qnodeservice | 59b1bfedcb58180036edfa10e515f72204d88fbcf456059907b93043b3f6ae40

Analysis

Target

Shipping documents.jar
Size

72KB
MD5

0e274414e008ee3e555e296593012828
SHA1

98e64ec5869c19641dac93541e1355030fe2a68f
SHA256

59b1bfedcb58180036edfa10e515f72204d88fbcf456059907b93043b3f6ae40
SHA512

f430701dcaf40dda38f84645920c2ea073c15ed4268144b1fc310b33b69f568de24f17d7337c8af11c0916d12db76501320b0bbf767484c8b65ac02955cfe96f

Score

10^/10

QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
trojan qnodeservice
Executes dropped EXE 1 IoCs

Processes:

node.exe

pid process

2732 node.exe

pid	process
2732	node.exe

JavaScript code in executable 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\node-v14.12.0-win-x64\node.exe	js

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

node.exe

pid process

2732 node.exe
2732 node.exe
2732 node.exe
2732 node.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

java.exejavaw.exe

description	pid	process	target process
PID 3712 wrote to memory of 1976	3712	java.exe	javaw.exe
PID 3712 wrote to memory of 1976	3712	java.exe	javaw.exe
PID 1976 wrote to memory of 2732	1976	javaw.exe	node.exe
PID 1976 wrote to memory of 2732	1976	javaw.exe	node.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Shipping documents.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:3712

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\01503380.tmp
2⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
MD5
094002d5b227ef30aa81fcc45426c9c6

SHA1
733236d6c75de6121102106cd3e31fe585eb2466

SHA256
15bc685bcc9990b3367d190888dc6d8848c7b1a3d9d8a46aedcb46d39e00104a

SHA512
13714b2283134627e0c899e45c135c04c546f3a920d91c0c37f4f250b945889c8dd630e4de9a5f72d3b08a19aaecf9b1e1be909078b53d51f26f72b79549cafc

Download Submit
C:\Users\Admin\AppData\Local\Temp\01503380.tmp
MD5
0e274414e008ee3e555e296593012828

SHA1
98e64ec5869c19641dac93541e1355030fe2a68f

SHA256
59b1bfedcb58180036edfa10e515f72204d88fbcf456059907b93043b3f6ae40

SHA512
f430701dcaf40dda38f84645920c2ea073c15ed4268144b1fc310b33b69f568de24f17d7337c8af11c0916d12db76501320b0bbf767484c8b65ac02955cfe96f

Download Submit
C:\Users\Admin\node-v14.12.0-win-x64\node.exe
MD5
f0b11a5823c45fc2664e116dc0323bcb

SHA1
612339040c1f927ec62186cd5012f4bb9c53c1b9

SHA256
16fb671d2b06196482243fc31afb9cc0914c191b08181e71e20d872b51b09d99

SHA512
0e07919012d0764aef67ae20c69d66f0c2279137d3459c8437f00c63f0e868a79c52d5ddeb57b9273009780b147bb46b1f429248a8b1f946981097b8e5e851ac

Download Submit
memory/1976-55-0x0000000000000000-mapping.dmp

Download
memory/2732-173-0x0000000000000000-mapping.dmp

Download
memory/2732-177-0x0000031464480000-0x0000031464481000-memory.dmp

Filesize
4KB

Download