Rewterz Threat Alert – LemonDuck Crypto-Miner New Variant

Severity

High

Analysis Summary

A previous cryptojacker campaign, Kingminer, landed on victims via brute-forced SQL server accounts and performed its actions with Defense Evasion in mind. The way Kingminer infects victim machines opened up new horizons for attackers aiming to take control of enterprise computers. LemonDuck (which got the name from the unique User-Agent used to send HTTP requests) draws inspiration from Kingminer for lateral movement, but, at the same time, it employs new techniques to infect even more systems than Kingminer did. Since its first appearance in October 2019, the malware extended its capabilities with a new persistence mechanism through WMI and new lateral movement strategies. LemonDuck has previously been known for targeting cloud Apps and Linux.

An infection can start on a system in multiple ways: 

• phishing e-mail – sent from an already infected machine 
• EternalBlue or other SMB exploits 
• RDP brute-forcing – if there are weak accounts on the system 
• A .lnk file from a removable drive or a network drive 
• SSH brute-forcing – if there are weak accounts on the system 
• Pass-the-hash – if the attackers manage to dump a valid NTLM password hash 
• MS-SQL brute-forcing – similar to Kingminer, if there are weak DB credentials 
• Redis remote command 
• Yarn remote command

Impact

• Unauthorized Access
• Credential Theft
• Device Takeover
• Detection Evasion

Indicators of Compromise

Hostname

• t[.]amynx[.]com
• t[.]zer9g[.]com
• t[.]zz3r0[.]com
• www[.]pingcastle[.]com
• d[.]ackng[.]com

MD5

• 23d59ed726e13edabcb751da7a5ce310
• 614257993fd996b4cea3a0fdffa4feac
• ce510f7de1c4312aa0d74d0f1804c151
• 5b2849ff2e8c335dcc60fd2155b2d4d3
• ef3a4697773f84850fe1a086db8edfe0

SHA-256

• 8bd665c7f0522b1cd4ad61c5424f7acfb64cf0a5fb1313ad7da303d604019052
• 5e47d3058962bf781895ba7c761d4e462c5f366a9b50d21969bbbfa9bd434897
• b2faa3a2f01b5aa58db9d59e2d7de3e170cef7a832df114f631abb00304bc298
• 2a788f1f0dfb1d52f5155f60d57a55f54b39475f06eea9e9e13d00d3191c364c
• d7d0f18071899c81ee90a7f8b266bd2cf22e988da7d0e991213f5fb4c8864e77

SHA1

• c1384205da4a8b76aec5db733700b3159531a77d
• ac890783ed388aa55ed70d560e4904f47dd4e4c1
• 2d0a23e49f3f5e33ca85d58117f7c6190417628d
• 0af7a28d9e5a9435db125d7e46e7e20825643ca4
• 6a4c477ba19a7bb888540d02acdd9be0d5d3fd02

Source IP

• 161[.]35[.]107[.]193
• 139[.]162[.]80[.]221
• 167[.]99[.]154[.]202
• 128[.]199[.]183[.]160
• 167[.]71[.]87[.]85
• 66[.]42[.]43[.]37

URL

• http[:]//167[.]71[.]87[.]85/20[.]dat?$params
• http[:]//d[.]ackng[.]com
• http[:]//t[.]amynx[.]com/ipc[.]jsp?0[.]8?Ion
• http[:]//t[.]zz3r0[.]com
• http[:]//167[.]71[.]87[.]85/20[.]
• http[:]//t[.]amynx[.]com
• http[:]//t[.]zer9g[.]com

Remediation

• Block the threat indicators at their respective controls.
• Do not download email attachments without prior confirmation from the sender.
• To thwart brute force attacks, enable account lockout policies by limiting the number of failed login attempts per user.
• Apply security measures to both the clients and the servers involved in the RDP communication.
• Implement a strong password policy.
• Keep all systems and software updated to latest patched versions.