The Anonymous Parasite:

Background

Required Exposition

To completely understand the malware and why it originated, it is important to understand cryptocurrency mining and blockchain concepts and how they work. I hope to brush these topics for any reader with a lack of understanding or knowledge, just like when I started.

Blockchain is a revolutionized trusted peer-to-peer data interaction system to access, verify, and transact between systems. It is a solution for decentralizing trust and enabling direct access to data, and is in most cases referred to as being invented to power cryptocurrency.

Blockchain technology uses a decentralized network of computers to hold the ledger method of information, possibly eliminating the ability to tamper with data placed by each individual in the form of chronological blocks that cannot be rewritten. For someone to place a block of information, a cryptographic puzzle must be solved by a computer and then shared with all computers on the network as a proof-of-work. This is then verified by each computer on the network, only after which it is added as the next block to the chain, which together establishes trust among each block on the chain.

Origin

The Reason for Existence

The origin of Adylkuzz points straight to the complexity of solving the math problem, in other words, cryptocurrency mining, which needs an exponential amount of computational resources and proved to be non-profitable for an individual to invest in. Hence an individual or a group of prominent hackers came up with a generation of malware, referred to as a more lucrative cousin to WannaCry, built from the tools developed by the NSA.

The logic is simple: if you cannot afford the computing power to mine profitably on your own, you steal it from thousands of others without their knowledge. Adylkuzz does exactly that.

The Currency

Discovery: Why Monero?

Monero is an open-source cryptocurrency that enhances anonymity capabilities with similar functions to Bitcoin technology. As the number of users keeps increasing, the feasibility of solving the math problem, proof-of-work, for mining Bitcoin falls, resulting in almost no-profit outcomes for new miners. Due to the reputation and popularity of Bitcoin, Bitcoin blockchain data mining has emerged, through which organizations responsible for it can de-anonymize Bitcoin transactions.

To overcome these problems, Monero was developed with additional features, including ring signatures and stealth addresses, which make it a private, more secure, and untraceable currency, keeping its transactions anonymous. This is likely the reason hackers accepted payment in Monero from the WannaCry ransomware attack. It has also been observed that many darknet markets, including AlphaBay, an underground marketplace, adopted Monero, which showed a potential surge in its transaction activity.

For an attacker running a cryptomining botnet, Monero is the obvious choice: untraceable, increasingly valuable, and already normalized on criminal infrastructure.

The Exploit

EternalBlue

EternalBlue was developed by the NSA and intended to be kept secure and secret, used only against national-level threats. That changed when the Shadow Brokers, a group of hackers, infiltrated the NSA and leaked several exploitation tools, EternalBlue among them. The result was one of the biggest ransomware attack campaigns in history: WannaCry, and now Adylkuzz.

EternalBlue works on all Windows versions up to Windows 7, and some Windows 8, Windows 10, and Windows Server versions, taking advantage of multiple vulnerabilities in SMBv1, the Server Message Block protocol. A complete list of vulnerable versions is listed under CVE-2017-0144.

The Protocol

SMB Protocol

SMB is embedded into Windows as a network file-sharing protocol that allows a system to access, request, and share files or services to and from a remote server. It is also known as the Common Internet File System, functioning as an application layer network protocol that serves as a medium to share and provide access to files, printers, ports, and communication between nodes in a network.

The service has 4 widely known vulnerabilities leading to Remote Code Execution and Denial of Service. EternalBlue exploits 3 major vulnerabilities, all leading to a successful Remote Code Execution:

Microsoft initially fixed all the vulnerabilities in systems above Windows 8.1, and later published patches for older versions due to the WannaCry campaign. However, completely overthrowing the vulnerability is impossible due to the large number of legacy systems and non-tech-savvy users still running unpatched versions.

The Backdoor

DoublePulsar

Similar to EternalBlue, DoublePulsar, a backdoor implant, was leaked by the Shadow Brokers when they infiltrated the United States National Security Agency’s Equation Group. It was found that the tool infected more than 250,000 Microsoft Windows computers and is considered much more powerful than Heartbleed.

DoublePulsar is triggered by EternalBlue. It is a multi-architecture kernel-level payload that resides in memory. Because it operates at the kernel level, it gives attackers full control over the system to run any raw shellcode payloads. It uses the SMB ports on the machine to further infect the system by loading other malware. Analysis shows this malware has specific limited tasks it can perform:

As it acts as an intermediate to load malware and further infect the system, there is a way to detect if a system is compromised. Countercept released a Python script to check this. A system infected with DoublePulsar sends a “trans2 SESSION_SETUP” request. The system responds with a different multiplexer ID: 65 (0x41) for a normal system and 81 (0x51) for an infected system. This can later be used to take control of the SMB service and further infect with other malware, launch remote code, or exfiltrate data.

Microsoft has since patched the vulnerabilities, and tools have updated enough to detect DoublePulsar, though this only allowed hackers to install custom backdoors alongside EternalBlue during the active campaign window.

Full Attack Chain

Forensic Study

Malware Analysis

Lab Setup

Collection and Acquisition

Static Analysis

Static Analysis

The malware is packed by VMProtect (v3.00 to 3.1.2) with entropy 7.97, has a GUI interface, and is executable. No information regarding version, libraries, identifiers, or PE header information was obtainable from PEiD or PEStudio, as the application closes as soon as the malware is loaded.

Section Headers of the malware obtained from CFF Explorer.

PEStudio analysis output. Limited static information available due to VMProtect packing.

Not much information was obtained from static analysis due to the packing. Moving to dynamic and behavioral analysis gives a much more complete picture.

Dynamic Analysis

Behavioral Analysis

Multiple incoming connections from a remote source were observed on the victim system’s SMB port 445, which was open and listening.

Incoming connections over SMB port 445 observed during initial execution.

The incoming connections over the SMB port were attempting to deliver DoublePulsar, which was confirmed as Adylkuzz began functioning right after the end of incoming connections. This led to the conclusion that the exploit infects the SMB service to run and install a backdoor, which then pushes the actual payload. Cybereason captured these details, which were used for bibliographic research on the initial part of the attack.

DoublePulsar backdoor delivery observed over SMB. KAFEINE, Adylkuzz Cryptocurrency Mining Malware Spreading for Weeks Via EternalBlue/DoublePulsar (Proofpoint, 2017).

DoublePulsar backdoor used to download Adylkuzz botnet via svchost.exe. KAFEINE, Adylkuzz Cryptocurrency Mining Malware Spreading for Weeks Via EternalBlue/DoublePulsar (Proofpoint, 2017).

Multiple antivirus vendors flagged the IP addresses as malicious, confirming DoublePulsar used svchost.exe to download the Adylkuzz botnet from flagged infrastructure. KAFEINE, Adylkuzz Cryptocurrency Mining Malware Spreading for Weeks Via EternalBlue/DoublePulsar (Proofpoint, 2017).

Full attack chain overview showing EternalBlue to DoublePulsar to Adylkuzz payload delivery. KAFEINE, Adylkuzz Cryptocurrency Mining Malware Spreading for Weeks Via EternalBlue/DoublePulsar (Proofpoint, 2017).

Hands-On Forensics

Adylkuzz Malware Behavioral Analysis

The following study was conducted under the conditions above using the mentioned tools. Wireshark was initialized to capture network traffic. Process Hacker and Process Monitor were initialized with a filter on Operation: Process Create to exactly understand the working of the malware. The malware file was run with administrator privileges, as in a real attack.

Multiple processes flashed on screen immediately after running the malware.

Multiple processes created, captured in Process Monitor immediately after execution.

The malware used the command line to kill certain programs including hdmanager.exe, mmc.exe, and msiexev.exe, stopped and deleted a service called WELM, modified firewall rules, and added filter rules using the netsh command. As stated in the work, the malware blocked SMB port 445 to deny further communication and further exploitation by itself or any other malware.

Malware added firewall filter rules via netsh, blocking SMB port 445 to prevent further exploitation.

A program related to Monero found running, likely the mining application itself.

The malware also installed remote access to wmidap, a program used to update performance counters, likely to hide CPU usage from standard monitoring tools.

Remote access installed via wmidap, likely used to conceal CPU usage from standard monitoring.

Another important observation: when CPU usage was viewed from Process Hacker, it started fluctuating the moment the application was closed, going to 100% and then much lower. However, msiexev.exe was found utilizing almost 100% of the CPU.

CPU usage fluctuates dramatically when Process Hacker is closed. msiexev.exe observed consuming near 100% CPU.

When viewed through Task Manager, the percentage dropped to almost negligible and immediately increased when Task Manager was closed. The malware is actively aware of monitoring tools and adjusts its behavior in real time to avoid detection.

CPU usage drops when Task Manager is open, then immediately spikes when closed. Active evasion of monitoring tools confirmed.

The malware installed an application in the Windows Fonts location that is executed to kill or initiate any process, and is probably the miner itself. This application was observed running immediately after opening Task Manager to kill msiexev.exe.

Application installed by malware in the Windows Fonts directory, likely used to restart or protect the mining process.

RegShot was used to check for changes made to the registry. The result: 24 keys and 193 values added, along with 28 values modified, summing up to 245 changes in the registry. The malware changed firewall rules, installed new applications, initialized the session, changed IPsec policies, and much more.

RegShot output: 24 keys added, 193 values added, 28 values modified. Total 245 registry changes.

Network Forensics

Network Forensics

Wireshark captured multiple HTTP requests immediately after running the malware.

Multiple HTTP requests captured by Wireshark immediately after malware execution.

The first request made was to Broadcom.com, actually establishing a device-to-device connection without passing through the router, followed by a second request: a layer 3 forwarding from the Netgear router in this case.

First request: device-to-device connection to Broadcom.com bypassing the router, followed by Layer 3 forwarding.

The malware then typically announces that it is successfully installed and requests instructions.

Malware announces successful installation to the C2 server and requests further instructions.

The malware then requested a text file containing instructions to run the Monero miner application, then closed the connection. Additional applications were also downloaded, including 64.exe.

Malware downloads a text file containing instructions for the Monero mining application, then downloads additional tools including 64.exe.

Malware also reported the victim’s system configuration and details to a remote server.

Malware exfiltrates victim system configuration to a remote C2 server.

Malware also reported host system details to a remote server, which is quite interesting. It also attempted to get the actual external IP from icanhazip.com.

Malware attempts to retrieve the victim’s actual external IP address via icanhazip.com.

It is also evident that a session is active and running, confirmed by smss.exe running in the victim system.

Indicators of Compromise

Indicators of Compromise

Final Assessment

Conclusion