qnodeservice | e6b43893d49d522864469d81499e46121eadbe089baf0657c23b15b91c973180

Analysis

Target

INVOICE#2006.jar
Size

80KB
MD5

ceb73af74d8f6bc1069203085381af03
SHA1

409c6f3b4150e0d5631884fa35de0f43b8bc6ecb
SHA256

e6b43893d49d522864469d81499e46121eadbe089baf0657c23b15b91c973180
SHA512

a1ee48c4da064a43b3d3a9ae78ceb80dc1687b4b70d056a1d2021597db692d919f8e221f5dd40ae6ab2a23cd3ed9d0f5cd6331324e41688ada0f9dcbcd9f66f5

Score

10^/10

QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
trojan qnodeservice

Executes dropped EXE 1 IoCs

pid	Process
2112	node.exe

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ab61-171.dat	js

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 3384	3968	java.exe	75
PID 3968 wrote to memory of 3384	3968	java.exe	75
PID 3384 wrote to memory of 2112	3384	javaw.exe	79
PID 3384 wrote to memory of 2112	3384	javaw.exe	79

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\INVOICE#2006.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\dd0682d4.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Users\Admin\node-v14.12.0-win-x64\node.exe
    C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain success87.hopto.org
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2112

memory/2112-172-0x000002CB1B840000-0x000002CB1B841000-memory.dmp

Filesize
4KB

Download