bce9addd9304f81c854e60e9d40dad0c50d21527c1fe3fb1e9f973147ab1011a | Triage

Analysis

max time kernel
127s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-05-2023 01:52

Sharing

Report Analysis Logs

General

Target

qBittorrentPortable_4.5.2.paf.exe
Size

15.0MB
MD5

83b1ccdde2d2ea442c2f93bbdb5104eb
SHA1

cf2e6b6dd24224b41d74cca4b6c4b738ea9c0f38
SHA256

bce9addd9304f81c854e60e9d40dad0c50d21527c1fe3fb1e9f973147ab1011a
SHA512

67e89951b2582c1375c3dc5db5fdf4b9d4c736596dc28e75faee3f67cb0361b9e9dea649652794a09feb31340ecc4479a4bfe54ce00aa881c98b1cd7fedbe779
SSDEEP

393216:5UXiAFPR1KptgvG9AwUAUrKlWFvv7J5Bpg2a:5Uz1xvG9AwJlm7Hja

Score

4^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

qBittorrentPortable_4.5.2.paf.exe

pid process

1216 qBittorrentPortable_4.5.2.paf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

qBittorrentPortable_4.5.2.paf.exe

pid process

1216 qBittorrentPortable_4.5.2.paf.exe

C:\Users\Admin\AppData\Local\Temp\qBittorrentPortable_4.5.2.paf.exe
"C:\Users\Admin\AppData\Local\Temp\qBittorrentPortable_4.5.2.paf.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1216

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsiFBC.tmp\LangDLL.dll
Filesize
5KB

MD5
68b287f4067ba013e34a1339afdb1ea8

SHA1
45ad585b3cc8e5a6af7b68f5d8269c97992130b3

SHA256
18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

SHA512
06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

Download Submit