This presentation was created based on a sample we found. At first sight this looked to be a standard fileless cryptocurrency mining malware, however, when looking a bit further, we noted that this malware had some other tricks up its sleeve. This presentation starts with an introduction into how fileless malware works and how to detect it, a short introduction into cryptocurrency mining and of course the analysis of the sample itself.

1. Michel Coene
Tearing apart a fileless
malware sample
SANS@Night

2. Tearing apart a fileless malware sample
About us
2
Michel Coene
DFIR and Threat hunting @ NVISO
SANS Instructor development program
@coenemichel

3. Tearing apart a fileless malware sample
What will we talk about today
3
Introduction
Fileless malware
Cryptocurrency mining malware
Tearing apart a sample!

4. Tearing apart a fileless malware sample
What will we talk about today
4
Introduction
Fileless malware
Cryptocurrency mining malware
Tearing apart a sample!

5. Tearing apart a fileless malware sample
The cyber kill chain
5
Reconnaissance Delivery Installation
Action on
Objectives
Weaponization Exploitation
Command &
Control

6. Tearing apart a fileless malware sample
What will we talk about today
6
Introduction
Fileless malware
Cryptocurrency mining malware
Tearing apart a sample!

7. Tearing apart a fileless malware sample
What is fileless malware
7
Fileless malware is malicious computer code that exclusively exists in
memory and does not write any part of its activity to disk
Persistent Non-persistent

8. Tearing apart a fileless malware sample
Persistent fileless malware
• Fileless malware
8
Installation

9. Tearing apart a fileless malware sample
Combining best of both worlds
9
Installation

10. Tearing apart a fileless malware sample
How it works – deep dive
10
New process (exe) or existing process (DLL)
New process Existing process
Win32: CreateProcess Win32: LoadLibrary
AV

11. Tearing apart a fileless malware sample
How it works – deep dive
How does fileless malware work
• Inject code
11
Process
(ex. Explorer.exe)
Win32: CreateProcess
Custom loader
Malicious
code

12. Tearing apart a fileless malware sample
How it works – deep dive – Fileless code
12
• The code for fileless malware can take several forms:
• Shellcode
• VirtualAlloc
• WriteProcessMemory
• CreateThread/CreateRemoteThread
• DLL
• Custom loader
• Reflective loader
• …
• Advantage of coding a DLL
• Many powerful development tools (Visual Studio)
• Reusing code

13. Tearing apart a fileless malware sample
How it works – deep dive - PowerShell
13
• PowerShell is a very powerful programming language
• Win32 API
• .NET Framework
• ActiveX
• …
• Facilitates administration of Windows (legitimate application)
• So versatile and powerful that it is often used as loader and host for
fileless malware
• powershell –Command …
• Powershell –EncodedCommand …

14. Tearing apart a fileless malware sample
How it works – deep dive - PowerShell
14
Library .NET code

15. Tearing apart a fileless malware sample
How it works – deep dive - PowerShell
15
Encoded Command
Library .NET code

16. Tearing apart a fileless malware sample
How to detect?
16
No files you say?

17. Tearing apart a fileless malware sample
How to detect?
17

18. Tearing apart a fileless malware sample
How to detect?
18
HKLMSoftwareMicrosoftWindowsCurrentVersionRun
HKCU SoftwareMicrosoftWindowsCurrentVersionRun
HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun

19. Tearing apart a fileless malware sample
How to detect?
19

20. Tearing apart a fileless malware sample
How to detect?
20

21. Tearing apart a fileless malware sample
How to detect?
21
Hunt for suspicious registry run
keys and scheduled tasks
Behavior based detection
Look for known IOCs:
- C2 traffic
- Specific registry keys
- Specific scheduled tasks
Prevent known malicious items from
entering your environment

22. Tearing apart a fileless malware sample
What will we talk about today
22
Introduction
Fileless malware
Cryptocurrency mining malware
Tearing apart a sample!

23. Tearing apart a fileless malware sample
Cryptocurrency mining malware - What is it? What does it do?
23
Action on
Objectives

24. Tearing apart a fileless malware sample
In browser mining
24
Delivery
Source: blog.malwarebytes.com

25. Tearing apart a fileless malware sample
Evolution from ransomware to cryptocurrency mining malware
25
• Ransomware attacks are becoming
harder to execute
• Microsoft adding Controlled folder access feature to
Windows Defender Security for Windows 10 users
to prevent malicious (or unexpected) alteration of
important files.
• Everyone advises against paying
• Easily detected
• Countries and regions available that
cannot pay the ransom
• Cryptocurrency mining often flies
under the radar
Source: blog.fortinet.com

26. Tearing apart a fileless malware sample
Implications for companies
26
• Power
• Cost
• Might harm production environment
(CPU, stability, might kill processes, etc)

27. Tearing apart a fileless malware sample
What will we talk about today
27
Introduction
Fileless malware
Cryptocurrency mining malware
Tearing apart a sample!

28. Tearing apart a fileless malware sample
Detecting malware
• AV detection for files originally based on signatures (sequence
of bytes / heuristics)
• On disk, Windows has provided filters for the file system (intercept all
bytes accessed from disk)
• A similar mechanism does not exist for memory
•  AV detection bypass
• Next option to detect fileless malware: observe behavior
• Is this program encrypting files? Strange, this could be ransomware …
• Is this program mining crypto currency? OK, this could be benign …
• Not all AVs have (advanced) behavior analysis engines
Process
AV

29. Tearing apart a fileless malware sample
Our sample
• How did we know there was malware about?
• No AV alerts
• Observed TCP connections to a Monero mining pool
• Observed a PowerShell process consuming a lot of CPU
• How did we sample the malware?
• Specialized task managers like Process Explorer can inspect
the command line of processes
• powershell -EncodedCommand QQBkAGQALQBUAHk…
• … and show the parent process
• task scheduler
• The BASE64-decoded PowerShell script accessed a value in the registry
• {95EF38A4-95F9-55C1-55302E9FD8427349}=AAAId0wBAAOWAAADKWBNWpAA…
• Create mem dump of process & carve executables

30. Tearing apart a fileless malware sample
The loader
Registry
32-bit/64-bit
BASE64

31. Tearing apart a fileless malware sample
The loader
Win32 API
Win32 API

32. Tearing apart a fileless malware sample
The “package”
Embedded PE
file

33. Tearing apart a fileless malware sample
The “package”
The “package” is
known to
VirusTotal, and
triggers AV

34. Tearing apart a fileless malware sample
The “package”
“Trojan injector cvt”
does not yield
valuable information

35. Tearing apart a fileless malware sample
The “package”
The carved DLL has
been analyzed
before, without
success

36. Tearing apart a fileless malware sample
Dynamic analysis
• No useful info online: We had to analyze the sample ourselves
• Create a .ps1 file combining the loader and the “package”
• Focus dynamic analysis
• Submit it to sandboxes
• Run it on physical machine

37. Tearing apart a fileless malware sample
Mining activity
• Tearing apart a sample

38. Tearing apart a fileless malware sample
Mining activity
On 22/02/2018:
- 1 XMR = 255 EUR
- 600 XMR = 153 156 EUR
On 17/04/2018
- 1 XMR = 161 EUR
- 663 XMR = 106 743EUR

39. Tearing apart a fileless malware sample
Mining activity
Time in UTC

40. Tearing apart a fileless malware sample
Mining activity
• Tearing apart a sample

41. Tearing apart a fileless malware sample
Worm activity
Scanning port 445?
An EternalBlue worm?

42. Tearing apart a fileless malware sample
Worm activity
EternalBlue/Shellcode
Gitlab
“Package”
1) Persistence on Windows XP: file based
2) Persistence on > Windows XP: fileless
SMB1 = 0
Immunize!

43. Tearing apart a fileless malware sample
Worm activity
Active since
August 2017
A history of
versions

44. Tearing apart a fileless malware sample
Info stealing activity
Why is it accessing
these files?
Why is it
connecting
to Tor?

45. Tearing apart a fileless malware sample
Info stealing activity
FileZilla
storing
credentials

46. Tearing apart a fileless malware sample
Info stealing activity
FileZilla
credentials file
read into
memory
FileZilla credentials
decoded

47. Tearing apart a fileless malware sample
Concluding
51
Miner Worm
Info stealer

48. Q&A
@coenemichel
53