Coin miners remediation workflow

Follow these steps to remediate a coin miner attack.

Introduction

Coin miners are executable files that steal CPU cycles and RAM to do the mining calculations for various cryptocurrencies. These malware variants are usually very stealthy because they don’t want to cause explicit harm, so they can keep the mining in the background on a device. The most common symptom is a significant degradation in a device's performance.

Confirm if it's a coin miner

First, you need to determine if you're dealing with a coin miner or some other Windows Management Instrumentation (WMI) persistence based infection. To confirm you have a coin miner infection, do as follows:

Use Microsoft Autoruns to find the infection. See How to use Microsoft Autoruns to locate undetected malware.

An entry shows in the WMI tab.

The screenshot below shows an example of a coin miner.


Example coin miner

Update and patch your systems

Make sure that all your devices have the latest Windows security patches. You must make sure that you include the patch for the EternalBlue exploit.

EternalBlue is an exploit that takes advantage of a vulnerability in Microsoft SMB, which was used notably by the WannaCry ransomware to spread. Various malware families now use it. Patching devices and removing this infection vector makes it harder for coin miners and protects you against other malware using EternalBlue.

Microsoft released the patch for EternalBlue in Microsoft update: MS17-010. The official Microsoft article explains how to verify if a computer has the patch. See How to verify that MS17-010 is installed.

Sophos has a simple PowerShell script that you can run on individual devices to confirm if they have the patch. For more information about this, see How to Verify if a Machine is Vulnerable to EternalBlue - MS17-010.

To patch and update your devices, do as follows:

  1. Check if your devices are vulnerable to EternalBlue.
  2. Update your devices with the latest Windows security patches.
  3. Use these PowerShell commands to pull event filter, event consumer and filter consumer binding information from the WMI database.
    • wmic /namespace:\\root\subscription PATH __EventFilter get/format:list > C:\EventFilter.txt
    • wmic /namespace:\\root\subscription PATH __EventConsumer get/format:list > C:\EventConsumer.txt
    • wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding get/format:list > C:\FilterToConsumerBinding.txt
  4. Zip the resulting .txt files generated in C:\ and rename it to [Machine_Name_WMI].zip.
  5. Check your files against these examples from a clean device.

    EventFilter.txt

    CreatorSID={1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0}
EventAccess=
EventNamespace=root\cimv2
Name=SCM Event Log Filter
Query=select * from MSFT_SCMEventLogEvent
QueryLanguage=WQL

    EventConsumer.txt

    Category=0
CreatorSID={1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0}
EventID=0
EventType=1
InsertionStringTemplates={""}
MachineName=
MaximumQueueSize=
Name=SCM Event Log Consumer
NameOfRawDataProperty=
NameOfUserSIDProperty=sid
NumberOfInsertionStrings=0
SourceName=Service Control Manager
UNCServerName=

    FilterToConsumerBinding.txt

    Consumer="NTEventLogEventConsumer.Name="SCM Event Log Consumer""
CreatorSID={1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0}
DeliverSynchronously=FALSE
DeliveryQoS=
Filter="__EventFilter.Name="SCM Event Log Filter""
MaintainSecurityContext=FALSE
SlowDownProviders=FALSE
  6. If your files contain different or more entries than those shown for a clean device, use these scripts to clean them.
    1. Find the appropriate information in the bold text and replace the required information in the following scripts and run them. 
      Get-WMIObject -Namespace root\Subscription -Class __EventFilter -filter "Name= 'SCM Event Log Filter'" | Remove-WMIObject  -Verbose
Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer -Filter "Name='SCM Events Log Consumer'" | Remove-WMIObject -Verbose
wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding WHERE "Filter=""__EventFilter.Name='SCM Events Log Filter'""" DELETE

Find the coin miner

A coin miner is either an executable file or a script in the form of a scheduled task or WMI entry.

  1. Use Microsoft Autoruns to determine what type of coin miner you have.
  2. If you have a malicious executable file, submit a sample. See Submit a Sample.

    When the signatures have been updated and released, Sophos automatically cleans it from all devices.

    If you can't find the executable file, contact Sophos MTR Rapid Response.

  3. If you have a script, use the following articles to help deal with it.

Delete the coin miner

If you have a malicious executable file, you need to remove it.

Delete the detected files on all the infected devices.

Coin miner remediation video

This video covers this workflow.