49120084b513287ae224f654854a88ed3a8bff124efa63d57db3f81d16adb846

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:21

Target

qbittorrent_4.6.3_x64_setup.exe
Size

34.1MB
MD5

daa53d95d6935aabaf66a0607110fed2
SHA1

0c3a414b34f343a9c04be2770e111a2862c88693
SHA256

49120084b513287ae224f654854a88ed3a8bff124efa63d57db3f81d16adb846
SHA512

759b898608242eef9e8c401bdf40c69d7efb9ccc5444c1d842a2a9d91de156b703ef53ff08052b3e78c5bd04b6412001ec69a6baac1b6b0517571a99f6e73d5c
SSDEEP

786432:7mZb7euTgPUeOq0+hF2t1DpHcyOJPk77aMSGdyXmVO:7GeJcev0UmDp8hJPkqMSGdXc

Score

7^/10

Loads dropped DLL 2 IoCs

Processes:

qbittorrent_4.6.3_x64_setup.exe

pid process

1928 qbittorrent_4.6.3_x64_setup.exe
1928 qbittorrent_4.6.3_x64_setup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1928	qbittorrent_4.6.3_x64_setup.exe
1928	qbittorrent_4.6.3_x64_setup.exe

C:\Users\Admin\AppData\Local\Temp\qbittorrent_4.6.3_x64_setup.exe
"C:\Users\Admin\AppData\Local\Temp\qbittorrent_4.6.3_x64_setup.exe"
1⤵
- Loads dropped DLL
PID:1928

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsd2435.tmp\LangDLL.dll
Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2435.tmp\UAC.dll
Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit