Page cover

Coinminer - Malware Analysis

Coinminer’s presentation 🪙

Cryptocurrency miners generate popular digital currencies like Bitcoin, Monero, and Ethereum. When used willingly, they can be a valuable income source. However, malware creators have designed threats that exploit accessible mining software to harness another user’s computing resources without consent — a practice known as cryptojacking.

Download: https://bazaar.abuse.ch/download/b56608aa06ded2deaf07/

$hashMD5 = Get-FileHash .\coinminer.exe -Algorithm MD5
$hashSHA256 = Get-FileHash .\coinminer.exe -Algorithm SHA256
$hashMD5, $hashSHA256 | Format-Table Algorithm, Hash

Algorithm Hash
--------- ----
MD5       61CC7E8A49ED8D3B193E9394907B7081
SHA256    3AEAB6E4D9FB1E51C0D94069517FD681EBC9CB4AB5A945650C17E50A19C958A2

File identification :

 file coinminer.exe
coinminer.exe: PE32+ executable (GUI) x86-64, for MS Windows
Score vt 33/49 for this PE32+ exe

Static Analysis :

A quick use of Floss to retrieve the important strings:

Results:

We managed to extract many strings, but nothing particularly interesting (http, cmd, ip, etc.).

Pestudio provided information on several techniques related to CoinMiner and at least one embedded file:

techniques (2)
file embedded

To gain more insights on these points, we decided to submit CoinMiner to a dynamic analysis.

Dynamic Analysis :

let’s run it

After analysis, 150+ processes, 2 files extracted, and a more comprehensive overview of the TTPs used:

Behavior graph

The analysis of the processes reveals a well-orchestrated strategy to maintain presence on the system while avoiding detection. This involves modifying system settings and stopping several Windows services. The execution of CoinMiner.exe clearly indicates the use of mining software. Additionally, the commands utilizing wusa.exe and powershell.exe seem aimed at excluding certain paths from Windows Defender’s monitoring and uninstalling specific updates, likely to evade detection. Lastly, the creation and management of the “JVNIRHNX” service highlight an effort to ensure persistence through a hidden executable, reinforcing the malicious nature of the observed activities.

In this context, file 1 (fqwofdtexigy.exe) has also been observed in the wild during the same period, linked to a sample of another Coinminer: w2EhpArSUP.exe (SHA256: a2d7b3a0425ac23b1fda3c12674ead2d7cd06ac36ce98b5fe04e1469d618ce3a). This indicates that the same threat actor is widely distributing multiple Coinminers:

w2EhpArSUP.exe > fqwofdtexigy.exe

The reported YARA detection rules indicate the presence of the “XMRIG” cryptominer based on macOS.

Yara rules matched

Threat intel :

An analysis published in 2023 indicates that XMRig is a command-line cryptomining tool (for Monero) commonly used for legitimate purposes. However, due to its flexibility and open-source code, it is also highly favored by malicious actors. It is also noted that a trojan may execute in this manner under the guise of Final Cut Pro, the video editing software developed by Apple.

This deceptive marketing technique is known as “bundling.” Often, “bundling” is used to introduce multiple potentially unwanted programs (PUAs) into a system simultaneously. Therefore, it is highly likely that the XMRIG virus arrived alongside various adware-type applications that display intrusive ads and collect sensitive information.

TTPs :

IOCs :

Detection & Hunting :

Yara:

Dropped files:

The presence of files generated by CoinMiner, such as fqwofdtexigy.exe, and their execution via PowerShell from unusual startup paths indicates a clever strategy to maintain a foothold on the system while avoiding detection by blending in with legitimate processes.

Key:

Mitigation Measures:

  • To protect against threats associated with XMRig, which is a legitimate Monero mining tool, it is crucial to block all known threat indicators related to its misuse within your security controls.

  • Conduct searches for Indicators of Compromise (IOCs) linked to unauthorized XMRig infections within your environment, using your available security tools. Ensure that all platforms and software are promptly patched and updated, focusing on vulnerabilities that may be exploited by malicious actors distributing counterfeit versions of XMRig. This should be a core component of your security policy.

  • In addition to hardening networks and systems, implement code hardening measures for web applications and software to safeguard your organization against potential threats from malicious XMRig distributions. Use vulnerability testing tools to detect weaknesses in deployed code that could be exploited by these counterfeit versions.

  • Strengthen your cyber hygiene by keeping antivirus software up to date and following a structured patch management lifecycle. To further mitigate risk, consider using ad blockers and disabling JavaScript in web browsers to reduce exposure to malicious downloads often associated with unauthorized XMRig distributions.

  • Finally, remain vigilant regarding counterfeit software and suspicious download links, particularly those found on torrent sites. These sources may offer fake versions of XMRig or other mining tools, which can lead to malware infections. Always use software from trusted and verified sources to ensure security.

Thank you for reading! :) Julien

PreviousMalware analysisNextPublications

Last updated