014614e6650f00448b18b594013d532043165806280ac04e0e1aab9c9d7d8ad3

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client/SEBarClt.exe
Size 874KB
Sample240517-ba7q8aab65
SHA256 b01acb4f2dc26be063b4fcc12ee959c6db5871226234c9ef7f3af5a75eb3214d
MD5 b59037d9e8e90a0a29d7570e6afedef5
SHA1 81dd5832eae9b5f5953666e9642517ab8658dd79
SHA512 e2d574e796cb631cfcf159b860c94c1bf4be3f4e39c3e4e44e29a560079b0c6833c762a2344312b49e72657a947ffa5bcaec3d65d251d14c098124935cef7632
SSDEEP 12288:fExzJnjVqy6qetASRTYsapGL6QS8Ds9lTSGT9V1uTW2XbeUFoloLEs3Ks:cxhxJTpGjS8DsrTSAyTWA3FoloLpKs
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SEBarClt.exe
File opened (read-only)	\??\L:	SEBarClt.exe
File opened (read-only)	\??\N:	SEBarClt.exe
File opened (read-only)	\??\P:	SEBarClt.exe
File opened (read-only)	\??\R:	SEBarClt.exe
File opened (read-only)	\??\Z:	SEBarClt.exe
File opened (read-only)	\??\E:	SEBarClt.exe
File opened (read-only)	\??\G:	SEBarClt.exe
File opened (read-only)	\??\K:	SEBarClt.exe
File opened (read-only)	\??\M:	SEBarClt.exe
File opened (read-only)	\??\O:	SEBarClt.exe
File opened (read-only)	\??\W:	SEBarClt.exe
File opened (read-only)	\??\Y:	SEBarClt.exe
File opened (read-only)	\??\I:	SEBarClt.exe
File opened (read-only)	\??\J:	SEBarClt.exe
File opened (read-only)	\??\Q:	SEBarClt.exe
File opened (read-only)	\??\T:	SEBarClt.exe
File opened (read-only)	\??\V:	SEBarClt.exe
File opened (read-only)	\??\A:	SEBarClt.exe
File opened (read-only)	\??\H:	SEBarClt.exe
File opened (read-only)	\??\S:	SEBarClt.exe
File opened (read-only)	\??\U:	SEBarClt.exe
File opened (read-only)	\??\X:	SEBarClt.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\physicaldrive0	SEBarClt.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SYNCSTAT.EXE	SEBarClt.exe
File created	C:\Windows\SysWOW64\SYNCCMD.EXE	SEBarClt.exe
File opened for modification	C:\Windows\SysWOW64\SYNCCMD.EXE	SEBarClt.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 624 set thread context of 1872	624	nQMailer.exe	29
PID 1832 set thread context of 2656	1832	nQMailer.exe	31
PID 2668 set thread context of 2352	2668	nQMailer.exe	33
PID 2900 set thread context of 2672	2900	nQMailer.exe	35
PID 2848 set thread context of 3020	2848	nQMailer.exe	37
PID 2560 set thread context of 2624	2560	nQMailer.exe	39
PID 2212 set thread context of 2576	2212	nQMailer.exe	41
PID 1620 set thread context of 2196	1620	nQMailer.exe	43
PID 1044 set thread context of 1860	1044	nQMailer.exe	45
PID 2500 set thread context of 2784	2500	nQMailer.exe	47
PID 2780 set thread context of 2796	2780	nQMailer.exe	49
PID 1640 set thread context of 308	1640	nQMailer.exe	51
PID 1820 set thread context of 1892	1820	nQMailer.exe	53
PID 2424 set thread context of 1684	2424	nQMailer.exe	55
PID 2244 set thread context of 2176	2244	nQMailer.exe	57
PID 532 set thread context of 264	532	nQMailer.exe	59
PID 1488 set thread context of 2208	1488	nQMailer.exe	61
PID 300 set thread context of 760	300	nQMailer.exe	63
PID 1848 set thread context of 2328	1848	nQMailer.exe	65
PID 2872 set thread context of 2868	2872	nQMailer.exe	67
PID 2072 set thread context of 2776	2072	nQMailer.exe	69
PID 2928 set thread context of 2256	2928	nQMailer.exe	71
PID 852 set thread context of 2376	852	nQMailer.exe	75
PID 440 set thread context of 1128	440	nQMailer.exe	77
PID 1784 set thread context of 1792	1784	nQMailer.exe	79
PID 944 set thread context of 1304	944	nQMailer.exe	81
PID 1736 set thread context of 2940	1736	nQMailer.exe	83
PID 692 set thread context of 1072	692	nQMailer.exe	85
PID 2964 set thread context of 1184	2964	nQMailer.exe	87
PID 3016 set thread context of 348	3016	nQMailer.exe	89
PID 808 set thread context of 2952	808	nQMailer.exe	91
PID 1412 set thread context of 2084	1412	nQMailer.exe	93
PID 2260 set thread context of 1604	2260	nQMailer.exe	95
PID 2128 set thread context of 1864	2128	nQMailer.exe	97
PID 2656 set thread context of 2652	2656	nQMailer.exe	99
PID 2352 set thread context of 2668	2352	nQMailer.exe	101
PID 2548 set thread context of 2748	2548	nQMailer.exe	103
PID 2440 set thread context of 2456	2440	nQMailer.exe	105
PID 2648 set thread context of 2676	2648	nQMailer.exe	107
PID 2560 set thread context of 2508	2560	nQMailer.exe	109
PID 2212 set thread context of 2632	2212	nQMailer.exe	111
PID 2196 set thread context of 1620	2196	nQMailer.exe	113
PID 1860 set thread context of 1044	1860	nQMailer.exe	115
PID 1804 set thread context of 2800	1804	nQMailer.exe	117
PID 2764 set thread context of 2796	2764	nQMailer.exe	119
PID 1556 set thread context of 840	1556	nQMailer.exe	121
PID 1948 set thread context of 1256	1948	nQMailer.exe	123
PID 2224 set thread context of 2164	2224	nQMailer.exe	125
PID 2236 set thread context of 2016	2236	nQMailer.exe	127
PID 1704 set thread context of 1716	1704	nQMailer.exe	129
PID 572 set thread context of 1000	572	nQMailer.exe	131
PID 2864 set thread context of 632	2864	nQMailer.exe	133
PID 544 set thread context of 292	544	nQMailer.exe	135
PID 3068 set thread context of 2880	3068	nQMailer.exe	137
PID 2608 set thread context of 2920	2608	nQMailer.exe	139
PID 2256 set thread context of 2928	2256	nQMailer.exe	141
PID 2376 set thread context of 852	2376	nQMailer.exe	143
PID 1128 set thread context of 440	1128	nQMailer.exe	145
PID 1792 set thread context of 1784	1792	nQMailer.exe	147
PID 1304 set thread context of 944	1304	nQMailer.exe	149
PID 2940 set thread context of 1736	2940	nQMailer.exe	151
PID 752 set thread context of 2284	752	nQMailer.exe	153
PID 3008 set thread context of 2964	3008	nQMailer.exe	155
PID 348 set thread context of 3016	348	nQMailer.exe	157

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\BootSys.log	SEBarClt.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	SEBarClt.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	SEBarClt.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SEBarClt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SEBarClt.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2180	SEBarClt.exe
Token: SeIncBasePriorityPrivilege	2180	SEBarClt.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2180	SEBarClt.exe
2180	SEBarClt.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2180	SEBarClt.exe
2180	SEBarClt.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2180	SEBarClt.exe
2180	SEBarClt.exe
2180	SEBarClt.exe

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
760	svchost.exe
1620	svchost.exe
1256	svchost.exe
2964	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 624	2180	SEBarClt.exe	28
PID 2180 wrote to memory of 624	2180	SEBarClt.exe	28
PID 2180 wrote to memory of 624	2180	SEBarClt.exe	28
PID 2180 wrote to memory of 624	2180	SEBarClt.exe	28
PID 624 wrote to memory of 1872	624	nQMailer.exe	29
PID 624 wrote to memory of 1872	624	nQMailer.exe	29
PID 624 wrote to memory of 1872	624	nQMailer.exe	29
PID 624 wrote to memory of 1872	624	nQMailer.exe	29
PID 624 wrote to memory of 1872	624	nQMailer.exe	29
PID 624 wrote to memory of 1872	624	nQMailer.exe	29
PID 2180 wrote to memory of 1832	2180	SEBarClt.exe	30
PID 2180 wrote to memory of 1832	2180	SEBarClt.exe	30
PID 2180 wrote to memory of 1832	2180	SEBarClt.exe	30
PID 2180 wrote to memory of 1832	2180	SEBarClt.exe	30
PID 1832 wrote to memory of 2656	1832	nQMailer.exe	31
PID 1832 wrote to memory of 2656	1832	nQMailer.exe	31
PID 1832 wrote to memory of 2656	1832	nQMailer.exe	31
PID 1832 wrote to memory of 2656	1832	nQMailer.exe	31
PID 1832 wrote to memory of 2656	1832	nQMailer.exe	31
PID 1832 wrote to memory of 2656	1832	nQMailer.exe	31
PID 2180 wrote to memory of 2668	2180	SEBarClt.exe	32
PID 2180 wrote to memory of 2668	2180	SEBarClt.exe	32
PID 2180 wrote to memory of 2668	2180	SEBarClt.exe	32
PID 2180 wrote to memory of 2668	2180	SEBarClt.exe	32
PID 2668 wrote to memory of 2352	2668	nQMailer.exe	33
PID 2668 wrote to memory of 2352	2668	nQMailer.exe	33
PID 2668 wrote to memory of 2352	2668	nQMailer.exe	33
PID 2668 wrote to memory of 2352	2668	nQMailer.exe	33
PID 2668 wrote to memory of 2352	2668	nQMailer.exe	33
PID 2668 wrote to memory of 2352	2668	nQMailer.exe	33
PID 2180 wrote to memory of 2900	2180	SEBarClt.exe	34
PID 2180 wrote to memory of 2900	2180	SEBarClt.exe	34
PID 2180 wrote to memory of 2900	2180	SEBarClt.exe	34
PID 2180 wrote to memory of 2900	2180	SEBarClt.exe	34
PID 2900 wrote to memory of 2672	2900	nQMailer.exe	35
PID 2900 wrote to memory of 2672	2900	nQMailer.exe	35
PID 2900 wrote to memory of 2672	2900	nQMailer.exe	35
PID 2900 wrote to memory of 2672	2900	nQMailer.exe	35
PID 2900 wrote to memory of 2672	2900	nQMailer.exe	35
PID 2900 wrote to memory of 2672	2900	nQMailer.exe	35
PID 2180 wrote to memory of 2848	2180	SEBarClt.exe	36
PID 2180 wrote to memory of 2848	2180	SEBarClt.exe	36
PID 2180 wrote to memory of 2848	2180	SEBarClt.exe	36
PID 2180 wrote to memory of 2848	2180	SEBarClt.exe	36
PID 2848 wrote to memory of 3020	2848	nQMailer.exe	37
PID 2848 wrote to memory of 3020	2848	nQMailer.exe	37
PID 2848 wrote to memory of 3020	2848	nQMailer.exe	37
PID 2848 wrote to memory of 3020	2848	nQMailer.exe	37
PID 2848 wrote to memory of 3020	2848	nQMailer.exe	37
PID 2848 wrote to memory of 3020	2848	nQMailer.exe	37
PID 2180 wrote to memory of 2560	2180	SEBarClt.exe	38
PID 2180 wrote to memory of 2560	2180	SEBarClt.exe	38
PID 2180 wrote to memory of 2560	2180	SEBarClt.exe	38
PID 2180 wrote to memory of 2560	2180	SEBarClt.exe	38
PID 2560 wrote to memory of 2624	2560	nQMailer.exe	39
PID 2560 wrote to memory of 2624	2560	nQMailer.exe	39
PID 2560 wrote to memory of 2624	2560	nQMailer.exe	39
PID 2560 wrote to memory of 2624	2560	nQMailer.exe	39
PID 2560 wrote to memory of 2624	2560	nQMailer.exe	39
PID 2560 wrote to memory of 2624	2560	nQMailer.exe	39
PID 2180 wrote to memory of 2212	2180	SEBarClt.exe	40
PID 2180 wrote to memory of 2212	2180	SEBarClt.exe	40
PID 2180 wrote to memory of 2212	2180	SEBarClt.exe	40
PID 2180 wrote to memory of 2212	2180	SEBarClt.exe	40

C:\Users\Admin\AppData\Local\Temp\Client\SEBarClt.exe
"C:\Users\Admin\AppData\Local\Temp\Client\SEBarClt.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1872
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2656
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2352
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2672
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3020
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2624
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2212
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2576
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1620
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2196
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1044
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1860
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2500
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2784
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2780
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2796
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1640
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:308
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1820
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1892
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2424
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1684
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2244
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2176
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:532
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:264
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1488
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2208
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:300
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of UnmapMainImage
    PID:760
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1848
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2328
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2872
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2868
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2072
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2776
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2928
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2256
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:852
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2376
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:440
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1128
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1784
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1792
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:944
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1304
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1736
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2940
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:692
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1072
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2964
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1184
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:3016
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:348
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:808
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2952
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1412
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2084
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2260
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1604
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2128
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1864
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2656
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2652
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2352
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2668
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2548
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2748
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2440
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2456
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2648
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2676
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2560
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2508
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2212
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2632
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2196
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of UnmapMainImage
    PID:1620
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1860
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1044
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1804
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2800
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2764
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2796
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1556
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:840
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1948
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of UnmapMainImage
    PID:1256
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2224
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2164
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2236
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2016
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1704
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1716
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:572
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1000
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2864
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:632
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:544
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:292
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:3068
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2880
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2608
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2920
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2256
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2928
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2376
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:852
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1128
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:440
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1792
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1784
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1304
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:944
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2940
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1736
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:752
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2284
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:3008
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of UnmapMainImage
    PID:2964
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:348
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3016
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:2952
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:808
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:2084
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1412
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:1604
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2260
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:1208
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:952
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:2840
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2996
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:2736
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2724
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:1688
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2052
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:2644
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2276
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:2716
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2900
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:2456
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2440
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:2444
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2804
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:2524
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/308-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/624-4-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/624-10-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1044-58-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1620-52-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1832-17-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1832-11-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/1860-53-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1872-9-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1872-7-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1872-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2180-0-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/2180-69-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/2180-3-0x0000000000680000-0x00000000006A8000-memory.dmp

Download

memory/2180-47-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/2196-48-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2212-46-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2352-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2500-63-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2560-41-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2576-42-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2624-37-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2656-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2668-24-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2668-18-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/2672-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2780-68-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2784-59-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2796-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2848-36-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2900-30-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2900-31-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/3020-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads