qnodeservice | 43b00ce8ab382b247ec70fe0ea52becff208637b49c56a54c35c89043aed0ada

Analysis

Target

AWB051120.jar
Size

109KB
MD5

f17ee8a3e364faa7296e453ad60cd1d4
SHA1

863fe6242f284f1dcc7ecbb2faccd296895d5cdf
SHA256

43b00ce8ab382b247ec70fe0ea52becff208637b49c56a54c35c89043aed0ada
SHA512

15b2776081bd224ab63d636edf0096b1aa7eaf5b633e8c7a9710d4c7086f144dbc9d49235503f72fa62530a23ae0f49c477f0976457a301b1756294793c6711c

Score

10^/10

QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
trojan qnodeservice

Executes dropped EXE 1 IoCs

pid	Process
3168	node.exe

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ab62-177.dat	js

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 4032	412	java.exe	77
PID 412 wrote to memory of 4032	412	java.exe	77
PID 4032 wrote to memory of 3168	4032	javaw.exe	81
PID 4032 wrote to memory of 3168	4032	javaw.exe	81

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\AWB051120.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\5ff5ed12.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Users\Admin\node-v14.12.0-win-x64\node.exe
    C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain chinpao.hopto.org --hub-domain localhost
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3168

memory/3168-178-0x000002E24E040000-0x000002E24E041000-memory.dmp

Filesize
4KB

Download