Hackers are using a layered Windows malware chain to run an XMRig cryptocurrency miner while keeping its key parts out of sight. The operation hides code in the Windows Registry, a PNG image, and files that appear to be ordinary WAV audio, making routine checks less useful.

The attack begins with a PowerShell script that retrieves an encoded next stage from a Registry value. It then uses DNS TXT records to find a download location for a PNG file, an approach that extends the kind of registry stored PowerShell payloads previously seen in stealth-focused Windows intrusions.

Analysts at K7 Security Labs identified the multi-stage infection after investigating repeated PowerShell alerts on an affected system.

K7 Security Labs said in a report shared with Cyber Security News (CSN) that the campaign combines encoded data, remote instructions, persistence, security-control tampering, and memory-only execution.

The immediate effect is unauthorized use of a victim’s CPU for cryptocurrency mining, which can slow systems and raise power use.

Attack Chain (Source - K7 Security Labs) — Attack Chain (Source – K7 Security Labs)

More importantly, the miner is not the only concern: the earlier command-and-control channel remains available, potentially allowing operators to send further commands or malware after mining begins.

Hackers Hide XMRig Miner in Windows Registry, PNG and WAV Files

The initial command runs PowerShell with its execution policy bypassed and calls code recovered from a Registry value. The script disables PowerShell command history, then repeatedly looks up DNS TXT data, turns decimal values into text, and obtains a URL for the PNG payload container.

That image is not simply a decoy. The script reads data from its red pixel channel to rebuild another hidden script, a technique designed to conceal malicious instructions inside a familiar file format. The stage contacts its controller and receives the next PowerShell component.

The next script clears the Public\Music directory, downloads a ZIP archive, and places files named Atsg.wav and Tmav.wav there.

Although their extensions suggest audio, the scripts process them as data containers, a method that can bypass simple extension and file-type filtering much like malware hidden in WAV files in other campaigns.

Atsg.wav supplies encoded PowerShell used to weaken visibility. It changes the execution policy, removes history, alters security and telemetry settings, adds broad Defender exclusions, and creates hidden scheduled tasks plus a WMI event subscription for persistence. It also uses DNS-over-HTTPS TXT queries to locate the controller.

Memory Execution Extends the Threat

A further WAV download, labelled Realtek HD Audio.wav, carries a .NET assembly. The loader skips the normal 44-byte WAV header, combines portions of following bytes, and loads the reconstructed assembly directly into the PowerShell process rather than saving it as a normal executable.

Tmav.wav follows the same model and can obtain mav.wav if it is missing locally. The resulting .NET executable runs in memory and is configured as an XMRig-based miner using the RandomX algorithm, encrypted pool communication, and a CPU thread limit.

The malware also drops the signed WinRing0.sys driver to support mining optimization. This is a useful reminder that a miner can mask a broader compromise.

Similar XMRig miner deployment campaigns have shown how resource theft may arrive through multi-step delivery, but this case adds Registry, image, audio, and memory stages to reduce visible evidence.

Script for C2 Establishment (Source - K7 Security Labs) — Script for C2 Establishment (Source – K7 Security Labs)

Defenders should investigate unusual PowerShell activity, especially execution-policy bypasses, dynamic code from Registry values, and DNS TXT lookups followed by downloads.

They should also review unexpected scheduled tasks, WMI event subscriptions, changes to Defender exclusions, and WAV or PNG files accessed by scripts. Monitoring for PowerShell defense evasion activity can help expose the chain before its final miner runs.

Organizations that find these artifacts should isolate the host, preserve logs and volatile memory where possible, block the listed infrastructure, and reset affected security settings.

Removing only the miner is not enough: responders should search for the Registry-held launcher and persistence mechanisms, then confirm that the command channel can no longer reach the device.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
Registry key	`HKLM:\Software\uf42a9660377\vstdfehzr`	Registry location holding the encoded PowerShell stage
File	`vstdfehze.ps1`	PowerShell script used in the initial execution command
Domain	`sslvalidcert[.]com`	DNS TXT record domain used during payload retrieval
URL	`http[:]//txtcdn[.]net`	Later infrastructure used for encoded retrieval data
URL	`https[:]//frames-1zm[.]pages[.]dev/frames.png`	PNG payload container download
Domain	`httptls[.]org`	DNS-over-HTTPS TXT lookup domain used for C2 discovery
URL	`https[:]//wavmain[.]pages[.]dev/main.wav`	WAV payload download location
URL	`https[:]//publicwavlib[.]pages[.]dev/mav.wav`	Fallback location for `mav.wav`
URL	`https[:]//config-rg7[.]pages[.]dev/config.txt`	Remote XMRig configuration resource
URL	`https[:]//softtestcopapool[.]pages[.]dev/rxconfig.txt`	Remote mining configuration resource
URL	`https[:]//publicwavlib[.]pages[.]dev/hdaudio.wav`	Download location for `Realtek HD Audio.wav`
File	`Atsg.wav`	WAV container carrying encoded PowerShell and persistence functions
File	`Tmav.wav`	WAV container carrying the in-memory .NET execution stage
File	`Realtek HD Audio.wav`	WAV container carrying a hidden .NET assembly
File	`mav.wav`	WAV container carrying a hidden .NET executable
File	`fp.dll`	Malware-associated DLL artifact
File	`upgrade.exe`	Malware-associated executable artifact
File	`WinRing0.sys`	Signed driver dropped for XMRig CPU optimization
MD5	`ED276B2312F641B00F87FA18E85C48EB`	`Realtek HD Audio.wav`
MD5	`BE860A15B7E5D44B0B3D67F598238FAD`	`mav.wav`
MD5	`C024189E1E7FA0AE6D24353367E8B98D`	`tmav.wav`
MD5	`94B50ACE73CC03790678C73B867BE129`	`atsg.wav`
MD5	`F94DE28BD66AFC4679F546500DB184D4`	`fp.dll`
MD5	`F1D2FDB7F3B699DA69A050C5352A33C2`	`upgrade.exe`
C2 endpoint	`104[.]21[.]2[.]193:8443`	Observed command-and-control server
Mining endpoint	`xmr-asiannanopoolorg:10343`	XMRig pool endpoint shown in the embedded configuration

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Hackers Hide XMRig Miner in Windows Registry, PNG and WAV Files to Evade Detection appeared first on Cyber Security News.