qnodeservice | c79a8f611b934f2630d4b6fb91240048cc85ecb354f75e01d6a2c444e8c12eed

Analysis

Target

PO Quotation.jar
Size

89KB
MD5

1cc049bd0c76d165ac6f78afd0474c6f
SHA1

38503f829afd9f9e17d2f72fda89adab6e598129
SHA256

c79a8f611b934f2630d4b6fb91240048cc85ecb354f75e01d6a2c444e8c12eed
SHA512

60753e595658dda0d91cb358c2fe3b84137ce11e0d814fbd1a99cd32d7d0ae06a04ea37a228b1665de73d4bed43e88b7a36961eb5b40c67e335b5adb4270a16d

Score

10^/10

QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
trojan qnodeservice

Executes dropped EXE 1 IoCs

pid	Process
1564	node.exe

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ab81-179.dat	js

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 3488	656	java.exe	76
PID 656 wrote to memory of 3488	656	java.exe	76
PID 3488 wrote to memory of 1564	3488	javaw.exe	80
PID 3488 wrote to memory of 1564	3488	javaw.exe	80

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\PO Quotation.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:656
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\6dc06c06.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Users\Admin\node-v14.12.0-win-x64\node.exe
    C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain marshost.publicvm.com
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1564

memory/1564-181-0x0000005A55080000-0x0000005A55081000-memory.dmp

Filesize
4KB

Download