CoinHelper

CoinHelper is mostly bundled with cracked software installers such as WinRAR and game cheats... We’ve also found this threat inside a Windows 11 ISO image from unofficial sources... We have even seen this threat bundled with clean software such as Logitech drivers for webcams.

Two additional WMI queries are used to obtain the names of the victim’s processor and video card: SELECT * FROM Win32_Processor SELECT * FROM Win32_VideoController

the SystemCheck scheduled task presents itself as a Helper.exe application from Microsoft... The scheduled task is used for executing the malware, persistently.

This sample is the first stage of a compiled AutoIt script, a dropper that we call CoinHelper... Both of these files are once again compiled AutoIt scripts

the SystemCheck scheduled task presents itself as a Helper.exe application from Microsoft... The scheduled task is used for executing the malware, persistently.

the SystemCheck scheduled task presents itself as a Helper.exe application from Microsoft... The scheduled task is used for executing the malware, persistently.

Helper.exe holds a variety of other functionalities as well... injecting itself into %WINDIR%\System32\attrib.exe system binary... The CPU coinmining is performed by injecting into a newly created and suspended process of %WINDIR%\System32\attrib.exe .

the SystemCheck scheduled task presents itself as a Helper.exe application from Microsoft... Although Helper.exe is the most common name of the malware by far... other options we’ve seen in the wild are for example: svchost.exe System.exe system32.exe

Helper.exe holds a variety of other functionalities as well... injecting itself into %WINDIR%\System32\attrib.exe system binary... The CPU coinmining is performed by injecting into a newly created and suspended process of %WINDIR%\System32\attrib.exe .

If such a window is found and it doesn’t belong to CoinHelper, the malware considers it as a competing miner and kills the process.

the attacker harvests information about victims, focusing on the victim’s OS, amount of RAM installed, the CPU and video card information, as well as the security solutions present on the system.

The script also checks for running processes, searching for security solutions present on the machine. This information is once again “just” logged and sent to the IP logging server

the primary goal of the Helper.exe dropper is to drop an XMRig coinminer onto the victim’s system via Tor network... After Tor is executed, it listens on port 9303 on localhost (127.0.0.1) and waits for requests.

All the collected information is formatted and concatenated to a single string. This string is then sent to a hardcoded URL address in the form of a user-agent via GET request.

One of the primary goals of CoinHelper is to drop a crypto miner on the infected machine and use the resources (electricity and computing power) of the victim’s computer to generate money for the attackers through mining.