WannaMine worm: analysis and intervention

Analysis of the sample enabled our analysts to obtain information on the Worm’s compromise and propagation methods as well as the Monero Wallet address associated with this criminal group: 46gVfDm99aq9JqESFxXFp5AyFCZPHsbTn48dWAtVASddf4TmhQMkxvQadhKPvAjszJV8cQKVHHLQ7WpNrh33ogkGUPHhpVP

---

Some of the Tactics and Techniques associated with WannaMine Worm compromise:

---

The malware, known since 2017, has undergone several modifications and is present in the wild with different variants and functionalities.‎

Article index:

Compromise Chain Analysis

Compromise Initiation

The attack vector used by the Worm is, with high probability, represented by Drive-By Compromise activity. Execution of the dropper (a Powershell script, in6.ps1) on the system triggers a long chain of events responsible for malware installation.

The first part of the code is used to bypass the Windows Anti-Malware Scan Interface (AMSI).

Within the dropper is a list of server URLs used for malware download during Lateral Movement activities:‎

The remaining code contains instructions for cryptominer installation on the system:

Persistence

The malware establishes persistence through the registration of Windows Management Instrumentation (WMI) events. WMI can be used to execute code when a specific event occurs.

For example, it is possible to trigger a command at a certain time of day, at user logon, or after a certain period of system inactivity. In this way, an event can be registered and arbitrary code executed when that event occurs, providing a perfect persistence mechanism.

• SCM Event8 Log Consumer executes approximately every 4 hours to resume the infection process in case the process previously failed;
• SCM Event8 Log Consumer2 executes 4/5 minutes after system startup.

Lateral Movement

Lateral movement is executed through the funs, mimi, and sc artefacts extracted from the $fa variable.

Funs is a PowerShell file containing all the functions necessary to infect other systems on the network.
Much of the funs code originates from the Empire framework.
Through Get-creds, it uses the mimi artefact, containing Mimikatz code, to extract usernames and passwords from the system. Subsequently, it uses test-net, to which an array with Class B and C IPs identified on the network is passed.

This function initiates propagation activity across internal corporate networks, a pattern we observed through Managed Detection and Response telemetry showing WMI-based lateral movement across multiple subnets:

‎The script contains a series of propagation mechanisms (in order of execution):

1. Remote execution with WMI
2. Remote execution with Samba
3. Exploitation of the EternalBlue vulnerability, in which it uses the sc artefact as shellcode.

Cryptocurrency mining

To execute Monero mining activity, the malware uses two artefacts: mon and mue.

First method – MON

‎As a first attempt, the worm executes the mon artefact in fileless mode; the code is embedded in the systemcore_Updater8 class, which is invoked via PowerShell. ‎

The code is a copy of the open-source miner XMRig.

XMRig software configuration:

• Cryptocurrency: Monero
• Wallet: 46gVfDm99aq9JqESFxXFp5AyFCZPHsbTn48dWAtVASddf4TmhQMkxvQadhKPvAjszJV8cQKVHHLQ7WpNrh33ogkGUPHhpVP
• Pool addresses:
  • xmr-eu1.nanopool.org:14444
  • xmr-asia1.nanopool.org:14444
  • xmr-eu2.nanopool.org:14444
  • xmr-us-east1.nanopool.org:14444
  • xmr-us-west1.nanopool.org:14444
  • pool.minexmr.com:80
  • sg.minexmr.com:80
  • ca.minexmr.com:80

The artifact ring is then installed on the system under the name WinRing0x64.sys.
This is a Microsoft driver used by mon to optimise the RandomX Monero mining algorithm.
The driver, although legitimate, contains several vulnerabilities that if exploited would allow an attacker to obtain SYSTEM privileges.

Second method – MUE

‎If the first execution does not succeed, WannaMine executes a different artifact, placing the file on disk via WMI, naming it mue.exe (system path C:\Windows\system32). ‎
The executable is an obsolete version of XMRig that does not leverage the WinRing0x64.sys driver.