Hackers Hide XMRig Miner in Windows Registry, PNG and WAV Files to Evade Detection
K7 Security Labs discovered a multi-stage Windows malware chain hiding an XMRig miner in the Registry, PNG, and WAV files.
K7 Security Labs analysts investigated repeated PowerShell alerts and uncovered a layered infection that stores encoded PowerShell in a Registry value, uses DNS TXT lookups to retrieve a PNG container whose red pixel channel hides a script, and downloads WAV files (Atsg.wav, Tmav.wav, Realtek HD Audio.wav) that carry encoded stages and .NET assemblies. The chain tampers with Defender exclusions and execution policy, establishes persistence via scheduled tasks and WMI event subscriptions, and loads an XMRig RandomX miner entirely in memory, aided by the signed WinRing0.sys driver. The active C2 channel could allow operators to deliver additional payloads beyond cryptomining.
- PowerShell stage reads encoded payload from Registry value HKLM:\Software\uf42a9660377\vstdfehzr
- PNG red-pixel channel hides a script retrieved via DNS TXT resolution
- WAV files used as data containers bypass simple file-type filtering
- .NET XMRig miner with RandomX runs memory-only; WinRing0.sys driver dropped
- C2 channel persists, enabling delivery of further payloads beyond mining
- ATT&CK
- T1112 Modify RegistryT1140 Deobfuscate/Decode Files or InformationT1059.001 PowerShellT1547.001 Registry Run Keys / Startup FolderT1562.001 Disable or Modify Tools
- Tags
- cryptominingdefender-evasionk7-security-labspowershellregistry-persistencesteganographywmi-persistencexmrig
- Vendors
- K7 Security LabsMicrosoft
- Products
- XMRigWinRing0.sys
- Malware
- XMRig
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | config-rg7.pages.dev | s[.]dev/mav.wav Fallback location for mav.wav URL https[:]//config-rg7[.]pages[.]dev/config.txt Remote XMRig configuration resource URL http |
| domain | frames-1zm.pages.dev | nfrastructure used for encoded retrieval data URL https[:]//frames-1zm[.]pages[.]dev/frames.png PNG payload container download Domain httptl |
| domain | httptls.org | ages[.]dev/frames.png PNG payload container download Domain httptls[.]org DNS-over-HTTPS TXT lookup domain used for C2 discovery UR |
| domain | publicwavlib.pages.dev | [.]dev/main.wav WAV payload download location URL https[:]//publicwavlib[.]pages[.]dev/mav.wav Fallback location for mav.wav URL https[:]//con |
| domain | softtestcopapool.pages.dev | onfig.txt Remote XMRig configuration resource URL https[:]//softtestcopapool[.]pages[.]dev/rxconfig.txt Remote mining configuration resource URL h |
| domain | sslvalidcert.com | erShell script used in the initial execution command Domain sslvalidcert[.]com DNS TXT record domain used during payload retrieval URL h |
| domain | txtcdn.net | XT record domain used during payload retrieval URL http[:]//txtcdn[.]net Later infrastructure used for encoded retrieval data URL |
| domain | wavmain.pages.dev | HTTPS TXT lookup domain used for C2 discovery URL https[:]//wavmain[.]pages[.]dev/main.wav WAV payload download location URL https[:]//pu |
| ipv4 | 104.21.2.193 | D5 F1D2FDB7F3B699DA69A050C5352A33C2 upgrade.exe C2 endpoint 104[.]21[.]2[.]193:8443 Observed command-and-control server Mining endpo |
| md5 | 94b50ace73cc03790678c73b867be129 | D mav.wav MD5 C024189E1E7FA0AE6D24353367E8B98D tmav.wav MD5 94B50ACE73CC03790678C73B867BE129 atsg.wav MD5 F94DE28BD66AFC4679F546500DB184D4 fp.dll MD5 F1 |
| md5 | be860a15b7e5d44b0b3d67f598238fad | 5 ED276B2312F641B00F87FA18E85C48EB Realtek HD Audio.wav MD5 BE860A15B7E5D44B0B3D67F598238FAD mav.wav MD5 C024189E1E7FA0AE6D24353367E8B98D tmav.wav MD5 9 |
| md5 | c024189e1e7fa0ae6d24353367e8b98d | Audio.wav MD5 BE860A15B7E5D44B0B3D67F598238FAD mav.wav MD5 C024189E1E7FA0AE6D24353367E8B98D tmav.wav MD5 94B50ACE73CC03790678C73B867BE129 atsg.wav MD5 |
| md5 | ed276b2312f641b00f87fa18e85c48eb | g0.sys Signed driver dropped for XMRig CPU optimization MD5 ED276B2312F641B00F87FA18E85C48EB Realtek HD Audio.wav MD5 BE860A15B7E5D44B0B3D67F598238FAD m |
| md5 | f1d2fdb7f3b699da69a050c5352a33c2 | 29 atsg.wav MD5 F94DE28BD66AFC4679F546500DB184D4 fp.dll MD5 F1D2FDB7F3B699DA69A050C5352A33C2 upgrade.exe C2 endpoint 104[.]21[.]2[.]193:8443 Observed co |
| md5 | f94de28bd66afc4679f546500db184d4 | tmav.wav MD5 94B50ACE73CC03790678C73B867BE129 atsg.wav MD5 F94DE28BD66AFC4679F546500DB184D4 fp.dll MD5 F1D2FDB7F3B699DA69A050C5352A33C2 upgrade.exe C2 |
From the original article
4 min read at cybersecuritynews.com
Hackers are using a layered Windows malware chain to run an XMRig cryptocurrency miner while keeping its key parts out of sight. The operation hides code in the Windows Registry, a PNG image, and files that appear to be ordinary WAV audio, making routine checks less useful. The attack begins with a PowerShell script that […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.