Loading malware…
WannaMine is a Windows cryptojacking worm that propagates primarily by exploiting the EternalBlue SMB vulnerability on unpatched systems. After achieving high-privilege code execution, it launches heavily obfuscated PowerShell and uses WMI extensively to determine system architecture, retrieve the appropriate payload, and spread laterally across reachable hosts. The malware has been observed compiling and using PingCastle to map networks and identify additional exploitable machines, and it incorporates a PowerShell implementation of Mimikatz to obtain credential material and support further movement within compromised environments.
WannaMine is notable for fileless and living-off-the-land tradecraft. It stores components and state in WMI classes, establishes persistence through WMI event subscriptions, and can also maintain scheduled-task-related persistence data. Its mining activity runs inside PowerShell processes rather than as a conspicuous standalone miner, often resulting in large numbers of PowerShell instances consuming substantial CPU resources. To maximize mining uptime, it modifies power-management settings to prevent systems from sleeping and terminates competing mining processes associated with common mining ports.
The malware also employs defense-evasion techniques. Observed variants attempt to bypass Microsoft AMSI by patching AMSI-related code in memory, including amsi.dll, before continuing execution of malicious scripts. This behavior aligns with broader cryptojacking and post-exploitation trends that rely on PowerShell, WMI, and in-memory tampering to reduce detection.
WannaMine has been seen in opportunistic compromises of exposed or insufficiently patched enterprise Windows systems, including servers. Its spread mechanism and reliance on long-patched SMB flaws make it especially effective in environments with legacy systems or poor patch hygiene. The malware’s primary objective is unauthorized cryptocurrency mining, but its use of credential theft tooling, reconnaissance utilities, lateral movement, persistence, and defense evasion makes it operationally similar to a wormable post-exploitation framework built around cryptomining.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The presence of WannaMine, however, does indicate that the server it was found on may have been unpatched and vulnerable to the EternalBlue exploit, as well as more recent exploits targeting this web server. | The WannaMine crypto-mining malware was also seen on the same Exchange server, though it appears likely that this activity was not linked to the Daggerfly group.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
The attackers are using WMI to enumerate the bitness of the victim machine - 32bit or 64bit.
over 98 percent of the bypass attempts we see in recent telemetry focus on a different approach: tampering with the code of the AMSI library itsef. already loaded into memory to make scan requests fail. In this attack, the malware locates the library AmsiScanBuffer in memory, and then overwrites the instructions at that address with new ones that redirect to an error message.
Most of it is base64 encoded along with some other text encoding and obfuscation tricks.
over 98 percent of the bypass attempts we see in recent telemetry focus on a different approach: tampering with the code of the AMSI library itsef. already loaded into memory to make scan requests fail. In this attack, the malware locates the library AmsiScanBuffer in memory, and then overwrites the instructions at that address with new ones that redirect to an error message.
attackers (and security researchers) have created tools to attempt to bypass or disable AMSI... attackers continue to adjust—using automated tools in some cases to obfuscate their attack code and probing defenses until they find one that sticks, and finding other ways to avoid AMSI altogether.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cryptojacking worm malware that spreads across networks and uses heavily obfuscated PowerShell plus amsi.dll patching to evade AMSI and install its miner.
Cryptomining malware that exploits EternalBlue against unpatched SMB services to gain high-privilege code execution, propagate laterally, persist via WMI event subscriptions, use PowerShell heavily, leverage PingCastle for network mapping, and use Mimikatz-derived code plus NTLM hashes for lateral movement.
WannaMine is mentioned as unrelated cryptomining malware present on the same server, suggesting the host may have been unpatched and vulnerable.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.