# PowerShell Cryptomining Loader Abuses Registry-Resident Scripts, DNS TXT Records, and PNG/WAV Steganography for Stealth C2

> A multi-stage, fileless PowerShell campaign stores an encoded loader in the Windows Registry, retrieves C2 instructions via DNS TXT records, and hides subsequent .NET payloads inside a PNG's red pixel channel and WAV audio data to deploy an in-memory XMRig RandomX miner, while establishing persistence via Defender exclusions, hidden Scheduled Tasks, and a WMI permanent event subscription.

- **Published:** 2026-09-20T00:00:00Z
- **Last reviewed:** 2026-09-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2593
- **ID:** TL-2026-2593
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2020-14979

## Description

K7 Security Labs identified the campaign after repeated PowerShell-activity alerts on a monitored Windows host. The infection begins with a PowerShell process launched using -NoProfile and an execution-policy bypass, which reads and decodes an encoded script stored directly in the Registry value HKLM:\Software\uf42a9660377\vstdfehzr rather than as a .ps1 file on disk, limiting the malware's forensic footprint from the outset.

The registry-resident script queries DNS TXT records for sslvalidcert.com (later rotated to txtcdn.net) using Resolve-DnsName; the TXT response carries comma-separated decimal values that are converted to ASCII to reconstruct a payload URL, frames-1zm.pages.dev/frames.png. The script then extracts data from the red colour channel of that PNG's pixels to reconstruct and execute a further stage, which opens a command channel to receive additional PowerShell instructions and downloads two WAV containers -- Atsg.wav and Tmav.wav -- from Cloudflare Pages-hosted domains. Both WAV files are decoded by skipping the standard 44-byte WAV header and recombining the lower nibbles of consecutive bytes to reconstruct embedded .NET assemblies, which are loaded directly into memory via [Reflection.Assembly]::Load() rather than written to disk.

The Atsg.wav stage performs defense evasion and persistence: it sets the PowerShell execution policy to Bypass, adds broad Microsoft Defender exclusions, disables/clears PowerShell command history, installs hidden Scheduled Tasks that fire at logon and on a recurring interval, and creates a WMI permanent event subscription that monitors Registry conditions to re-trigger the chain across reboots. It also generates a 20-character hardware identifier stored in the Registry and used as an X-HWID header on subsequent HTTP/HTTPS POST requests, and performs DNS-over-HTTPS lookups against Google's public resolver for TXT records at httptls.org to rediscover C2 endpoints if the primary channel is blocked.

The Tmav.wav stage reconstructs and in-memory-loads the XMRig miner, configured for the RandomX (rx/0) algorithm against a Monero mining pool over TLS with a keepalive channel and a CPU thread-count hint of up to 40, with live pool/wallet/threading parameters pulled from remote config resources (config-rg7.pages.dev/config.txt, softtestcopapool.pages.dev/rxconfig.txt). To optimize RandomX performance the malware also drops the signed kernel driver WinRing0.sys / WinRing0x64.sys, whose 1.2.0 build (as bundled in EVGA Precision X1 through 1.0.6) is tracked under CVE-2020-14979: the driver lets any local process, including low-integrity ones, read and write arbitrary physical memory by mapping \Device\PhysicalMemory, granting NT AUTHORITY\SYSTEM-equivalent MSR/memory access without a Windows kernel exploit. A separate defense-evasion DLL (fp.dll) further modifies PowerShell profiles and disables Defender services/scheduled tasks. All observed C2 traffic converges on 104.21.2.193:8443, an IP inside Cloudflare's shared anycast range. K7 Labs assesses that even after the miner is remediated, the underlying C2 channel could persist and deliver payloads beyond cryptomining. No CVE is required for initial execution, no actor attribution or campaign name is given in reporting, and the observed motivation is financial (Monero mining).

## MITRE ATT&CK

- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1112 Modify Registry
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1620 Reflective Code Loading
- T1685 Disable or Modify Tools
- T1070.003 Clear Command History
- T1053.005 Scheduled Task
- T1546.003 Windows Management Instrumentation Event Subscription
- T1071.004 DNS
- T1071.001 Web Protocols
- T1001.002 Steganography
- T1132.002 Non-Standard Encoding
- T1496 Resource Hijacking

## Sources

- [PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner](https://gbhackers.com/powershell-malware-abuses-registry-and-dns-txt-records/)
- [From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection Chain](https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/)
- [Hackers Hide PowerShell Malware in Registry, PNG and WAV Files to Deploy XMRig Miner](https://cyberpress.org/hackers-hide-powershell-malware-in-registry/)
- [Registry-Resident PowerShell Chain Deploys In-Memory XMRig Miner](https://mallory.ai/stories/01a0b2b7-a016-7264-a073-b38f15582f35)
- [NVD - CVE-2020-14979](https://nvd.nist.gov/vuln/detail/CVE-2020-14979)
- [VulnerableDriver:WinNT/Winring0.A threat description](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VulnerableDriver%3AWinNT%2FWinring0.A)
- [Windows: Vulnerable WinRing0 Driver Load](https://help.fortinet.com/fsiem/Public_Resource_Access/7_1_0/rules/PH_RULE_Vulnerable_WinRing0_Driver_Load.htm)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2593