A Post-exploitation Look at Coinminers Abusing WebLogic Vulnerabilities

Using Workload Security to detect WebLogic vulnerability exploitation

Workload Security's correlation of telemetry and detections provided the initial security context in this campaign, which allowed security teams and analysts to track and monitor the malicious actor's activities.

The following Workload Security modules worked to detect the exploitation of CVE-2020-14882 on vulnerable systems:

Intrusion prevention system module

Workload Security's intrusion prevention system module can tap into incoming traffic and effectively block and detect malicious network traffic. This module includes multiple IPS rules that can block the vulnerability exploitation of the WebLogic server. One of these is IPS rule 1010590 - Oracle WebLogic Server Remote Code Execution Vulnerabilities (CVE-2020-14882, CVE-2020-14750 and CVE-2020-14883), which can detect and block the exploitation of vulnerabilities assigned to both CVE-2020-14882 and CVE-2020-14883.

In figure 4, the malicious actor sent a crafted request that attempted to access the console.portal resource under the "images"directory. The "%252e%252e" is a double URL-encoded string of the ".." directory traversal pattern. Because the class managing the targeted resource did not validate the input, it automatically computed the code that the attacker provided. In this case, the attacker forced the server to read the contents of the wb.xml file, which downloaded a shell script with the following contents:

Antimalware module

This module provides real-time protection against the exploitation of this vulnerability using behavior-monitoring features.

Web reputation module

The web reputation module protects systems against web threats by blocking access to malicious URLs. In our investigation, this module immediately identified and blocked the wb.sh script's attempt to download the Kinsing malware.

Activity monitoring module

This module can detect process, file, and network activities on endpoints that are running the Cloud One Workload Security solution. As seen on figure 13, the activity monitoring module detected the Java process that was attempting to open a bash shell.

A closer look at the WebLogic vulnerability exploitation using Trend Micro Vision One and Trend Micro Cloud One

In our investigation of this Kinsing campaign, Trend Micro Vision One provided real-time details into the paths and events related to this attack. This section provides insights on the activities performed by the downloaded shell script, the detections provided by the Trend Micro Cloud One and Trend Micro Vision One solutions, and how the said solutions provide information on every step of the malware's behavior.

Trend Micro Cloud One

After the successful exploitation of the vulnerability, the wb.sh file was downloaded into the host machine. In infected machines that do not run Workload Security and Vision One, it would attempt to perform the following malicious actions:

1. The script would check if the "/tmp/zzza"file was present, which would then trigger the script to stop.Otherwise, it would create an empty file and would perform the other actions. It is a flag used to verify that two or more instances are not running on the same host. This file can also be used to stop further infections if created manually.

2. The script would increase the resource limit using the "ulimit"command and remove the /var/log/syslog file.

3. It would make multiple files immutable so that it can update them.

4. It would also disable multiple security features within the system.

5. It would disable "alibaba," "bydo," and "qcloud" cloud service agents.

6. Like other cryptocurrency-mining malware, it would start removing or killing off other cryptocurrency miners' processes within the infected system.

7. It would also remove some Docker images that belonged to other cryptocurrency-mining malware.

8. Until this point, the script worked as a stager - it would remove the files and processes that were related to other cryptominers and malware families. It would also disable security features and would modify the attributes of important files so that they can be manipulated. After the script performs all these steps, it would then download the Kinsingmalware.

9. It would check if the user was root or not and would then select the path and utility (wget and curl) to download the malicious binary.

10. It would then create a cronjob to download the wb.sh script.

Observed attack techniques (OATs)

Observed attack techniques (OATs) are generated from individual events that provide security value. To investigate possible attempts of exploitation using this vulnerability, analysts can look for these OAT IDs from many other helper OAT triggers that can indicate suspicious activities on the affected host.

Trend Micro Vision One Workbench app

The Trend Micro Vision One Workbench app helps analysts see the significant correlated events that are intelligently based on the occurrences that happened throughout the entire fleet of workloads.

The left side of figure 25 shows the summarized sequence of events. Meanwhile, security analysts can view the different fields of interest that are considered important and provide security value on the right side. The app allows security teams to see compromised assets and isolate those that can be potentially affected while patching and mitigation procedures are in progress.

Execution profile

Execution profile is a Trend Micro Vision One feature that generates graphs for security defenders. Fields like "processCmd" and "objectCmd' can be expanded from the search app or the threat hunting app to look for different activities in any given period. These activities include process creation, file creation, and inbound and outbound network activity.

If "Check Execution Profile" is selected, a security analyst can go through the extensive list of actions that a malicious actor has performed.

Threat hunting queries

To hunt down potential malicious activity within the environment, security analysts can use the following queries using the Trend Micro Vision One search app:

1. To find the potential misuse of Java applications to open bash process: processFilePath:/bin/java AND objectFilePath:/usr/bin/bash

2. To find the use of curl or wget initiated by Java via bash:

a. processFilePath:/bin/java AND objectFilePath:/usr/bin/bash AND (objectCmd:curl or objectCmd:wget)

3. To find the execution of Base64-decoded string execution by Java via bash:

a. processFilePath:/bin/java AND objectFilePath:/usr/bin/bash AND objectCmd:base64

How Trend Micro Vision One and Trend Micro Cloud One - Workload Security can help thwart vulnerability exploitation

In this blog entry, we discussed how malicious actors exploited a two-year-old vulnerability and attempted to deploy the Kinsing malware into a vulnerable system. The successful exploitation of this vulnerability can lead to RCE, which can allow attackers to perform a plethora of malicious activities on affected systems. This can range from malware execution, as in the case of our analysis, to theft of critical data, and even complete control of a compromised machine.

Trend Micro Vision One helps security teams gain an overall view of attempts in ongoing campaigns by providing them a correlated view of multiple layers such as email, endpoints, servers, and cloud workloads. Security teams can gain a broader perspective and a better understanding of attack attempts and detect suspicious behavior that would otherwise seem benign when viewed from a single layer alone.

Meanwhile, Trend Micro Cloud One - Workload Security helps defend systems against vulnerability exploits, malware, and unauthorized change. It can protect a variety of environments such as virtual, physical, cloud, and containers. Using advanced techniques like machine learning (ML) and virtual patching, the solution can automatically secure new and existing workloads both against known and new threats.

MITRE ATT&CK Technique IDs

IOCs

URLs:

• hxxp://91[.]241[.]19[.]134/wb.sh
• hxxp://185[.]14[.]30[.]35/kinsing
• hxxp://185[.]14[.]30[.]35/wb.sh
• hxxp://195[.]2[.]79[.]26/kinsing
• hxxp://195[.]2[.]79[.]26/wb.sh
• hxxp://195[.]2[.]78[.]230/wb.sh
• hxxp://193[.]178[.]170[.]47/wb.sh
• hxxp://178[.]20[.]40[.]200/wb.sh
• hxxp://94[.]103[.]89[.]159/wb.sh
• hxxp://185[.]231[.]153[.]4/wb.sh
• hxxp://195[.]2[.]85[.]171/wb.sh
• hxxp://80[.]92[.]204[.]82/wb.sh
• hxxp://195[.]2[.]84[.]209/kinsing
• hxxp://193[.]178[.]170[.]47/kinsing
• hxxp://178[.]20[.]40[.]200/kinsing

File hashes

• IP addresses
• 212[.]22[.]77[.]79
• 185[.]234[.]247[.]8
• 185[.]154[.]53[.]140