More than a year after the world first saw the Eternal Blue exploit in action during the May 2017 WannaCry outbreak, we are still seeing unpatched machines in Asia being infected by malware that uses the exploit to spread. Starting in mid-November 2018, our telemetry reports indicate that the newest version of the NRSMiner cryptominer, which uses the Eternal Blue exploit to propagate to vulnerable systems within a local network, is actively spreading in Asia. Most of the infected systems seen are in Vietnam.
In addition to downloading a cryptocurrency miner onto an infected machine, NRSMiner can download updated modules and delete the files and services installed by its own previous versions.
This post provides an analysis of how the latest version of NRSMiner infects a system and finds new vulnerable targets to infect. Recommendations for mitigation measures, IOCs and SHA1s are listed at the end of the post.
How NRSMiner spreads
There are 2 methods by which a system can be infected by the newest version of NRSMiner:
- By downloading the updater module onto a system that is already infected with a previous version of NRSMiner, or:
- If the system is unpatched (MS17-010) and another system within the intranet has been infected by NRSMiner.
Method 1: Infection via the Updater module
First, a system that has been infected with an older version of NRSMiner (and has the wmassrv service running) will connect to tecate[.]traduires[.]com to download an updater module to the %systemroot%\temp folder as tmp[xx].exe, where [xx] is the return value of the GetTickCount() API.
When this updater module is executed, it downloads another file to the same folder from one of a series of hard-coded IP addresses:
List of IP addresses found in different updater module files
The downloaded file, /x86 or /x64, is saved in the %systemroot%\temp folder as WUDHostUpgrade[xx].exe; again, [xx] is the return value of the GetTickCount() API.
WUDHostUpgrade[xx].exe
The WUDHostUpgrade[xx].exe first checks the mutex {502CBAF5-55E5-F190-16321A4} to determine if the system has already been infected with the latest NRSMiner version. If the system is infected, the WUDHostUpgrade[xx].exe deletes itself. Otherwise, it will delete the files MarsTraceDiagnostics.xml, snmpstorsrv.dll, MgmtFilterShim.ini.
Next, the module extracts the following files from its resource section (BIN directory) to the %systemroot%\system32 or %systemroot%\sysWOW64 folder: MarsTraceDiagnostics.xml, snmpstorsrv.dll.
It then copies the values for the CreationTime, LastAccessTime and LastWritetime properties from svchost.exe and updates the same properties for the MarsTraceDiagnostics.xml and snmpstorsrv.dll files with the copied values.
Finally, the WUDHostUpgrade[xx].exe installs a service named snmpstorsrv, with snmpstorsrv.dll registered as servicedll. It then deletes itself.
Pseudo-code for WUDHostUpgradexx.exe’s actions
Snmpstorsrv service
The newly-created Snmpstorsrv service starts under “svchost.exe -k netsvcs” and loads the snmpstorsrv.dll file, which creates multiple threads to perform several malicious activities.
Snmpstorsrv service’s activities
The service first creates a file named MgmtFilterShim.ini in the %systemroot%\system32 folder, writes ‘+’ in it and modifies its CreationTime, LastAccessTime and LastWritetime properties to have the same values as svchost.exe.
Next, the Snmpstorsrv service extracts malicious URLs and the cryptocurrency miner’s configuration file from MarsTraceDiagnostics.xml.
Malicious URLs and miner configuration details in the MarsTraceDiagnostics.xml file
On a system that is already infected with an older version of NRSMiner, the malware will delete all components of its older version before infecting it with the newer one. To remove the prior version of itself, the newest version refers to a list of services, tasks and files to be deleted that can be found as strings in the snmpstorsrv.dll file; to remove all older versions, it refers to a list that is found in the MarsTraceDiagnostics.xml file.
After all the artifacts of the old versions are deleted, the Snmpstorsrv service checks for any updates to the miner module by connecting to:
- reader[.]pamphler[.]com/resource
- handle[.]pamphler[.]com/modules.dat
If an updated miner module is available, it is downloaded and written into the MarsTraceDiagnostics.xml file. Once the new module is downloaded, the old miner file in %systemroot%\system32\TrustedHostex.exe is deleted. The new miner is decompressed in memory and the newly extracted miner configuration data is written into it.
This newly updated miner file is then injected into the svchost.exe to start crypto-mining. If the injection fails, the service instead writes the miner to %systemroot%\system32\TrustedHostex.exe and executes it.
The miner decompressed in memory
Next, the Snmpstorsrv service decompresses the wininit.exe file and injects it into svchost.exe. If the injection fails, it writes wininit.exe to %systemroot%\AppDiagnostics\wininit.exe and executes it. The service also opens port 60153 and starts listening.
In two other threads, the service sends out details about the infected system to the following sites:
- pluck[.]moisture[.]tk – MAC address, IP Address, System Name, Operating System information
- jump[.]taucepan[.]com – processor and memory specific information
Based on the information sent, a new updater file will be downloaded and executed, which will perform the same activities as described in “Updater Module” section above. This updater module can be used to infect systems with any new upcoming version of NRSMiner.
Method 2: Infection via Wininit.exe and Exploit
In the latest NRSMiner version, wininit.exe is responsible for handling its exploitation and propagation activities. Wininit.exe decompresses the zipped data in %systemroot%\AppDiagnostics\blue.xml and unzips files to the AppDiagnostics folder. Among the unzipped files is one named svchost.exe, which is the Eternalblue – 2.2.0 exploit executable. It then deletes the blue.xml file and writes 2 new files named x86.dll and x64.dll in the AppDiagnostics folder.
Wininit.exe scans the local network on TCP port 445 to search for other accessible systems. After the scan, it executes the Eternalblue executable file to exploit any vulnerable systems found. Exploit information is logged in the process1.txt file.
If the vulnerable system is successfully exploited, Wininit.exe then executes spoolsv.exe, which is the DoublePulsar – 1.3.1 executable file. This file installs the DoublePulsar backdoor onto the exploited system. Depending on the operating system of the target, either the x86.dll or x64.dll file is then transferred by Wininit.exe and gets injected into the targeted system’s lsass.exe by the spoolsv.exe backdoor.
Propagation method
x86.dll/x64.dll
This file creates a socket connection and gets the MarsTraceDiagnostics.xml file in %systemroot%\system32 folder from the parent infected system. It extracts the snmpstorsrv.dll, then creates and starts the Snmpstorsrv service on the newly infected system, so that it repeats the whole infection cycle and finds other vulnerable machines.
Miner module
NRSMiner uses the XMRig Monero CPU miner to generate units of the Monero cryptocurrency. It runs with one of the following parameters:
Miner parameters
The following are the switches used in the parameters:
- -o, –url=URL URL of mining server
- -u, –user=USERNAME username for mining server
- -p, –pass=PASSWORD password for mining server
- -t, –threads=N number of miner threads
- –donate-level=N donate level, default 5% (5 minutes in 100 minutes)
- –nicehash enable nicehash.com support
Detection
F-Secure products currently detect and block all variants of this malware, with a variety of detections.
Mitigation recommendations
The following measures can be taken to mitigate the exploitation of the vulnerability targeted by Eternal Blue and prevent an infection from spreading in your environment.
- For F-Secure products:
- Ensure that the F-Secure security program is using the latest available database updates.
- Ensure DeepGuard is turned on in all your corporate endpoints, and F-Secure Security Cloud connection is enabled.
- Ensure that F-Secure firewall is turned on in its default settings. Alternatively, configure your firewall to properly block 445 in- and outbound traffic within the organization to prevent it from spreading within the local network.
- For Windows:
- Use Software Updater or any other available tool to identify endpoints without the Microsoft-issued security fix (4013389) and patch them immediately.
- Apply the relevant security patches for any Windows systems under your administration based on the guidance given in Microsoft’s Customer Guidance for WannaCrypt attacks.
- If you are unable to patch it immediately, we recommend that you disable SMBv1 with the steps documented in Microsoft Knowledge Base Article 2696547 to reduce attack surface.
Indicator of compromise – IOC:
Sha1s:
32ffc268b7db4e43d661c8b8e14005b3d9abd306 - MarsTraceDiagnostics.xml 07fab65174a54df87c4bc6090594d17be6609a5e - snmpstorsrv.dll abd64831ad85345962d1e0525de75a12c91c9e55 - AppDiagnostics folder (zip) 4971e6eb72c3738e19c6491a473b6c420dde2b57 - Wininit.exe e43c51aea1fefb3a05e63ba6e452ef0249e71dd9 – tmpxx.exe 327d908430f27515df96c3dcd180bda14ff47fda – tmpxx.exe 37e51ac73b2205785c24045bc46b69f776586421 - WUDHostUpgradexx.exe da673eda0757650fdd6ab35dbf9789ba8128f460 - WUDHostUpgradexx.exe ace69a35fea67d32348fc07e491080fa635cc859 - WUDHostUpgradexx.exe 890377356f1d41d2816372e094b4e4687659a96f - WUDHostUpgradexx.exe 7f1f63feaf79c5f0a4caa5bbc1b9d76b8641181a - WUDHostUpgradexx.exe 9d4d574a01aaab5688b3b9eb4f3df2bd98e9790c - WUDHostUpgradexx.exe 9d7d20e834b2651036fb44774c5f645363d4e051 – x64.dll 641603020238a059739ab4cd50199b76b70304e1 – x86.dll
IP addresses:
167[.]179.79.234 104[.]248.72.247 172[.]105.229.220 207[.]148.110.212 149[.]28.133.197 167[.]99.172.78 181[.]215.176.23 38[.]132.111.23 216[.]250.99.33 103[.]103.128.151
URLs:
c[.]lombriz[.]tk state[.]codidled[.]com null[.]exhauest[.]com take[.]exhauest[.]com junk[.]soquare[.]com loop[.]sawmilliner[.]com fox[.]weilders[.]com asthma[.]weilders[.]com reader[.]pamphler[.]com jump[.]taucepan[.]com pluck[.]moisture[.]tk handle[.]pamphler[.]com
Categories