PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner

A sophisticated cryptomining campaign is employing multiple layers of obfuscation to conceal malicious PowerShell payloads and ultimately deploy an XMRig-based cryptocurrency miner. This obfuscation includes Windows Registry entries, DNS TXT records, PNG images, and WAV audio files.

The infection was detected after repeated security alerts indicated suspicious PowerShell activity. The initial execution command launched PowerShell using the -NoProfile and execution-policy bypass options and retrieved code stored in a Registry value located at HKLM:Softwareuf42a9660377vstdfehzr.

PowerShell Malware Abuses Registry

Instead of saving the next-stage script as a conventional .ps1 file, the attackers encoded the PowerShell data in the Registry. The loader dynamically read, decoded, and executed this data in memory, thereby limiting the malware’s disk footprint and making detection more challenging.

According to K7 Security Labs, the Registry-resident script then queried DNS TXT records associated with sslvalidcert[.]com, which were later replaced by txtcdn[.]net. The TXT responses contained comma-separated decimal values that the malware converted into ASCII text. This process reconstructed a URL pointing to a PNG image hosted at frames-1zm[.]pages[.]dev.

Rather than serving as standard media, the image acted as a covert payload container. The PowerShell script extracted data hidden in the PNG’s red pixel channel, reconstructed the embedded code, and executed it on the infected host. This stage established command-and-control communication and retrieved further PowerShell instructions.

Subsequently, the malware deleted files from the PublicMusic directory. It downloaded a ZIP archive containing files disguised as audio tracks, such as Atsg.wav and Tmav.wav. Even though these files had a .wav extension, they contained encoded malicious PowerShell scripts and embedded .NET payloads.

The Atsg.wav stage primarily focused on persistence and evasion. It modified PowerShell settings, attempted to weaken telemetry and security controls, added broad Microsoft Defender exclusions, and cleared PowerShell command history artifacts. Additionally, the malware created hidden Scheduled Tasks configured to execute at logon and at recurring intervals.

The campaign also established a WMI permanent event subscription that monitored Registry-related events, triggering execution when specified conditions changed. This gave the attackers another persistence mechanism that could survive restarts and maintain access.

The malware generated a unique 20-character hardware identifier for each compromised system and stored it in the Registry. To discover command-and-control servers, it used DNS-over-HTTPS queries to retrieve TXT records linked to httptls[.]org.

It then communicated with discovered C2 infrastructure through HTTP or HTTPS POST requests, using an X-HWID header to identify the victims.

Both WAV-based stages reconstructed hidden .NET assemblies by skipping the standard 44-byte WAV header and combining lower nibbles from consecutive bytes. The resulting payloads were loaded directly into memory using [Reflection.Assembly]::Load(), thereby avoiding the need to write executable files to disk.

The final payload was an XMRig-associated miner configured to utilize the RandomX rx/0 algorithm. It retrieved additional configuration data remotely, including settings for the mining pool, wallet, TLS, keepalive, and CPU usage. The malware also dropped WinRing0.sys, a driver commonly used to optimize CPU performance during RandomX mining.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC