{"id":2806,"date":"2021-07-12T09:02:00","date_gmt":"2021-07-12T07:02:00","guid":{"rendered":"https:\/\/fortgale.com\/news\/?p=2806"},"modified":"2026-06-08T22:17:43","modified_gmt":"2026-06-08T22:17:43","slug":"wannamine-worm-analysis-intervention","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/emerging-threats\/wannamine-worm-analysis-intervention\/","title":{"rendered":"WannaMine worm: analysis and intervention"},"content":{"rendered":"\n\n\n
\"\"<\/figure>
\n

Our team recently detected, analysed and managed a compromise attempt by WannaMine<\/strong> malware.<\/p>\n\n\n\n

WannaMine is a Worm<\/strong>-type malware (known since 2017) whose purpose is to propagate within corporate networks and perform cryptocurrency mining (Monero)<\/strong> on all compromised systems.<\/p>\n

Its propagation capabilities via valid credentials<\/strong> (Mimikatz and Empire modules) and exploitation of SMB<\/strong> protocol vulnerabilities (EternalBlue<\/strong> CVE-2017-0144<\/a>) render Incident Response<\/strong> activities more complex. Furthermore, the almost entirely fileless<\/em> structure of the malware enables it to bypass classic Endpoint protections.<\/p>\n<\/div><\/div>\n\n\n\n

Analysis of the sample enabled our analysts to obtain information on the Worm’s compromise and propagation methods as well as the Monero Wallet<\/strong> address associated with this criminal group: 46gVfDm99aq9JqESFxXFp5AyFCZPHsbTn48dWAtVASddf4TmhQMkxvQadhKPvAjszJV8cQKVHHLQ7WpNrh33ogkGUPHhpVP<\/p>\n\n\n\n

\n\n\n\n

Some of the Tactics<\/strong> and Techniques<\/strong> associated with WannaMine Worm compromise:<\/p>\n\n\n\n

\n\n\n\n\n\n\n\n\n\n
Tattica<\/strong><\/span><\/td>\nID Tecnica<\/strong><\/span><\/td>\nNome Tecnica<\/strong><\/span><\/td>\n<\/tr>\n
Initial Access<\/strong><\/td>\nT1189<\/span><\/td>\nDrive-by Compromise<\/td>\n<\/tr>\n
T1566.001<\/span><\/td>\nSpearphishing Attachments<\/td>\n<\/tr>\n
Persistence<\/strong><\/td>\n T1546.003<\/span><\/td>\nWindows Management Instrumentation Event Subscription<\/td>\n<\/tr>\n
Credential Access<\/strong><\/td>\nT1003.001<\/span><\/td>\nOS Credential Dumping<\/td>\n<\/tr>\n
Lateral Movement<\/strong><\/td>\nT1210<\/span><\/td>\nExploitation of Remote Services<\/td>\n<\/tr>\n
T1021.002<\/span><\/td>\nRemote Services<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div><\/div>\n\n\n\n
\n\n\n\n

The malware, known since 2017, has undergone several modifications and is present in the wild with different variants and functionalities.\u200e<\/span><\/p>\n

Article index:<\/strong><\/p>\n\n\n\n

Compromise Chain Analysis<\/h2>\n\n\n\n

Compromise Initiation<\/h3>\n\n\n\n

The attack vector used by the Worm is, with high probability, represented by Drive-By Compromise<\/strong> activity. Execution of the dropper<\/strong> (a Powershell script, in6.ps1<\/strong>) on the system triggers a long chain of events responsible for malware installation.<\/p>\n\n\n\n

The first part of the code is used to bypass the Windows Anti-Malware Scan Interface<\/em> (AMSI<\/strong>).<\/p>\n\n\n\n

\"\"
AMSI Bypass<\/figcaption><\/figure><\/div>\n\n\n\n

Within the dropper is a list of server URLs used for malware download during Lateral Movement<\/strong><\/em> activities:\u200e<\/p>\n\n\n\n

\"\"
Dropper address list<\/figcaption><\/figure><\/div>\n\n\n\n

The remaining code contains instructions for cryptominer installation on the system:<\/p>\n\n\n\n

\"\"
Code to extract artefacts from the $fa variable<\/figcaption><\/figure><\/div>\n\n\n\n

Persistence<\/h3>\n\n\n\n

The malware establishes persistence through the registration of Windows Management Instrumentation<\/strong> (WMI<\/strong>) events. WMI can be used to execute code when a specific event occurs.<\/p>\n

For example, it is possible to trigger a command at a certain time of day, at user logon, or after a certain period of system inactivity. In this way, an event can be registered and arbitrary code executed when that event occurs, providing a perfect persistence mechanism.<\/p>\n\n\n\n

\"\"
Persistence<\/figcaption><\/figure><\/div>\n\n\n\n