Loading malware…
WannaMine is a Windows cryptojacking worm that propagates primarily by exploiting the EternalBlue SMB vulnerability on unpatched systems. After achieving high-privilege code execution, it launches heavily obfuscated PowerShell and uses WMI extensively to determine system architecture, retrieve the appropriate payload, and spread laterally across reachable hosts. The malware has been observed compiling and using PingCastle to map networks and identify additional exploitable machines, and it incorporates a PowerShell implementation of Mimikatz to obtain credential material and support further movement within compromised environments.
WannaMine is notable for fileless and living-off-the-land tradecraft. It stores components and state in WMI classes, establishes persistence through WMI event subscriptions, and can also maintain scheduled-task-related persistence data. Its mining activity runs inside PowerShell processes rather than as a conspicuous standalone miner, often resulting in large numbers of PowerShell instances consuming substantial CPU resources. To maximize mining uptime, it modifies power-management settings to prevent systems from sleeping and terminates competing mining processes associated with common mining ports.
The malware also employs defense-evasion techniques. Observed variants attempt to bypass Microsoft AMSI by patching AMSI-related code in memory, including amsi.dll, before continuing execution of malicious scripts. This behavior aligns with broader cryptojacking and post-exploitation trends that rely on PowerShell, WMI, and in-memory tampering to reduce detection.
WannaMine has been seen in opportunistic compromises of exposed or insufficiently patched enterprise Windows systems, including servers. Its spread mechanism and reliance on long-patched SMB flaws make it especially effective in environments with legacy systems or poor patch hygiene. The malware’s primary objective is unauthorized cryptocurrency mining, but its use of credential theft tooling, reconnaissance utilities, lateral movement, persistence, and defense evasion makes it operationally similar to a wormable post-exploitation framework built around cryptomining.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
The attackers are using WMI to enumerate the bitness of the victim machine - 32bit or 64bit.
$scba = Scheduled task information for persistence
The long command will execute the cryptominer by invoking all of the commands that are stored in the $funs variable.
Once code execution was gained, a PowerShell instance was spawned.
The initial attack vector was exploitation of EternalBlue via an unpatched SMB server, like we saw with the WannaCry attack last May.
$scba = Scheduled task information for persistence
the malware installed a WMI filter, consumer and binder to gain persistent execution through WMI intrinsic events.
$scba = Scheduled task information for persistence
over 98 percent of the bypass attempts we see in recent telemetry focus on a different approach: tampering with the code of the AMSI library itsef. already loaded into memory to make scan requests fail. In this attack, the malware locates the library AmsiScanBuffer in memory, and then overwrites the instructions at that address with new ones that redirect to an error message.
the malware installed a WMI filter, consumer and binder to gain persistent execution through WMI intrinsic events.
Most of it is base64 encoded along with some other text encoding and obfuscation tricks.
over 98 percent of the bypass attempts we see in recent telemetry focus on a different approach: tampering with the code of the AMSI library itsef. already loaded into memory to make scan requests fail. In this attack, the malware locates the library AmsiScanBuffer in memory, and then overwrites the instructions at that address with new ones that redirect to an error message.
attackers (and security researchers) have created tools to attempt to bypass or disable AMSI... attackers continue to adjust—using automated tools in some cases to obfuscate their attack code and probing defenses until they find one that sticks, and finding other ways to avoid AMSI altogether.
there are other parts from the main PowerShell script still in motion, including a PowerShell implementation of Mimikatz.
$NTLM = Extracted NTLM hashes for lateral movement
PingCastle’s job is to map the network and find the shortest path to the next exploitable machine by grabbing SMB information through the response packets sent by the SMB servers.
The attackers are using WMI to enumerate the bitness of the victim machine - 32bit or 64bit.
Wannamine penetrates computer systems through an unpatched SMB service and gains code execution with high privileges to then propagate across the network.
Once the bitness is enumerated, the correct payload will be downloaded and executed - in3.ps1 for 32 bit machines and in6.ps1 for 64bit machines.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.