Overview
overview
7Static
static
3qbittorren...up.exe
windows7-x64
7qbittorren...up.exe
windows10-2004-x64
7$PLUGINSDI...er.bmp
windows7-x64
3$PLUGINSDI...er.bmp
windows10-2004-x64
7$PLUGINSDI...rd.bmp
windows7-x64
3$PLUGINSDI...rd.bmp
windows10-2004-x64
7qbittorrent.pdb
windows7-x64
3qbittorrent.pdb
windows10-2004-x64
3qt.conf
windows7-x64
3qt.conf
windows10-2004-x64
3translations/qt_gl.qm
windows7-x64
3translations/qt_gl.qm
windows10-2004-x64
3translations/qt_lt.qm
windows7-x64
3translations/qt_lt.qm
windows10-2004-x64
3translatio..._PT.qm
windows7-x64
3translatio..._PT.qm
windows10-2004-x64
3translations/qt_sl.qm
windows7-x64
3translations/qt_sl.qm
windows10-2004-x64
3translations/qt_sv.qm
windows7-x64
3translations/qt_sv.qm
windows10-2004-x64
3translatio..._ar.qm
windows7-x64
3translatio..._ar.qm
windows10-2004-x64
3translatio..._bg.qm
windows7-x64
3translatio..._bg.qm
windows10-2004-x64
3translatio..._ca.qm
windows7-x64
3translatio..._ca.qm
windows10-2004-x64
3translatio..._cs.qm
windows7-x64
3translatio..._cs.qm
windows10-2004-x64
3translatio..._da.qm
windows7-x64
3translatio..._da.qm
windows10-2004-x64
3translatio..._de.qm
windows7-x64
3translatio..._de.qm
windows10-2004-x64
3Analysis
-
max time kernel
110s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14-11-2024 19:32
Static task
static1
Behavioral task
behavioral1
Sample
qbittorrent_5.0.1_x64_setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
qbittorrent_5.0.1_x64_setup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
qbittorrent.pdb
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
qbittorrent.pdb
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
qt.conf
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
qt.conf
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
translations/qt_gl.qm
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
translations/qt_gl.qm
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
translations/qt_lt.qm
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
translations/qt_lt.qm
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
translations/qt_pt_PT.qm
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
translations/qt_pt_PT.qm
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
translations/qt_sl.qm
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
translations/qt_sl.qm
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
translations/qt_sv.qm
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
translations/qt_sv.qm
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
translations/qtbase_ar.qm
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
translations/qtbase_ar.qm
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
translations/qtbase_bg.qm
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
translations/qtbase_bg.qm
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
translations/qtbase_ca.qm
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
translations/qtbase_ca.qm
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
translations/qtbase_cs.qm
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
translations/qtbase_cs.qm
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
translations/qtbase_da.qm
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
translations/qtbase_da.qm
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
translations/qtbase_de.qm
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
translations/qtbase_de.qm
Resource
win10v2004-20241007-en
General
-
Target
qbittorrent.pdb
-
Size
162.8MB
-
MD5
1a7cb8a5dc6a23b2fd0d5b4e0bf1638f
-
SHA1
97124f273d2202572d7ac9c35ff33810d291c63f
-
SHA256
746a57aec4c0f7f7e4da21d3f6b18c989ea36582acdb00b0e0c3d16331959d5a
-
SHA512
bb974fab9fe3068fcf1d2a8a33887f14b942f33ec6ace10e90aaff47a67f80a02be9edcd279876bee89dde9fbcb1edb6f1383330cdec4eaf465e1f45d01bba68
-
SSDEEP
393216:4NX806H0hHQexrBAqC91DU31qqyh8emQ5lz8jspZx0xMCbNI+CLX5551z+Ec+Tu:Uc0hHHdBFU9MUqy8M0e1ZB
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2696 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2696 AcroRd32.exe 2696 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 108 wrote to memory of 2916 108 cmd.exe 30 PID 108 wrote to memory of 2916 108 cmd.exe 30 PID 108 wrote to memory of 2916 108 cmd.exe 30 PID 2916 wrote to memory of 2696 2916 rundll32.exe 31 PID 2916 wrote to memory of 2696 2916 rundll32.exe 31 PID 2916 wrote to memory of 2696 2916 rundll32.exe 31 PID 2916 wrote to memory of 2696 2916 rundll32.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\qbittorrent.pdb1⤵
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\qbittorrent.pdb2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\qbittorrent.pdb"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2696
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD546663c5ffb7105cb34eb8731862777a9
SHA1d8231859aa2e61fccf901d6f3f957ebe5664433a
SHA256267248b92d5599bec1afa5dc172917576330e85bada46f9e2d7e3bf3dc8af081
SHA512f42010f4377b15d9f8adcea153bf7ebb5edb4852590582fe9fbda3bb54aa523f4c3e2217d47f2ae108c6a77d4e5aa4647790b495a6e8b59346ea5951a44c3569