qnodeservice | d7db41d41a5f0480425730603768f4df0b190e3f7e1681f3670bab7dd488d796

Analysis

Target

BB1.jar
Size

91KB
MD5

e5b74fcd216a1bc2d3f18f137fae608f
SHA1

0e266e567f9471bb17bb47144aeae8499ff0c882
SHA256

d7db41d41a5f0480425730603768f4df0b190e3f7e1681f3670bab7dd488d796
SHA512

6f231d29497be715fff696518def755411f493cb598711d4e8a90df144f3935c922b7f0f4cdcfeed10c86d58aa4225323faa8293ebc077a2a95ff15986d21933

Score

10^/10

QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
trojan qnodeservice
Executes dropped EXE 1 IoCs

Processes:

node.exe

pid process

2640 node.exe

pid	process
2640	node.exe

JavaScript code in executable 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\node-v14.12.0-win-x64\node.exe	js

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

node.exe

pid process

2640 node.exe
2640 node.exe
2640 node.exe
2640 node.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

java.exejavaw.exe

description	pid	process	target process
PID 2260 wrote to memory of 1320	2260	java.exe	javaw.exe
PID 2260 wrote to memory of 1320	2260	java.exe	javaw.exe
PID 1320 wrote to memory of 2640	1320	javaw.exe	node.exe
PID 1320 wrote to memory of 2640	1320	javaw.exe	node.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\BB1.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2260

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\18f8fb0a.tmp
2⤵
- Suspicious use of WriteProcessMemory
PID:1320

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
MD5
b53a802f3bc434e8a21cfc211fa7712a

SHA1
1e8ccbc23bbb5bf6ac9cfaa0bf185217b7d4b761

SHA256
8b2d5554a9d330649be08586348eed4f8855d12002b38f8887b661b6ccf53368

SHA512
0ad770bbe63533aa86ea9933d350e2fdf2c997384dca3fd0032179f6918ee4b1f5e999564e677fad36e22c5ac4a232a82afb8a5d42e66e6aa803416a7a1d8f46

Download Submit
C:\Users\Admin\AppData\Local\Temp\18f8fb0a.tmp
MD5
e5b74fcd216a1bc2d3f18f137fae608f

SHA1
0e266e567f9471bb17bb47144aeae8499ff0c882

SHA256
d7db41d41a5f0480425730603768f4df0b190e3f7e1681f3670bab7dd488d796

SHA512
6f231d29497be715fff696518def755411f493cb598711d4e8a90df144f3935c922b7f0f4cdcfeed10c86d58aa4225323faa8293ebc077a2a95ff15986d21933

Download Submit
C:\Users\Admin\node-v14.12.0-win-x64\node.exe
MD5
f0b11a5823c45fc2664e116dc0323bcb

SHA1
612339040c1f927ec62186cd5012f4bb9c53c1b9

SHA256
16fb671d2b06196482243fc31afb9cc0914c191b08181e71e20d872b51b09d99

SHA512
0e07919012d0764aef67ae20c69d66f0c2279137d3459c8437f00c63f0e868a79c52d5ddeb57b9273009780b147bb46b1f429248a8b1f946981097b8e5e851ac

Download Submit
memory/1320-53-0x0000000000000000-mapping.dmp

Download
memory/2640-166-0x0000000000000000-mapping.dmp

Download
memory/2640-168-0x000000DED7CC0000-0x000000DED7CC1000-memory.dmp

Filesize
4KB

Download