Overview
overview
8Static
static
3qbittorren...up.exe
windows11-21h2-x64
8$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDIR/UAC.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...lW.dll
windows11-21h2-x64
3qbittorrent.exe
windows11-21h2-x64
1uninst.exe
windows11-21h2-x64
7$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDIR/UAC.dll
windows11-21h2-x64
3$PLUGINSDI...lW.dll
windows11-21h2-x64
3Analysis
-
max time kernel
89s -
max time network
96s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-11-2024 04:55
Static task
static1
Behavioral task
behavioral1
Sample
qbittorrent_5.0.1_x64_setup.exe
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UAC.dll
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsisFirewallW.dll
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
qbittorrent.exe
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
uninst.exe
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20241007-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win11-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/UAC.dll
Resource
win11-20241007-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsisFirewallW.dll
Resource
win11-20241007-en
General
-
Target
uninst.exe
-
Size
138KB
-
MD5
7ef2fd299b7bffdd88a53223cb6ac426
-
SHA1
ea63fc81cc8a9ea3031f5eca4e9ec4c8be25f46e
-
SHA256
ba1ec2684ceee82f817b250417985a9ef33dd679f5e97a18e0f8f3fda8a055b1
-
SHA512
47da0192a634ae7ea7553ad2e158c505b7cdb0c13ec956424f8777522609544bf059ac7b6919c877a2c67e7576e8237071d0962cfa59b321eb0ff7d53245e6f6
-
SSDEEP
3072:dnPdzuK8Jdw4TMJw3uXceAgF88Q0ejM6ocOSlH/Hs9:dnPdudwDzmgO8iPOSJM9
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1396 Un.exe -
Executes dropped EXE 1 IoCs
pid Process 1396 Un.exe -
Loads dropped DLL 6 IoCs
pid Process 1396 Un.exe 1396 Un.exe 1396 Un.exe 1396 Un.exe 1396 Un.exe 1396 Un.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uninst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Un.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1396 Un.exe 1396 Un.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2500 wrote to memory of 1396 2500 uninst.exe 77 PID 2500 wrote to memory of 1396 2500 uninst.exe 77 PID 2500 wrote to memory of 1396 2500 uninst.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninst.exe"C:\Users\Admin\AppData\Local\Temp\uninst.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe"C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1396
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b4faf654de4284a89eaf7d073e4e1e63
SHA18efcfd1ca648e942cbffd27af429784b7fcf514b
SHA256c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3
SHA512eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388
-
Filesize
5KB
MD550016010fb0d8db2bc4cd258ceb43be5
SHA144ba95ee12e69da72478cf358c93533a9c7a01dc
SHA25632230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e
SHA512ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233
-
Filesize
12KB
MD54add245d4ba34b04f213409bfe504c07
SHA1ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA2569111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
SHA5121bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
-
Filesize
14KB
MD5adb29e6b186daa765dc750128649b63d
SHA1160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA2562f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
-
Filesize
8KB
MD5f5bf81a102de52a4add21b8a367e54e0
SHA1cf1e76ffe4a3ecd4dad453112afd33624f16751c
SHA25653be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
SHA5126e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
-
Filesize
138KB
MD57ef2fd299b7bffdd88a53223cb6ac426
SHA1ea63fc81cc8a9ea3031f5eca4e9ec4c8be25f46e
SHA256ba1ec2684ceee82f817b250417985a9ef33dd679f5e97a18e0f8f3fda8a055b1
SHA51247da0192a634ae7ea7553ad2e158c505b7cdb0c13ec956424f8777522609544bf059ac7b6919c877a2c67e7576e8237071d0962cfa59b321eb0ff7d53245e6f6