{
  "family": "mine",
  "sample_count": 10,
  "category": "advanced_threat",
  "description": "CoinMiner:Win32/Mine (also tracked under generic 'Miner' heuristics) represents a massive class of malware designed to secretly hijack the processing power (CPU and GPU) of infected endpoints to mine cryptocurrency (most commonly Monero) for the financial benefit of the attacker.<br><br><b>Understanding Cryptominers</b><br>To an end-user, the infection manifests as a sluggish, overheating computer with constantly spinning fans and terrible battery life. For a security analyst, unauthorized cryptomining ('Cryptojacking') is a severe resource hijacking event that drastically increases cloud compute costs, wears out hardware, and indicates a critical failure in perimeter security. Attackers frequently use automated worms or exploit internet-facing vulnerabilities to drop miners on hundreds of servers simultaneously.<br><br><b>Execution and Hijacking Mechanics</b><br>Miners are often deployed as secondary payloads by botnets (like Mirai or Sefnit) or via lateral movement using stolen credentials (`T1078`). Upon execution, the payload establishes persistence via WMI event subscriptions (`T1546.003`) or Scheduled Tasks (`T1053.005`). To evade detection, the miner frequently utilizes 'Process Hollowing' (`T1055.012`), injecting the mining engine (often a customized version of the open-source XMRig) into a legitimate Windows process (like `notepad.exe` or `svchost.exe`). The injected process then begins massive mathematical calculations (`T1496`), communicating exclusively via the Stratum protocol (`T1071`) to a remote mining pool to receive work and submit hashes.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme resource degradation, potential hardware failure, and massive electricity/cloud billing spikes. The primary IoC is sustained, 100% CPU/GPU utilization by an unexpected process, or a legitimate process (like `svchost.exe`) consuming massive amounts of CPU without a clear reason. Network logs will reveal persistent outbound connections on unusual ports (like 3333, 4444, or 7777) to known cryptocurrency mining pools.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1546.003",
    "T1071",
    "T1496",
    "T1055.012"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1496",
      "name": "Resource Hijacking (Cryptomining)",
      "tactic": "Impact"
    },
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1071",
      "name": "Application Layer Protocol (Stratum Protocol to Mining Pools)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1546.003",
      "name": "Event Triggered Execution: Windows Management Instrumentation Event Subscription",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to sever the connection to the mining pool and halt the resource drain.",
    "Use EDR or Process Explorer to identify the heavily utilizing process; if it's a legitimate Windows binary, assume it has been hollowed out/injected.",
    "Block the mining pool IP addresses and domains at the enterprise firewall.",
    "Investigate the initial vector: If a server was infected, review external-facing web application logs for recent exploitation attempts (e.g., Log4Shell, WebLogic exploits)."
  ],
  "what_to_avoid": [
    "Do not simply kill the process; most modern miners use a secondary 'watchdog' service to immediately restart the mining engine if it is terminated.",
    "Avoid ignoring the alert as a 'low priority' PUA; if an attacker can deploy a miner, they can just as easily deploy ransomware."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}