qnodeservice | 0944b4a447e409d6b9af31421bddaa58484b70203c429945570ec533842be635

Analysis

Target

review.delivery.information.jar
Size

82KB
MD5

f787589c52802370ce0a71033afbf356
SHA1

0e6ded18abbcc8b36ffbb649b0bc24f9624f86dd
SHA256

0944b4a447e409d6b9af31421bddaa58484b70203c429945570ec533842be635
SHA512

429b9bfd2973283f40998218b0d17b231b915e2a2a58d13fe33402e911541a7f0ee54829305cfbdcdeab7e435ce65999a538f5bb40eaa2f69e56a64bcd6bc936

Score

10^/10

QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
trojan qnodeservice
Executes dropped EXE 1 IoCs

Processes:

node.exe

pid process

3524 node.exe

pid	process
3524	node.exe

JavaScript code in executable 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\node-v14.12.0-win-x64\node.exe	js

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

node.exe

pid process

3524 node.exe
3524 node.exe
3524 node.exe
3524 node.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

java.exejavaw.exe

description	pid	process	target process
PID 508 wrote to memory of 2652	508	java.exe	javaw.exe
PID 508 wrote to memory of 2652	508	java.exe	javaw.exe
PID 2652 wrote to memory of 3524	2652	javaw.exe	node.exe
PID 2652 wrote to memory of 3524	2652	javaw.exe	node.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\review.delivery.information.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:508
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\4c7d09dc.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Users\Admin\node-v14.12.0-win-x64\node.exe
    C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain ideasexpress.website
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3524

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

MD5
02ddc2dfa07b4b2d739f4f08a522cb58

SHA1
263d668a527132ae9adeec14ce204e248c73fc1e

SHA256
7168c5bffcf1cbdfcc0d3a30298bfb72db60dd734df123daa9e4c51196937482

SHA512
65bb8b746e0ac0731db69b9d9f5eff35af4691ccf2779887d8401bb6cd8c4adddf4974b78758a3bd03d81357ba0fb4f927161fbd2e0da3a6018c7e61d01bd71d

Download Submit
C:\Users\Admin\AppData\Local\Temp\4c7d09dc.tmp

MD5
f787589c52802370ce0a71033afbf356

SHA1
0e6ded18abbcc8b36ffbb649b0bc24f9624f86dd

SHA256
0944b4a447e409d6b9af31421bddaa58484b70203c429945570ec533842be635

SHA512
429b9bfd2973283f40998218b0d17b231b915e2a2a58d13fe33402e911541a7f0ee54829305cfbdcdeab7e435ce65999a538f5bb40eaa2f69e56a64bcd6bc936

Download Submit
C:\Users\Admin\node-v14.12.0-win-x64\node.exe

MD5
f0b11a5823c45fc2664e116dc0323bcb

SHA1
612339040c1f927ec62186cd5012f4bb9c53c1b9

SHA256
16fb671d2b06196482243fc31afb9cc0914c191b08181e71e20d872b51b09d99

SHA512
0e07919012d0764aef67ae20c69d66f0c2279137d3459c8437f00c63f0e868a79c52d5ddeb57b9273009780b147bb46b1f429248a8b1f946981097b8e5e851ac

Download Submit
memory/2652-53-0x0000000000000000-mapping.dmp

Download
memory/3524-164-0x0000000000000000-mapping.dmp

Download
memory/3524-166-0x00000217A8A80000-0x00000217A8A81000-memory.dmp

Filesize
4KB

Download