Analysis Report javac.exe

ID:	324352
Product:	CloudBasic
Start time:	13:49:28
Start date:	29.11.2020
Sample:	javac.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	bbf20caee8bfce48f883a65b779dec71
SHA1:	71a8569ce4577016e1bc78eb27daab94ba6d9ce3
SHA256:	03100a76bca9d9ac984cccdf0cf7eef82bb2f1d20751538addc4405e35de4c00
Filetype:	Win64 Executable Console (202006/5) 81.26%

Name	Type	MD5	SHA1	SHA256
\Device\ConDrv	ASCII text, with CRLF, CR line terminators	D581D2AA3DBA6FBE81A0145388397820	EE1778795109B01B46622B8E75E6A5C634B9F464	A964F0660EA9448E758EBA4592569ACF43BADCF9E03FCD52FFE11CA41E4F138E

AV Detection:

Multi AV Scanner detection for submitted file

Source: javac.exe	Virustotal: Detection: 57%			Perma Link
Source: javac.exe	Metadefender: Detection: 16%			Perma Link
Source: javac.exe	ReversingLabs: Detection: 65%

Machine Learning detection for sample

Source: javac.exe

Joe Sandbox ML: detected

Bitcoin Miner:

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 00000000.00000002.203735977.00007FF755A51000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: javac.exe PID: 6636, type: MEMORY
Source: Yara match	File source: 0.2.javac.exe.7ff755a50000.0.unpack, type: UNPACKEDPE

Found strings related to Crypto-Mining

Source: javac.exe, 00000000.00000002.203735977.00007FF755A51000.00000040.00020000.sdmp	String found in binary or memory: stratum+tcp://
Source: javac.exe, 00000000.00000002.203735977.00007FF755A51000.00000040.00020000.sdmp	String found in binary or memory: cryptonight/0
Source: javac.exe, 00000000.00000002.203735977.00007FF755A51000.00000040.00020000.sdmp	String found in binary or memory: stratum+tcp://
Source: javac.exe, 00000000.00000002.203735977.00007FF755A51000.00000040.00020000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server

Networking:

Urls found in memory or binary data

Source: javac.exe, 00000000.00000002.203735977.00007FF755A51000.00000040.00020000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: javac.exe, 00000000.00000002.203688180.0000018E0D84B000.00000004.00000020.sdmp, javac.exe, 00000000.00000002.203707251.0000018E0D86D000.00000004.00000020.sdmp, ConDrv.0.dr	String found in binary or memory: https://xmrig.com/wizard
Source: javac.exe, 00000000.00000002.203735977.00007FF755A51000.00000040.00020000.sdmp	String found in binary or memory: https://xmrig.com/wizardSIGTERM

System Summary:

Malicious sample detected (through community Yara rule)

Source: 0.2.javac.exe.7ff755a50000.0.unpack, type: UNPACKEDPE

Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth

PE file contains strange resources

Source: javac.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: javac.exe, 00000000.00000000.202225027.00007FF7561CB000.00000008.00020000.sdmp	Binary or memory string: OriginalFilenamexmrig.exe0 vs javac.exe
Source: javac.exe	Binary or memory string: OriginalFilenamexmrig.exe0 vs javac.exe

Yara signature match

Source: 0.2.javac.exe.7ff755a50000.0.unpack, type: UNPACKEDPE

Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc

Classification label

Source: classification engine

Classification label: mal84.evad.mine.winEXE@2/1@0/0

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6644:120:WilError_01

Reads software policies

Source: C:\Users\user\Desktop\javac.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Source: javac.exe	Virustotal: Detection: 57%
Source: javac.exe	Metadefender: Detection: 16%
Source: javac.exe	ReversingLabs: Detection: 65%

Sample might require command line arguments

Source: javac.exe	String found in binary or memory: set-addPolicy
Source: javac.exe	String found in binary or memory: id-cmc-addExtensions

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\javac.exe 'C:\Users\user\Desktop\javac.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

PE file has a high image base, often used for DLLs

Source: javac.exe

Static PE information: Image base 0x140000000 > 0x60000000

Submission file is bigger than most known malware samples

Source: javac.exe

Static file information: File size 1778688 > 1048576

PE file has a big raw section

Source: javac.exe

Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x187800

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: javac.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\javac.exe

Code function: 0_2_00007FF7561CA330 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00007FF7561CA330

Sample is packed with UPX

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Hooking and other Techniques for Hiding and Protection:

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon1488.png

Malware Analysis System Evasion:

Potential time zone aware malware

Source: C:\Users\user\Desktop\javac.exe

System information queried: CurrentTimeZoneInformation

Jump to behavior

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Program exit points

Source: C:\Users\user\Desktop\javac.exe

API call chain: ExitProcess graph end node

Anti Debugging:

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\javac.exe

Code function: 0_2_00007FF7561CA330 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00007FF7561CA330

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected