Windows Analysis Report
PHHOjspjmp.exe

Overview

General Information

Sample name: PHHOjspjmp.exe
renamed because original name is a hash value
Original sample name: 46d004a90bfc51d6447a0661f440e7a5.exe
Analysis ID: 1432016
MD5: 46d004a90bfc51d6447a0661f440e7a5
SHA1: fe33bb099ec660d4cc2607a34bcf55c92c5dc0f8
SHA256: a50139923127672a8083b6d24b45e102e358aa0fcb8b558a85386cf9892605aa
Tags: 32exe
Infos:

Detection

CMSBrute
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected CMSBrute
Contains functionality to inject code into remote processes
Drops PE files with benign system names
Found Tor onion address
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May use the Tor software to hide its network traffic
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Suspicious Process Parents
Sigma detected: System File Execution Location Anomaly
Connects to several IPs in different countries
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (may stop execution after checking a module file name)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: PHHOjspjmp.exe Avira: detected
Antivirus detection for dropped file
Source: C:\ProgramData\Drivers\csrss.exe Avira: detection malicious, Label: HEUR/AGEN.1312652
Multi AV Scanner detection for dropped file
Source: C:\ProgramData\Drivers\csrss.exe ReversingLabs: Detection: 50%
Source: C:\ProgramData\Drivers\csrss.exe Virustotal: Detection: 50% Perma Link
Multi AV Scanner detection for submitted file
Source: PHHOjspjmp.exe ReversingLabs: Detection: 50%
Source: PHHOjspjmp.exe Virustotal: Detection: 50% Perma Link
Machine Learning detection for dropped file
Source: C:\ProgramData\Drivers\csrss.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: PHHOjspjmp.exe Joe Sandbox ML: detected
Source: PHHOjspjmp.exe, 00000001.00000002.4474538963.0000000000400000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_5f442bbf-0
Uses 32bit PE files
Source: PHHOjspjmp.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.15.246.170:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 195.201.94.113:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 85.10.240.250:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 195.154.106.60:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 130.225.244.90:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.158.147.25:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown HTTPS traffic detected: 209.58.180.90:443 -> 192.168.2.5:49769 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.5:49774 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.65.205.10:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.5:49775 version: TLS 1.2
Source: Binary string: C:\mova-vur\fina_cusayuk\nusami.pdb source: PHHOjspjmp.exe, csrss.exe.1.dr
Source: Binary string: w>C:\mova-vur\fina_cusayuk\nusami.pdb source: PHHOjspjmp.exe, csrss.exe.1.dr

Networking
barindex
Found Tor onion address
Source: PHHOjspjmp.exe, 00000001.00000002.4474538963.0000000000824000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: Referer: X-Requested-With: XMLHttpRequest Content-Type: application/json;127.0.0.1:--ignore-missing-torrcect[] = --SOCKSPort--DataDirectory--bridgehttp://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/rep.phperr.php?&n=v=b=p=repsf=e=nocache=SEH exceptionSEHSTD: C++.dll4kPv6aJG8e\!update!sleep !regcheckcreateObjectwp-login.phpwp-admin/name="loginform"ionW[] = id="loginform"name="log"id="user_login"name="pwd"id="user_pass"administrator/administrator/index.php ] = id="form-login"action="/administrator= = id="mod-login-username"nd[] = name="username"id="mod-login-password" name="passwd"admin.phpDataLifesubactionusernamepasswordOK{
Source: csrss.exe, 00000004.00000002.4474695059.0000000000824000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: Referer: X-Requested-With: XMLHttpRequest Content-Type: application/json;127.0.0.1:--ignore-missing-torrcect[] = --SOCKSPort--DataDirectory--bridgehttp://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/rep.phperr.php?&n=v=b=p=repsf=e=nocache=SEH exceptionSEHSTD: C++.dll4kPv6aJG8e\!update!sleep !regcheckcreateObjectwp-login.phpwp-admin/name="loginform"ionW[] = id="loginform"name="log"id="user_login"name="pwd"id="user_pass"administrator/administrator/index.php ] = id="form-login"action="/administrator= = id="mod-login-username"nd[] = name="username"id="mod-login-password" name="passwd"admin.phpDataLifesubactionusernamepasswordOK{
Connects to several IPs in different countries
Source: unknown Network traffic detected: IP country count 19
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 31.127.34.9:9001
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 75.176.45.87:9001
Source: global traffic TCP traffic: 192.168.2.5:49722 -> 51.91.121.255:9001
Source: global traffic TCP traffic: 192.168.2.5:49726 -> 95.216.154.139:9001
Source: global traffic TCP traffic: 192.168.2.5:49729 -> 128.31.0.39:9101
Source: global traffic TCP traffic: 192.168.2.5:49731 -> 185.220.101.20:10020
Source: global traffic TCP traffic: 192.168.2.5:49732 -> 193.218.118.100:9001
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 143.107.229.120:40233
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 151.197.240.154:9001
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 46.188.6.64:9001
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 173.249.63.227:9001
Source: global traffic TCP traffic: 192.168.2.5:49743 -> 47.56.94.99:9001
Source: global traffic TCP traffic: 192.168.2.5:49744 -> 80.66.135.13:9001
Source: global traffic TCP traffic: 192.168.2.5:49746 -> 8.209.79.125:9001
Source: global traffic TCP traffic: 192.168.2.5:49748 -> 167.86.94.107:9001
Source: global traffic TCP traffic: 192.168.2.5:49751 -> 93.186.202.32:9001
Source: global traffic TCP traffic: 192.168.2.5:49754 -> 62.78.194.4:9001
Source: global traffic TCP traffic: 192.168.2.5:49755 -> 51.38.65.160:9001
Source: global traffic TCP traffic: 192.168.2.5:49756 -> 212.8.243.229:9001
Source: global traffic TCP traffic: 192.168.2.5:49761 -> 45.153.160.131:9001
Source: global traffic TCP traffic: 192.168.2.5:49763 -> 185.220.101.205:10205
Source: global traffic TCP traffic: 192.168.2.5:49764 -> 212.47.227.71:9001
Source: global traffic TCP traffic: 192.168.2.5:49766 -> 149.56.98.216:9001
Source: global traffic TCP traffic: 192.168.2.5:49767 -> 134.249.185.176:9001
Source: global traffic TCP traffic: 192.168.2.5:49768 -> 188.195.109.45:9001
Source: global traffic TCP traffic: 192.168.2.5:49771 -> 91.121.160.6:9001
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 171.25.193.9 171.25.193.9
Source: Joe Sandbox View IP Address: 171.25.193.9 171.25.193.9
Source: Joe Sandbox View IP Address: 45.66.33.45 45.66.33.45
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 83d60721ecc423892660e275acc4dffd
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.227.109
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.227.109
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.227.109
Source: unknown TCP traffic detected without corresponding DNS query: 31.127.34.9
Source: unknown TCP traffic detected without corresponding DNS query: 31.127.34.9
Source: unknown TCP traffic detected without corresponding DNS query: 75.176.45.87
Source: unknown TCP traffic detected without corresponding DNS query: 75.176.45.87
Source: unknown TCP traffic detected without corresponding DNS query: 31.127.34.9
Source: unknown TCP traffic detected without corresponding DNS query: 75.176.45.87
Source: unknown TCP traffic detected without corresponding DNS query: 31.127.34.9
Source: unknown TCP traffic detected without corresponding DNS query: 75.176.45.87
Source: unknown TCP traffic detected without corresponding DNS query: 31.127.34.9
Source: unknown TCP traffic detected without corresponding DNS query: 75.176.45.87
Source: unknown TCP traffic detected without corresponding DNS query: 51.15.246.170
Source: unknown TCP traffic detected without corresponding DNS query: 204.13.164.118
Source: unknown TCP traffic detected without corresponding DNS query: 51.15.246.170
Source: unknown TCP traffic detected without corresponding DNS query: 204.13.164.118
Source: unknown TCP traffic detected without corresponding DNS query: 51.15.246.170
Source: unknown TCP traffic detected without corresponding DNS query: 204.13.164.118
Source: unknown TCP traffic detected without corresponding DNS query: 204.13.164.118
Source: unknown TCP traffic detected without corresponding DNS query: 204.13.164.118
Source: unknown TCP traffic detected without corresponding DNS query: 204.13.164.118
Source: unknown TCP traffic detected without corresponding DNS query: 51.15.246.170
Source: unknown TCP traffic detected without corresponding DNS query: 51.15.246.170
Source: unknown TCP traffic detected without corresponding DNS query: 51.15.246.170
Source: unknown TCP traffic detected without corresponding DNS query: 51.91.121.255
Source: unknown TCP traffic detected without corresponding DNS query: 51.91.121.255
Source: unknown TCP traffic detected without corresponding DNS query: 198.245.49.18
Source: unknown TCP traffic detected without corresponding DNS query: 198.245.49.18
Source: unknown TCP traffic detected without corresponding DNS query: 154.35.175.225
Source: unknown TCP traffic detected without corresponding DNS query: 154.35.175.225
Source: unknown TCP traffic detected without corresponding DNS query: 198.245.49.18
Source: unknown TCP traffic detected without corresponding DNS query: 154.35.175.225
Source: unknown TCP traffic detected without corresponding DNS query: 51.91.121.255
Source: unknown TCP traffic detected without corresponding DNS query: 51.91.121.255
Source: unknown TCP traffic detected without corresponding DNS query: 154.35.175.225
Source: unknown TCP traffic detected without corresponding DNS query: 198.245.49.18
Source: unknown TCP traffic detected without corresponding DNS query: 51.15.246.170
Source: unknown TCP traffic detected without corresponding DNS query: 204.13.164.118
Source: unknown TCP traffic detected without corresponding DNS query: 51.15.246.170
Source: unknown TCP traffic detected without corresponding DNS query: 204.13.164.118
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.227.109
Source: unknown TCP traffic detected without corresponding DNS query: 95.216.154.139
Source: unknown TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.94.113
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.94.113
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.94.113
Source: unknown TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.94.113
Source: PHHOjspjmp.exe, 00000001.00000002.4474538963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000004.00000002.4474695059.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: www.google.com,www.mit.edu,www.yahoo.com,www.slashdot.org equals www.yahoo.com (Yahoo)
Source: PHHOjspjmp.exe, 00000001.00000002.4475450110.0000000000B45000.00000004.00000020.00020000.00000000.sdmp, csrss.exe, 00000004.00000002.4475777311.0000000002812000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo)
Source: csrss.exe, 00000004.00000002.4475777311.0000000002812000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: }www.yahoo.com equals www.yahoo.com (Yahoo)
Source: PHHOjspjmp.exe, 00000001.00000002.4474538963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000004.00000002.4474695059.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://www.openssl.org/support/faq.html
Source: PHHOjspjmp.exe, 00000001.00000002.4474538963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000004.00000002.4474695059.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://www.openssl.org/support/faq.htmlTYPE=2OpenSSL
Source: PHHOjspjmp.exe, 00000001.00000002.4474538963.0000000000824000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000004.00000002.4474695059.0000000000824000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/re
Source: PHHOjspjmp.exe, 00000001.00000002.4474538963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000004.00000002.4474695059.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https:///phpMyAdmin//PhpMyAdmin//pma/rootmysqlimapssmtpspop3sscp://your_IP_is_greylisted_README.txt2
Source: PHHOjspjmp.exe, 00000001.00000002.4474538963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000004.00000002.4474695059.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: csrss.exe, 00000004.00000002.4474695059.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: PHHOjspjmp.exe, 00000001.00000002.4474538963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000004.00000002.4474695059.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: PHHOjspjmp.exe, 00000001.00000002.4474538963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000004.00000002.4474695059.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://trac.torproject.org/projects/tor/ticket/14917.
Source: PHHOjspjmp.exe, 00000001.00000002.4474538963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000004.00000002.4474695059.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.torproject.org/
Source: csrss.exe, 00000004.00000002.4474695059.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.torproject.org/documentation.html
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.15.246.170:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 195.201.94.113:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 85.10.240.250:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 195.154.106.60:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 130.225.244.90:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.158.147.25:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown HTTPS traffic detected: 209.58.180.90:443 -> 192.168.2.5:49769 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.5:49774 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.65.205.10:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.5:49775 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected CMSBrute
Source: Yara match File source: 4.2.csrss.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PHHOjspjmp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: Process Memory Space: PHHOjspjmp.exe PID: 6512, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: csrss.exe PID: 2792, type: MEMORYSTR

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000000.00000002.2010418377.00000000044BF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.2113415020.0000000004700000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_06020110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess, 0_2_06020110
Source: C:\ProgramData\Drivers\csrss.exe Code function: 3_2_061E0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess, 3_2_061E0110
Detected potential crypto function
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_00406515 0_2_00406515
Source: C:\ProgramData\Drivers\csrss.exe Code function: 3_2_00406515 3_2_00406515
Sample file is different than original file name gathered from version info
Source: PHHOjspjmp.exe Binary or memory string: OriginalFilename vs PHHOjspjmp.exe
Source: PHHOjspjmp.exe, 00000000.00000002.2010184740.00000000041C6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameFirezer( vs PHHOjspjmp.exe
Source: PHHOjspjmp.exe, 00000001.00000002.4474538963.0000000000843000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCSRSS.Exej% vs PHHOjspjmp.exe
Source: PHHOjspjmp.exe, 00000001.00000000.2007772196.00000000041C6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameFirezer( vs PHHOjspjmp.exe
Source: PHHOjspjmp.exe Binary or memory string: OriginalFilenameFirezer( vs PHHOjspjmp.exe
Uses 32bit PE files
Source: PHHOjspjmp.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 00000000.00000002.2010418377.00000000044BF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.2113415020.0000000004700000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: classification engine Classification label: mal100.troj.evad.winEXE@6/3@0/53
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_044BF7C6 CreateToolhelp32Snapshot,Module32First, 0_2_044BF7C6
Source: C:\ProgramData\Drivers\csrss.exe Mutant created: NULL
Source: C:\Users\user\Desktop\PHHOjspjmp.exe File created: C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\ Jump to behavior
Source: PHHOjspjmp.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\PHHOjspjmp.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: PHHOjspjmp.exe ReversingLabs: Detection: 50%
Source: PHHOjspjmp.exe Virustotal: Detection: 50%
Source: C:\Users\user\Desktop\PHHOjspjmp.exe File read: C:\Users\user\Desktop\PHHOjspjmp.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\PHHOjspjmp.exe "C:\Users\user\Desktop\PHHOjspjmp.exe"
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Process created: C:\Users\user\Desktop\PHHOjspjmp.exe "C:\Users\user\Desktop\PHHOjspjmp.exe"
Source: unknown Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\ProgramData\Drivers\csrss.exe Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Process created: C:\Users\user\Desktop\PHHOjspjmp.exe "C:\Users\user\Desktop\PHHOjspjmp.exe" Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe" Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: csunsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: swift.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: nfhwcrhk.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: surewarehook.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: csunsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: aep.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: atasi.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: swift.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: nfhwcrhk.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: nuronssl.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: surewarehook.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: ubsec.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: aep.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: atasi.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: swift.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: nfhwcrhk.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: nuronssl.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: surewarehook.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: ubsec.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: PHHOjspjmp.exe Static file information: File size 1984000 > 1048576
Source: PHHOjspjmp.exe Static PE information: Raw size of .data is bigger than: 0x100000 < 0x1be800
Source: PHHOjspjmp.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PHHOjspjmp.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PHHOjspjmp.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PHHOjspjmp.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PHHOjspjmp.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PHHOjspjmp.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: PHHOjspjmp.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\mova-vur\fina_cusayuk\nusami.pdb source: PHHOjspjmp.exe, csrss.exe.1.dr
Source: Binary string: w>C:\mova-vur\fina_cusayuk\nusami.pdb source: PHHOjspjmp.exe, csrss.exe.1.dr
Source: PHHOjspjmp.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PHHOjspjmp.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PHHOjspjmp.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PHHOjspjmp.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PHHOjspjmp.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 1_2_0069D030 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer, 1_2_0069D030
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_00407725 push ecx; ret 0_2_00407738
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_04619A51 push eax; retf 0_2_04619A53
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_04566A35 push ds; ret 0_2_04566A36
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_0460DAE0 push esi; iretd 0_2_0460DAEB
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_045322C0 push eax; iretd 0_2_045322C9
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_04619AB0 push A7EF5AB4h; ret 0_2_04619AB7
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_0454A3F1 push edx; ret 0_2_0454A3F3
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 1_2_00696299 push ecx; ret 1_2_006962AC
Source: C:\ProgramData\Drivers\csrss.exe Code function: 3_2_00407725 push ecx; ret 3_2_00407738
Source: C:\ProgramData\Drivers\csrss.exe Code function: 3_2_0485AA90 push A7EF5AB4h; ret 3_2_0485AA97
Source: C:\ProgramData\Drivers\csrss.exe Code function: 3_2_0484EAC0 push esi; iretd 3_2_0484EACB
Source: C:\ProgramData\Drivers\csrss.exe Code function: 3_2_047A7A15 push ds; ret 3_2_047A7A16
Source: C:\ProgramData\Drivers\csrss.exe Code function: 3_2_0485AA31 push eax; retf 3_2_0485AA33
Source: C:\ProgramData\Drivers\csrss.exe Code function: 3_2_047732A0 push eax; iretd 3_2_047732A9
Source: C:\ProgramData\Drivers\csrss.exe Code function: 3_2_0478B3D1 push edx; ret 3_2_0478B3D3
Source: C:\ProgramData\Drivers\csrss.exe Code function: 4_2_00696299 push ecx; ret 4_2_006962AC

Persistence and Installation Behavior
barindex
Drops PE files with benign system names
Source: C:\Users\user\Desktop\PHHOjspjmp.exe File created: C:\ProgramData\Drivers\csrss.exe Jump to dropped file
Drops PE files
Source: C:\Users\user\Desktop\PHHOjspjmp.exe File created: C:\ProgramData\Drivers\csrss.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\PHHOjspjmp.exe File created: C:\ProgramData\Drivers\csrss.exe Jump to dropped file
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run CSRSS Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run CSRSS Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
May use the Tor software to hide its network traffic
Source: PHHOjspjmp.exe, 00000001.00000002.4474538963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000004.00000002.4474695059.0000000000400000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: onion-port
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_00406515 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00406515
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Window / User API: threadDelayed 1758 Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Window / User API: threadDelayed 8140 Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe Window / User API: threadDelayed 8410 Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe Window / User API: threadDelayed 1582 Jump to behavior
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\ProgramData\Drivers\csrss.exe Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\PHHOjspjmp.exe TID: 6644 Thread sleep count: 1758 > 30 Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe TID: 6644 Thread sleep time: -175800s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe TID: 6644 Thread sleep count: 8140 > 30 Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe TID: 6644 Thread sleep time: -814000s >= -30000s Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe TID: 3424 Thread sleep count: 8410 > 30 Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe TID: 3424 Thread sleep time: -841000s >= -30000s Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe TID: 3424 Thread sleep count: 1582 > 30 Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe TID: 3424 Thread sleep time: -158200s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\ProgramData\Drivers\csrss.exe Last function: Thread delayed
Source: C:\ProgramData\Drivers\csrss.exe Last function: Thread delayed
Source: PHHOjspjmp.exe, 00000001.00000002.4475518026.0000000000B78000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll;
Source: csrss.exe, 00000004.00000002.4475366301.0000000000C00000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\PHHOjspjmp.exe API call chain: ExitProcess graph end node
Source: C:\ProgramData\Drivers\csrss.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_0040A882 IsDebuggerPresent, 0_2_0040A882
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 1_2_0069D030 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer, 1_2_0069D030
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_044BF0A3 push dword ptr fs:[00000030h] 0_2_044BF0A3
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_06020042 push dword ptr fs:[00000030h] 0_2_06020042
Source: C:\ProgramData\Drivers\csrss.exe Code function: 3_2_04700083 push dword ptr fs:[00000030h] 3_2_04700083
Source: C:\ProgramData\Drivers\csrss.exe Code function: 3_2_061E0042 push dword ptr fs:[00000030h] 3_2_061E0042
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_00406914 GetProcessHeap, 0_2_00406914
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_0040A80D SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_0040A80D
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 1_2_006943E0 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_006943E0
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 1_2_00694A78 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_00694A78
Source: C:\ProgramData\Drivers\csrss.exe Code function: 3_2_0040A80D SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_0040A80D

HIPS / PFW / Operating System Protection Evasion
barindex
Contains functionality to inject code into remote processes
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_06020110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess, 0_2_06020110
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Memory written: C:\Users\user\Desktop\PHHOjspjmp.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe Memory written: C:\ProgramData\Drivers\csrss.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Process created: C:\Users\user\Desktop\PHHOjspjmp.exe "C:\Users\user\Desktop\PHHOjspjmp.exe" Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Code function: 0_2_0040A2D9 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_0040A2D9
Source: C:\Users\user\Desktop\PHHOjspjmp.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1432016 Sample: PHHOjspjmp.exe Startdate: 26/04/2024 Architecture: WINDOWS Score: 100 26 Malicious sample detected (through community Yara rule) 2->26 28 Antivirus / Scanner detection for submitted sample 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 5 other signatures 2->32 6 PHHOjspjmp.exe 2->6         started        9 csrss.exe 2->9         started        process3 signatures4 34 Contains functionality to inject code into remote processes 6->34 36 Drops PE files with benign system names 6->36 38 Injects a PE file into a foreign processes 6->38 11 PHHOjspjmp.exe 2 7 6->11         started        40 Antivirus detection for dropped file 9->40 42 Multi AV Scanner detection for dropped file 9->42 44 Machine Learning detection for dropped file 9->44 16 csrss.exe 2 9->16         started        process5 dnsIp6 20 127.0.0.1 unknown unknown 11->20 22 212.8.243.229, 49756, 9001 WORLDSTREAMNL Netherlands 11->22 24 51 other IPs or domains 11->24 18 C:\ProgramData\Drivers\csrss.exe, PE32 11->18 dropped 46 Found Tor onion address 11->46 48 May use the Tor software to hide its network traffic 11->48 file7 signatures8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
171.25.193.9
 unknown Sweden
198093 DFRI-ASForeningenfordigitalafri-ochrattigheterSE false
85.10.240.250
 unknown Germany
24940 HETZNER-ASDE false
45.66.33.45
 unknown Netherlands
47482 SPECTRENL false
195.201.94.113
 unknown Germany
24940 HETZNER-ASDE false
8.209.79.125
 unknown Singapore
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false
143.107.229.120
 unknown Brazil
28571 UNIVERSIDADEDESAOPAULOBR false
51.158.147.25
 unknown France
12876 OnlineSASFR false
95.216.154.139
 unknown Germany
24940 HETZNER-ASDE false
86.59.21.38
 unknown Austria
8437 UTA-ASAT false
93.186.202.32
 unknown Germany
24961 MYLOC-ASIPBackboneofmyLocmanagedITAGDE false
154.35.175.225
 unknown United States
14987 RETHEMHOSTINGUS false
128.31.0.39
 unknown United States
3 MIT-GATEWAYSUS false
62.78.194.4
 unknown Finland
16086 DNAFI false
51.91.121.255
 unknown France
16276 OVHFR false
195.154.106.60
 unknown France
12876 OnlineSASFR false
47.56.94.99
 unknown United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false
185.220.101.205
 unknown Germany
208294 ASMKNL false
204.13.164.118
 unknown United States
25700 25700US false
109.70.100.14
 unknown Austria
208323 APPLIEDPRIVACY-ASAT false
188.195.109.45
 unknown Germany
31334 KABELDEUTSCHLAND-ASDE false
46.105.227.109
 unknown France
16276 OVHFR false
151.197.240.154
 unknown United States
701 UUNETUS false
23.129.64.239
 unknown United States
396507 EMERALD-ONIONUS false
185.65.205.10
 unknown Turkey
59895 CITYNETHOST-ASTR false
104.149.129.210
 unknown United States
40676 AS40676US false
37.187.23.232
 unknown France
16276 OVHFR false
167.86.94.107
 unknown Germany
51167 CONTABODE false
217.160.255.217
 unknown Germany
8560 ONEANDONE-ASBrauerstrasse48DE false
149.56.98.216
 unknown Canada
16276 OVHFR false
88.88.79.90
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
198.245.49.18
 unknown Canada
16276 OVHFR false
31.127.34.9
 unknown United Kingdom
12576 EELtdGB false
193.218.118.100
 unknown Ukraine
207656 EPINATURAUA false
212.8.243.229
 unknown Netherlands
49981 WORLDSTREAMNL false
80.66.135.13
 unknown Belgium
1239 SPRINTLINKUS false
131.188.40.189
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
188.68.53.92
 unknown Germany
197540 NETCUP-ASnetcupGmbHDE false
185.220.101.20
 unknown Germany
208294 ASMKNL false
46.188.6.64
 unknown Russian Federation
8334 CO-2COM-ASMoscowRU false
45.153.160.131
 unknown Czech Republic
55933 CLOUDIE-AS-APCloudieLimitedHK false
134.249.185.176
 unknown Ukraine
15895 KSNET-ASUA false
130.225.244.90
 unknown Denmark
1835 FSKNET-DKForskningsnettet-DanishnetworkforResearchand false
199.58.81.140
 unknown Canada
7765 KOUMBITCA false
212.47.227.71
 unknown France
12876 OnlineSASFR false
192.0.128.86
 unknown Canada
5645 TEKSAVVYCA false
91.121.160.6
 unknown France
16276 OVHFR false
75.176.45.87
 unknown United States
11426 TWC-11426-CAROLINASUS false
209.58.180.90
 unknown Singapore
59253 LEASEWEB-APAC-SIN-11LeasewebAsiaPacificpteltdSG false
50.7.8.141
 unknown United States
174 COGENT-174US false
51.15.246.170
 unknown France
12876 OnlineSASFR false
51.38.65.160
 unknown France
16276 OVHFR false
173.249.63.227
 unknown Germany
51167 CONTABODE false

Private

IP
127.0.0.1