qnodeservice | d7db41d41a5f0480425730603768f4df0b190e3f7e1681f3670bab7dd488d796

Analysis

Target

BB1.jar
Size

91KB
MD5

e5b74fcd216a1bc2d3f18f137fae608f
SHA1

0e266e567f9471bb17bb47144aeae8499ff0c882
SHA256

d7db41d41a5f0480425730603768f4df0b190e3f7e1681f3670bab7dd488d796
SHA512

6f231d29497be715fff696518def755411f493cb598711d4e8a90df144f3935c922b7f0f4cdcfeed10c86d58aa4225323faa8293ebc077a2a95ff15986d21933

Score

10^/10

QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
trojan qnodeservice

Executes dropped EXE 1 IoCs

pid	Process
2640	node.exe

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ab51-167.dat	js

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 1320	2260	java.exe	76
PID 2260 wrote to memory of 1320	2260	java.exe	76
PID 1320 wrote to memory of 2640	1320	javaw.exe	80
PID 1320 wrote to memory of 2640	1320	javaw.exe	80

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\BB1.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\18f8fb0a.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Users\Admin\node-v14.12.0-win-x64\node.exe
    C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain success87.hopto.org
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2640

memory/2640-168-0x000000DED7CC0000-0x000000DED7CC1000-memory.dmp

Filesize
4KB

Download