Kiran 
A newly analyzed intrusion shows just how far threat actors will go to keep a payload off the radar.
Instead of dropping a miner straight to disk, the attackers behind this campaign built a five-stage delivery pipeline that hid code inside Windows Registry values, DNS TXT records, a PNG image’s pixel data, and even ordinary-looking WAV audio files, all to quietly install an XMRig-based cryptocurrency miner while keeping a command-and-control channel alive for future abuse.
Hackers Hide Cryptominer in PNG Images and WAV Files
The infection surfaced through repeated PowerShell detection alerts. Investigation traced the activity to a script executed from C:\Windows\System32, which pulled an encoded payload directly out of an HKLM Registry key rather than referencing a file on disk. This let the attacker avoid dropping a conventional .ps1 file that endpoint tools might flag.
The retrieved script periodically queried DNS TXT records first against sslvalidcert.com, later switched to txtcdn.net , converting the decimal-encoded responses into an ASCII URL.
That URL pointed to a PNG file, frames.png, hosted on a Cloudflare Pages subdomain. The image wasn’t decorative: the script extracted data hidden in the red color channel of its pixels, reconstructing a hidden script that opened a live connection to a command-and-control (C2) server.
From there, the C2 server delivered a ZIP archive of files disguised with .wav extensions Atsg.wav and Tmav.wav dropped into the victim’s Public\Music folder. Neither was actual audio.
- Atsg.wav carried a payload focused on defense evasion: it forced PowerShell’s execution policy to Bypass, added broad Microsoft Defender exclusions, wiped command history, and established persistence through hidden Scheduled Tasks and a WMI permanent event subscription tied to a Registry-change trigger.
- Tmav.wav led to a third disguised file,
hdaudio.wav(“Realtek HD Audio.wav”), from which the malware stripped the standard 44-byte WAV header and rebuilt a .NET assembly from the nibbles of the remaining audio bytes, loading it straight into memory via[Reflection.Assembly]::Load()without ever touching disk.
The extracted .NET DLL reinforced the evasion work, disabling Defender-related services and scheduled tasks while further sanitizing PowerShell artifacts.
The final in-memory .NET executable turned out to be a cryptocurrency miner built on the XMRig ecosystem, configured with the RandomX (rx/0) algorithm and pointed at a remote mining pool over TLS, with CPU thread usage capped via a configuration hint.
The miner also fetched supplementary settings from a remote config.txt file and dropped WinRing0.sys, a signed kernel driver XMRig commonly uses to access CPU Model-Specific Registers for RandomX performance tuning.
K7 stated that perhaps the most concerning detail is that the DNS-over-HTTPS-based C2 channel built using a unique 20-character host identifier and an X-HWID header for tracking operates independently of the mining activity.
Even after defenders detect and remove a miner, the underlying channel could remain, giving the operator a path to push new commands or payloads later.
Defenders should hunt for Registry keys under unusual HKLM:\Software subpaths storing binary PowerShell data, WAV files in Public\Music that were never played, and outbound traffic to the associated Cloudflare Pages domains and the C2 endpoint at 104.21.2.193:8443. Given the layered evasion, isolated detection of the miner alone should not be treated as full remediation.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
George antony 
