Hackers Hide XMRig Miner in Windows Registry, PNG and WAV Files to Evade Detection

Hackers are using a layered Windows malware chain to run an XMRig cryptocurrency miner while keeping its key parts out of sight. The operation hides code in the Windows Registry, a PNG image, and files that appear to be ordinary WAV audio, making routine checks less useful.

The attack begins with a PowerShell script that retrieves an encoded next stage from a Registry value. It then uses DNS TXT records to find a download location for a PNG file, an approach that extends the kind of registry stored PowerShell payloads previously seen in stealth-focused Windows intrusions.

Analysts at K7 Security Labs identified the multi-stage infection after investigating repeated PowerShell alerts on an affected system.

K7 Security Labs said in a report shared with Cyber Security News (CSN) that the campaign combines encoded data, remote instructions, persistence, security-control tampering, and memory-only execution.

The immediate effect is unauthorized use of a victim’s CPU for cryptocurrency mining, which can slow systems and raise power use.

More importantly, the miner is not the only concern: the earlier command-and-control channel remains available, potentially allowing operators to send further commands or malware after mining begins.

Hackers Hide XMRig Miner in Windows Registry, PNG and WAV Files

The initial command runs PowerShell with its execution policy bypassed and calls code recovered from a Registry value. The script disables PowerShell command history, then repeatedly looks up DNS TXT data, turns decimal values into text, and obtains a URL for the PNG payload container.

That image is not simply a decoy. The script reads data from its red pixel channel to rebuild another hidden script, a technique designed to conceal malicious instructions inside a familiar file format. The stage contacts its controller and receives the next PowerShell component.

The next script clears the Public\Music directory, downloads a ZIP archive, and places files named Atsg.wav and Tmav.wav there.

Although their extensions suggest audio, the scripts process them as data containers, a method that can bypass simple extension and file-type filtering much like malware hidden in WAV files in other campaigns.

Atsg.wav supplies encoded PowerShell used to weaken visibility. It changes the execution policy, removes history, alters security and telemetry settings, adds broad Defender exclusions, and creates hidden scheduled tasks plus a WMI event subscription for persistence. It also uses DNS-over-HTTPS TXT queries to locate the controller.

Memory Execution Extends the Threat

A further WAV download, labelled Realtek HD Audio.wav, carries a .NET assembly. The loader skips the normal 44-byte WAV header, combines portions of following bytes, and loads the reconstructed assembly directly into the PowerShell process rather than saving it as a normal executable.

Tmav.wav follows the same model and can obtain mav.wav if it is missing locally. The resulting .NET executable runs in memory and is configured as an XMRig-based miner using the RandomX algorithm, encrypted pool communication, and a CPU thread limit.

The malware also drops the signed WinRing0.sys driver to support mining optimization. This is a useful reminder that a miner can mask a broader compromise.

Similar XMRig miner deployment campaigns have shown how resource theft may arrive through multi-step delivery, but this case adds Registry, image, audio, and memory stages to reduce visible evidence.

Defenders should investigate unusual PowerShell activity, especially execution-policy bypasses, dynamic code from Registry values, and DNS TXT lookups followed by downloads.

They should also review unexpected scheduled tasks, WMI event subscriptions, changes to Defender exclusions, and WAV or PNG files accessed by scripts. Monitoring for PowerShell defense evasion activity can help expose the chain before its final miner runs.

Organizations that find these artifacts should isolate the host, preserve logs and volatile memory where possible, block the listed infrastructure, and reset affected security settings.

Removing only the miner is not enough: responders should search for the Registry-held launcher and persistence mechanisms, then confirm that the command channel can no longer reach the device.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
Registry key	HKLM:\Software\uf42a9660377\vstdfehzr	Registry location holding the encoded PowerShell stage
File	vstdfehze.ps1	PowerShell script used in the initial execution command
Domain	sslvalidcert[.]com	DNS TXT record domain used during payload retrieval
URL	http[:]//txtcdn[.]net	Later infrastructure used for encoded retrieval data
URL	https[:]//frames-1zm[.]pages[.]dev/frames.png	PNG payload container download
Domain	httptls[.]org	DNS-over-HTTPS TXT lookup domain used for C2 discovery
URL	https[:]//wavmain[.]pages[.]dev/main.wav	WAV payload download location
URL	https[:]//publicwavlib[.]pages[.]dev/mav.wav	Fallback location for mav.wav
URL	https[:]//config-rg7[.]pages[.]dev/config.txt	Remote XMRig configuration resource
URL	https[:]//softtestcopapool[.]pages[.]dev/rxconfig.txt	Remote mining configuration resource
URL	https[:]//publicwavlib[.]pages[.]dev/hdaudio.wav	Download location for Realtek HD Audio.wav
File	Atsg.wav	WAV container carrying encoded PowerShell and persistence functions
File	Tmav.wav	WAV container carrying the in-memory .NET execution stage
File	Realtek HD Audio.wav	WAV container carrying a hidden .NET assembly
File	mav.wav	WAV container carrying a hidden .NET executable
File	fp.dll	Malware-associated DLL artifact
File	upgrade.exe	Malware-associated executable artifact
File	WinRing0.sys	Signed driver dropped for XMRig CPU optimization
MD5	ED276B2312F641B00F87FA18E85C48EB	Realtek HD Audio.wav
MD5	BE860A15B7E5D44B0B3D67F598238FAD	mav.wav
MD5	C024189E1E7FA0AE6D24353367E8B98D	tmav.wav
MD5	94B50ACE73CC03790678C73B867BE129	atsg.wav
MD5	F94DE28BD66AFC4679F546500DB184D4	fp.dll
MD5	F1D2FDB7F3B699DA69A050C5352A33C2	upgrade.exe
C2 endpoint	104[.]21[.]2[.]193:8443	Observed command-and-control server
Mining endpoint	xmr-asiannanopoolorg:10343	XMRig pool endpoint shown in the embedded configuration

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC