Hackers Hide XMRig Miner in Windows Registry, PNG and WAV Files to Evade Detection

Hackers are using a layered Windows malware chain to run an XMRig cryptocurrency miner while keeping its key parts out of sight. The operation hides code in the Windows Registry, a PNG image, and files that appear to be ordinary WAV audio, making routine checks less useful.

The attack begins with a PowerShell script that retrieves an encoded next stage from a Registry value. It then uses DNS TXT records to find a download location for a PNG file, an approach that extends the kind of registry stored PowerShell payloads previously seen in stealth-focused Windows intrusions.

Analysts at K7 Security Labs identified the multi-stage infection after investigating repeated PowerShell alerts on an affected system.

K7 Security Labs said in a report shared with Cyber Security News (CSN) that the campaign combines encoded data, remote instructions, persistence, security-control tampering, and memory-only execution.

The immediate effect is unauthorized use of a victim’s CPU for cryptocurrency mining, which can slow systems and raise power use.

More importantly, the miner is not the only concern: the earlier command-and-control channel remains available, potentially allowing operators to send further commands or malware after mining begins.

Hackers Hide XMRig Miner in Windows Registry, PNG and WAV Files

The initial command runs PowerShell with its execution policy bypassed and calls code recovered from a Registry value. The script disables PowerShell command history, then repeatedly looks up DNS TXT data, turns decimal values into text, and obtains a URL for the PNG payload container.

That image is not simply a decoy. The script reads data from its red pixel channel to rebuild another hidden script, a technique designed to conceal malicious instructions inside a familiar file format. The stage contacts its controller and receives the next PowerShell component.

The next script clears the PublicMusic directory, downloads a ZIP archive, and places files named Atsg.wav and Tmav.wav there.

Although their extensions suggest audio, the scripts process them as data containers, a method that can bypass simple extension and file-type filtering much like malware hidden in WAV files in other campaigns.

Atsg.wav supplies encoded PowerShell used to weaken visibility. It changes the execution policy, removes history, alters security and telemetry settings, adds broad Defender exclusions, and creates hidden scheduled tasks plus a WMI event subscription for persistence. It also uses DNS-over-HTTPS TXT queries to locate the controller.

Memory Execution Extends the Threat

A further WAV download, labelled Realtek HD Audio.wav, carries a .NET assembly. The loader skips the normal 44-byte WAV header, combines portions of following bytes, and loads the reconstructed assembly directly into the PowerShell process rather than saving it as a normal executable.

Tmav.wav follows the same model and can obtain mav.wav if it is missing locally. The resulting .NET executable runs in memory and is configured as an XMRig-based miner using the RandomX algorithm, encrypted pool communication, and a CPU thread limit.

The malware also drops the signed WinRing0.sys driver to support mining optimization. This is a useful reminder that a miner can mask a broader compromise.

Similar XMRig miner deployment campaigns have shown how resource theft may arrive through multi-step delivery, but this case adds Registry, image, audio, and memory stages to reduce visible evidence.

Defenders should investigate unusual PowerShell activity, especially execution-policy bypasses, dynamic code from Registry values, and DNS TXT lookups followed by downloads.

They should also review unexpected scheduled tasks, WMI event subscriptions, changes to Defender exclusions, and WAV or PNG files accessed by scripts. Monitoring for PowerShell defense evasion activity can help expose the chain before its final miner runs.

Organizations that find these artifacts should isolate the host, preserve logs and volatile memory where possible, block the listed infrastructure, and reset affected security settings.

Removing only the miner is not enough: responders should search for the Registry-held launcher and persistence mechanisms, then confirm that the command channel can no longer reach the device.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Hackers Hide XMRig Miner in Windows Registry, PNG and WAV Files to Evade Detection appeared first on Cyber Security News.