About Loader Malware
Loader malware was a frequent topic of conversation and investigation within the Darktrace Threat Research team throughout 2023, with a wide range of existing and novel variants affecting a significant number of Darktrace customers, as detailed in Darktrace’s inaugural End of Year Threat Report. The multi-phase nature of such compromises poses a significant threat to organizations due to the need to defend against multiple threats at the same time.
CoinLoader, a variant of loader malware first observed in the wild in 2018 [1], is an example of one of the more prominent variant of loaders observed by Darktrace in 2023, with over 65 customers affected by the malware. Darktrace’s Threat Research team conducted a deep dive investigation into the patterns of behavior exhibited by devices infected with CoinLoader in the latter part of 2023, with compromises observed in Europe, the Middle East and Africa (EMEA), Asia-Pacific (APAC) and the Americas.
The autonomous threat detection capabilities of Darktrace DETECT™ allowed for the effective identification of these CoinLoader infections whilst Darktrace RESPOND™, if active, was able to quickly curtail attacker’s efforts and prevent more disruptive, and potentially costly, secondary compromises from occurring.
What is CoinLoader?
Much like other strains of loader, CoinLoader typically serves as a first stage malware that allows threat actors to gain initial access to a network and establish a foothold in the environment before delivering subsequent malicious payloads, including adware, botnets, trojans or pay-per-install campaigns.
CoinLoader is generally propagated through trojanized popular software or game installation archive files, usually in the rar or zip formats. These files tend can be easily obtained via top results displayed in search engines when searching for such keywords as "crack" or "keygen" in conjunction with the name of the software the user wishes to pirate [1,2,3,4]. By disguising the payload as a legitimate programme, CoinLoader is more likely to be unknowingly downloaded by endpoint users, whilst also bypassing traditional security measures that trust the download.
It also has several additional counter-detection methods including using junk code, variable obfuscation, and encryption for shellcode and URL schemes. It relies on dynamic-link library (DLL) search order hijacking to load malicious DLLs to legitimate executable files. The malware is also capable of performing a variety of checks for anti-virus processes and disabling endpoint protection solutions.
In addition to these counter-detection tactics, CoinLoader is also able to prevent the execution of its malicious DLL files in sandboxed environments without the presence of specific DNS cache records, making it extremely difficult for security teams and researchers to analyze.
In 2020 it was reported that CoinLoader compromises were regularly seen alongside cryptomining activity and even used the alias “CoinMiner” in some cases [2]. Darktrace’s investigations into CoinLoader in 2023 largely confirmed this theory, with around 15% of observed CoinLoader connections being related to cryptomining activity.
Cryptomining malware consumes large amounts of a hijacked (or cryptojacked) device's resources to perform complex mathematical calculations and generate income for the attacker all while quietly working in the background. Cryptojacking can lead to high electricity costs, device slow down, loss of functionality, and in the worst case scenario can be a potential fire hazard.
Darktrace Coverage of CoinLoader
In September 2023, Darktrace observed several cases of CoinLoader that served to exemplify the command-and-control (C2) communication and subsequent cryptocurrency mining activities typically observed during CoinLoader compromises. While the initial infection method in these cases was outside of Darktrace’s purview, it likely occurred via socially engineered phishing emails or, as discussed earlier, trojanized software downloads.
Command-and-Control Activity
CoinLoader compromises observed across the Darktrace customer base were typically identified by encrypted C2 connections over port 433 to rare external endpoints using self-signed certificates containing "OU=IT,O=MyCompany LLC,L=San Francisco,ST=California,C=US" in their issue fields.
All observed CoinLoader C2 servers were associated with the ASN of MivoCloud, a Virtual Private Server (VPS) hosting service (AS39798 MivoCloud SRL). It had been reported that Russian-state sponsored threat actors had previously abused MivoCloud’s infrastructure in order to bypass geo-blocking measures during phishing attacks against western nations [5].
Darktrace observed that the majority of CoinLoader infrastructure utilized IP addresses in the 185.225.0.0/19 range and were associated with servers hosted in Romania, with just one instance of an IP address based in Moldova. The domain names of these servers typically followed the naming pattern ‘*[a-d]{1}[.]info’, with 'ams-updatea[.]info’, ‘ams-updateb[.]info’, ‘ams-updatec[.]info’, and ‘ams-updated[.]info’ routinely identified on affected networks.
Researchers found that CoinLoader typically uses DNS tunnelling in order to covertly exchange information with attacker-controlled infrastructure, including the domains ‘candatamsnsdn[.]info’, ‘mapdatamsnsdn[.]info’, ‘rqmetrixsdn[.]info’ [4].
While Darktrace did not observe these particular domains, it did observer similar DNS lookups to a similar suspicous domain, namely ‘ucmetrixsdn[.]info’, in addition to the aforementioned HTTPS C2 connections.
Cryptomining Activity and Possible Additional Tooling
After establishing communication channels with CoinLoader servers, affected devices were observed carrying out a range of cryptocurrency mining activities. Darktrace detected devices connecting to multiple MivoCloud associated IP addresses using the MinerGate protocol alongside the credential “x”, a MinerGate credential observed by Darktrace in previous cryptojacking compromises, including the Sysrv-hello botnet.
In a number of customer environments, Darktrace observed affected devices connected to endpoints associated with other malware such as the Andromeda botnet and the ViperSoftX information stealer. It was, however, not possible to confirm whether CoinLoader had dropped these additional malware variants onto infected devices.
On customer networks where Darktrace RESPOND was enabled in autonomous response mode, Darktrace was able to take swift targeted steps to shut down suspicious connections and contain CoinLoader compromises. In one example, following DETECT’s initial identification of an affected device connecting to multiple MivoCloud endpoints, RESPOND autonomously blocked the device from carrying out such connections, effectively shutting down C2 communication and preventing threat actors carrying out any cryptomining activity, or downloading subsequent malicious payloads. The autonomous response capability of RESPOND provides customer security teams with precious time to remove infected devices from their network and action their remediation strategies.
Additionally, customers subscribed to Darktrace’s Proactive Threat Notification (PTN) service would be alerted about potential CoinLoader activity observed on their network, prompting Darktrace’s Security Operations Center (SOC) to triage and investigate the activity, allowing customers to prioritize incidents that require immediate attention.
Conclusion
By masquerading as free or ‘cracked’ versions of legitimate popular software, loader malware like CoinLoader is able to indiscriminately target a large number of endpoint users without arousing suspicion. What’s more, once a network has been compromised by the loader, it is then left open to a secondary compromise in the form of potentially costly information stealers, ransomware or, in this case, cryptocurrency miners.
While urging employees to think twice before installing seemingly legitimate software unknown or untrusted locations is an essential first step in protecting an organization against threats like CoinLoader, its stealthy tactics mean this may not be enough.
In order to fully safeguard against such increasingly widespread yet evasive threats, organizations must adopt security solutions that are able to identify anomalies and subtle deviations in device behavior that could indicate an emerging compromise. The Darktrace suite of products, including DETECT and RESPOND, are well-placed to identify and contain these threats in the first instance and ensure they cannot escalate to more damaging network compromises.
Credit to: Signe Zaharka, Senior Cyber Security Analyst, Paul Jennings, Principal Analyst Consultant
Appendix
Darktrace DETECT Model Detections
- Anomalous Connection/Multiple Connections to New External TCP Port
- Anomalous Connection/Multiple Failed Connections to Rare Endpoint
- Anomalous Connection/Rare External SSL Self-Signed
- Anomalous Connection/Repeated Rare External SSL Self-Signed
- Anomalous Connection/Suspicious Self-Signed SSL
- Anomalous Connection/Young or Invalid Certificate SSL Connections to Rare
- Anomalous Server Activity/Rare External from Server
- Compromise/Agent Beacon (Long Period)
- Compromise/Beacon for 4 Days
- Compromise/Beacon to Young Endpoint
- Compromise/Beaconing Activity To External Rare
- Compromise/High Priority Crypto Currency Mining
- Compromise/High Volume of Connections with Beacon Score
- Compromise/Large Number of Suspicious Failed Connections
- Compromise/New or Repeated to Unusual SSL Port
- Compromise/Rare Domain Pointing to Internal IP
- Compromise/Repeating Connections Over 4 Days
- Compromise/Slow Beaconing Activity To External Rare
- Compromise/SSL Beaconing to Rare Destination
- Compromise/Suspicious File and C2
- Compromise/Suspicious TLS Beaconing To Rare External
- Device/ Anomalous Github Download
- Device/ Suspicious Domain
- Device/Internet Facing Device with High Priority Alert
- Device/New Failed External Connections
Indicators of Compromise (IoCs)
IoC - Hostname C2 Server
ams-updatea[.]info
ams-updateb[.]info
ams-updatec[.]info
ams-updated[.]info
candatamsna[.]info
candatamsnb[.]info
candatamsnc[.]info
candatamsnd[.]info
mapdatamsna[.]info
mapdatamsnb[.]info
mapdatamsnc[.]info
mapdatamsnd[.]info
res-smarta[.]info
res-smartb[.]info
res-smartc[.]info
res-smartd[.]info
rqmetrixa[.]info
rqmetrixb[.]info
rqmetrixc[.]info
rqmetrixd[.]info
ucmetrixa[.]info
ucmetrixb[.]info
ucmetrixc[.]info
ucmetrixd[.]info
any-updatea[.]icu
IoC - IP Address - C2 Server
185.225[.]16.192
185.225[.]16.61
185.225[.]16.62
185.225[.]16.63
185.225[.]16.88
185.225[.]17.108
185.225[.]17.109
185.225[.]17.12
185.225[.]17.13
185.225[.]17.135
185.225[.]17.14
185.225[.]17.145
185.225[.]17.157
185.225[.]17.159
185.225[.]18.141
185.225[.]18.142
185.225[.]18.143
185.225[.]19.218
185.225[.]19.51
194.180[.]157.179
194.180[.]157.185
194.180[.]158.55
194.180[.]158.56
194.180[.]158.62
194.180[.]158.63
5.252.178[.]74
94.158.246[.]124
IoC - IP Address - Cryptocurrency mining related endpoint
185.225.17[.]114
185.225.17[.]118
185.225.17[.]130
185.225.17[.]131
185.225.17[.]132
185.225.17[.]142
IoC - SSL/TLS certificate issuer information - C2 server certificate example
emailAddress=admin@example[.]ltd,CN=example[.]ltd,OU=IT,O=MyCompany LLC,L=San Francisco,ST=California,C=US
emailAddress=admin@'res-smartd[.]info,CN=res-smartd[.]info,OU=IT,O=MyCompany LLC,L=San Francisco,ST=California,C=US
CN=ucmetrixd[.]info,OU=IT,O=MyCompany LLC,L=San Francisco,ST=California,C=US
MITRE ATT&CK Mapping
INITIAL ACCESS
Exploit Public-Facing Application - T1190
Spearphishing Link - T1566.002
Drive-by Compromise - T1189
COMMAND AND CONTROL
Non-Application Layer Protocol - T1095
Non-Standard Port - T1571
External Proxy - T1090.002
Encrypted Channel - T1573
Web Protocols - T1071.001
Application Layer Protocol - T1071
DNS - T1071.004
Fallback Channels - T1008
Multi-Stage Channels - T1104
PERSISTENCE
Browser Extensions
T1176
RESOURCE DEVELOPMENT
Web Services - T1583.006
Malware - T1588.001
COLLECTION
Man in the Browser - T1185
IMPACT
Resource Hijacking - T1496
References
1. https://www.avira.com/en/blog/coinloader-a-sophisticated-malware-loader-campaign
2. https://asec.ahnlab.com/en/17909/
3. https://www.cybereason.co.jp/blog/cyberattack/5687/
4. https://research.checkpoint.com/2023/tunnel-warfare-exposing-dns-tunneling-campaigns-using-generative-models-coinloader-case-study/
5. https://securityboulevard.com/2023/02/three-cases-of-cyber-attacks-on-the-security-service-of-ukraine-and-nato-allies-likely-by-russian-state-sponsored-gamaredon/
Like this and want more?
![Device Event Log indicating several connections from the source device to the rare external IP address 146.70.71[.]135 over port 80.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/669973708ae3bd007b761051_Screenshot%202024-07-18%20at%2012.55.55%20PM.png)
![PCAP of a HTTP POST request showing streams of data being sent to the endpoint, 146.70.71[.]135.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/669973c9c7e48724389cdff4_Screenshot%202024-07-18%20at%2012.57.50%20PM.png)
