• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – MontysThree; Industrial Espionage with Steganography
October 9, 2020
Rewterz Threat Alert – Latest Trickbot IOCs
October 12, 2020

Rewterz Threat Alert – LemonDuck Crypto-Miner New Variant

October 9, 2020

Severity

High

Analysis Summary

A previous cryptojacker campaign, Kingminer, landed on victims via brute-forced SQL server accounts and performed its actions with Defense Evasion in mind. The way Kingminer infects victim machines opened up new horizons for attackers aiming to take control of enterprise computers. LemonDuck (which got the name from the unique User-Agent used to send HTTP requests) draws inspiration from Kingminer for lateral movement, but, at the same time, it employs new techniques to infect even more systems than Kingminer did. Since its first appearance in October 2019, the malware extended its capabilities with a new persistence mechanism through WMI and new lateral movement strategies. LemonDuck has previously been known for targeting cloud Apps and Linux.

An infection can start on a system in multiple ways: 

  • phishing e-mail – sent from an already infected machine 
  • EternalBlue or other SMB exploits 
  • RDP brute-forcing – if there are weak accounts on the system 
  • A .lnk file from a removable drive or a network drive 
  • SSH brute-forcing – if there are weak accounts on the system 
  • Pass-the-hash – if the attackers manage to dump a valid NTLM password hash 
  • MS-SQL brute-forcing – similar to Kingminer, if there are weak DB credentials 
  • Redis remote command 
  • Yarn remote command

Impact

  • Unauthorized Access
  • Credential Theft
  • Device Takeover
  • Detection Evasion

Indicators of Compromise

Hostname

  • t[.]amynx[.]com
  • t[.]zer9g[.]com
  • t[.]zz3r0[.]com
  • www[.]pingcastle[.]com
  • d[.]ackng[.]com

MD5

  • 23d59ed726e13edabcb751da7a5ce310
  • 614257993fd996b4cea3a0fdffa4feac
  • ce510f7de1c4312aa0d74d0f1804c151
  • 5b2849ff2e8c335dcc60fd2155b2d4d3
  • ef3a4697773f84850fe1a086db8edfe0

SHA-256

  • 8bd665c7f0522b1cd4ad61c5424f7acfb64cf0a5fb1313ad7da303d604019052
  • 5e47d3058962bf781895ba7c761d4e462c5f366a9b50d21969bbbfa9bd434897
  • b2faa3a2f01b5aa58db9d59e2d7de3e170cef7a832df114f631abb00304bc298
  • 2a788f1f0dfb1d52f5155f60d57a55f54b39475f06eea9e9e13d00d3191c364c
  • d7d0f18071899c81ee90a7f8b266bd2cf22e988da7d0e991213f5fb4c8864e77

SHA1

  • c1384205da4a8b76aec5db733700b3159531a77d
  • ac890783ed388aa55ed70d560e4904f47dd4e4c1
  • 2d0a23e49f3f5e33ca85d58117f7c6190417628d
  • 0af7a28d9e5a9435db125d7e46e7e20825643ca4
  • 6a4c477ba19a7bb888540d02acdd9be0d5d3fd02

Source IP

  • 161[.]35[.]107[.]193
  • 139[.]162[.]80[.]221
  • 167[.]99[.]154[.]202
  • 128[.]199[.]183[.]160
  • 167[.]71[.]87[.]85
  • 66[.]42[.]43[.]37

URL

  • http[:]//167[.]71[.]87[.]85/20[.]dat?$params
  • http[:]//d[.]ackng[.]com
  • http[:]//t[.]amynx[.]com/ipc[.]jsp?0[.]8?Ion
  • http[:]//t[.]zz3r0[.]com
  • http[:]//167[.]71[.]87[.]85/20[.]
  • http[:]//t[.]amynx[.]com
  • http[:]//t[.]zer9g[.]com

Remediation

  • Block the threat indicators at their respective controls.
  • Do not download email attachments without prior confirmation from the sender.
  • To thwart brute force attacks, enable account lockout policies by limiting the number of failed login attempts per user.
  • Apply security measures to both the clients and the servers involved in the RDP communication.
  • Implement a strong password policy.
  • Keep all systems and software updated to latest patched versions.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.