While rolling out Cyberbit’s Endpoint Detection and Response (EDR) in an international airport in Europe, our researchers identified an interesting crypto mining infection, where cryptocurrency mining software was installed on more than 50% of the airport’s workstations. The findings raise concerns regarding the ease of installing malicious software within corporate networks despite being protected by antivirus systems.
The malware was discovered while rolling out Cyberbit EDR, an advanced behavioral detection and threat hunting platform, in an international airport in Europe. Based on further analysis we can associate this malware with the anti-coinminer campaign reported by Zscaler in August 2018.
During a standard rollout process, we install our kernel-level EDR Agents on the customer’s workstations. The Agent collects endpoint activity and the data is centralized in a big-data repository where it is analyzed using a set of behavioral algorithms. The behavioral engine then generates alerts for endpoint behaviors that are potentially malicious. Cyberbit’s team of analysts examines these alerts and whitelists legitimate processes. This enables our customers to achieve accurate detection of evasive activity, which often bypasses antivirus systems, while minimizing false positives during ongoing operation after rollout.
During this process, our behavioral engine alerted on suspicious use of the PAExec tool. The tool was used multiple times over a short period to launch an application named player.exe. PAExec is a redistributable version of Microsoft’s PSExec, used for running Windows programs on remote systems without having to physically install software on these systems. The use of PAExec is often an indication of malicious activity, moreover the repeated use of the tool.
Cyberbit EDR analysis screen shot:

In addition, our behavioral analysis engine detected the use of Reflective DLL Loading after running player.exe. This is a technique for remotely injecting a DLL into a process without using the Windows loader, avoiding accessing the hard drive. Reflective DLL loading is a typical defense evasion tactic used by attackers to mask the loading of malicious files.
The malware may have been used for months prior to the installation of Cyberbit EDR, although all workstations were equipped with an industry standard antivirus.
The combination of the 2 suspicious behaviors triggered a high priority EDR alert which we proceeded to investigate.
Cyberbit EDR analysis screen shot: Reflective DLL Loading Alert

Once we have received the alert, we analyzed the chain of events by using EDR behavioral graph analysis. The malware was suspected to be a Bitcoin miner because of its behavior of executing multiple processes over a short timeframe, typical to a miner using system resources for its calculations. We have cross- checked our behavioral findings with VirusTotal site for further analysis, to understand its purpose.
VirusTotal Report

Persistence Mechanism: Cyberbit EDR Screen Shot

We used Cyberbit EDR threat hunting tool to search for the MD5 across the airport network and found the malware residing on over 50% of the workstations, while not running at that time. We’ve removed the malware from the organization’s endpoints and blocked its ability to execute.
In addition, we’ve used a unique remediation capability to remove malicious entries from the registry. These registry keys were added by the malware to provide persistence. The removal of the malicious keys from the registry ensures that not only is the malware itself blocked, but so is its persistence mechanism.
Remediation – removing the malicious registry from all hosts
EDR Screen Shot

Here are our main takeaways:
We advise corporate customers not to rely on AV alone. To reach an optimal combination of prevention and detection, we strongly suggest complementing AV with EDR, which uses behavioral analysis (which doesn’t rely on signatures or IoCs). With the increased convergence of IT and OT networks, we strongly urge airports to also ramp up the protection of their OT network, which is used to control physical airport systems. By penetrating OT networks attackers can cause catastrophic physical damage and this should, therefore, be a strategic cyber defense priority.
Meir Brown
Head of Research, Cyberbit