qnodeservice | bdc561ae53aa52900af298a57b5e2f920f9cdf74bccf674735dbab318499c2d0

Analysis

Target

VideoCCTV.jar
Size

390KB
MD5

c4ceec1bf73783dcb2ee150b771e23a4
SHA1

20a9f2f207bbb388076383a0ed2c5205ae299433
SHA256

bdc561ae53aa52900af298a57b5e2f920f9cdf74bccf674735dbab318499c2d0
SHA512

e05e4c6a237970e98f528eefa1ff7fc581b25a92203c777422aa50a49bcb336711b61f6a82f1c9bf0ba065e0229e82e3f03a5bd921f56f12fa57ee2440012bbd

Score

10^/10

QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
trojan qnodeservice

Executes dropped EXE 1 IoCs

pid	Process
2884	node.exe

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ad66-163.dat	js

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 2836	408	java.exe	73
PID 408 wrote to memory of 2836	408	java.exe	73
PID 2836 wrote to memory of 2884	2836	javaw.exe	77
PID 2836 wrote to memory of 2884	2836	javaw.exe	77

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\VideoCCTV.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:408
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\9ba1e8d2.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Users\Admin\node-v14.12.0-win-x64\node.exe
    C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain localhost --hub-domain piolozxx.ddns.net
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2884

memory/2884-164-0x00000101D3B80000-0x00000101D3B81000-memory.dmp

Filesize
4KB

Download