Researchers have discovered a sophisticated multi-stage cryptomining campaign that employs PowerShell, Registry-stored payloads, DNS TXT records, PNG images, and WAV audio files to conceal malware and deploy an XMRig-based cryptocurrency miner on compromised Windows systems. Initial analysis revealed that the malware executed PowerShell with -NoProfile and execution-policy bypass settings, subsequently retrieving a malicious script from the Windows Registry. PowerShell Malware in Registry The command accessed a value under HKLM:\Software\uf42a9660377\vstdfehzr, enabling the attacker to circumvent placing the next-stage PowerShell payload directly on disk.

The implant communicates over HTTP or HTTPS POST requests using an X-HWID header and supports commands for delivering and asynchronously executing additional PowerShell code.

XMRig configuration retrieved (Source: K7 Security Labs) The reconstructed assemblies were loaded directly into memory via [Reflection.Assembly]::Load(), bypassing a traditional executable write to disk. Indicators of Compromise Type Indicator Details Registry path HKLM:\Software\uf42a9660377\vstdfehzr Stores encoded PowerShell stage Domain sslvalidcert[. ]com DNS TXT payload delivery Domain txtcdn[.

]net Later DNS TXT payload delivery Domain httptls[. ]org DNS-over-HTTPS C2 discovery URL https[:]//frames-1zm[. ]pages.dev/frames.png PNG payload container URL https[:]//publicwavlib[. ]pages.dev/hdaudio.wav WAV-hosted .NET assembly URL https[:]//publicwavlib[.

]pages.dev/mav.wav WAV-hosted .NET executable URL https[:]//wavmain[. ]pages.dev/main.wav Malicious payload resource URL https[:]//config-rg7[. ]pages.dev/config.txt Mining configuration URL https[:]//softtestcopapool[. ]pages.dev/rxconfig.txt Mining configuration File Realtek HD Audio.wav MD5: ED276B2312F641B00F87FA18E85C48EB File mav.wav MD5: BE860A15B7E5D44B0B3D67F598238FAD File tmav.wav MD5: C024189E1E7FA0AE6D24353367E8B98D File atsg.wav MD5: 94B50ACE73CC03790678C73B867BE129 File fp.dll MD5: F94DE28BD66AFC4679F546500DB184D4 File upgrade.exe MD5: F1D2FDB7F3B699DA69A050C5352A33C2 C2 server 104[.]21[.]2[.

]193:8443 Command-and-control endpoint