{
  "family": "neksminer",
  "sample_count": 25,
  "category": "cryptominer",
  "description": "NeksMiner (cataloged across security intelligence feeds under signatures including Trojan:Win32/NeksMiner, CoinMiner:Win32/NeksMiner, and Trojan.NeksMiner) is a covert cryptocurrency mining trojan active since 2017. Distributed through trojanized software keygens, cracked game repacks, and malicious torrent archives, NeksMiner stealthily hijacks host CPU and GPU resources to mine privacy-centric cryptocurrencies such as Monero (XMR). Upon infection, NeksMiner injects open-source XMRig mining payloads into legitimate Windows processes (such as svchost.exe or conhost.exe) or executes hidden background services. It actively monitors for Windows Task Manager, Process Hacker, and Process Explorer, instantly throttling or terminating mining threads when analysis tools are launched to avoid user detection, before resuming full mining operations once monitoring utilities are closed.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/NeksMiner",
    "CoinMiner:Win32/NeksMiner",
    "Trojan.NeksMiner",
    "Win32/NeksMiner",
    "CoinMiner:Win32/NeksMiner.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is CoinMiner:Win32/NeksMiner?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "NeksMiner is a stealthy cryptocurrency mining trojan that hijacks computer CPU and GPU power to mine Monero (XMR)."
      }
    },
    {
      "@type": "Question",
      "name": "How does NeksMiner hide from users and Task Manager?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It monitors running processes and automatically pauses its mining threads whenever Task Manager or monitoring tools are opened."
      }
    },
    {
      "@type": "Question",
      "name": "How does NeksMiner get installed onto systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled inside cracked video game installers, software keygens, and torrent downloads from untrusted sources."
      }
    },
    {
      "@type": "Question",
      "name": "What hardware damage or performance issues does NeksMiner cause?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It causes high CPU/GPU temperature, constant thermal throttling, loud cooling fans, and severe system lag."
      }
    },
    {
      "@type": "Question",
      "name": "How can you detect and remove NeksMiner?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Run a full scan with Microsoft Defender, check for unauthorized mining services in services.msc, and block mining pool traffic."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1496",
    "T1055",
    "T1562.001",
    "T1082",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Cracked Game Repacks & Keygens",
    "Torrent File Downloads",
    "Phishing Links on Gaming Forums"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Cryptocurrency Mining (Monero / XMR)",
    "Process Injection into svchost.exe & conhost.exe",
    "Task Manager Process Monitoring & Auto-Throttling",
    "System Hardware & Thermal Discovery",
    "Registry Autostart & Service Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (XMRig Variant)",
      "Service Wrapper Binary"
    ],
    "network_signatures": [
      "Stratum mining protocol traffic (JSON-RPC) on TCP ports 3333, 5555, or 7777 connecting to public Monero mining pools",
      "Direct TLS-wrapped communication with mining pool proxy servers"
    ],
    "evasion_techniques": [
      "Terminating mining threads whenever taskmgr.exe, ProcessHacker.exe, or procexp.exe is detected in foreground",
      "Injecting mining code into trusted system binaries to hide resource usage"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "59e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9",
      "6af2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0"
    ],
    "registry_keys": [
      "HKLM\\SYSTEM\\CurrentControlSet\\Services\\NeksMinerSvc",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\NeksMiner"
    ],
    "file_paths": [
      "%ProgramData%\\NeksMiner\\miner.exe",
      "%AppData%\\NeksMiner\\config.json",
      "%LocalAppdata%\\Temp\\xmr_stage.tmp"
    ]
  },
  "defensive_measures": [
    "Block outbound Stratum mining protocol ports (3333, 4444, 5555, 7777) and known mining pool IP addresses at perimeter firewalls",
    "Deploy endpoint behavioral monitoring to detect persistent high CPU utilization by injected svchost.exe processes",
    "Enforce strict execution controls preventing unverified binaries from running from user temp directories"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - CoinMiner:Win32/NeksMiner",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=CoinMiner:Win32/NeksMiner"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Coinminer.Win32.NeksMiner",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [
      "XMRig Open Source Monero Miner"
    ],
    "variants": [
      "CoinMiner:Win32/NeksMiner.A",
      "Trojan:Win32/NeksMiner.B"
    ]
  },
  "motivation": "Cryptocurrency Mining & Unauthorized Computing Resource Hijacking",
  "sample_hashes": []
}