{"id":2142,"date":"2018-02-23T21:33:56","date_gmt":"2018-02-24T05:33:56","guid":{"rendered":"https:\/\/new.acalvio.com\/?p=2142"},"modified":"2018-02-23T21:33:56","modified_gmt":"2018-02-24T05:33:56","slug":"wannmine-lateral-movement-techniques","status":"publish","type":"post","link":"https:\/\/acalvio.p2staging.us\/index.php\/2018\/02\/23\/wannmine-lateral-movement-techniques\/","title":{"rendered":"WannMine – Lateral Movement Techniques"},"content":{"rendered":"

[et_pb_section fb_built=”1″ admin_label=”section” _builder_version=”3.22″][et_pb_row admin_label=”row” _builder_version=”3.25″ background_size=”initial” background_position=”top_left” background_repeat=”repeat”][et_pb_column type=”4_4″ _builder_version=”3.25″ custom_padding=”|||” custom_padding__hover=”|||”][et_pb_text _builder_version=”4.7.0″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” hover_enabled=”0″ sticky_enabled=”0″]Acalvio Threat Research Labs<\/strong>
\nIntroduction:<\/strong>
\nCryptominer is quickly becoming one of the greatest threats that is facing our industry. Similar to ransomware, it provides an easy avenue for a threat actor to monetize his\/her skills. In one of the earlier blogs, we discussed lateral movement techniques employed by the Zealot campaign. This campaign was aimed at mining cryptocurrency.  In this blog, we detail lateral movement techniques used by WannMine campaign. This campaign was recently disclosed by Panda Labs[1].  Essentially, WannMine harvests credentials from memory and also uses eternal blue exploit for lateral movement, details of which are outlined below:
\nLateral Movement:<\/strong>
\nInfo6.ps1 discussed on the blog [1] from Panda Labs was involved in lateral movement. The code checks if there are any existing established connections to ports 3333 or 5555. If any of these connections are found, then the process is terminated. SoftEther VPN uses the port 5555.
\n\"\"<\/p>\n

Figure 1.0 Showing the Killing of the process<\/p>\n

To select the machines for lateral movement,  PowerShell script first makes a call to the b\u0000\u001c$Networks = Get-WmiObject Win32_NetworkAdapterConfiguration b\u0000\u001c  to get the list of all the IP address in the network adapter configurations. For each of the IP address in the network configurations, the script then<\/p>\n