CoinMiner is another EternalBlue Exploit Vulnerability

Topic

New Reply

Cryptocurrency Miner Infects Windows PCs via EternalBlue and WMI
By Catalin Cimpanu | August 22, 2017

 
A new malware family detected under the name of CoinMiner is causing users and security firms alike loads of problems, being hard to stop or detect due to the combination of various unique features.

The malware — a cryptocurrency miner — uses the EternalBlue NSA exploit to infect victims and the WMI (Windows Management Instrumentation) toolkit as a method to run commands on infected systems.

In addition, CoinMiner also runs in memory (fileless malware), and uses multiple layers of command and control servers to deploy the multitude of scripts and components it needs to infect victims.

All of these make a deadly mixture of features that spell trouble for outdated machines and systems running antivirus solutions not up to par with the latest infection techniques.
…
Users should make sure they have the MS17-010 Microsoft security patch installed, or at least disable the SMBv1 protocol on their systems, so CoinMiner won’t have any way of reaching their computers… Trend Micro, the company that discovered CoinMiner this week, recommends disabling WMI on systems where it’s not needed, or at least restricting WMI access to only one admin account, accessible to IT staff only.

 
Read the full article on bleepingcomputer.com

 
From msdn.microsoft.com:
Starting and Stopping the WMI Service

Stopping Winmgmt Service:
The following procedure describes how to stop the WMI Service.

To stop Winmgmt Service
– At a command prompt, enter net stop winmgmt.
– Other services that are dependent on the WMI service also halt, such as SMS Agent Host or Windows Firewall.

4 users thanked author for this post.

Elly, ch100, Microfix, DrBonzo

Reply | Quote

Replies

I read the article at bleeping computer and it sounds to me that if I’m current on my MS patches and security updates that I’m protected. I’m wondering (and hoping) that you agree.

I don’t really want to disable WMI service because that sounds like it will also disable Windows Firewall.

1 user thanked author for this post.

Microfix

Reply | Quote

That was how I understood it too, @drbonzo
🙂

Reply | Quote

New fileless cryptocurrency miner abuses WMI, leverages EternalBlue Windows exploit
By Bradley Barth | August 22, 2017

 
A newly discovered fileless cryptocurrency miner has been targeting the Asia-Pacific region since July, leveraging the dangerous EternalBlue Windows SMB exploit to drop a backdoor while abusing Microsoft Windows Management Instrumentation as its persistence mechanism.

Microsoft describes WMI as a core Windows technology that can be used to manage both local and remote computers, while offering a consistent way to handle routine tasks using programming or scripting languages. The malware, dubbed TROJ64_COINMINER.QO, uses one particular scripting application, WMI Standard Event Consumer, to execute its scripts. explains Trend Micro in a Monday blog post that describes its researchers’ findings.

Between July and August, Japan has seen the highest share of infections, at 43.05 percent, followed by Indonesia (approximately 21.36 percent), Taiwan (13.67 percent), Thailand (10.07 percent) and India (4.12 percent), Trend Micro reports.

 
Read the full article here

2 users thanked author for this post.

NetDef, Microfix

Reply | Quote

Further to your links Kirsty, another detailed link from Trendlabs Security who discovered it.

It seems to me that as long as MS17-010 is patched from march 2017, the exploit cannot achieve the second phase of initialising WMI scripts.

Disabling WMI / Winmgmt Service! but, the Windows Firewall depends on this service and seems to be a secondary way in for the exploit that can either be dormant (undetectable) if not activated by the unpatched MS17-010 SMBv1 protocol.

A catch 22 situation for windows firewall users or am I missing something?

Keeping IT Lean, Clean and Mean!

2 users thanked author for this post.

Elly, Kirsty

Reply | Quote

Kirsty wrote:

Users should make sure they have the MS17-010 Microsoft security patch installed, or at least disable the SMBv1 protocol on their systems…
Trend Micro, the company that discovered CoinMiner this week, recommends disabling WMI on systems where it’s not needed, or at least restricting WMI access to only one admin account, accessible to IT staff only.

As @Woody said some weeks ago, you really need to have MS17-010 addressed!

Reply | Quote