\nDestruction Level:<\/strong> Moderate
\nPrevalence:<\/strong> Moderate<\/p>\n
<\/p>\n
Malware Names<\/h3>\n\n- Trojan.Win32.Mornhya (Padvish)<\/li>\n
- Powershell\/Kriptik(Eset)<\/li>\n
- Trojan.Bat.Alien(Microsoft)<\/li>\n<\/ul>\n
<\/p>\n
What is Trojan?<\/h3>\n
Trojan is a type of malware that disguises itself as clean and legitimate software and behaves totally like a useful and functional software, but when executed, it causes a lot of damage to the computer system. There are different ways in which trojans could enter the system, some are: Entering through a software downloaded from the Internet, embedding in HTML text, attaching to an email, etc.<\/p>\n
<\/p>\n
What is Mornhya malware?<\/h3>\n
Mornhya is a obscured batch<\/em> file (typically with a .cmd extension) that, upon execution and after disambiguation, executes a miner file. The malware employs various techniques to evade detection and monitoring by security tools. In observed cases, samples of this malware have been downloaded from the following addresses, often disguised as software cracks:<\/p>\nhxxp[:]\/\/89[.]23[.]97[.]199[:]1444<\/span><\/em><\/p>\nhxxps[:]\/\/89[.]23[.]97[.]199<\/span><\/em><\/p>\n <\/p>\n
Technical Review<\/h2>\nIndicators of Compromise (IoC)<\/h3>\n
![\"?\"](\"https:\/\/s.w.org\/images\/core\/emoji\/11\/svg\/1f53a.svg\")
Presence of a .cmd<\/em> file in the `%programdata%\\Microsoft%` path, with names seen in different malware samples such as:<\/p>\nWinDriver.cmd<\/em>
\nAnonmy.cmd<\/em>
\nProject88.cmd<\/em><\/p>\nHigh CPU usage by the `explorer.exe<\/span>` process or `xmrig.exe<\/span>` program process.
\nSystem processes internet connection to the following mining domain (e.g., `powershell.exe<\/span>`, `explorer.exe<\/span>`, or<\/span> `xmrig.exe<\/span>`)
\npool[.]hashvault[.]pro<\/span><\/em><\/p>\n <\/p>\n
Performance Description<\/h3>\n
Mornhya<\/em> malware is a batch<\/em> file that ultimately executes a miner on the victim’s system. This file is obfuscated and disambiguated in several stages. Initially, the malware runs a command-line command, creates a subprocess `powershell.exe<\/em>` to execute an obscured code fragment:<\/p>\n <\/p>\n
![\"\u0634\u0631\u062d](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/\u062a\u0635\u0648\u06cc\u0631-1.png\")
<\/p>\n
<\/p>\n
After disambiguation, the PowerShell code snippet is as follows. The malware first reads the pseudocode in the original file, decrypts it using the AES<\/em> algorithm, and then decompresses it from GZip<\/em>. By executing this code, two malicious PE<\/em> files are obtained and loaded directly into the `powershell.exe<\/em>` memory process.<\/p>\n <\/p>\n
![\"\u0634\u0631\u062d](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/\u062a\u0635\u0648\u06cc\u0631-2.png\")
<\/p>\n
<\/p>\n
The first file (referred to as AMSIPatcher<\/em>) employs various techniques to bypass antivirus and other security tools. Once the first file is executed, the second file is loaded and executed within the `powershell.exe<\/em>` memory to run the `xmrig.exe<\/em>` miner.<\/p>\n <\/p>\n
?The First File: AMSIPatcher<\/em><\/strong><\/p>\nMornhya<\/em> malware, in AMSIPatcher.exe<\/em> file, uses the following techniques to bypass antivirus and monitoring tools. The following figure presents a code sample of AMSIPatcher<\/em>:<\/p>\n![\"\u06a9\u062f](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/3-\u06a9\u062f-\u0646\u0645\u0648\u0646\u0647\u200c\u0627\u06cc-\u0627\u0632-\u0641\u0627\u06cc\u0644-AMSIPatcher.png\")
<\/p>\n
\n- Upload clean Versions of kernel32.dll<\/em> and ntdll.dll<\/em> Files:\u00a0<\/strong>The malware locates `ntdll.dll` and `kernel32.dll` modules among the uploaded modules of the `powershell.exe` process. It also loads clean versions of these files into the malware process memory, then it changes the start address of the code in these modules to the start address of the clean versions it has uploaded. This allows the malware to bypass hooks that may have been applied to the functions of these two modules during the creation of the `powershell.exe` process.<\/li>\n
- AMSIScanBuffer<\/em> Function Code Modification:\u00a0<\/strong>The AMSIScanBuffer function from the `amsi.dll` library, is used to scan buffer contents in the memory. The malware modifies the initial bytes of this function to prevent its execution, so the function returns without running the original code. For example, in 64-bit Windows, the malware rewrites the initial bytes with [184, 87, 0, 7, 128, 194, 24, 0] bites, whose assembly equivalent command is shown below.”<\/li>\n<\/ul>\n
![\"\u2022](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/\u062a\u0635\u0648\u06cc\u0631-4.png\")
<\/p>\n
\n- EtwEventWrite<\/em> Function Code change:\u00a0<\/strong>To avoid logging its own process events, the malware changes the initial bytes of this function in the `ntdll.dll` module to [194, 20, 0] in 32-bit Windows and [195] in 64-bit Windows. This is equivalent to the “”ret”” command in assembly language, making the function return immediately without executing its code<\/li>\n<\/ul>\n
?The Second File: Miner<\/em><\/strong><\/p>\nThe miner file varies in different malware samples , but ultimately executes the `xmrig.exe` mining tool on the victim’s system, typically using the following address as a mining pool:<\/p>\n
pool[.]hashvault[.]pro<\/em><\/span><\/p>\nFor instance, in one malware sample, the malware miner file is based on the .NET<\/em> framework and contains two malicious resources similar to the following figure. The first resource, LP<\/em> resource in the following figure, is a malicious library file named `LoadPE.dll<\/em>` that executes the second resource, P. Resource P is a malware that, upon execution, creates a subprocess with a clean Windows file `explorer.exe<\/em>`, and injects the `xmrig.exe` miner file into it.<\/p>\n![\"](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/5-\u0641\u0627\u06cc\u0644-\u062f\u0648\u0645-Miner.png\")
<\/p>\n
The following figure illustrates the malware execution:<\/p>\n
![\"\u0627\u062c\u0631\u0627\u06cc](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/5-\u0627\u062c\u0631\u0627\u06cc-\u0628\u062f\u0627\u0641\u0632\u0627\u0631-Mornhya-1.png\")
<\/p>\n
<\/p>\n
How to deal with and clean the system?<\/h2>\n
Padvish Antivirus detects and removes this malware from the system. It is recommended to:<\/p>\n
\u2705 Always keep your OS and antivirus up to date.
\n\u2705 Download files only from reliable sources.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview Type: Trojan Destruction Level: Moderate Prevalence: Moderate Malware Names Trojan.Win32.Mornhya (Padvish) Powershell\/Kriptik(Eset) Trojan.Bat.Alien(Microsoft) What is Trojan? Trojan is a type of malware that disguises itself as clean and legitimate software and behaves totally like a useful and functional software, but when executed, it causes a lot of damage to the computer system.…<\/p>\n","protected":false},"author":27,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[43,76],"class_list":["post-1567","post","type-post","status-publish","format-standard","hentry","category-trojan","tag-trojan","tag-mornhya"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1567","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=1567"}],"version-history":[{"count":7,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1567\/revisions"}],"predecessor-version":[{"id":1575,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1567\/revisions\/1575"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=1567"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=1567"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=1567"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
<\/p>\n
What is Trojan?<\/h3>\n
Trojan is a type of malware that disguises itself as clean and legitimate software and behaves totally like a useful and functional software, but when executed, it causes a lot of damage to the computer system. There are different ways in which trojans could enter the system, some are: Entering through a software downloaded from the Internet, embedding in HTML text, attaching to an email, etc.<\/p>\n
<\/p>\n
What is Mornhya malware?<\/h3>\n
Mornhya is a obscured batch<\/em> file (typically with a .cmd extension) that, upon execution and after disambiguation, executes a miner file. The malware employs various techniques to evade detection and monitoring by security tools. In observed cases, samples of this malware have been downloaded from the following addresses, often disguised as software cracks:<\/p>\n hxxp[:]\/\/89[.]23[.]97[.]199[:]1444<\/span><\/em><\/p>\n hxxps[:]\/\/89[.]23[.]97[.]199<\/span><\/em><\/p>\n <\/p>\n WinDriver.cmd<\/em> <\/p>\n Mornhya<\/em> malware is a batch<\/em> file that ultimately executes a miner on the victim’s system. This file is obfuscated and disambiguated in several stages. Initially, the malware runs a command-line command, creates a subprocess `powershell.exe<\/em>` to execute an obscured code fragment:<\/p>\n <\/p>\n <\/p>\n After disambiguation, the PowerShell code snippet is as follows. The malware first reads the pseudocode in the original file, decrypts it using the AES<\/em> algorithm, and then decompresses it from GZip<\/em>. By executing this code, two malicious PE<\/em> files are obtained and loaded directly into the `powershell.exe<\/em>` memory process.<\/p>\n <\/p>\n <\/p>\n The first file (referred to as AMSIPatcher<\/em>) employs various techniques to bypass antivirus and other security tools. Once the first file is executed, the second file is loaded and executed within the `powershell.exe<\/em>` memory to run the `xmrig.exe<\/em>` miner.<\/p>\n <\/p>\n ?The First File: AMSIPatcher<\/em><\/strong><\/p>\n Mornhya<\/em> malware, in AMSIPatcher.exe<\/em> file, uses the following techniques to bypass antivirus and monitoring tools. The following figure presents a code sample of AMSIPatcher<\/em>:<\/p>\n ?The Second File: Miner<\/em><\/strong><\/p>\n The miner file varies in different malware samples , but ultimately executes the `xmrig.exe` mining tool on the victim’s system, typically using the following address as a mining pool:<\/p>\n pool[.]hashvault[.]pro<\/em><\/span><\/p>\n For instance, in one malware sample, the malware miner file is based on the .NET<\/em> framework and contains two malicious resources similar to the following figure. The first resource, LP<\/em> resource in the following figure, is a malicious library file named `LoadPE.dll<\/em>` that executes the second resource, P. Resource P is a malware that, upon execution, creates a subprocess with a clean Windows file `explorer.exe<\/em>`, and injects the `xmrig.exe` miner file into it.<\/p>\n The following figure illustrates the malware execution:<\/p>\n <\/p>\n Padvish Antivirus detects and removes this malware from the system. It is recommended to:<\/p>\n \u2705 Always keep your OS and antivirus up to date. Overview Type: Trojan Destruction Level: Moderate Prevalence: Moderate Malware Names Trojan.Win32.Mornhya (Padvish) Powershell\/Kriptik(Eset) Trojan.Bat.Alien(Microsoft) What is Trojan? Trojan is a type of malware that disguises itself as clean and legitimate software and behaves totally like a useful and functional software, but when executed, it causes a lot of damage to the computer system.…<\/p>\n","protected":false},"author":27,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[43,76],"class_list":["post-1567","post","type-post","status-publish","format-standard","hentry","category-trojan","tag-trojan","tag-mornhya"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1567","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=1567"}],"version-history":[{"count":7,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1567\/revisions"}],"predecessor-version":[{"id":1575,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1567\/revisions\/1575"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=1567"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=1567"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=1567"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Technical Review<\/h2>\n
Indicators of Compromise (IoC)<\/h3>\n
Presence of a .cmd<\/em> file in the `%programdata%\\Microsoft%` path, with names seen in different malware samples such as:<\/p>\n
\nAnonmy.cmd<\/em>
\nProject88.cmd<\/em><\/p>\nHigh CPU usage by the `explorer.exe<\/span>` process or `xmrig.exe<\/span>` program process.
\nSystem processes internet connection to the following mining domain (e.g., `powershell.exe<\/span>`, `explorer.exe<\/span>`, or<\/span> `xmrig.exe<\/span>`)
\npool[.]hashvault[.]pro<\/span><\/em><\/p>\nPerformance Description<\/h3>\n
<\/p>\n<\/p>\n<\/p>\n\n
<\/p>\n\n
<\/p>\n<\/p>\nHow to deal with and clean the system?<\/h2>\n
\n\u2705 Download files only from reliable sources.<\/p>\n","protected":false},"excerpt":{"rendered":"