CTI · corroborated · 2026-09-19

PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner

Full story & timeline

MITRE ATT&CK

• T1059 Command and Scripting Interpreter Execution
• T1086 PowerShell Execution
• T1112 Modify Registry Defense Impairment
• T1071 Application Layer Protocol Command and Control
• T1027 Obfuscated Files or Information Stealth

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: PowerShell Cryptominer Loader - Registry + DNS TXT + Steganography Chain
id: c9f5e4d3-6b0a-4c3f-9e8d-4b2a7f6c0e1d
status: experimental
description: Detects multi-stage PowerShell cryptominer loader that reads encoded payloads from Registry (HKLM:\Software\uf42a9660377), resolves DNS TXT records to decode C2 URLs, and downloads steganographic PNG/WAV payloads for XMRig deployment.
references:
  - https://gbhackers.com/
  - https://cyberpress.org/
author: Tia N. List
date: 2026-09-19
tags:
  - attack.t1059
  - attack.t1086
  - attack.t1112
  - attack.t1071
logsource:
  product: windows
  service: process_creation
detection:
  selection_ps_noprofile:
    Image|endswith: '\powershell.exe'
    CommandLine|contains|all:
      - '-NoProfile'
      - '-ExecutionPolicy'
      - 'Bypass'
  selection_registry_access:
    Image|endswith: '\powershell.exe'
    CommandLine|contains|all:
      - 'HKLM:\Software'
      - 'uf42a9660377'
  selection_dns_txt:
    Image|endswith: '\powershell.exe'
    CommandLine|contains|all:
      - 'Resolve-DnsName'
      - '-Type'
      - 'TXT'
  selection_encoded_download:
    Image|endswith: '\powershell.exe'
    CommandLine|contains|all:
      - '[Convert]::FromBase64String'
      - 'Invoke-Expression'
  condition: selection_ps_noprofile and (selection_registry_access or selection_dns_txt or selection_encoded_download)
falsepositives:
  - Legitimate PowerShell scripts using -NoProfile with registry operations
  - IT automation scripts querying DNS TXT records
level: high

References

• https://gbhackers.com/
• https://cyberpress.org/