{
  "family": "multiminer",
  "sample_count": 3,
  "category": "ransomware",
  "description": "CoinMiner:Win32/Multiminer represents a prevalent class of malware known as **Cryptojackers or Cryptocurrency Miners**. Unlike ransomware that destroys data, Multiminer's objective is entirely parasitic: it silently hijacks the infected computer's processing power (CPU and/or GPU) to solve complex cryptographic algorithms, mining cryptocurrency (like Monero or Bitcoin) and sending the profits directly to the attacker's wallet.<br><br><b>Understanding Multiminer (Cryptojacking)</b><br>To an end-user, the primary symptom of a Multiminer infection is severe system sluggishness. The computer's fans will spin constantly at maximum speed, applications will hang, and laptop batteries will drain rapidly. For an enterprise, widespread cryptomining infections represent a massive, unauthorized consumption of electricity and cloud computing resources, resulting in tangible financial loss and hardware degradation.<br><br><b>Execution and Resource Hijacking Mechanics</b><br>Multiminer is often distributed via opportunistic botnets scanning for unpatched vulnerabilities (like EternalBlue), malicious email attachments (`T1566.001`), or bundled with pirated software. Upon execution, it establishes persistence, often running as a hidden Windows Service (`T1543.003`) or via a scheduled task. The core payload (`T1496`) is a mining binary (often a modified version of open-source tools like XMRig). The malware configures the miner to connect to a specific mining pool over the internet (`T1071.001`), providing the attacker's wallet address. Advanced variants use defense evasion techniques to detect if Task Manager or security tools are opened, temporarily pausing the mining process to avoid detection (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is significant resource theft, hardware wear, and inflated cloud infrastructure bills. Host-based IoCs include EDR alerts for sustained, 100% CPU/GPU utilization by unknown processes (often disguised as `svchost.exe` or `wuauclt.exe`). Network IoCs are highly distinct: consistent, unencrypted TCP connections to known cryptocurrency mining pools (e.g., using the Stratum protocol on ports 3333, 14444, or 443).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1071.001",
    "T1496",
    "T1543.003",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1496",
      "name": "Resource Hijacking (Cryptocurrency mining)",
      "tactic": "Impact"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (Connecting to mining pools)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Pausing mining when Task Manager opens)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to immediately sever the connection to the mining pool and halt the unauthorized resource consumption.",
    "Use EDR or Process Explorer to identify the heavily obfuscated mining process consuming CPU cycles and terminate it.",
    "Audit Windows Services and Scheduled Tasks to locate and remove the persistence mechanisms used to restart the miner.",
    "Implement network-level blocking of known cryptocurrency mining pool IP addresses and domains at the corporate firewall."
  ],
  "what_to_avoid": [
    "Do not ignore complaints of 'slow computers'; while often a benign IT issue, widespread sluggishness is a primary indicator of a cryptojacking outbreak.",
    "Avoid assuming cryptominers are harmless; threat actors often deploy miners as a secondary payload after establishing a backdoor, meaning data theft may have also occurred."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}