RunningRAT Analysis Finds Crypto-Mining Tools on Associated C2 Server
Summary
Researchers analyzed RunningRAT samples and infrastructure, finding XMRig deployment scripts and tools on an associated C2 server. The RAT communicates with the server, while a separate executable showed possible credential-stealing functionality.
Key points
- An open directory hosted a RunningRAT sample, which drops files and loads a DLL to perform data collection, C2 communication, and persistence.
- The sample communicated with 24.199.123[.]1 over TCP port 4000; packet data included a hardware-related string that may indicate system profiling.
- An open directory on the associated server contained scripts that remove competing miners, download XMRig, and use NSSM to register the miner as a service.
- No cryptocurrency wallet addresses were found in the analyzed XMRig-related files.
- A separate executable, kill.exe, appeared designed to search files and browsers for stored credentials, but testing observed limited data transmission.
- The article provides IP addresses, domains, file hashes, and ports as threat-intelligence indicators.
Article Details
- Attack Vectors
- RunningRAT was hosted in an accessible open directory and executed from me.exe.
- RunningRAT dropped files into the System32 directory, launched a custom service-group process, and loaded its DLL payload.
- RunningRAT communicated with a C2 server over TCP port 4000.
- Batch scripts used CMD and PowerShell commands to remove competing coinminers, download and install XMRig, and register it as a service using NSSM.
- kill.exe scanned the compromised device for stored credentials and browser data, then attempted to communicate with the C2 server over TCP port 5000.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api[.]ipify[.]org | Endpoint kill.exe contacts to retrieve the compromised host's public IP address; the article does not identify it as attacker-controlled infrastructure. |
| DOMAIN | host404111[.]xyz | Domain associated with the RunningRAT C2 server. |
| IPV4 | 139[.]162[.]102[.]163 | IP hosting the open directory containing a RunningRAT sample. |
| IPV4 | 24[.]199[.]123[.]1 | RunningRAT C2 server and host of the open directory containing cryptocurrency-mining files. |
| SHA256 | 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5 | SHA-256 of WinRing0x64.sys included with the XMRig files. |
| SHA256 | 152f1bf6b11eb2f8e0f31bce6853f7f9fa604164a429741ec0973f508f6520e1 | SHA-256 of the 240634687.dll payload dropped by me.exe. |
| SHA256 | 175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5 | SHA-256 of xmr-unban.bat, a script used to install XMRig. |
| SHA256 | 27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad | SHA-256 of xmrig.zip, downloaded by the mining scripts. |
| SHA256 | 54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f | SHA-256 of the XMRig configuration file config.json. |
| SHA256 | 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910 | SHA-256 of NETSYSDDL.exe dropped by me.exe. |
| SHA256 | b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867 | SHA-256 of the RunningRAT sample me.exe. |
| SHA256 | b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d | SHA-256 of the xmrig.exe miner included in the archive. |
| SHA256 | c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a | SHA-256 of kill.exe, described as a spyware tool for scanning stored credentials. |
| SHA256 | db312628b3001d24ca2836ab065bed9573f65158a3b31d97f009f44110c4a4cb | SHA-256 of the ini.ini configuration file dropped by me.exe. |
| SHA256 | e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985 | SHA-256 of xmr-normal.bat, a script used to install XMRig. |
MITRE ATT&CK
T1055 · Process InjectionRunningRAT uses in-memory anti-debugging techniques and executes its DLL payload through a loader.T1059.001 · PowerShellThe mining scripts use PowerShell commands to download and install XMRig.T1059.003 · Windows Command ShellThe mining scripts use Windows CMD commands to remove competing miners and install XMRig.T1105 · Ingress Tool TransferThe batch scripts download xmrig.zip to the compromised host.T1543.003 · Windows ServiceThe batch script uses NSSM to register the XMRig miner as a service named c3pool_miner.T1555 · Credentials from Password Storeskill.exe scans the compromised device for stored credentials in files and web browsers.
Malware
Brave Princeto the Pyeongchang Winter Olympics. Deployed alongside other malware families, such as Gold Dragon and Brave Prince, it supported attacks focused on data collection and persistent access within targeted networks.Gold Dragonlinked to the Pyeongchang Winter Olympics. Deployed alongside other malware families, such as Gold Dragon and Brave Prince, it supported attacks focused on data collection and persistent access within targetedRunningRATThis post explores RunningRAT, a remote access trojan (RAT) recently found deploying crypto mining payloads. Previously known for its remote access and information-stealing capabilities, RunningRAT's appearance inXMRigintent to deploy cryptocurrency miners within the directory, specifically targeting Monero through the XMRig mining software. Among these files are two batch scripts:
Products
Tools
7za.exeto install XMRig CoinMiner.After downloading xmrig.zip, the batch script decompresses the file using 7za.exe, a 7zip utility included in the directory. The folder's contents reveal an XMRig CoinMiner executable (NSSMThe batch script then follows a similar process for nssm.zip, which contains NSSM (Non-Sucking Service Manager), using it to register the miner as a service under the name "