Digging Gold with a Spoon – Resurgence of Monero-mining Malware

What is apparent with the current XMRig threat, is its multi-staged approach and use of LOLBAS (Living Off the Land Binaries and Scripts) techniques. These techniques leverage pre-installed Windows tools such as PowerShell for download and execution of its payload, detection evasion, and scheduled task persistence. These initial behaviors were relieved from the malicious XMRig binaries observed in 2023, which shrunk the current binary version down to about 1MB and focused on cryptomining only. 

A notable observation is that the scripts were written in plain text, without any form of encoding or obfuscation. The scripts even had straightforward comments describing the use of the commands indicating that it may have been created by LLMs or copied from a certain malware kit or a work of “script kiddies”. Although the scripts may have been written in a simple manner, this simplicity proved effective, with a very low reputation score from antivirus vendors (according to VirusTotal) at the time of discovery. The current binary version targets a more diverse set of countries which still includes Russia, but now also added Belgium, Greece, and China to the roster. In comparison, the 2023 version, according to our telemetry and intelligence data, primarily affected Russia, Azerbaijan, and Uzbekistan. 

As of this writing, the initial vector used by the malware to get to the victim's machine is still unknown. The malicious behavior starts when svchost.exe creates a cmd process that executes the Windows batch file, 1.cmd (known in other sources as S1.bat). At the time it was first observed, it was newly seen in the wild with no more than five detections on VirusTotal. 

Upon execution, 1.cmd first checks whether a marker file (check.txt) already exists on the system under the %APPDATA%\Temp path. If the marker file is present, the batch file ends its execution. Otherwise, the batch file modifies the registry to exclude the C:\ path from Windows Defender scanning. 1.cmd script then connects to notif[.]su and downloads S2.bat to the C:\Temp folder using the PowerShell Invoke-WebRequest command. At the time of discovery, notif[.]su was a newly registered domain, with a handful of antivirus vendors flagging it as malicious. 

Once the malicious XMRig miner (named miner.exe) runs, it drops a renamed copy of itself at %AppData%\frxpfpjpzvub\dvrctxctzmmr.exe. It then creates registry entry in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DJKONTAH with the value pointing to the dropped copy as a form of persistence. 

Miner.exe also drops a file named djhtniluoblq.sys in the %temp% folder. This .sys file is the WinRing0 driver, a legitimate component of XMRig. It is used to perform tasks such as registry modification, direct memory read/write operations, and privilege escalation. 

All malicious XMRig miner files hosted on notif[.]su (e.g., eu1.exe, eu2.exe, ws1.exe, na1.exe, as.exe, au1.exe) behave similarly, with differences in DateTimeStamp and deobfuscation key of obfuscated malicious code. They share the same file size, drop a copy as dvrctxctzmmr.exe in the same location, and create a registry entry named “DJKONTAH”. They also drop the same WinRing0 driver in the same file path, but with different random filenames. 

Based on our OSINT investigations, the last updated copies of the downloaded executables from notif[.]su are from April 15, 2025. The stage 1 batch file s1.bat was last sourced on April 17, however it was updated to a blank file on April 22, with the whole domain being taken down a few weeks later. 

Malware with unobfuscated behaviors and use of LOLBAS techniques can still be used effectively by threat actors, slipping through the cracks and executing its payloads. G DATA’s XDR (Extended Detection and Response) solution can detect the behaviors of these malicious batch scripts when they attempt to use these LOLBAS techniques, providing another layer of protection based on behavior and activities. 

Users must also be aware of possible signs of cryptomining infection in their systems, such as: 

• Network traffic connections to suspicious domains such as notif[.]su 

• Addition of suspicious files with random filenames: 

  •  “dvrctxctzmmr.exe” in the %APPDATA% folder 

  • “djhtniluoblq.sys” in the %TEMP% folder 

  • “check.txt” in the %TEMP% folder 

• Registry entries for persistence: 

  • HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DJKONTAH