Analysis
-
max time kernel
151s -
max time network
255s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16-08-2023 02:15
Static task
static1
Behavioral task
behavioral1
Sample
qbittorrent_4.5.4_x64_setup.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
qbittorrent_4.5.4_x64_setup.exe
Resource
win10v2004-20230703-en
General
-
Target
qbittorrent_4.5.4_x64_setup.exe
-
Size
31.3MB
-
MD5
6e35e4512488a44ebf34bff82dc4724f
-
SHA1
38903134b1a0a774cdcf728d3484493e7d83592a
-
SHA256
3ba266ddbe5624aeedec1a23c6bf86d6cfd5b547e8c1a31169f6a08434c9e615
-
SHA512
a6faa23d08c34da39111b9da1d9be62eb9486d010b6217b0aaacaa0cc240bca4e305bdbdaf1f4175f4a4ddb12530ddecc3c488d1620e2ead20b9e90f3cbe6a1e
-
SSDEEP
786432:rVrG7dnL27saKvlVIbS7ykgixD9ZLstXfL:rVrsdn0sa8IbShgiVXLstXT
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 3 IoCs
Processes:
resource yara_rule C:\Program Files\qBittorrent\qbittorrent.exe BazarLoaderVar5 C:\Program Files\qBittorrent\qbittorrent.exe BazarLoaderVar5 C:\Program Files\qBittorrent\qbittorrent.exe BazarLoaderVar5 -
Executes dropped EXE 1 IoCs
Processes:
qbittorrent.exepid process 928 qbittorrent.exe -
Loads dropped DLL 7 IoCs
Processes:
qbittorrent_4.5.4_x64_setup.exepid process 4952 qbittorrent_4.5.4_x64_setup.exe 4952 qbittorrent_4.5.4_x64_setup.exe 4952 qbittorrent_4.5.4_x64_setup.exe 4952 qbittorrent_4.5.4_x64_setup.exe 4952 qbittorrent_4.5.4_x64_setup.exe 4952 qbittorrent_4.5.4_x64_setup.exe 4952 qbittorrent_4.5.4_x64_setup.exe -
Drops file in Program Files directory 37 IoCs
Processes:
qbittorrent_4.5.4_x64_setup.exedescription ioc process File created C:\Program Files\qBittorrent\qbittorrent.exe qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_bg.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_ja.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_pl.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_pt_BR.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_zh_CN.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qt_gl.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qt_lt.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_uk.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_zh_TW.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qt_sl.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_da.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_tr.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\uninst.exe qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_ar.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_es.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_it.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_nl.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qt_pt_PT.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qt_sv.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_cs.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_fi.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_he.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\qbittorrent.pdb qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_ca.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_fr.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_lv.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_nn.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_de.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_gd.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_hu.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_ru.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_sk.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\qt.conf qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_fa.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_hr.qm qbittorrent_4.5.4_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_ko.qm qbittorrent_4.5.4_x64_setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
Processes:
qbittorrent.exeqbittorrent_4.5.4_x64_setup.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ qbittorrent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\magnet\ = "URL:Magnet link" qbittorrent_4.5.4_x64_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\ = "open" qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\open qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\magnet\DefaultIcon qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\magnet\shell\open qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU qbittorrent.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" qbittorrent.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" qbittorrent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\"" qbittorrent_4.5.4_x64_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\ = "qBittorrent" qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\open\command qbittorrent_4.5.4_x64_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\magnet\Content Type = "application/x-magnet" qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\magnet qbittorrent_4.5.4_x64_setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\magnet\ = "URL:Magnet link" qbittorrent_4.5.4_x64_setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193" qbittorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" qbittorrent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell qbittorrent_4.5.4_x64_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1" qbittorrent_4.5.4_x64_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\ = "open" qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\open qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\.torrent qbittorrent_4.5.4_x64_setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\.torrent\ = "qBittorrent" qbittorrent_4.5.4_x64_setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\magnet\shell\ = "open" qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ qbittorrent.exe Key created \REGISTRY\MACHINE\Software\Classes\qBittorrent qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\qBittorrent\shell qbittorrent_4.5.4_x64_setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell qbittorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\magnet\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1" qbittorrent_4.5.4_x64_setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff qbittorrent.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 qbittorrent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\magnet qbittorrent_4.5.4_x64_setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\magnet\Content Type = "application/x-magnet" qbittorrent_4.5.4_x64_setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots qbittorrent.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000004d510c07acadd901ebc459d2b4add9017c92f7d9e7cfd90114000000 qbittorrent.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1" qbittorrent.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" qbittorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\.torrent\Content Type = "application/x-bittorrent" qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} qbittorrent.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" qbittorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\magnet\URL Protocol qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\magnet\shell qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg qbittorrent.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" qbittorrent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags qbittorrent.exe Key created \REGISTRY\MACHINE\Software\Classes\magnet\shell\open\command qbittorrent_4.5.4_x64_setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 qbittorrent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\Content Type = "application/x-bittorrent" qbittorrent_4.5.4_x64_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\magnet\URL Protocol qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\magnet\shell qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\magnet\shell\open\command qbittorrent_4.5.4_x64_setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff qbittorrent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\ = "qBittorrent Torrent File" qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\qBittorrent\shell\open\command qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\open\command qbittorrent_4.5.4_x64_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\"" qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\magnet qbittorrent_4.5.4_x64_setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\magnet\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\"" qbittorrent_4.5.4_x64_setup.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 qbittorrent.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" qbittorrent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\FriendlyTypeName = "qBittorrent Torrent File" qbittorrent_4.5.4_x64_setup.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
qbittorrent.exepid process 928 qbittorrent.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
qbittorrent_4.5.4_x64_setup.exetaskmgr.exepid process 4952 qbittorrent_4.5.4_x64_setup.exe 4952 qbittorrent_4.5.4_x64_setup.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
qbittorrent.exepid process 928 qbittorrent.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 3872 taskmgr.exe Token: SeSystemProfilePrivilege 3872 taskmgr.exe Token: SeCreateGlobalPrivilege 3872 taskmgr.exe Token: 33 3872 taskmgr.exe Token: SeIncBasePriorityPrivilege 3872 taskmgr.exe -
Suspicious use of FindShellTrayWindow 46 IoCs
Processes:
qbittorrent.exetaskmgr.exepid process 928 qbittorrent.exe 928 qbittorrent.exe 928 qbittorrent.exe 928 qbittorrent.exe 928 qbittorrent.exe 928 qbittorrent.exe 928 qbittorrent.exe 928 qbittorrent.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe -
Suspicious use of SendNotifyMessage 46 IoCs
Processes:
qbittorrent.exetaskmgr.exepid process 928 qbittorrent.exe 928 qbittorrent.exe 928 qbittorrent.exe 928 qbittorrent.exe 928 qbittorrent.exe 928 qbittorrent.exe 928 qbittorrent.exe 928 qbittorrent.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
qbittorrent.exepid process 928 qbittorrent.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
qbittorrent_4.5.4_x64_setup.exedescription pid process target process PID 4952 wrote to memory of 928 4952 qbittorrent_4.5.4_x64_setup.exe qbittorrent.exe PID 4952 wrote to memory of 928 4952 qbittorrent_4.5.4_x64_setup.exe qbittorrent.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\qbittorrent_4.5.4_x64_setup.exe"C:\Users\Admin\AppData\Local\Temp\qbittorrent_4.5.4_x64_setup.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\qBittorrent\qbittorrent.exe"C:\Program Files\qBittorrent\qbittorrent.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\qBittorrent\qbittorrent.exeFilesize
28.5MB
MD5299af9fcfb3067e8f5f64f0866c8fe33
SHA15244f3c95dbee3c29c4171899a1a158087419f59
SHA256aacf4cc8c1591d4a5aeb1d1c32be0c0211fa593a3a4c5107f906a3910fdb6c34
SHA51235598c4d22d29acec1f98fc61cb5e7ca8d3f281bb0ef586c0f1735497fcba4b714f8f5ab2c539cef8b843b35151e0516acd18724c04160c5cddd642cd754ebd2
-
C:\Program Files\qBittorrent\qbittorrent.exeFilesize
28.5MB
MD5299af9fcfb3067e8f5f64f0866c8fe33
SHA15244f3c95dbee3c29c4171899a1a158087419f59
SHA256aacf4cc8c1591d4a5aeb1d1c32be0c0211fa593a3a4c5107f906a3910fdb6c34
SHA51235598c4d22d29acec1f98fc61cb5e7ca8d3f281bb0ef586c0f1735497fcba4b714f8f5ab2c539cef8b843b35151e0516acd18724c04160c5cddd642cd754ebd2
-
C:\Program Files\qBittorrent\qbittorrent.exeFilesize
28.5MB
MD5299af9fcfb3067e8f5f64f0866c8fe33
SHA15244f3c95dbee3c29c4171899a1a158087419f59
SHA256aacf4cc8c1591d4a5aeb1d1c32be0c0211fa593a3a4c5107f906a3910fdb6c34
SHA51235598c4d22d29acec1f98fc61cb5e7ca8d3f281bb0ef586c0f1735497fcba4b714f8f5ab2c539cef8b843b35151e0516acd18724c04160c5cddd642cd754ebd2
-
C:\Program Files\qBittorrent\qt.confFilesize
84B
MD5af7f56a63958401da8bea1f5e419b2af
SHA1f66ee8779ca6d570dea22fe34ef8600e5d3c5f38
SHA256fdb8fa58a6ffc14771ca2b1ef6438061a6cba638594d76d9021b91e755d030d3
SHA51202f70ca7f1291b25402989be74408eb82343ab500e15e4ac22fbc7162eb9230cd7061eaa7e34acf69962b57ed0827f51ceaf0fa63da3154b53469c7b7511d23d
-
C:\Users\Admin\AppData\Local\Temp\nso3620.tmp\FindProcDLL.dllFilesize
3KB
MD5b4faf654de4284a89eaf7d073e4e1e63
SHA18efcfd1ca648e942cbffd27af429784b7fcf514b
SHA256c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3
SHA512eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388
-
C:\Users\Admin\AppData\Local\Temp\nso3620.tmp\LangDLL.dllFilesize
5KB
MD568b287f4067ba013e34a1339afdb1ea8
SHA145ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA25618e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
SHA51206c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
-
C:\Users\Admin\AppData\Local\Temp\nso3620.tmp\System.dllFilesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
C:\Users\Admin\AppData\Local\Temp\nso3620.tmp\UAC.dllFilesize
14KB
MD5adb29e6b186daa765dc750128649b63d
SHA1160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA2562f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
-
C:\Users\Admin\AppData\Local\Temp\nso3620.tmp\modern-wizard.bmpFilesize
25KB
MD5cbe40fd2b1ec96daedc65da172d90022
SHA1366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA2563ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
SHA51262990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
-
C:\Users\Admin\AppData\Local\Temp\nso3620.tmp\nsDialogs.dllFilesize
9KB
MD56c3f8c94d0727894d706940a8a980543
SHA10d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA25656b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
SHA5122094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
-
C:\Users\Admin\AppData\Local\Temp\nso3620.tmp\nsisFirewallW.dllFilesize
8KB
MD5f5bf81a102de52a4add21b8a367e54e0
SHA1cf1e76ffe4a3ecd4dad453112afd33624f16751c
SHA25653be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
SHA5126e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
-
C:\Users\Admin\AppData\Local\Temp\nso3620.tmp\nsisFirewallW.dllFilesize
8KB
MD5f5bf81a102de52a4add21b8a367e54e0
SHA1cf1e76ffe4a3ecd4dad453112afd33624f16751c
SHA25653be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
SHA5126e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
-
C:\Users\Admin\AppData\Local\Temp\nso3620.tmp\nsisFirewallW.dllFilesize
8KB
MD5f5bf81a102de52a4add21b8a367e54e0
SHA1cf1e76ffe4a3ecd4dad453112afd33624f16751c
SHA25653be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
SHA5126e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
-
C:\Users\Admin\AppData\Roaming\qBittorrent\watched_folders.jsonFilesize
4B
MD55b76b0eef9af8a2300673e0553f609f9
SHA10b56d40c0630a74abec5398e01c6cd83263feddc
SHA256d914176fd50bd7f565700006a31aa97b79d3ad17cee20c8e5ff2061d5cb74817
SHA512cf06a50de1bf63b7052c19ad53766fa0d99a4d88db76a7cbc672e33276e3d423e4c5f5cb4a8ae188c5c0e17d93bb740eaab6f25753f0d26501c5f84aeded075d
-
memory/928-274-0x0000019A90690000-0x0000019A906A0000-memory.dmpFilesize
64KB
-
memory/928-291-0x0000019A90690000-0x0000019A906A0000-memory.dmpFilesize
64KB
-
memory/3872-313-0x0000028E39E00000-0x0000028E39E01000-memory.dmpFilesize
4KB
-
memory/3872-314-0x0000028E39E00000-0x0000028E39E01000-memory.dmpFilesize
4KB
-
memory/3872-315-0x0000028E39E00000-0x0000028E39E01000-memory.dmpFilesize
4KB
-
memory/3872-320-0x0000028E39E00000-0x0000028E39E01000-memory.dmpFilesize
4KB
-
memory/3872-319-0x0000028E39E00000-0x0000028E39E01000-memory.dmpFilesize
4KB
-
memory/3872-322-0x0000028E39E00000-0x0000028E39E01000-memory.dmpFilesize
4KB
-
memory/3872-324-0x0000028E39E00000-0x0000028E39E01000-memory.dmpFilesize
4KB
-
memory/3872-323-0x0000028E39E00000-0x0000028E39E01000-memory.dmpFilesize
4KB
-
memory/3872-321-0x0000028E39E00000-0x0000028E39E01000-memory.dmpFilesize
4KB
-
memory/3872-325-0x0000028E39E00000-0x0000028E39E01000-memory.dmpFilesize
4KB