Mine
Table of Contents
Overview
CoinMiner:Win32/Mine (also tracked under generic 'Miner' heuristics) represents a massive class of malware designed to secretly hijack the processing power (CPU and GPU) of infected endpoints to mine cryptocurrency (most commonly Monero) for the financial benefit of the attacker.
Understanding Cryptominers
To an end-user, the infection manifests as a sluggish, overheating computer with constantly spinning fans and terrible battery life. For a security analyst, unauthorized cryptomining ('Cryptojacking') is a severe resource hijacking event that drastically increases cloud compute costs, wears out hardware, and indicates a critical failure in perimeter security. Attackers frequently use automated worms or exploit internet-facing vulnerabilities to drop miners on hundreds of servers simultaneously.
Execution and Hijacking Mechanics
Miners are often deployed as secondary payloads by botnets (like Mirai or Sefnit) or via lateral movement using stolen credentials (`T1078`). Upon execution, the payload establishes persistence via WMI event subscriptions (`T1546.003`) or Scheduled Tasks (`T1053.005`). To evade detection, the miner frequently utilizes 'Process Hollowing' (`T1055.012`), injecting the mining engine (often a customized version of the open-source XMRig) into a legitimate Windows process (like `notepad.exe` or `svchost.exe`). The injected process then begins massive mathematical calculations (`T1496`), communicating exclusively via the Stratum protocol (`T1071`) to a remote mining pool to receive work and submit hashes.
Indicators of Compromise & Impact
The impact is extreme resource degradation, potential hardware failure, and massive electricity/cloud billing spikes. The primary IoC is sustained, 100% CPU/GPU utilization by an unexpected process, or a legitimate process (like `svchost.exe`) consuming massive amounts of CPU without a clear reason. Network logs will reveal persistent outbound connections on unusual ports (like 3333, 4444, or 7777) to known cryptocurrency mining pools.
MITRE ATT&CK Techniques
Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:
| Technique | Name | Tactic | Official Spec |
|---|---|---|---|
T1496 | Resource Hijacking (Cryptomining) | Impact | ATT&CK ↗ |
T1055.012 | Process Injection: Process Hollowing | Defense Evasion | ATT&CK ↗ |
T1071 | Application Layer Protocol (Stratum Protocol to Mining Pools) | Command and Control | ATT&CK ↗ |
T1546.003 | Event Triggered Execution: Windows Management Instrumentation Event Subscription | Persistence | ATT&CK ↗ |
Tactical Mitigations
Based on the techniques used by this family, consider the following defensive strategies:
- T1071: Monitor network traffic for anomalous application layer protocols like non-standard HTTP/S patterns or unexpected DNS requests.
MITRE D3FEND™ Defensive Countermeasures
Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):
| D3FEND ID | Countermeasure Name | Tactic | Countered ATT&CK | Defensive Guidance |
|---|---|---|---|---|
D3-PHA | Process Hollowing Analysis | Detect | T1055.012 | Inspect unbacked executable memory regions (PAGE_EXECUTE_READWRITE) for replaced PE image headers inside legitimate host processes. |
D3-ALPA | Application Layer Protocol Analysis | Detect | T1071 | Fingerprint application traffic structures and enforce TLS inspection for external outbound sessions. |
D3-PEA | Processor Execution Auditing | Detect | T1496 | Alert on sustained high CPU/GPU utilization by processes originating from temporary user directories and block stratum mining pool ports. |
Tiered Detection Rules (Cisco CAIRN Model)
Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:
Tier 1 Primitive Artifact Rule (Fast Triage)
Matches raw strings and file markers. Vulnerable to binary repacking and simple obfuscation.
rule MALWARE_WIN_MINE_T1_ARTIFACT {
meta:
description = "Tier 1 Primitive Artifact: Raw string matches for Mine"
tier = "T1 - Primitive Artifact"
confidence = "Low-Medium (Fast Triage)"
author = "SystemHelpdesk Threat Research Desk"
date = "2026-10-14"
strings:
$s1 = "mine" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Tier 2 Behavioral Context Rule (Process Chains & Sigma)
Tracks parent-child process anomalies and suspicious scripting telemetry. Resilient against file renames.
title: SystemHelpDesk Detection - Mine (Advanced Threat) Execution & Triage
id: a6ae99a0-7ab5-54fb-8461-c1451f45dd38
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
with the Mine malware family. Detects proxy execution, reflective DLL loading, and
remote command injection associated with modular enterprise backdoors.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/mine
- https://malware-families-catalog.systemhelpdesk.com/defensive/backdoor-rat-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.advanced-threat
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1546_003
- attack.t1071
- attack.t1496
- attack.t1055_012
logsource:
category: process_creation
product: windows
detection:
selection_process:
Image|endswith:
- \powershell.exe
- \cmd.exe
- \rundll32.exe
- \regsvr32.exe
CommandLine|contains:
- DownloadString
- IEX(
- '/s /n /u /i:'
- sc create
- start-process
condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: highTier 3 Attribution Fingerprint Rule (High Fidelity)
Deep signature matching distinctive operational fingerprints and payload characteristics.
rule MALWARE_WIN_MINE_T3_ATTRIBUTION {
meta:
description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mine tradecraft"
tier = "T3 - Attribution Fingerprint"
confidence = "High (Confirmed Family Signature)"
author = "SystemHelpdesk Threat Research Desk"
date = "2026-10-14"
strings:
// Core family identifier & heuristic payload signatures
$attrib_str = "mine" ascii wide nocase
$pe_magic = "MZ" ascii
$net_marker = "http" ascii nocase
condition:
uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}Containment & Response Steps
Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.
- Isolate the endpoint to sever the connection to the mining pool and halt the resource drain.
- Use EDR or Process Explorer to identify the heavily utilizing process; if it's a legitimate Windows binary, assume it has been hollowed out/injected.
- Block the mining pool IP addresses and domains at the enterprise firewall.
- Investigate the initial vector: If a server was infected, review external-facing web application logs for recent exploitation attempts (e.g., Log4Shell, WebLogic exploits).
What to Avoid
Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.
- Do not simply kill the process; most modern miners use a secondary 'watchdog' service to immediately restart the mining engine if it is terminated.
- Avoid ignoring the alert as a 'low priority' PUA; if an attacker can deploy a miner, they can just as easily deploy ransomware.
References & External Analysis
- Search "mine" on VirusTotal (External Analysis)
- Search "mine" on Any.Run (Sandbox Sandbox)
- Search "mine" on MalwareBazaar (Malware Samples)
Frequently Asked Questions
What is Mine and what threat category does it belong to?
Mine is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments.
How does Mine establish persistence and evade defensive controls?
Mine typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks.
What are the essential incident response steps for mitigating a Mine compromise?
Security teams responding to Mine should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups.
What lateral movement and credential access tactics does Mine leverage in enterprise intrusions?
Mine frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers.
How does Mine maintain covert communications and evade perimeter network monitoring?
Mine often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering.
How do I remove the Mine Advanced_Threat from Windows?
Manual removal of Mine is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Mine a virus or a Advanced_Threat?
Mine is classified as a Advanced_Threat. Unlike traditional viruses that infect files, modern malware like Mine typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Mine infection?
Symptoms of Mine can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Protect Your Network Against Advanced_Threats
Want to prevent Mine and similar threats from compromising your organization? Read our comprehensive defensive guide: Think You've Been Hacked? What To Do First.
📣 Threat Intel Correction or Update?
Notice an outdated IOC, unlisted alias, or disputed attribution? Threat researchers are invited to propose an update on GitHub or contact the SystemHelpDesk research desk. All community revisions are credited in our public CHANGELOG.
Machine-readable
Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/mine.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.