XMRig Campaign Disguises Malicious Code Across Affected Windows Systems

EXECUTIVE SUMMARY:

A multi-stage cryptocurrency mining campaign has been observed using heavily obfuscated PowerShell execution combined with Registry-based payload storage and covert data delivery techniques. The infection chain progressively reconstructs malicious components from Registry values, DNS TXT records, PNG images and WAV files before deploying an XMRig-based cryptocurrency miner. The campaign also incorporates persistence and defense-evasion mechanisms to maintain access while reducing visibility of malicious activity on compromised Windows systems.[emaillocker id="1283"]

The infection begins with PowerShell retrieving an encoded payload from a Registry value before querying DNS TXT records to obtain a URL hosting a PNG image containing hidden data. The extracted payload establishes C2 communication and retrieves additional PowerShell instructions. A subsequent ZIP archive contains WAV files that serve as covert payload containers. The extracted scripts modify PowerShell execution settings, weaken selected security and telemetry controls, create Microsoft Defender exclusions, remove PowerShell history and establish persistence through scheduled tasks and WMI permanent event subscriptions. Additional payloads use DNS-over-HTTPS for C2 discovery before communicating through HTTP or HTTPS requests. Embedded .NET assemblies are reconstructed from WAV files and loaded directly into memory through .NET reflection without being written to disk. The final .NET executable functions as an XMRig-based cryptocurrency miner using the RandomX algorithm and remotely retrieved mining configurations.

It demonstrates extensive use of payload concealment, defense evasion, persistence and memory-based execution to reduce detection opportunities throughout the attack. Although cryptocurrency mining is the final observed objective, the persistent C2 channel remains capable of delivering additional commands or payloads after the miner is deployed. Organizations should monitor unusual PowerShell activity, Registry-based script execution, DNS TXT queries, suspicious image or WAV downloads, unauthorized Defender configuration changes, Scheduled Task creation, WMI event subscriptions and in-memory .NET execution.

THREAT PROFILE:

MBC PROFILE:

REFERENCES:

The following reports contain further technical details:
https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/