XMRig Miner Hides in Windows Registry, PNG, WAV Files to Evade Detection

Key Takeaways

• A new multi-stage malware campaign is deploying the XMRig cryptocurrency miner on Windows systems.
• The attackers employ advanced evasion techniques, including hiding malicious code within the Windows Registry, PNG image files, and seemingly innocuous WAV audio files.
• The infection chain utilizes PowerShell scripts, DNS TXT records for C2 communication, and in-memory execution to minimize its footprint.
• Initial impact includes unauthorized CPU usage for mining, but the persistent command-and-control channel poses a broader threat for future attacks.

Cybersecurity researchers have uncovered a sophisticated, multi-layered attack chain designed to stealthily deploy the XMRig cryptocurrency miner on Windows operating systems. This operation meticulously conceals its malicious components within common file types and system locations, making traditional detection methods significantly less effective.

The intricate attack begins with a PowerShell script that retrieves subsequent stages from a Windows Registry value. It then leverages DNS TXT records to pinpoint the download location of a PNG image file, a technique that builds upon previously observed stealth-focused Windows intrusions involving registry-stored PowerShell payloads.

Analysts at K7 Security Labs said in a report, which detailed the multi-stage infection, after their investigation into recurrent PowerShell alerts on a compromised system. The campaign, as documented in their findings, integrates encoded data, remote instructions, persistence mechanisms, security control evasion, and memory-only execution to achieve its objectives.

The immediate consequence for affected systems is the unauthorized utilization of CPU resources for cryptocurrency mining, leading to degraded system performance and increased power consumption. Crucially, the presence of the miner is not the only concern; the established command-and-control (C2) channel remains active, potentially enabling threat actors to deliver additional commands or deploy further malware even after mining operations have commenced.

Hackers Hide XMRig Miner in Windows Registry, PNG, and WAV Files

The initial phase of the attack involves executing a PowerShell script with its execution policy bypassed. This script retrieves obfuscated code from a specific Registry value. It then disables PowerShell command history and repeatedly queries DNS TXT records, converting decimal values into text to ultimately obtain a URL for a PNG file acting as a payload container.

This image file is not merely a decoy. The script extracts hidden data from the red pixel channel of the PNG to reconstruct another malicious script. This steganographic technique is designed to embed hostile instructions within an otherwise ordinary file format. Following this, the reassembled script establishes contact with its controller to receive the next PowerShell component.

Subsequently, another script clears the PublicMusic directory and downloads a ZIP archive containing two files: Atsg.wav and Tmav.wav. Despite their .wav extensions, which typically denote audio files, these are processed by the scripts as data containers. This method allows the malware to bypass basic file extension and type filtering, mirroring tactics seen in other campaigns where malware is hidden within WAV files.

Atsg.wav contains encoded PowerShell instructions aimed at diminishing system visibility and security. It modifies the execution policy, purges command history, adjusts security and telemetry settings, and adds extensive exclusions for Windows Defender. Furthermore, it creates hidden scheduled tasks and a WMI event subscription to ensure persistence. This stage also employs DNS-over-HTTPS TXT queries to locate its command-and-control server.

Memory Execution Extends the Threat

A subsequent WAV file download, named Realtek HD Audio.wav, carries a .NET assembly. The loader component bypasses the standard 44-byte WAV header, reconstructs portions of the following bytes, and loads the resulting assembly directly into the PowerShell process. This in-memory execution prevents the malicious code from being written to disk as a conventional executable.

Tmav.wav operates on a similar principle, capable of fetching mav.wav if it is not present locally. The resulting .NET executable runs entirely in memory and is configured as an XMRig-based miner. It utilizes the RandomX algorithm, employs encrypted communication with its mining pool, and respects a CPU thread limit to avoid immediate suspicion. The malware also drops a signed driver, WinRing0.sys, to optimize mining performance. This illustrates how resource theft can mask a broader compromise, with the persistent C2 channel remaining a significant concern.

While multi-stage delivery methods for XMRig miners are not new, this particular campaign significantly enhances stealth by incorporating Registry, image, audio, and memory-based stages to minimize visible forensic evidence.

What You Should Do

• Monitor PowerShell Activity: Investigate any unusual PowerShell execution, especially instances of execution policy bypasses, dynamic code loaded from Registry values, and DNS TXT lookups followed by file downloads.
• Review Scheduled Tasks and WMI Subscriptions: Regularly audit unexpected scheduled tasks and WMI event subscriptions that could indicate persistence mechanisms.
• Inspect Defender Exclusions: Scrutinize any unauthorized additions or modifications to Windows Defender exclusions.
• Analyze File Access Patterns: Monitor for scripts accessing or processing WAV or PNG files in unusual ways, particularly if these files are treated as data containers rather than their intended media formats.
• Isolate and Remediate: If compromise is detected, immediately isolate the affected host, preserve logs and volatile memory for forensic analysis, block all identified command-and-control infrastructure, and reset all compromised security settings.
• Comprehensive Cleanup: Do not merely remove the miner. Ensure all persistence mechanisms, including Registry-held launchers and scheduled tasks, are eradicated, and confirm that the command channel can no longer communicate with the device.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.