Thursday, March 28, 2024

Hackers Using RIG Exploit Kit to Compromise Windows PC for Mining Crypto-Currency

A RIG Exploit Kit (EK) propagating sophisticated code injection techniques to mine Monero cryptocurrency from infected Windows PC.

Rig Exploit Kit is one of the powerful exploit kits that actively using in dark web and delivered various payload for many malware and ransomware families such as  GandCrab ransomware and Panda Banker.

Code injection Technique is used to inject malicious code into an application. The code introduced or injected is capable of compromising database integrity and/or compromising privacy website, security and even data correctness.

Attack chain initially started from the compromised website when users visit it which will then redirect them to RIG EK landing page.

Later RIG delivered the malicious loader NSIS (Nullsoft Scriptable Install System) to leverage the code injection technique and inject shellcode into explorer.exe.

Later infected shell code leverage the next level payload and the payload will download the Monero miner and execute it.

RIG Exploit Kit Injection analysis

Intially user visit the compromised page that contains an iframes which leads into the landing page of the RIG and it contains 3 javascript loader each contains differnet technique to deliver the paylaod.

  • Javascript 1 contains a function called “fa” which returns the VBscript that exploits  CVE-2016-0189 which allows it to download the payload.
  • Javascript 2 contains aditional javascript code to download the another exploit CVE-2015-2419  which utilizes a vulnerability in JSON.stringify.
  • Third Javascript similar to the second one and it adds a flash object that exploits CVE-2018-4878.

According to FireEye Analysis, Once all the exploitation will successfully completed  the shellcode invokes a command line to create a JavaScript file which will then download the next level of Paylaod with the filename called u32.tmp.

Apart from the code infection technique, Attackers using maltiple varaity of payload to evade the detection using anti analysis and anti VM techniques.

3 Stages of Payloads

First Stage of execution contain the SmokeLoader payload that contains two components: a DLL, and a data filewhich is dropped by the RIG EK which helps to read and decrypt the data file and redirect into the second level of Payload.

When we compare to the first level of payload, the second level is higly obfucticated and it perfrom the propagation of the code injection and inject the shellcode and PE in to legitimate windows process.

Third stage of the payload will check and confirm to make sure no analysis tool is runnig within the victms computer and the malware then communicates with the malicious URL to download the final payload.

The Final payload is the Monero Miner which is downloaded from the server and installed into the windows system to mine the Monero cryptocurrency.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles