qnodeservice | 82e6c353c73c37d89e87eebfb9cccbc5b717f1a6aad3f560b32a5aa5c28a2115

Analysis

Target

RFQ-HSO-76411758-1.jar
Size

85KB
MD5

dfb8376d1168bfda3e5b14cc178e7889
SHA1

e0ad99d56ed5bc570487919c898eacbb2157986a
SHA256

82e6c353c73c37d89e87eebfb9cccbc5b717f1a6aad3f560b32a5aa5c28a2115
SHA512

1a4b02326706f0412062c98900f853f1e275134da1a525666ff86c0a93de8df61fa9f62448ed66379203de0f177facbc02981a783ed78f2ce788cae04dc47e81

Score

10^/10

QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
trojan qnodeservice

Executes dropped EXE 1 IoCs

pid	Process
2748	node.exe

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ab9a-169.dat	js

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1852	1112	java.exe	77
PID 1112 wrote to memory of 1852	1112	java.exe	77
PID 1852 wrote to memory of 2748	1852	javaw.exe	81
PID 1852 wrote to memory of 2748	1852	javaw.exe	81

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\RFQ-HSO-76411758-1.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\5cd18f38.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Users\Admin\node-v14.12.0-win-x64\node.exe
    C:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain steelpipeskzn.ddns.net
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2748

memory/2748-170-0x0000033B29B40000-0x0000033B29B41000-memory.dmp

Filesize
4KB

Download