Summary:
Researchers discovered a suspicious shellcode in a system process memory in June 2022. They made the decision to explore further and look at the initial insertion of the shellcode into the process as well as the location of the threat on the compromised system.[/subscribe_to_unlock_form]
Summary:
Researchers discovered a suspicious shellcode in a system process memory in June 2022. They made the decision to explore further and look at the initial insertion of the shellcode into the process as well as the location of the threat on the compromised system.[emaillocker id="1283"]
The PowerShell script critical part of initiating the malware installation process. It accomplishes this by retrieving an encrypted payload from a remote server, decrypting it using a unique XOR encryption method with the key "fuckkasd9a," and loading it into the computer's memory. The PowerShell process then executes a .NET binary (DLL) as the payload, providing necessary arguments. This DLL is specifically designed to facilitate the installation of malware components embedded within the .NET DLL resources. During the installation process, the script ensures the presence of the legitimate ilasm.exe file. If ilasm.exe is not found, the process terminates. However, if ilasm.exe is present, a Scheduled Task is created for persistence. The malware encrypts the "RSHash(MachineName)" file obtained from the "_64_bin" .NET DLL resource, incorporating the initial 100 bytes of the installer. Additionally, the fusion.dll and SDBMHash(MachineName).dll files are modified by inserting up to 10240 random bytes, rendering hash detection by anti-malware applications ineffective.
Execution Flow
The installer utilizes the legitimate fusion.dll using the DLL hijacking technique. It launches the previously generated task for the running ilasm.exe, leading to the loading of the malicious fusion.dll library from the same directory. As a result, a suspended dllhost.exe process is generated. The payload is then extracted from the encrypted binary file, and the dllhost.exe process loads the decrypted payload as a DLL. The PID of the dllhost.exe process is stored in a file within the ProgramData directory. Subsequently, control is transferred to the decrypted payload, enabling the launch of the miner DLL in memory after it is extracted by the payload DLL.
Minas is a miner that uses a common implementation and tries to go undetected. The use of hijacking and injection techniques, random name generation, and encryption all contribute to the difficulties of detection. Additionally, it has the capacity to use persistence strategies to remain on the compromised system.
Threat Profile:
References:
The following reports contain further technical details:
https://securelist.com/minas-miner-on-the-way-to-complexity/109692/
[/emaillocker]