07f1777b4508c5629e26bb592050dfd4421169b76de79001d2f0350f92010f23

Analysis

max time kernel
76s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2023, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

qbittorrent_4.4.3.1_x64_setup.exe
Size

28.6MB
MD5

a7bfe1dd4310b27370f4f7f775087482
SHA1

a98dc34c27b2f5727c2bf6d646d09ce4320f5028
SHA256

07f1777b4508c5629e26bb592050dfd4421169b76de79001d2f0350f92010f23
SHA512

3e1779c4efc91a246ca6c857243dbcc9033f33b8a2cf71cd6b3920593d1460d391601462e7e6e099a8f776d54c00357d7e4ebec3ce7b1f6709ffc3b54e05740b
SSDEEP

786432:46uKvEAZ4VCo8DtKViW1aLt+dWtXBfesPX2s0:4OugDzW4L8Wp8kXe

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
4724	qbittorrent_4.4.3.1_x64_setup.exe
4724	qbittorrent_4.4.3.1_x64_setup.exe
4724	qbittorrent_4.4.3.1_x64_setup.exe
4724	qbittorrent_4.4.3.1_x64_setup.exe
4724	qbittorrent_4.4.3.1_x64_setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\qbittorrent_4.4.3.1_x64_setup.exe
"C:\Users\Admin\AppData\Local\Temp\qbittorrent_4.4.3.1_x64_setup.exe"
1⤵
- Loads dropped DLL
PID:4724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsl7E8D.tmp\InstallOptions.dll

Filesize
15KB

MD5
0a9fb96a7579b685ec36b17fc354e6a3

SHA1
355754104dd47d5fcf8918dee0dc2e2ee53390a6

SHA256
b34fb342f21d690aac024b6f48a597e78d15791ef480ac55159cd585d0f64af7

SHA512
67870206fa7f1e7df45c8c1bc2f51fb430f0a048a2bdb55a4a41525388ca3b50203784537f139169705a03db4bb13b591162a79a5d2df81a4d11fd849615c86b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl7E8D.tmp\InstallOptions.dll

Filesize
15KB

MD5
0a9fb96a7579b685ec36b17fc354e6a3

SHA1
355754104dd47d5fcf8918dee0dc2e2ee53390a6

SHA256
b34fb342f21d690aac024b6f48a597e78d15791ef480ac55159cd585d0f64af7

SHA512
67870206fa7f1e7df45c8c1bc2f51fb430f0a048a2bdb55a4a41525388ca3b50203784537f139169705a03db4bb13b591162a79a5d2df81a4d11fd849615c86b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl7E8D.tmp\InstallOptions.dll

Filesize
15KB

MD5
0a9fb96a7579b685ec36b17fc354e6a3

SHA1
355754104dd47d5fcf8918dee0dc2e2ee53390a6

SHA256
b34fb342f21d690aac024b6f48a597e78d15791ef480ac55159cd585d0f64af7

SHA512
67870206fa7f1e7df45c8c1bc2f51fb430f0a048a2bdb55a4a41525388ca3b50203784537f139169705a03db4bb13b591162a79a5d2df81a4d11fd849615c86b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl7E8D.tmp\LangDLL.dll

Filesize
5KB

MD5
014a3be4a7c1ccb217916dbf4f222bd1

SHA1
9b4c41eb0e84886beb5591d8357155e27f9c68ed

SHA256
09acfc5ee34a1dfa1af3a9d34f00c3b1327b56641feebd536e13752349c08ac8

SHA512
0f3d1bf548e29a136150b699665a3f22c6ea2821701737363fa2920b51c391d735f1eae92dea8af655e7d07304bd3d06e4aff3f5a82fa22bcf5d1690013eb922

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl7E8D.tmp\System.dll

Filesize
12KB

MD5
564bb0373067e1785cba7e4c24aab4bf

SHA1
7c9416a01d821b10b2eef97b80899d24014d6fc1

SHA256
7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

SHA512
22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl7E8D.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl7E8D.tmp\ioSpecial.ini

Filesize
1KB

MD5
5550351716c1a0353a93b022210b2f99

SHA1
ff52df27005505f33487267f1f3f3626b26840cf

SHA256
dbdfd9b7e1bbe33e4bba5ea1616229ab45dec41b072971349b43cb65145a6b75

SHA512
8610cfd52362285779310c0d8b6adb7cea088dc301b225c77741482f8f1e570873ae4be6154d19d623f05a86e98ce7beaa3c05b7f2925b6bcf54e766a73b324b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl7E8D.tmp\ioSpecial.ini

Filesize
1KB

MD5
bf4d06846403655784c38a575cd6d2cd

SHA1
e1fed41f6a6b03eb2fe9c4bca8deb52a1d469c95

SHA256
da12c7c235dbb44b45df4dedb50f304b9f0678f2c46efce6c8a9268c2b06d05c

SHA512
e48754d848596d94be6e56ae049faf27e520e0b6b8b35dd417c2a0756562c16836db9b1f3f4a6175921573b37189bf57682b0b3234cbb48277d96045d91c7148

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl7E8D.tmp\ioSpecial.ini

Filesize
1KB

MD5
bf4d06846403655784c38a575cd6d2cd

SHA1
e1fed41f6a6b03eb2fe9c4bca8deb52a1d469c95

SHA256
da12c7c235dbb44b45df4dedb50f304b9f0678f2c46efce6c8a9268c2b06d05c

SHA512
e48754d848596d94be6e56ae049faf27e520e0b6b8b35dd417c2a0756562c16836db9b1f3f4a6175921573b37189bf57682b0b3234cbb48277d96045d91c7148

Download Submit