qnodeservice | d7db41d41a5f0480425730603768f4df0b190e3f7e1681f3670bab7dd488d796

Analysis

Target

d7db41d41a5f0480425730603768f4df0b190e3f7e1681f3670bab7dd488d796.jar
Size

91KB
MD5

e5b74fcd216a1bc2d3f18f137fae608f
SHA1

0e266e567f9471bb17bb47144aeae8499ff0c882
SHA256

d7db41d41a5f0480425730603768f4df0b190e3f7e1681f3670bab7dd488d796
SHA512

6f231d29497be715fff696518def755411f493cb598711d4e8a90df144f3935c922b7f0f4cdcfeed10c86d58aa4225323faa8293ebc077a2a95ff15986d21933

Score

10^/10

QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
trojan qnodeservice

Executes dropped EXE 1 IoCs

pid	Process
3456	node.exe

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ab7b-172.dat	js

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 1196	696	java.exe	77
PID 696 wrote to memory of 1196	696	java.exe	77
PID 1196 wrote to memory of 3456	1196	javaw.exe	81
PID 1196 wrote to memory of 3456	1196	javaw.exe	81

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\d7db41d41a5f0480425730603768f4df0b190e3f7e1681f3670bab7dd488d796.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:696
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\275fb0ba.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Users\Admin\node-v14.12.0-win-x64\node.exe
    C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain success87.hopto.org
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3456

memory/3456-173-0x000001CC0D580000-0x000001CC0D581000-memory.dmp

Filesize
4KB

Download