Trojan:PowerShell/Lonit.PA

This threat is a form of fileless malware that uses the EternalBlue exploit (CVE-2017-0144).  For more details about EternalBlue, see the Analysis of the ETERNALBLUE and ETERNALROMANCE exploits leaked by Shadow Brokers. 

After the system is exploited, this threat uses its elevated permissions to persist in Windows Management Instrumentation (WMI) and execute from the Task Scheduler. In the case of this malware, persistence is created to run bitcoin miners.

The WMI instance contains variables "funs" (base64 expression).

This threat also fetches the already infected WmiClass "root\default:Office_Updater" (it could also have other names other than Office_Updater).

It immediately executes the "funs" element of the WmiClass. The "funs" element is base64 encoded and this is the malicious payload. It could be anything from bitcoin miners to ad clickers.

Then, it removes all other WMI Objects not called "SCM Event Logs" in the root\subscription folder. It checks if the malware is running by checking port connections on 80 or 14444.

If it finds that the malware isn't running, it will fetch the malware from the WmiClass and run it again. That is how the malware persists.

The tool also uses Mimikatz, another malware, to get NTLM credentials. With these credentials, it checks for other network adapters/connections to connect with. If it finds new addresses, it will check for vulnerabilities. If it finds a possible vulnerability, the malware spreads to the new machine.

WMI Object values:

• funs - payload. Base64 encoded.
• mimi - Mimikatz
• ipsu - Previously infected IPs.
• i17 - PingCastle port scanner
• sc - Unknown.

Payload

Connects to a remote host

• 80
• 14444
  

Allows backdoor access and control

This threat can give a malicious hacker access and control of your PC. They can then perform a number of different actions, such as:

• Downloading and uploading files
• Enumerating running processes
• Executing arbitrary commands
• Gathering system information such as IP address and computer name
• Changing some of your device settings