{
  "family": "nicehashminer",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "PUA:Win32/Nicehashminer is a legitimate, widely used cryptocurrency mining application that allows users to rent out their computing power. However, it is heavily flagged as a Potentially Unwanted Application (PUA) or 'CoinMiner' by enterprise antivirus engines because threat actors frequently bundle it silently with malware or deploy it en masse across compromised corporate networks (Cryptojacking) to illegally hijack CPU/GPU resources (`T1496`).<br><br><b>Understanding Nicehashminer (Cryptojacking Vector)</b><br>To an end-user intentionally running it, it's a way to earn crypto. To a corporate IT department, its unauthorized presence represents a massive theft of electricity, severe degradation of workstation performance, and a clear indication that perimeter defenses or endpoint controls have failed, allowing an attacker to execute arbitrary binaries.<br><br><b>Execution and Resource Hijacking Mechanics</b><br>When deployed maliciously, attackers use droppers or exploit tools (like PsExec) to silently install the Nicehashminer client on victim machines. They configure the application (`.json` or `.ini` files) to mine cryptocurrency to the attacker's wallet address rather than the victim's. They often use scheduled tasks or registry run keys to ensure the miner starts automatically (`T1547.001`), and may use simple scripts to hide the mining window from the user's desktop.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme resource exhaustion and increased operational costs. Host-based IoCs are highly visible: CPU or GPU utilization will pin at 90-100%, causing the system fans to run loudly and the machine to become sluggish. You will find the `nicehashminer.exe` process (or renamed variants) running, often from unusual directories like `%Temp%` or `C:\\Windows\\Temp`. Network IoCs include continuous outbound traffic over specific mining stratum protocols (e.g., port 3333, 4444) to known mining pools like `stratum.nicehash.com`.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Nicehashminer and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Nicehashminer is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Nicehashminer establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Nicehashminer typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Nicehashminer compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Nicehashminer should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Nicehashminer leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Nicehashminer frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Nicehashminer maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Nicehashminer often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1204.002",
    "T1547.001",
    "T1496"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1496",
      "name": "Resource Hijacking (The core activity of utilizing CPU/GPU power for cryptomining)",
      "tactic": "Impact"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (Often bundled with 'free' software the user downloads)",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys (Ensuring the miner runs constantly)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Terminate the rogue mining processes to immediately restore system performance.",
    "Identify how the miner was installed; if a user intentionally installed it, enforce corporate acceptable use policies. If it was dropped by malware, initiate a full incident response.",
    "Block known mining pool domains (e.g., *.nicehash.com) and stratum protocol ports at the corporate firewall.",
    "Enforce strict Application Control (AppLocker) to prevent the execution of known mining binaries."
  ],
  "what_to_avoid": [
    "Do not dismiss cryptomining as a 'low severity' threat; if an attacker can deploy a miner, they can just as easily deploy ransomware.",
    "Avoid relying solely on CPU monitoring, as advanced malicious deployments can throttle the miner when user activity is detected."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}