Hackers Conceal XMRig Miner in Windows Registry, PNG, and WAV Files to Evade Detection
A sophisticated multi-stage infection chain hides the XMRig cryptocurrency miner within the Windows Registry, PNG images, and WAV audio files, employing PowerShell and DNS TXT records for stealthy execution and command and control.
Cybercriminals are employing a complex, multi-stage infection chain to deploy the XMRig cryptocurrency miner while meticulously evading detection. This operation leverages the Windows Registry, PNG image files, and seemingly innocuous WAV audio files as containers for malicious code, rendering traditional file-based security scans less effective. The attack chain begins with a PowerShell script designed to retrieve encoded payloads from a Registry value, a technique that builds upon previously observed methods for stealthy Windows intrusions.
Security researchers at K7 Security Labs identified this sophisticated campaign, noting its combination of encoded data, remote command and control (C2) instructions, persistence mechanisms, security control tampering, and memory-only execution. The immediate impact for victims is the unauthorized utilization of their CPU resources for cryptocurrency mining, which can lead to performance degradation and increased power consumption. However, the mining operation is not the sole threat; the established C2 channel remains open, presenting an avenue for attackers to deploy additional malware or issue further commands.
The infection process initiates with a PowerShell script that bypasses execution policies. This script disables PowerShell command history and then proceeds to query DNS TXT records. It decodes decimal values from these records to construct a URL for a PNG payload container. This PNG file is not merely a decoy; the script extracts hidden malicious instructions by reading data from its red pixel channel, a clever method to conceal code within a common file format.
Upon retrieving the PNG, the script contacts its controller to obtain the next PowerShell component. This subsequent script clears the Public\Music directory, downloads a ZIP archive, and extracts files named Atsg.wav and Tmav.wav. Despite their .wav extensions, these files are treated as data containers by the scripts, a tactic that can bypass simple file extension and type filtering, mirroring techniques seen in other campaigns where malware is hidden within audio files.
The Atsg.wav file contains encoded PowerShell designed to weaken system defenses. It modifies execution policies, clears command history, alters security and telemetry settings, establishes broad Microsoft Defender exclusions, and creates hidden scheduled tasks and WMI event subscriptions for persistence. It also utilizes DNS-over-HTTPS TXT queries for C2 discovery.
A subsequent WAV download, named Realtek HD Audio.wav, contains a .NET assembly. The loader bypasses the standard 44-byte WAV header, reconstructs the assembly from subsequent bytes, and loads it directly into the PowerShell process in memory, avoiding the creation of a traditional executable file. The Tmav.wav file follows a similar pattern and can download a fallback file named mav.wav if locally absent.
The final .NET executable operates entirely in memory, configured as an XMRig miner utilizing the RandomX algorithm, encrypted pool communication, and a limited number of CPU threads. The malware also deploys the signed WinRing0.sys driver to optimize CPU usage for mining. This campaign serves as a stark reminder that cryptocurrency miners can mask more extensive compromise, with this particular operation adding Registry, image, audio, and memory stages to its evasion arsenal.
Security professionals should be vigilant for unusual PowerShell activity, including execution policy bypasses, dynamic code retrieval from Registry values, and DNS TXT lookups followed by downloads. Monitoring for unexpected scheduled tasks, WMI event subscriptions, changes to Defender exclusions, and suspicious access to WAV or PNG files by scripts is also crucial. Organizations detecting these indicators should isolate affected hosts, preserve logs and volatile memory, block identified infrastructure, and thoroughly reset security configurations, ensuring that the command channel is severed and persistence mechanisms are removed.