qnodeservice | 100f5ac30dd70d3844e582642a221d93555a6a5d7f081bea8fa4ad572164d17b

Analysis

Target

Invoice_1606.jar
Size

72KB
MD5

3884f884757f84749a7ff48d4deca32b
SHA1

22e456c713c3b64a2f92b9418cab1318ab70d48f
SHA256

100f5ac30dd70d3844e582642a221d93555a6a5d7f081bea8fa4ad572164d17b
SHA512

4aeaeef6f99f215f51d75ed1a0e600cdfcab5b7b28f800c9db2f6dc9ac8a00bd87b135d10571b3843ef64af409d751d55428ea1341fd78f7c46cefc743820b0e

Score

10^/10

QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
trojan qnodeservice

Executes dropped EXE 1 IoCs

pid	Process
1404	node.exe

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ad95-168.dat	js

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 344 wrote to memory of 2836	344	java.exe	76
PID 344 wrote to memory of 2836	344	java.exe	76
PID 2836 wrote to memory of 1404	2836	javaw.exe	78
PID 2836 wrote to memory of 1404	2836	javaw.exe	78

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Invoice_1606.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:344
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\2155f09c.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Users\Admin\node-v14.12.0-win-x64\node.exe
    C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain success87.hopto.org
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1404

memory/1404-170-0x000003EF6F640000-0x000003EF6F641000-memory.dmp

Filesize
4KB

Download