Overview

overview

10

Static

static

3

qbittorren...up.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-06-2023 18:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    qbittorrent_4.5.3_x64_setup.exe

  • Size

    31.5MB

  • MD5

    59950b6d52726702f8f868aa8492dc71

  • SHA1

    1ca7caf1192d0a4be0eb9cf8be44b79f2d08958d

  • SHA256

    99b0fce9fcf8f384b435f4d685536ff2e4150224ef0391c581588ba55e75a138

  • SHA512

    b5bf7c9e1a8f441cf101b6c3094cafc80c3649df5135acd531471c02e9bcb598b8b481d99a61ae333e45f73be29b54fa0b7766d9b9eb138a2e046f147ddbae90

  • SSDEEP

    786432:rfmX+yD1AXaUxBBeKus4SoaHC36aEDjb1fYNX:rfy+yBAVBIKu/+iqaAJQNX

Score
10/10
bazarloaderdiscoverydropperloader

Malware Config

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader
  • Bazar/Team9 Loader payload 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 37 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 44 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\qbittorrent_4.5.3_x64_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\qbittorrent_4.5.3_x64_setup.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:4104

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\qBittorrent\qbittorrent.exe
    Filesize

    28.5MB

    MD5

    454f27cbdd4f8d104e7f8f3dac1ac08a

    SHA1

    799eb991805ff0c3dc4e1cb5a85102e660e2988e

    SHA256

    10228af0155d3a41777dd4006a610fc01786ffecdf631b6e402c40883788ffb5

    SHA512

    52ab91c3e1300c4aaaaa4c65169e951cceb6438bfd2f69dcb277373dd5257e8dfe35101b60440820ae3130f9ee3a3cc59f1210e92e4d656f0541418dee514aee

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsfBADB.tmp\FindProcDLL.dll
    Filesize

    3KB

    MD5

    b4faf654de4284a89eaf7d073e4e1e63

    SHA1

    8efcfd1ca648e942cbffd27af429784b7fcf514b

    SHA256

    c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3

    SHA512

    eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsfBADB.tmp\LangDLL.dll
    Filesize

    5KB

    MD5

    68b287f4067ba013e34a1339afdb1ea8

    SHA1

    45ad585b3cc8e5a6af7b68f5d8269c97992130b3

    SHA256

    18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

    SHA512

    06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsfBADB.tmp\System.dll
    Filesize

    12KB

    MD5

    cff85c549d536f651d4fb8387f1976f2

    SHA1

    d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    SHA256

    8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    SHA512

    531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsfBADB.tmp\UAC.dll
    Filesize

    14KB

    MD5

    adb29e6b186daa765dc750128649b63d

    SHA1

    160cbdc4cb0ac2c142d361df138c537aa7e708c9

    SHA256

    2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

    SHA512

    b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsfBADB.tmp\modern-wizard.bmp
    Filesize

    25KB

    MD5

    cbe40fd2b1ec96daedc65da172d90022

    SHA1

    366c216220aa4329dff6c485fd0e9b0f4f0a7944

    SHA256

    3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

    SHA512

    62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsfBADB.tmp\nsDialogs.dll
    Filesize

    9KB

    MD5

    6c3f8c94d0727894d706940a8a980543

    SHA1

    0d1bcad901be377f38d579aafc0c41c0ef8dcefd

    SHA256

    56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

    SHA512

    2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsfBADB.tmp\nsisFirewallW.dll
    Filesize

    8KB

    MD5

    f5bf81a102de52a4add21b8a367e54e0

    SHA1

    cf1e76ffe4a3ecd4dad453112afd33624f16751c

    SHA256

    53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

    SHA512

    6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsfBADB.tmp\nsisFirewallW.dll
    Filesize

    8KB

    MD5

    f5bf81a102de52a4add21b8a367e54e0

    SHA1

    cf1e76ffe4a3ecd4dad453112afd33624f16751c

    SHA256

    53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

    SHA512

    6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

    Download Submit