csrss.exe Code function: 3_2_00696299 push ecx; ret 3_2_006962AC

Persistence and Installation Behavior
barindex
Drops PE files with benign system names
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe File created: C:\ProgramData\Drivers\csrss.exe Jump to dropped file
Drops PE files
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe File created: C:\ProgramData\Drivers\csrss.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe File created: C:\ProgramData\Drivers\csrss.exe Jump to dropped file
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run CSRSS Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run CSRSS Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
May use the Tor software to hide its network traffic
Source: Mcb5K3TOWT.exe, 00000001.00000002.4085798664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000003.00000002.4085831673.0000000000400000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: onion-port
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_00406FA0 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00406FA0
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Window / User API: threadDelayed 1927 Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Window / User API: threadDelayed 7959 Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe Window / User API: threadDelayed 9925 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe TID: 7612 Thread sleep count: 1927 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe TID: 7612 Thread sleep time: -192700s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe TID: 7612 Thread sleep count: 7959 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe TID: 7612 Thread sleep time: -795900s >= -30000s Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe TID: 7728 Thread sleep count: 9925 > 30 Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe TID: 7728 Thread sleep time: -992500s >= -30000s Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe TID: 7728 Thread sleep count: 66 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\ProgramData\Drivers\csrss.exe Last function: Thread delayed
Source: C:\ProgramData\Drivers\csrss.exe Last function: Thread delayed
Source: csrss.exe, 00000003.00000002.4087488823.0000000000C4A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: csrss.exe, 00000003.00000002.4087488823.0000000000C4A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: csrss.exe, 00000003.00000002.4087277129.0000000000C00000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllMJ
Source: Mcb5K3TOWT.exe, 00000001.00000002.4086757848.0000000000958000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll@
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_00408C01 IsDebuggerPresent, 0_2_00408C01
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 1_2_0069D030 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer, 1_2_0069D030
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_029C80A3 push dword ptr fs:[00000030h] 0_2_029C80A3
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_02B90042 push dword ptr fs:[00000030h] 0_2_02B90042
Source: C:\ProgramData\Drivers\csrss.exe Code function: 2_2_02E00083 push dword ptr fs:[00000030h] 2_2_02E00083
Source: C:\ProgramData\Drivers\csrss.exe Code function: 2_2_03000042 push dword ptr fs:[00000030h] 2_2_03000042
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_004080CC GetProcessHeap, 0_2_004080CC
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_00408B8C SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00408B8C
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 1_2_006943E0 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_006943E0
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 1_2_00694A78 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_00694A78

HIPS / PFW / Operating System Protection Evasion
barindex
Contains functionality to inject code into remote processes
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_02B90110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess, 0_2_02B90110
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Memory written: C:\Users\user\Desktop\Mcb5K3TOWT.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe Memory written: C:\ProgramData\Drivers\csrss.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Process created: C:\Users\user\Desktop\Mcb5K3TOWT.exe "C:\Users\user\Desktop\Mcb5K3TOWT.exe" Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Code function: 0_2_00408658 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00408658
Source: C:\Users\user\Desktop\Mcb5K3TOWT.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1417384 Sample: Mcb5K3TOWT.exe Startdate: 29/03/2024 Architecture: WINDOWS Score: 100 26 Malicious sample detected (through community Yara rule) 2->26 28 Antivirus / Scanner detection for submitted sample 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 4 other signatures 2->32 6 Mcb5K3TOWT.exe 2->6         started        9 csrss.exe 2->9         started        process3 signatures4 34 Contains functionality to inject code into remote processes 6->34 36 Drops PE files with benign system names 6->36 38 Injects a PE file into a foreign processes 6->38 11 Mcb5K3TOWT.exe 2 7 6->11         started        40 Antivirus detection for dropped file 9->40 42 Multi AV Scanner detection for dropped file 9->42 44 Machine Learning detection for dropped file 9->44 16 csrss.exe 2 9->16         started        process5 dnsIp6 20 127.0.0.1 unknown unknown 11->20 22 212.8.243.229, 49857, 9001 WORLDSTREAMNL Netherlands 11->22 24 98 other IPs or domains 11->24 18 C:\ProgramData\Drivers\csrss.exe, PE32 11->18 dropped 46 Found Tor onion address 11->46 48 May use the Tor software to hide its network traffic 11->48 file7 signatures8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
171.25.193.9
 unknown Sweden
198093 DFRI-ASForeningenfordigitalafri-ochrattigheterSE false
85.10.240.250
 unknown Germany
24940 HETZNER-ASDE false
198.50.191.95
 unknown Canada
16276 OVHFR false
178.20.55.18
 unknown France
50618 LIAZOFR false
143.107.229.120
 unknown Brazil
28571 UNIVERSIDADEDESAOPAULOBR false
94.142.241.226
 unknown Netherlands
8283 COLOCLUE-ASNetwerkverenigingColoclueAmsterdamNetherlan false
194.55.13.50
 unknown Germany
197540 NETCUP-ASnetcupGmbHDE false
198.98.52.143
 unknown United States
53667 PONYNETUS false
47.254.134.152
 unknown United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false
154.35.175.225
 unknown United States
14987 RETHEMHOSTINGUS false
128.31.0.39
 unknown United States
3 MIT-GATEWAYSUS false
88.198.112.25
 unknown Germany
24940 HETZNER-ASDE false
213.144.142.24
 unknown Switzerland
13030 INIT7CH false
176.31.116.155
 unknown France
16276 OVHFR false
62.141.38.69
 unknown Germany
24961 MYLOC-ASIPBackboneofmyLocmanagedITAGDE false
47.56.94.99
 unknown United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false
199.249.230.174
 unknown United States
62744 QUINTEXUS false
185.220.101.206
 unknown Germany
208294 ASMKNL false
185.220.101.205
 unknown Germany
208294 ASMKNL false
185.82.217.49
 unknown Bulgaria
59729 ITL-BG false
109.70.100.14
 unknown Austria
208323 APPLIEDPRIVACY-ASAT false
31.13.195.248
 unknown Bulgaria
34224 NETERRA-ASBG false
192.46.225.58
 unknown United States
5501 FRAUNHOFER-CLUSTER-BWResearchInstitutesspreadalloverGe false
185.227.82.7
 unknown Netherlands
208258 ACCESS2ITNL false
198.100.149.77
 unknown Canada
16276 OVHFR false
185.65.205.10
 unknown Turkey
59895 CITYNETHOST-ASTR false
109.150.12.235
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
23.129.64.239
 unknown United States
396507 EMERALD-ONIONUS false
104.149.129.210
 unknown United States
40676 AS40676US false
37.187.23.232
 unknown France
16276 OVHFR false
140.186.205.68
 unknown United States
11232 MIDCO-NETUS false
45.151.167.10
 unknown Germany
207871 FFDDORFDE false
54.36.112.239
 unknown France
16276 OVHFR false
149.56.98.216
 unknown Canada
16276 OVHFR false
31.127.34.9
 unknown United Kingdom
12576 EELtdGB false
185.220.100.251
 unknown Germany
205100 F3NETZEDE false
5.2.78.69
 unknown Netherlands
60404 LITESERVERNL false
62.216.85.110
 unknown Romania
9009 M247GB false
163.44.174.129
 unknown Japan 7506 INTERQGMOInternetIncJP false
91.121.86.59
 unknown France
16276 OVHFR false
185.213.155.169
 unknown Sweden
39351 ESAB-ASSE false
176.123.3.222
 unknown Moldova Republic of
200019 ALEXHOSTMD false
194.140.117.58
 unknown Germany
41998 NETCOMBW-ASDE false
192.0.128.86
 unknown Canada
5645 TEKSAVVYCA false
91.121.181.6
 unknown France
16276 OVHFR false
45.14.150.182
 unknown Romania
44220 PARFUMURI-FEMEI-ASRO false
162.247.74.201
 unknown United States
4224 CALYX-ASUS false
154.59.112.72
 unknown United States
174 COGENT-174US false
62.210.105.46
 unknown France
12876 OnlineSASFR false
173.249.63.227
 unknown Germany
51167 CONTABODE false
85.209.157.3
 unknown Netherlands
18978 ENZUINC-US false
178.254.31.125
 unknown Germany
42730 EVANZOASDE false
45.66.33.45
 unknown Netherlands
47482 SPECTRENL false
195.201.94.113
 unknown Germany
24940 HETZNER-ASDE false
8.209.79.125
 unknown Singapore
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false
144.76.170.20
 unknown Germany
24940 HETZNER-ASDE false
185.220.101.198
 unknown Germany
208294 ASMKNL false
38.145.200.61
 unknown United States
18978 ENZUINC-US false
86.59.21.38
 unknown Austria
8437 UTA-ASAT false
149.34.27.137
 unknown United States
35699 ADAMOEU-ASAdamoTelecomIberiaSAES false
178.33.183.251
 unknown France
16276 OVHFR false
62.78.194.4
 unknown Finland
16086 DNAFI false
91.213.233.138
 unknown Kyrgyzstan
39819 PROHOSTKG false
163.172.29.34
 unknown United Kingdom
12876 OnlineSASFR false
195.154.106.60
 unknown France
12876 OnlineSASFR false
143.107.229.210
 unknown Brazil
28571 UNIVERSIDADEDESAOPAULOBR false
192.42.116.17
 unknown Netherlands
1101 IP-EEND-ASIP-EENDBVNL false
145.239.158.234
 unknown France
16276 OVHFR false
198.58.107.53
 unknown United States
63949 LINODE-APLinodeLLCUS false
204.13.164.118
 unknown United States
25700 25700US false
95.211.136.23
 unknown Netherlands
60781 LEASEWEB-NL-AMS-01NetherlandsNL false
71.200.64.77
 unknown United States
7922 COMCAST-7922US false
37.191.206.197
 unknown Norway
57963 LYNET-INTERNETT-ASNO false
104.149.139.42
 unknown United States
40676 AS40676US false
217.160.255.217
 unknown Germany
8560 ONEANDONE-ASBrauerstrasse48DE false
193.23.244.244
 unknown Germany
50472 CHAOS-ASDE false
162.212.158.82
 unknown United States
11878 TZULOUS false
147.92.88.67
 unknown United States
396097 SAIL-INETUS false
192.36.38.33
 unknown Sweden
57169 EDIS-AS-EUAT false
5.181.51.52
 unknown Germany
197540 NETCUP-ASnetcupGmbHDE false
37.139.22.180
 unknown Netherlands
14061 DIGITALOCEAN-ASNUS false
184.105.220.24
 unknown United States
46841 FORKNETWORKINGUS false
217.12.203.242
 unknown Ukraine
59729 ITL-BG false
116.12.180.234
 unknown Singapore
3758 SINGNETSingNetSG false
212.8.243.229
 unknown Netherlands
49981 WORLDSTREAMNL false
80.66.135.13
 unknown Belgium
1239 SPRINTLINKUS false
131.188.40.189
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
199.249.230.115
 unknown United States
62744 QUINTEXUS false
185.220.101.23
 unknown Germany
208294 ASMKNL false
185.220.101.20
 unknown Germany
208294 ASMKNL false
185.251.165.74
 unknown Liechtenstein
204342 VESTRAvestraICTLICHLI false
195.123.209.91
 unknown Bulgaria
50979 ITL-LV false
51.195.124.251
 unknown France
16276 OVHFR false
199.58.81.140
 unknown Canada
7765 KOUMBITCA false
178.17.174.10
 unknown Moldova Republic of
43289 TRABIAMD false
212.47.227.71
 unknown France
12876 OnlineSASFR false
45.125.65.112
 unknown Hong Kong
133398 TELE-ASTeleAsiaLimitedHK false
103.253.41.98
 unknown Hong Kong
133398 TELE-ASTeleAsiaLimitedHK false
91.121.160.6
 unknown France
16276 OVHFR false

Private

IP
127.0.0.1