Analysis

  • max time kernel
    27s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-11-2020 07:29

General

  • Target

    PO Quotation.jar

  • Size

    89KB

  • MD5

    1cc049bd0c76d165ac6f78afd0474c6f

  • SHA1

    38503f829afd9f9e17d2f72fda89adab6e598129

  • SHA256

    c79a8f611b934f2630d4b6fb91240048cc85ecb354f75e01d6a2c444e8c12eed

  • SHA512

    60753e595658dda0d91cb358c2fe3b84137ce11e0d814fbd1a99cd32d7d0ae06a04ea37a228b1665de73d4bed43e88b7a36961eb5b40c67e335b5adb4270a16d

Score
10/10

Malware Config

Signatures

  • QNodeService

    Trojan/stealer written in NodeJS and spread via Java downloader.

  • Executes dropped EXE 1 IoCs
  • JavaScript code in executable 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\ProgramData\Oracle\Java\javapath\java.exe
    java -jar "C:\Users\Admin\AppData\Local\Temp\PO Quotation.jar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:656
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\6dc06c06.tmp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3488
      • C:\Users\Admin\node-v14.12.0-win-x64\node.exe
        C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain marshost.publicvm.com
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\Local\Temp\6dc06c06.tmp

    MD5

    1cc049bd0c76d165ac6f78afd0474c6f

    SHA1

    38503f829afd9f9e17d2f72fda89adab6e598129

    SHA256

    c79a8f611b934f2630d4b6fb91240048cc85ecb354f75e01d6a2c444e8c12eed

    SHA512

    60753e595658dda0d91cb358c2fe3b84137ce11e0d814fbd1a99cd32d7d0ae06a04ea37a228b1665de73d4bed43e88b7a36961eb5b40c67e335b5adb4270a16d

  • C:\Users\Admin\node-v14.12.0-win-x64\node.exe

    MD5

    f0b11a5823c45fc2664e116dc0323bcb

    SHA1

    612339040c1f927ec62186cd5012f4bb9c53c1b9

    SHA256

    16fb671d2b06196482243fc31afb9cc0914c191b08181e71e20d872b51b09d99

    SHA512

    0e07919012d0764aef67ae20c69d66f0c2279137d3459c8437f00c63f0e868a79c52d5ddeb57b9273009780b147bb46b1f429248a8b1f946981097b8e5e851ac

  • memory/1564-178-0x0000000000000000-mapping.dmp

  • memory/1564-181-0x0000005A55080000-0x0000005A55081000-memory.dmp

    Filesize

    4KB

  • memory/3488-56-0x0000000000000000-mapping.dmp