T1496: Resource Hijacking (The core function of mining Monero cryptocurrency)
Operational Executive Summary
T1496 (Resource Hijacking (The core function of mining Monero cryptocurrency)) is classified under the Impact tactic within the MITRE ATT&CK framework. Techniques adversaries use to disrupt business operations, destroy system integrity, or manipulate critical availability, including high-speed ransomware encryption and disk wiping. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 40 distinct malware families, totaling over 6,842 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Resource Hijacking (The core function of mining Monero cryptocurrency) to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Resource Hijacking (The core function of mining Monero cryptocurrency), malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1496 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Resource Hijacking (The core function of mining Monero cryptocurrency) to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1496/.
Detection Engineering & Threat Hunting
Detecting Resource Hijacking (The core function of mining Monero cryptocurrency) requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1496 (Resource Hijacking (The core function of mining Monero cryptocurrency)) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Resource Hijacking (The core function of mining Monero cryptocurrency) across adjacent network segments.
Cataloged Malware Families Utilizing T1496 (40 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1496 (Resource Hijacking (The core function of mining Monero cryptocurrency)):
40 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| filetour | Pua | 3,238 | FileTour (cataloged across threat telemetry as Trojan:Win32/Filetour, Adware.FileTour, and PUA:Win32/Filetour) is a dual-function software bundler and stealth c... |
| tiggre | Cryptominer | 1,728 | Trojan:Win32/Tiggre!rfn (widely recognized across Microsoft Defender and endpoint telemetry as CoinMiner.Tiggre, Trojan.Tiggre, or Win32/Tiggre) is a prolific, ... |
| maener | Cryptominer | 387 | Maener (cataloged by security vendors as Trojan:Win32/Maener, Trojan.Win32.Maener, Worm:Win32/Maener, and Bindmaener) is a persistent cryptocurrency mining troj... |
| coins | Cryptominer | 359 | There is no single, specific malware family universally referred to as "coins." Instead, the term is frequently used by security vendors as a descriptor for ent... |
| tofsee | Spam Bot | 264 | Tofsee (also widely cataloged as Gheg, Backdoor.Win32.Tofsee, and Spambot.Tofsee) is an extraordinarily resilient and sophisticated multi-purpose modular trojan... |
| xmrig | Cryptominer | 248 | XMRig (cataloged across antivirus vendors as Coinminer:Win32/XMRig, Trojan.XMRig, and Riskware.XMRig) is a high-performance open-source Monero (XMR) cryptocurre... |
| stantinko | Botnet | 168 | Stantinko (tracked across threat intelligence feeds as Trojan:Win32/Stantinko, Win32/CoinMiner.Stantinko, and Trojan.Win32.Stantinko) is a massive, highly resil... |
| game | Trojan | 144 | Trojan:Win32/GameThief (frequently cataloged in security telemetry as Trojan.Game, Win32/Game, or Trojan-PSW.Win32.Game) is a specialized class of password-stea... |
| phorpiex | Botnet | 115 | Phorpiex (also cataloged across the cybersecurity industry as Trik, Worm:Win32/Phorpiex, Trojan:Win32/Phorpiex, and Worm.Win32.Trik) is an infamous, multi-funct... |
| bitmin | Coinminer | 112 | Bitmin (cataloged under Microsoft Defender designations including Trojan:Win32/Bitmin, Trojan:Win32/Bitman, and CoinMiner.Win32.Bitman) is an enduring family of... |
| sefnit | Trojan | 11 | Trojan:Win32/Sefnit (often tracked as the **Mevade** botnet) was a massive, highly sophisticated botnet that infected millions of machines globally between 2013... |
| mine | Advanced Threat | 10 | CoinMiner:Win32/Mine (also tracked under generic 'Miner' heuristics) represents a massive class of malware designed to secretly hijack the processing power (CPU... |
| minerbot | Ransomware | 8 | Trojan:Win32/Minerbot (often a generic detection for **Cryptojacking Botnets**) represents a massive class of malware whose sole purpose is to silently hijack t... |
| idlebuddy | Advanced Threat | 7 | PUA:Win32/Idlebuddy is a persistent Potentially Unwanted Program (PUA) that functions primarily as a stealthy **Cryptominer** and distributed computing node. It... |
| cpuminer | Ransomware | 4 | Trojan:Win32/Cpuminer (often a generalized classification for multiple variants) represents a massive shift in cybercrime monetization: **Cryptojacking**. Inste... |
| autohit | Trojan | 3 | Autohit (classified in antivirus detection telemetry under designations including Trojan:Win32/Autohit, Trojan.Win32.Autohit, and Win32/Autohit) is a multi-stag... |
| bedep | Ransomware | 3 | Bedep (classified in antivirus detection telemetry under designations including Ransom:Win32/Bedep, Ransom.Win32.Bedep, and Win32/Bedep) is a crypto-ransomware ... |
| clickshell | Advanced Threat | 3 | Adware:Win32/Clickshell is a type of malware designed specifically for **Click Fraud**. Unlike standard adware that simply displays annoying pop-ups to the user... |
| multiminer | Ransomware | 3 | CoinMiner:Win32/Multiminer represents a prevalent class of malware known as **Cryptojackers or Cryptocurrency Miners**. Unlike ransomware that destroys data, Mu... |
| epicscale | Advanced Threat | 2 | Adware:Win32/Epicscale is a Potentially Unwanted Program (PUP) that operates as a covert cryptocurrency miner. While it originally presented itself as a platfor... |
| gameserver | Trojan | 2 | Riskware:Win32/Gameserver is a heuristic detection used to flag the presence of unauthorized server applications, specifically private game servers (e.g., World... |
| minebicoin | Ransomware | 2 | Riskware:Win32/Minebicoin is a heuristic detection representing the widespread threat of 'Cryptojacking'. It flags executables or scripts designed to hijack an ... |
| minerbat | Trojan | 2 | Trojan:BAT/Minerbat (or simply Miner.bat) is a classification for extremely simple, script-based cryptojacking malware. Instead of complex compiled executables,... |
| xmrigminer | Advanced Threat | 2 | RiskTool:Win32/Xmrigminer (or simply XMRig) is a highly efficient, open-source CPU mining application designed to mine Monero (XMR) and other RandomX-based cryp... |
| zombieboy | Ransomware | 2 | Trojan:Win32/Zombieboy is a highly aggressive, self-propagating cryptomining botnet (Worm) that emerged prominently around 2018. It is infamous for rapidly spre... |
| adylkuzz | Ransomware | 1 | Adylkuzz (classified in antivirus detection telemetry under designations including Ransom:Win32/Adylkuzz, Ransom.Win32.Adylkuzz, and Win32/Adylkuzz) is a crypto... |
| btcon | Trojan | 1 | Btcon (classified in antivirus detection telemetry under designations including Trojan:Win32/Btcon, Trojan.Win32.Btcon, and Win32/Btcon) is a multi-stage trojan... |
| coinloader | Ransomware | 1 | <h3>Executive Summary</h3> Coinloader is a specialized Trojan Downloader engineered with a singular, primary objective: to silently infect a system and subseque... |
| comine | Trojan | 1 | Coinminer:Win32/Comine (or Trojan:Win32/Comine) is a malicious cryptomining application designed to silently hijack the CPU and GPU resources of infected system... |
| cryptominer | Trojan | 1 | <h3>Executive Summary</h3> "Cryptominer" (often flagged as Riskware.CoinMiner, Trojan.Miner, or PUA.Miner) is a generic detection classification for software th... |
| cryptredol | Ransomware | 1 | Ransomware:Win32/Cryptredol is a destructive malware strain with a dual-impact payload: it functions primarily as ransomware, encrypting victim data (`T1486`), ... |
| idlecrawler | Advanced Threat | 1 | Adware/Bot:Win32/Idlecrawler is a sneaky class of malware designed to exploit system resources or display advertisements exclusively when the user is not active... |
| malxmr | Advanced Threat | 1 | <h3>Executive Summary</h3> MalXMR is a pervasive and highly optimized malicious cryptocurrency miner (cryptojacking malware) specifically engineered to illicitl... |
| mmxmr | Trojan | 1 | <h3>Executive Summary</h3> MMXMR is a specialized malicious cryptocurrency miner (cryptojacking malware) explicitly designed to illicitly mine Monero (XMR). By ... |
| nicehashminer | Advanced Threat | 1 | PUA:Win32/Nicehashminer is a legitimate, widely used cryptocurrency mining application that allows users to rent out their computing power. However, it is heavi... |
| onlineg | Advanced Threat | 1 | Adware/PUP:Win32/Onlineg (or 'Online Games') refers to malicious payloads bundled with or masquerading as free online games, game cheats, 'trainers', or mod ins... |
| rakhni | Ransomware | 1 | <h3>Executive Summary</h3> Rakhni is a notorious and highly versatile malware family that originally emerged as Ransomware but evolved into a multifaceted threa... |
| smominru | Advanced Threat | 1 | Worm:Win32/Smominru is one of the most prolific and resilient botnets in operation, primarily dedicated to large-scale cryptojacking (mining Monero). What sets ... |
| xiaobaminer | Trojan | 1 | <h3>Executive Summary</h3> XiaobaMiner is a malicious cryptocurrency mining Trojan (Cryptojacker) designed to hijack the computational resources (CPU and GPU) o... |
| xmrminer | Trojan | 1 | <h3>Executive Summary</h3> XMRig (often detected generally as XMRMiner or CoinMiner.XMR) is a legitimate, open-source Monero (XMR) CPU/GPU miner that has been o... |