bazarloader | a95a39a8701661fcd9eec6dbf78f8099be1edfa145fb7d43a0105ec82f97df8f

Resubmissions

28/09/2023, 19:47

230928-yhmscafd87 10

26/09/2023, 10:31

230926-mklghshg36 10

Analysis

max time kernel
203s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
26/09/2023, 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

qbittorrent-4-5-5.exe
Size

31.5MB
MD5

a1e3d62bb16c2fef5fba7d2899796239
SHA1

841c7c16a30ca3a2ec77148b2fcd250ce9335830
SHA256

a95a39a8701661fcd9eec6dbf78f8099be1edfa145fb7d43a0105ec82f97df8f
SHA512

121401f7df8f4cd01ecc5205510ad4d824ca7208ddb69bb9a5e4678359e82005d76b20467662878975a739f41236edc8581f61279bae278dbb5c7206058def59
SSDEEP

786432:rDRS7fOdUC+EQNLErJ5L8xPEP9vnzfrnfHo9ft03Pvy96VgQCGq7NBwq:rp1+EQNLkJO2pnvnfIfq3P6YCn7H

Score

10^/10

bazarloader discovery dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 3 IoCs

resource	yara_rule
behavioral2/files/0x00060000000230b0-112.dat	BazarLoaderVar5
behavioral2/files/0x00060000000230b0-122.dat	BazarLoaderVar5
behavioral2/files/0x00060000000230b0-142.dat	BazarLoaderVar5

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	qbittorrent-4-5-5.exe

Executes dropped EXE 1 IoCs

pid	Process
2128	qbittorrent.exe

Loads dropped DLL 7 IoCs

pid	Process
2532	qbittorrent-4-5-5.exe
2532	qbittorrent-4-5-5.exe
2532	qbittorrent-4-5-5.exe
2532	qbittorrent-4-5-5.exe
2532	qbittorrent-4-5-5.exe
2532	qbittorrent-4-5-5.exe
2532	qbittorrent-4-5-5.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 37 IoCs

description	ioc	Process
File created	C:\Program Files\qBittorrent\translations\qtbase_gd.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_lv.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nl.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qt_pt_PT.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_da.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fi.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_he.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_sk.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ar.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hr.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_it.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ko.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_tr.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\uninst.exe	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\qt.conf	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qt_sl.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_TW.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qt_lt.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fa.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_bg.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ca.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ru.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\qbittorrent.pdb	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qt_gl.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fr.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ja.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_cs.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_es.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_uk.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_CN.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_de.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pl.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nn.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pt_BR.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qt_sv.qm	qbittorrent-4-5-5.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hu.qm	qbittorrent-4-5-5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 44 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent	qbittorrent-4-5-5.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\.torrent	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\magnet\URL Protocol	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\magnet\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\ = "qBittorrent"	qbittorrent-4-5-5.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet	qbittorrent-4-5-5.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet\shell	qbittorrent-4-5-5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\magnet\ = "URL:Magnet link"	qbittorrent-4-5-5.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\magnet\shell	qbittorrent-4-5-5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\open	qbittorrent-4-5-5.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.torrent	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent-4-5-5.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\magnet	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\magnet\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent-4-5-5.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\magnet\shell\open\command	qbittorrent-4-5-5.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent	qbittorrent-4-5-5.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent\shell\open\command	qbittorrent-4-5-5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\.torrent\Content Type = "application/x-bittorrent"	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\URL Protocol	qbittorrent-4-5-5.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\magnet\DefaultIcon	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\ = "qBittorrent Torrent File"	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\ = "open"	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\ = "URL:Magnet link"	qbittorrent-4-5-5.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\magnet\shell\open	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent-4-5-5.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet\DefaultIcon	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent-4-5-5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\open\command	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\FriendlyTypeName = "qBittorrent Torrent File"	qbittorrent-4-5-5.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent\shell	qbittorrent-4-5-5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\open\command	qbittorrent-4-5-5.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent\DefaultIcon	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\Content Type = "application/x-bittorrent"	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\.torrent\ = "qBittorrent"	qbittorrent-4-5-5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\Content Type = "application/x-magnet"	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\ = "open"	qbittorrent-4-5-5.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet\shell\open\command	qbittorrent-4-5-5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\open	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\magnet\Content Type = "application/x-magnet"	qbittorrent-4-5-5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\magnet\shell\ = "open"	qbittorrent-4-5-5.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2128	qbittorrent.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2532	qbittorrent-4-5-5.exe
2532	qbittorrent-4-5-5.exe
1308	msedge.exe
1308	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2532	qbittorrent-4-5-5.exe
2128	qbittorrent.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2128	qbittorrent.exe
2128	qbittorrent.exe
2128	qbittorrent.exe
2128	qbittorrent.exe
2128	qbittorrent.exe
2128	qbittorrent.exe
2128	qbittorrent.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2128	qbittorrent.exe
2128	qbittorrent.exe
2128	qbittorrent.exe
2128	qbittorrent.exe
2128	qbittorrent.exe
2128	qbittorrent.exe
2128	qbittorrent.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2128	2532	qbittorrent-4-5-5.exe	104
PID 2532 wrote to memory of 2128	2532	qbittorrent-4-5-5.exe	104
PID 4092 wrote to memory of 1620	4092	msedge.exe	117
PID 4092 wrote to memory of 1620	4092	msedge.exe	117
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 3036	4092	msedge.exe	118
PID 4092 wrote to memory of 1308	4092	msedge.exe	119
PID 4092 wrote to memory of 1308	4092	msedge.exe	119
PID 4092 wrote to memory of 4668	4092	msedge.exe	120
PID 4092 wrote to memory of 4668	4092	msedge.exe	120
PID 4092 wrote to memory of 4668	4092	msedge.exe	120
PID 4092 wrote to memory of 4668	4092	msedge.exe	120
PID 4092 wrote to memory of 4668	4092	msedge.exe	120
PID 4092 wrote to memory of 4668	4092	msedge.exe	120
PID 4092 wrote to memory of 4668	4092	msedge.exe	120
PID 4092 wrote to memory of 4668	4092	msedge.exe	120
PID 4092 wrote to memory of 4668	4092	msedge.exe	120
PID 4092 wrote to memory of 4668	4092	msedge.exe	120
PID 4092 wrote to memory of 4668	4092	msedge.exe	120
PID 4092 wrote to memory of 4668	4092	msedge.exe	120
PID 4092 wrote to memory of 4668	4092	msedge.exe	120
PID 4092 wrote to memory of 4668	4092	msedge.exe	120
PID 4092 wrote to memory of 4668	4092	msedge.exe	120
PID 4092 wrote to memory of 4668	4092	msedge.exe	120
PID 4092 wrote to memory of 4668	4092	msedge.exe	120
PID 4092 wrote to memory of 4668	4092	msedge.exe	120

C:\Users\Admin\AppData\Local\Temp\qbittorrent-4-5-5.exe
"C:\Users\Admin\AppData\Local\Temp\qbittorrent-4-5-5.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files\qBittorrent\qbittorrent.exe
  "C:\Program Files\qBittorrent\qbittorrent.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2128

C:\Windows\System32\winver.exe
"C:\Windows\System32\winver.exe"
1⤵
PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault87f00659hb454h452dhafc0hc75c65d2f704
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe39f446f8,0x7ffe39f44708,0x7ffe39f44718
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,12454706285577962224,5486255453218462261,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,12454706285577962224,5486255453218462261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,12454706285577962224,5486255453218462261,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3008 /prefetch:8
  2⤵
  PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\qBittorrent\qbittorrent.exe

Filesize
28.6MB

MD5
eec321e889eadd13f2f398cb42c31e8c

SHA1
43f4a009554c22528ceb14b37cdc1f795a55876a

SHA256
3249a461c69458830faaa3bcbf138e1de9a882f381a8b44067475066f1fa6a77

SHA512
61303b82f9eec4e7fa9020835b4def4c8febe5636323ff89d2a56ca4cee788752cad4e40ba7b00b9547e4aa9e56aed992bf4d4bb3b6b11e0b33590d1b12b0811

Download Submit
C:\Program Files\qBittorrent\qbittorrent.exe

Filesize
28.6MB

MD5
eec321e889eadd13f2f398cb42c31e8c

SHA1
43f4a009554c22528ceb14b37cdc1f795a55876a

SHA256
3249a461c69458830faaa3bcbf138e1de9a882f381a8b44067475066f1fa6a77

SHA512
61303b82f9eec4e7fa9020835b4def4c8febe5636323ff89d2a56ca4cee788752cad4e40ba7b00b9547e4aa9e56aed992bf4d4bb3b6b11e0b33590d1b12b0811

Download Submit
C:\Program Files\qBittorrent\qbittorrent.exe

Filesize
28.6MB

MD5
eec321e889eadd13f2f398cb42c31e8c

SHA1
43f4a009554c22528ceb14b37cdc1f795a55876a

SHA256
3249a461c69458830faaa3bcbf138e1de9a882f381a8b44067475066f1fa6a77

SHA512
61303b82f9eec4e7fa9020835b4def4c8febe5636323ff89d2a56ca4cee788752cad4e40ba7b00b9547e4aa9e56aed992bf4d4bb3b6b11e0b33590d1b12b0811

Download Submit
C:\Program Files\qBittorrent\qt.conf

Filesize
84B

MD5
af7f56a63958401da8bea1f5e419b2af

SHA1
f66ee8779ca6d570dea22fe34ef8600e5d3c5f38

SHA256
fdb8fa58a6ffc14771ca2b1ef6438061a6cba638594d76d9021b91e755d030d3

SHA512
02f70ca7f1291b25402989be74408eb82343ab500e15e4ac22fbc7162eb9230cd7061eaa7e34acf69962b57ed0827f51ceaf0fa63da3154b53469c7b7511d23d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
61B

MD5
4df4574bfbb7e0b0bc56c2c9b12b6c47

SHA1
81efcbd3e3da8221444a21f45305af6fa4b71907

SHA256
e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377

SHA512
78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
63224d9e5f509ea10107cd09251b0df3

SHA1
55aa998a3c4187690050b7d42e2540f801aa5027

SHA256
ffa6dbbb111374023d976a58d45de00857e98e293476cfc0fb54fd15ca5e905c

SHA512
7cebd75b04af11b89d9ee400de972f5db7d4d4c4c01cd64c7074ce3e523bd71b403cfc1744dd2eb044086b076134be6d7c2eace5b89bb00b85e26750fded4f81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
d62b3c8298f3412bf84e94c0aa62e581

SHA1
9951f8bd335eeace790dcdcc63faa324eec8dea3

SHA256
ef3c832c210bebe9fa97d0b870c3ed6a3a545b577048cdaede6e034a8f6e6f0f

SHA512
5857f81cf510e7e3608dad213af64235fe7e84af63fca97ffe647ae1d1bc2e648d3d33fb7e3c6b52bc46582712a9c4b01138de909eca3b55bdf516683195ab23

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa3834.tmp\FindProcDLL.dll

Filesize
3KB

MD5
b4faf654de4284a89eaf7d073e4e1e63

SHA1
8efcfd1ca648e942cbffd27af429784b7fcf514b

SHA256
c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3

SHA512
eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa3834.tmp\LangDLL.dll

Filesize
5KB

MD5
68b287f4067ba013e34a1339afdb1ea8

SHA1
45ad585b3cc8e5a6af7b68f5d8269c97992130b3

SHA256
18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

SHA512
06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa3834.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa3834.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa3834.tmp\modern-wizard.bmp

Filesize
25KB

MD5
cbe40fd2b1ec96daedc65da172d90022

SHA1
366c216220aa4329dff6c485fd0e9b0f4f0a7944

SHA256
3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

SHA512
62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa3834.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa3834.tmp\nsisFirewallW.dll

Filesize
8KB

MD5
f5bf81a102de52a4add21b8a367e54e0

SHA1
cf1e76ffe4a3ecd4dad453112afd33624f16751c

SHA256
53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

SHA512
6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa3834.tmp\nsisFirewallW.dll

Filesize
8KB

MD5
f5bf81a102de52a4add21b8a367e54e0

SHA1
cf1e76ffe4a3ecd4dad453112afd33624f16751c

SHA256
53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

SHA512
6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa3834.tmp\nsisFirewallW.dll

Filesize
8KB

MD5
f5bf81a102de52a4add21b8a367e54e0

SHA1
cf1e76ffe4a3ecd4dad453112afd33624f16751c

SHA256
53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

SHA512
6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\watched_folders.json

Filesize
4B

MD5
5b76b0eef9af8a2300673e0553f609f9

SHA1
0b56d40c0630a74abec5398e01c6cd83263feddc

SHA256
d914176fd50bd7f565700006a31aa97b79d3ad17cee20c8e5ff2061d5cb74817

SHA512
cf06a50de1bf63b7052c19ad53766fa0d99a4d88db76a7cbc672e33276e3d423e4c5f5cb4a8ae188c5c0e17d93bb740eaab6f25753f0d26501c5f84aeded075d

Download Submit
memory/2128-158-0x000001A32E270000-0x000001A32E280000-memory.dmp

Filesize
64KB

Download
memory/2128-141-0x000001A32E270000-0x000001A32E280000-memory.dmp

Filesize
64KB

Download