Researchers Trace Multi-Stage PowerShell Infection to XMRig Cryptocurrency Miner
Summary
Researchers traced a PowerShell infection using Registry data, DNS TXT records, and PNG/WAV payload containers to deploy an in-memory XMRig-based miner, establish persistence, weaken security controls, and maintain a separate C2 channel.
Key points
- The infection launched PowerShell with execution-policy bypass and retrieved an encoded payload from the Windows Registry.
- DNS TXT records directed the malware to a PNG at frames-1zm[.]pages.dev/frames.png, which concealed script data in its pixel channels.
- ZIP archives and WAV files carried further PowerShell scripts and .NET assemblies, reconstructed from audio data and loaded directly into memory.
- The malware established persistence with scheduled tasks and a WMI permanent event subscription, and weakened PowerShell and Microsoft Defender protections.
- The final payload was an XMRig-family cryptocurrency miner, configured to use a mining pool and a dropped WinRing0.sys driver.
- A separate C2 channel used DNS-based discovery and HTTP/HTTPS requests to receive commands; researchers say it remained active independently of mining.
Article Details
- Attack Vectors
- Registry-stored PowerShell was executed with execution-policy bypass and used to retrieve and run encoded payload stages.
- DNS TXT records and DNS-over-HTTPS were used to retrieve encoded data and discover C2 information.
- PNG pixel data and WAV audio-file data concealed scripts and .NET assemblies that were reconstructed and executed in memory.
- ZIP archives delivered WAV payload containers to the PublicMusic directory.
- The infection established persistence through hidden Scheduled Tasks and a WMI permanent event subscription.
- The payload weakened PowerShell and Microsoft Defender controls, added Defender exclusions, disabled selected Defender-related services and tasks, and removed PowerShell history.
- The final .NET payload deployed an XMRig-based cryptocurrency miner and dropped WinRing0.sys.
- Defensive Notes
- Inspect Registry-stored PowerShell payloads and unusual PowerShell execution using execution-policy bypass.
- Monitor DNS TXT lookups and DNS-over-HTTPS requests associated with sslvalidcert.com, txtcdn.net, and httptls.org.
- Investigate suspicious PNG and WAV downloads, including reconstruction or execution of data concealed in image or audio content.
- Review hidden Scheduled Tasks, WMI permanent event subscriptions, changes to PowerShell logging or history, and broad Microsoft Defender exclusions.
- Check for XMRig-related mining activity and unexpected WinRing0.sys drops.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | httptls[.]org | Domain whose DNS TXT records the payload queried for C2 discovery. |
| DOMAIN | sslvalidcert[.]com | Domain whose DNS TXT records the payload queried to retrieve encoded data. |
| DOMAIN | txtcdn[.]net | Domain used for later DNS TXT lookups that supplied encoded data. |
| IPV4 | 104[.]21[.]2[.]193 | C2 server endpoint listed in the article; the reported connection used port 8443. |
| MD5 | 94b50ace73cc03790678c73b867be129 | Hash listed for the malicious atsg.wav payload artifact. |
| MD5 | be860a15b7e5d44b0b3d67f598238fad | Hash listed for the malicious mav.wav payload artifact. |
| MD5 | c024189e1e7fa0ae6d24353367e8b98d | Hash listed for the malicious tmav.wav payload artifact. |
| MD5 | ed276b2312f641b00f87fa18e85c48eb | Hash listed for the malicious Realtek HD Audio.wav payload artifact. |
| MD5 | f1d2fdb7f3b699da69a050c5352a33c2 | Hash listed for the malicious upgrade.exe artifact. |
| MD5 | f94de28bd66afc4679f546500db184d4 | Hash listed for the malicious fp.dll artifact. |
| URL | hxxps[:]//config-rg7[.]pages[.]dev/config.txt | Mining-configuration resource listed in the article's IOC section. |
| URL | hxxps[:]//frames-1zm[.]pages[.]dev/frames.png | URL used to download the PNG container holding concealed script data. |
| URL | hxxps[:]//publicwavlib[.]pages[.]dev/hdaudio.wav | Payload URL used to retrieve the WAV container from which a .NET assembly was extracted. |
| URL | hxxps[:]//publicwavlib[.]pages[.]dev/mav.wav | Fallback URL used by the payload to retrieve the WAV container. |
| URL | hxxps[:]//softtestcopapool[.]pages[.]dev/rxconfig.txt | Mining-configuration resource listed in the article's IOC section. |
| URL | hxxps[:]//wavmain[.]pages[.]dev/main.wav | Payload WAV URL listed in the article's IOC section. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationPayload data was encoded and concealed in Registry values, PNG pixel channels, and WAV audio data before reconstruction.T1041 · Exfiltration Over C2 ChannelThe payload sent host information and command results to its C2 server in Info, pingo, OK, and ERR messages.T1053.005 · Scheduled TaskHidden Scheduled Tasks ran the encrypted payload at logon and at regular intervals.T1059.001 · PowerShellPowerShell scripts executed encoded and reconstructed payloads, including with execution-policy bypass.T1071.004 · DNSDNS TXT queries retrieved encoded data and were used to discover C2 information.T1105 · Ingress Tool TransferThe scripts downloaded PNG and WAV payload containers and mining configuration resources.T1106 · Native APIReconstructed .NET assemblies were loaded into the PowerShell process using Assembly.Load rather than being written to disk.T1112 · Modify RegistryThe scripts stored and retrieved payload data and a host identifier in the Windows Registry.T1546.003 · Windows Management Instrumentation Event SubscriptionA WMI permanent event subscription monitored a Registry-related event and triggered the payload.T1562.001 · Disable or Modify ToolsThe payload weakened security controls, added Microsoft Defender exclusions, disabled selected Defender-related services and tasks, and removed PowerShell history.
Malware
Products
Microsoft Defender Antimalware PlatformThe chain ultimately deployed an XMRig-based cryptocurrency miner while maintaining a separate C2 channel and weakening Microsoft Defender and PowerShell logging controls.Microsoft Windows[T1546.003 ] Windows Management Instrumentation Event Subscription – Set up a WMI permanent event subscription for persistence (‘a WMI permanent event subscription was configured’).PowerShellResearchers analyzed a multi-stage infection that used Registry-stored PowerShell, DNS TXT records, PNG and WAV file payload containers, and in-memory .NET loading to hide its activity.