33 C
Jaipur
Monday, October 26, 2020

Hackers Use Process Hollowing Technique to Deploy Monero Miner

Must read

Hyundai i20 2020 First Look Unveiled; Now Sportier Than Ever

Hyundai Motor India has officially unveiled the first design renders for the upcoming i20. The new Hyundai i20 is set to launch next month...

Spotify Now Lets You Login with Your Google Account

Spotify has long offered the ability to login with Facebook and recently gained the capability to sign in with Apple ID on Apple devices....

Call Of Duty Mobile To Get A Mode With Zombies, But It Isn’t Zombies Mode

Call of Duty Mobile recently released the much-awaited Season 11 update with a lot of amazing content. However, unfortunately, Call of Duty Mobile didn’t...

Researchers observed a new crypto-mining malware campaign that uses a process hollowing method and a dropper component to deploy Monero miner on windows installations.

Process hollowing is a method to hide the presence of the process by replacing it with a secondary process. and the dropper file acts as a container. Malicious activity can be triggered only by supplying correct arguments.

The dropper file is not malicious, it needs a specific set command argument to trigger the malicious activity, this allows attackers to evade detection.

Monero Miner Infection

Trend Micro observed a sharp increase in malicious activity starting from November, the campaign primarily targets Kuwait, Thailand, India, Bangladesh, the United Arab Emirates, Brazil, and Pakistan.

“The dropper is a 64-bit binary packed with malicious code, upon execution it checks for certain arguments passed to it and verify it upon unpacking.”

The malware infection goes through two stages, the first stage performs an arithmetic operation on alphanumeric strings, researchers examined the alphanumeric string and it includes information including cryptocurrency wallet address which is the required argument to trigger the malicious activity.

Once the dropper executed with correct arguments it drops and executes the wakecobs[.]exe process in the suspended state and the dropper replaces the process memory malicious code which allows XMRig miner to run on the background.

The XMRig abuses the computer’s resources to mine Monero blocks, it causes the computer to overheat and to perform poorly.

Monero is the primary choice of crypto-mining malware operations because of it’s attractive features like untraceable transactions and proof-of-work algorithm CryptoNight which is suitable for normal PC CPUs without requiring any special devices.

Indicators of Compromise (IoCs)

SHA256

dd775ba66d6921035cc0cda61a6abff8f118a04a31eea082523157b48add4821
04b495ee51e370fc93f431553bfdb592f678543c432137016d9ba4c64901a92a

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates

Source link

- Advertisement -

More articles

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest article

Hyundai i20 2020 First Look Unveiled; Now Sportier Than Ever

Hyundai Motor India has officially unveiled the first design renders for the upcoming i20. The new Hyundai i20 is set to launch next month...

Spotify Now Lets You Login with Your Google Account

Spotify has long offered the ability to login with Facebook and recently gained the capability to sign in with Apple ID on Apple devices....

Call Of Duty Mobile To Get A Mode With Zombies, But It Isn’t Zombies Mode

Call of Duty Mobile recently released the much-awaited Season 11 update with a lot of amazing content. However, unfortunately, Call of Duty Mobile didn’t...

Airtel Xstream App Is Now Available on Amazon Fire TV Stick: Report

Airtel Xstream came into existence more than a year ago. It was the company’s major play towards content aggregation, offering you a variety of...