878ca7e3fb7a90a937afdbe080c055877b4c6334a9589d27e092fd6737a0716f

Analysis

max time kernel
33s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/01/2025, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qbittorrent_5.0.3_x64_setup.exe
Size 37.5MB
Sample250122-e5tdvsykgx
SHA256 878ca7e3fb7a90a937afdbe080c055877b4c6334a9589d27e092fd6737a0716f
MD5 83505c82e83bd2e61bd67dfcf30724cf
SHA1 5fbde5f904a7c0e1346b9bcef4a66a7a7dd7e5b9
SHA512 87ead0cac1dd041f7929e68bfdf8b61ac50c9d05a74344ab951f9c624874452e22a30f678a6a059cc3e8906f92189c39cfe7bba6552681140d610edb1b529833
SSDEEP 786432:7nvRa6b9c7DLVZhxGjtYO9NByxgyXXbFTUgCe4Oa0eMe6NwRI/gWfe+C:7paO9c7VZejf3OBbFTU3U+6NxIV+C
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2524	qbittorrent_5.0.3_x64_setup.exe
2524	qbittorrent_5.0.3_x64_setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qbittorrent_5.0.3_x64_setup.exe

C:\Users\Admin\AppData\Local\Temp\qbittorrent_5.0.3_x64_setup.exe
"C:\Users\Admin\AppData\Local\Temp\qbittorrent_5.0.3_x64_setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2524

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LangDLL.dll

Path \Users\Admin\AppData\Local\Temp\nst8F37.tmp\LangDLL.dll
Size 5KB
SHA256 32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e
MD5 50016010fb0d8db2bc4cd258ceb43be5
SHA1 44ba95ee12e69da72478cf358c93533a9c7a01dc
SHA512 ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233
SSDEEP 48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAC.dll

Path \Users\Admin\AppData\Local\Temp\nst8F37.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
MD5 SHA1 SHA512 SSDEEP