LoudMiner
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
LoudMiner used a batch script to run the Linux virtual machine as a service.[1] |
| .004 | Command and Scripting Interpreter: Unix Shell |
LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.[1] |
||
| Enterprise | T1543 | .003 | Create or Modify System Process: Windows Service |
LoudMiner can automatically launch a Linux virtual machine as a service at startup if the AutoStart option is enabled in the VBoxVmService configuration file.[1] |
| .004 | Create or Modify System Process: Launch Daemon |
LoudMiner adds plist files with the naming format |
||
| Enterprise | T1189 | Drive-by Compromise |
LoudMiner is typically bundled with pirated copies of Virtual Studio Technology (VST) for Windows and macOS.[1] |
|
| Enterprise | T1564 | .001 | Hide Artifacts: Hidden Files and Directories |
LoudMiner has set the attributes of the VirtualBox directory and VBoxVmService parent directory to "hidden".[1] |
| .006 | Hide Artifacts: Run Virtual Instance |
LoudMiner has used QEMU and VirtualBox to run a Tiny Core Linux virtual machine, which runs XMRig and makes connections to the C2 server for updates.[1] |
||
| Enterprise | T1070 | .004 | Indicator Removal on Host: File Deletion | |
| Enterprise | T1105 | Ingress Tool Transfer | ||
| Enterprise | T1027 | Obfuscated Files or Information |
LoudMiner has obfuscated various scripts and encrypted DMG files.[1] |
|
| Enterprise | T1057 | Process Discovery |
LoudMiner used the |
|
| Enterprise | T1496 | Resource Hijacking |
LoudMiner harvested system resources to mine cryptocurrency, using XMRig to mine Monero.[1] |
|
| Enterprise | T1218 | .007 | Signed Binary Proxy Execution: Msiexec |
LoudMiner used an MSI installer to install the virtualization software.[1] |
| Enterprise | T1082 | System Information Discovery | ||
| Enterprise | T1016 | System Network Configuration Discovery |
LoudMiner used a script to gather the IP address of the infected machine before sending to the C2.[1] |
|
| Enterprise | T1569 | .001 | System Services: Launchctl |
LoudMiner launched the QEMU services in the |
| .002 | System Services: Service Execution |
LoudMiner started the cryptomining virtual machine as a service on the infected machine.[1] |
||