Overview

overview

10

Static

static

1

qbittorren...up.exe

windows7-x64

7

qbittorren...up.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    131s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    04-04-2023 18:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    qbittorrent_4.5.2_x64_setup.exe

  • Size

    31.3MB

  • MD5

    c9cd92842c3fe0cbb53e320d46eb71cf

  • SHA1

    1bbbf8fc8b6ac9dc40ffb01b0d521c1b81174216

  • SHA256

    f2ec7fa4c5ae273d6d7181c0c9df225eb8ce8e0e85577b236c7b335c093f2e71

  • SHA512

    fb7f4c71c50b7ff77c8ddc41c6c4d944d8138b0d9b7e948ef16815e4f76a26b9e8f28610866fc9455ffcf04d2e38ceddf15020526730a8154694f2ac501b7138

  • SSDEEP

    786432:rFUPR+I5pNSnPbDAMzkWeumVDg9ptSF+40S5cCPJ2SAqKEUHwg:rFS+2pNcbUMoTumxXBqCPFAq3GF

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\qbittorrent_4.5.2_x64_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\qbittorrent_4.5.2_x64_setup.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1704

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsd1835.tmp\LangDLL.dll
    Filesize

    5KB

    MD5

    68b287f4067ba013e34a1339afdb1ea8

    SHA1

    45ad585b3cc8e5a6af7b68f5d8269c97992130b3

    SHA256

    18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

    SHA512

    06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsd1835.tmp\UAC.dll
    Filesize

    14KB

    MD5

    adb29e6b186daa765dc750128649b63d

    SHA1

    160cbdc4cb0ac2c142d361df138c537aa7e708c9

    SHA256

    2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

    SHA512

    b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

    Download Submit