qnodeservice | bfe596c9e91ff1f739cf53faf5996504addb964a7cbfd3823040f9f2acf36185

Analysis

Target

Image_00766433873_JPEG.jar
Size

69KB
MD5

38af657b78fbe7972d6056129a9ff437
SHA1

af3f1cdddfc251308ec0c627a95e088962a40c05
SHA256

bfe596c9e91ff1f739cf53faf5996504addb964a7cbfd3823040f9f2acf36185
SHA512

632638d1646be5e5a6cbf85d564bb52820706e25d673a3548b62b65181c6af4be0df39adf2fb8e97d0238c274dc47ec0246f6da36142314197c1a1108e5e0846

Score

10^/10

QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
trojan qnodeservice

Executes dropped EXE 1 IoCs

pid	Process
1200	node.exe

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001adb4-171.dat	js

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 2136	3104	java.exe	74
PID 3104 wrote to memory of 2136	3104	java.exe	74
PID 2136 wrote to memory of 1200	2136	javaw.exe	78
PID 2136 wrote to memory of 1200	2136	javaw.exe	78

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Image_00766433873_JPEG.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\ed0cb17b.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Users\Admin\node-v14.12.0-win-x64\node.exe
    C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain ntums330.hopto.org
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1200

memory/1200-172-0x00000213C5140000-0x00000213C5141000-memory.dmp

Filesize
4KB

Download