CoinMiner Malware Continues to Spread via USB Drives

SUMMARY

CoinMiner malware continues to propagate through USB drives in South Korea, leveraging a hidden shortcut that triggers VBS and BAT scripts, which in turn stage multiple components that ultimately deliver a cryptocurrency-mining payload.

Investigation

The report outlines the directory structure on the infected USB, the execution chain from the shortcut through multiple dropper stages, registration under the DcomLaunch service, and deployment of PrintMiner and XMRig cryptocurrency miners.

Mitigation

Users should keep OS and software patched, block execution of untrusted shortcut files, use up-to-date antivirus tools, and deny access to known malicious infrastructure.

Response

Detect the malicious shortcut and its related scripts, monitor for creation of dropper files and DCOM registrations, and block network traffic to the identified mining command-and-control domains and IP address.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  1. Stage 1 – Drop a malicious DLL: The adversary copies a crafted printui.dll to the same directory as printui.exe (simulating a driver payload delivered via a USB device).
  2. Stage 2 – Execute printui.exe: By invoking printui.exe with the /ml switch (malicious load), the malicious DLL is loaded, generating a process‑creation event that matches the rule’s selection (Image endswith \printui.exe) while also satisfying the filter condition (Image contains printui.dll). The rule excludes this case, so the attacker adds a second step to bypass it.
  3. Stage 3 – Execute svcinsty64.exe: The attacker registers a new service pointing to a payload binary (payload.exe) stored on the USB drive. This action creates a process‑creation event for svcinsty64.exe, satisfying the rule’s selection without triggering the filter, thus generating an alert.

• Regression Test Script: The script below automates the three stages, ensuring reproducibility.

  # -------------------------------------------------
  # Regression Test – Trigger Sigma rule for printui.exe / svcinsty64.exe
  # -------------------------------------------------
  $dllPath = "$env:TEMP\printui.dll"
  $exePath = "$env:SystemRoot\System32\printui.exe"
  $svcInstPath = "$env:SystemRoot\System32\svcinsty64.exe"
  $payloadPath = "$env:TEMP\payload.exe"
  
  # 1️⃣ Drop a dummy malicious DLL (binary content not important for detection)
  Write-Host "[*] Creating dummy malicious DLL at $dllPath"
  Set-Content -Path $dllPath -Value ([byte[]](0..255)) -Encoding Byte
  
  # 2️⃣ Execute printui.exe (benign load) – should NOT fire due to filter
  Write-Host "[*] Running benign printui.exe (will be filtered out)"
  Start-Process -FilePath $exePath -ArgumentList "/p" -Wait
  
  # 3️⃣ Execute printui.exe with malicious DLL loading – filtered out (expected)
  Write-Host "[*] Running printui.exe with malicious DLL (filtered case)"
  Start-Process -FilePath $exePath -ArgumentList "/ml `$dllPath`" -Wait
  
  # 4️⃣ Prepare a dummy payload executable (simple CMD script compiled to exe)
  Write-Host "[*] Creating dummy payload executable"
  $payloadSource = @"
  @echo off
  echo Payload executed > $env:TEMP\payload_output.txt
  "@
  $payloadScript = "$env:TEMP\payload.bat"
  $payloadSource | Set-Content -Path $payloadScript -Encoding ASCII
  # Convert .bat to .exe using iexpress (built‑in)
  $iexpress = "$env:SystemRoot\System32\iexpress.exe"
  $config = "$env:TEMP\iexpress.sed"
  @"
  [Version]
  Version=3.0
  [Options]
  ExtractTitle=Payload
  ExtractLocation=%TEMP%
  ShowProgress=0
  HideExtractWindow=1
  [SourceFiles]
  SourceFiles=0
  %TEMP%\payload.bat
  [Run]
  RunCommand="%TEMP%\payload.bat"
  "@ | Set-Content -Path $config -Encoding ASCII
  & $iexpress /N /Q /M $config
  Move-Item -Path "$env:TEMP\Payload.exe" -Destination $payloadPath -Force
  
  # 5️⃣ Register a malicious service using svcinsty64.exe – SHOULD FIRE
  Write-Host "[*] Registering malicious service via svcinsty64.exe"
  $svcName = "MaliciousSvc"
  $svcDisplay = "Malicious Service"
  $svcCmd = "`"$payloadPath`""
  $svcArgs = "/install `$svcName` `$svcDisplay` `$svcCmd`"
  Start-Process -FilePath $svcInstPath -ArgumentList $svcArgs -Wait
  
  # 6️⃣ Clean up service
  Write-Host "[*] Removing malicious service"
  $removeArgs = "/uninstall `$svcName`"
  Start-Process -FilePath $svcInstPath -ArgumentList $removeArgs -Wait
  
  # 7️⃣ Remove temporary artifacts
  Write-Host "[*] Cleaning temporary files"
  Remove-Item -Path $dllPath -Force -ErrorAction SilentlyContinue
  Remove-Item -Path $payloadPath -Force -ErrorAction SilentlyContinue
  Remove-Item -Path $payloadScript -Force -ErrorAction SilentlyContinue
  Write-Host "[+] Test completed"

• Cleanup Commands: (If the above script fails or you prefer manual cleanup)

  # Remove the malicious service if still present
  $svcName = "MaliciousSvc"
  $svcInstPath = "$env:SystemRoot\System32\svcinsty64.exe"
  & $svcInstPath /uninstall $svcName
  
  # Delete temporary DLL and payload
  Remove-Item -Path "$env:TEMP\printui.dll" -Force -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMP\payload.exe" -Force -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMP\payload.bat" -Force -ErrorAction SilentlyContinue
  
  # (Optional) Verify no leftover services
  Get-Service -Name $svcName -ErrorAction SilentlyContinue