Analysis
-
max time kernel
138s -
max time network
141s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
31-10-2024 22:50
Static task
static1
Behavioral task
behavioral1
Sample
qbittorrent_5.0.1_x64_setup.exe
Resource
win11-20241007-en
General
-
Target
qbittorrent_5.0.1_x64_setup.exe
-
Size
37.4MB
-
MD5
fd6ea4e1d7b3adb820908ec26b729ea7
-
SHA1
485b31d0f8394efdaa860c0d4a54227033f40579
-
SHA256
5513812584a5ba7810b812db7ceec2d0e9cb214cef95a2580e29927cf4fe9921
-
SHA512
e587c67bd4da787226187918206acfdb9ef4192e884b41e0680cf96458799eeeabde97376dbdfdd89c7de12839a062bd8f8da50b9e6a49c33018461783535c66
-
SSDEEP
786432:7fFBmZOcw9i54tPYrFrQAEODhrbt+Fn1/Zo2NCILF5Iud3gIwmbN:79BH1e+sFspIteZtQILFDdQIwm5
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3688 qbittorrent.exe -
Loads dropped DLL 7 IoCs
pid Process 2208 qbittorrent_5.0.1_x64_setup.exe 2208 qbittorrent_5.0.1_x64_setup.exe 2208 qbittorrent_5.0.1_x64_setup.exe 2208 qbittorrent_5.0.1_x64_setup.exe 2208 qbittorrent_5.0.1_x64_setup.exe 2208 qbittorrent_5.0.1_x64_setup.exe 2208 qbittorrent_5.0.1_x64_setup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 39 IoCs
description ioc Process File created C:\Program Files\qBittorrent\translations\qt_pt_PT.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qt_sl.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_nl.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_pl.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_zh_TW.qm qbittorrent_5.0.1_x64_setup.exe File opened for modification C:\Program Files\qBittorrent\qbittorrent.exe qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\qbittorrent.pdb qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_ar.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_nn.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_uk.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_bg.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_da.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_fi.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_it.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\uninst.exe qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_es.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_hu.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_ja.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_ka.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_lv.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_pt_BR.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_sk.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\qt.conf qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qt_sv.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_fa.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_ru.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_ca.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_fr.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_he.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_de.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_gd.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_hr.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_ko.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_tr.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_zh_CN.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\qbittorrent.exe qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qt_gl.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qt_lt.qm qbittorrent_5.0.1_x64_setup.exe File created C:\Program Files\qBittorrent\translations\qtbase_cs.qm qbittorrent_5.0.1_x64_setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qbittorrent_5.0.1_x64_setup.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\magnet qbittorrent_5.0.1_x64_setup.exe Key created \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} qbittorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" qbittorrent.exe Set value (data) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 qbittorrent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1" qbittorrent_5.0.1_x64_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\.torrent qbittorrent_5.0.1_x64_setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000 qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags qbittorrent.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193" qbittorrent.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" qbittorrent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\magnet\Content Type = "application/x-magnet" qbittorrent_5.0.1_x64_setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots qbittorrent.exe Set value (data) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff qbittorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" qbittorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" BackgroundTransferHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff qbittorrent.exe Set value (data) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 qbittorrent.exe Set value (data) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 qbittorrent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\ = "Torrent File" qbittorrent_5.0.1_x64_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1" qbittorrent_5.0.1_x64_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell qbittorrent_5.0.1_x64_setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 qbittorrent.exe Set value (data) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff qbittorrent.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" qbittorrent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open qbittorrent_5.0.1_x64_setup.exe Key created \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings qbittorrent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent qbittorrent_5.0.1_x64_setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" qbittorrent.exe Key created \REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent\DefaultIcon qbittorrent_5.0.1_x64_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent\shell\open\command qbittorrent_5.0.1_x64_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ qbittorrent.exe Set value (data) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 qbittorrent.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" qbittorrent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\"" qbittorrent_5.0.1_x64_setup.exe Key created \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU qbittorrent.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" qbittorrent.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" qbittorrent.exe Set value (data) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} qbittorrent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\"" qbittorrent_5.0.1_x64_setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 qbittorrent.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193" qbittorrent.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" qbittorrent.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" qbittorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix BackgroundTransferHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\magnet\ = "URL:Magnet URI" qbittorrent_5.0.1_x64_setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff qbittorrent.exe Set value (data) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000011e6e9c3b018db019da4b4d2b518db015576b775e72bdb0114000000 qbittorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" BackgroundTransferHost.exe Key created \REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet\DefaultIcon qbittorrent_5.0.1_x64_setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" qbittorrent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\ = "Magnet URI" qbittorrent_5.0.1_x64_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\magnet\URL Protocol qbittorrent_5.0.1_x64_setup.exe Key created \Registry\User\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\NotificationData qbittorrent.exe Set value (data) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff qbittorrent.exe Set value (data) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff qbittorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads" qbittorrent.exe Key created \REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent qbittorrent_5.0.1_x64_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open\command qbittorrent_5.0.1_x64_setup.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3688 qbittorrent.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2208 qbittorrent_5.0.1_x64_setup.exe 2208 qbittorrent_5.0.1_x64_setup.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3688 qbittorrent.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3688 qbittorrent.exe 3688 qbittorrent.exe 3688 qbittorrent.exe 3688 qbittorrent.exe 3688 qbittorrent.exe 3688 qbittorrent.exe 3688 qbittorrent.exe 3688 qbittorrent.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 3688 qbittorrent.exe 3688 qbittorrent.exe 3688 qbittorrent.exe 3688 qbittorrent.exe 3688 qbittorrent.exe 3688 qbittorrent.exe 3688 qbittorrent.exe 3688 qbittorrent.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3688 qbittorrent.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2208 wrote to memory of 3688 2208 qbittorrent_5.0.1_x64_setup.exe 82 PID 2208 wrote to memory of 3688 2208 qbittorrent_5.0.1_x64_setup.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\qbittorrent_5.0.1_x64_setup.exe"C:\Users\Admin\AppData\Local\Temp\qbittorrent_5.0.1_x64_setup.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files\qBittorrent\qbittorrent.exe"C:\Program Files\qBittorrent\qbittorrent.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3688
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
PID:1076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34.9MB
MD5bebf18e9f646943cfe8067ab60b3ad9e
SHA1d9dd3bb1190e70bcb338ffd713fd0c906b29d2c1
SHA256c8169df564f2b6bc12b0e0c1d8f628f5e7daafac5b94c5d92211ed631b68a551
SHA512531e0d546b02b1946010ca4b4ba8a26f34648efc315f75ba48d7ac534a7656c6c05d2c1a23e5a0ca80ffdc78ec133f4ba6601bb3ab6ce8392a88a8ec93093acb
-
Filesize
84B
MD5af7f56a63958401da8bea1f5e419b2af
SHA1f66ee8779ca6d570dea22fe34ef8600e5d3c5f38
SHA256fdb8fa58a6ffc14771ca2b1ef6438061a6cba638594d76d9021b91e755d030d3
SHA51202f70ca7f1291b25402989be74408eb82343ab500e15e4ac22fbc7162eb9230cd7061eaa7e34acf69962b57ed0827f51ceaf0fa63da3154b53469c7b7511d23d
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\18bd6410-616c-4cbf-be7d-c9a1ca75701c.down_data
Filesize555KB
MD55683c0028832cae4ef93ca39c8ac5029
SHA1248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
-
Filesize
3KB
MD5b4faf654de4284a89eaf7d073e4e1e63
SHA18efcfd1ca648e942cbffd27af429784b7fcf514b
SHA256c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3
SHA512eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388
-
Filesize
5KB
MD550016010fb0d8db2bc4cd258ceb43be5
SHA144ba95ee12e69da72478cf358c93533a9c7a01dc
SHA25632230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e
SHA512ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233
-
Filesize
12KB
MD54add245d4ba34b04f213409bfe504c07
SHA1ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA2569111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
SHA5121bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
-
Filesize
14KB
MD5adb29e6b186daa765dc750128649b63d
SHA1160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA2562f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
-
Filesize
25KB
MD5cbe40fd2b1ec96daedc65da172d90022
SHA1366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA2563ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
SHA51262990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
-
Filesize
9KB
MD51d8f01a83ddd259bc339902c1d33c8f1
SHA19f7806af462c94c39e2ec6cc9c7ad05c44eba04e
SHA2564b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
SHA51228bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
-
Filesize
8KB
MD5f5bf81a102de52a4add21b8a367e54e0
SHA1cf1e76ffe4a3ecd4dad453112afd33624f16751c
SHA25653be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
SHA5126e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
-
Filesize
64B
MD53819c632b31e912a21666744d24a47c4
SHA15ec4039caaefde0a9733ca88e55e77dd1ec1be05
SHA25641fe2d2dbf1aa7aef86d2fb1ace8449ab67db9dc8512d94500f14bd0c344bbd6
SHA5127891b7cd768ded80c51f693b13f567ff3e1e009da7ca50ae9d2d848e7236a2579558847720589cab99cb3515530ddc2fe22a9258ab99d6f7ba2c91e6878b2f37