96bac43faac2b1fa5e0bc495975b2e642af5da181e313a9c8f541912b83c0edb

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 13:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qbittorrent.exe
Size 30.8MB
Sample240405-qwcwasde2v
SHA256 1fac780feaa2e263dbd0ee2103d1815d97b4d6a676f5b83e9320120dc15ee6bb
MD5 b9dfd00c5fbb9cfaa2c4e1b3f9e218bf
SHA1 4dad2d51c73dffdd2cfc4d17146ac0253d74e3bf
SHA512 baec0664acfb41b96939f6462df5b9390f6cec16e71960f77ead222ad2bdf7f5f8bc4cb1937413472d4abe1ff6053eb8e89a9a6291c7b979138272dac780ab6c
SSDEEP 393216:Q943f9XQuqc+GJi2piZ09Br9UhfrZfndOj/HS4UfrBq9BKFdu9CwJsv6t/kubD:QuZfyrZgqrAZbD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies registry class 17 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\magnet\ = "URL:Magnet link"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\magnet\shell\open\command\	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\magnet\shell\open\command	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.torrent\Content Type = "application/x-bittorrent"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\magnet\	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\magnet\Content Type = "application/x-magnet"	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\magnet\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\qbittorrent.exe\",1"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\magnet\shell\	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.torrent\	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.torrent\ = "qBittorrent"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\magnet\DefaultIcon\	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\magnet	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\magnet\shell	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\magnet\shell\open	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\qbittorrent.exe\" \"%1\""	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\magnet\URL Protocol	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\magnet\shell\ = "open"	qbittorrent.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3096	qbittorrent.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3096	qbittorrent.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3096	qbittorrent.exe
3096	qbittorrent.exe
3096	qbittorrent.exe
3096	qbittorrent.exe
3096	qbittorrent.exe
3096	qbittorrent.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
3096	qbittorrent.exe
3096	qbittorrent.exe
3096	qbittorrent.exe
3096	qbittorrent.exe
3096	qbittorrent.exe
3096	qbittorrent.exe

C:\Users\Admin\AppData\Local\Temp\qbittorrent.exe
"C:\Users\Admin\AppData\Local\Temp\qbittorrent.exe"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

watched_folders.json

Path C:\Users\Admin\AppData\Roaming\qBittorrent\watched_folders.json
Size 4B
SHA256 d914176fd50bd7f565700006a31aa97b79d3ad17cee20c8e5ff2061d5cb74817
MD5 5b76b0eef9af8a2300673e0553f609f9
SHA1 0b56d40c0630a74abec5398e01c6cd83263feddc
SHA512 cf06a50de1bf63b7052c19ad53766fa0d99a4d88db76a7cbc672e33276e3d423e4c5f5cb4a8ae188c5c0e17d93bb740eaab6f25753f0d26501c5f84aeded075d
MD5 SHA1 SHA512

Submit Download

memory/3096-0-0x00000227A6B40000-0x00000227A6B50000-memory.dmp

Download