{
  "family": "nicehashminer",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "PUA:Win32/Nicehashminer is a legitimate, widely used cryptocurrency mining application that allows users to rent out their computing power. However, it is heavily flagged as a Potentially Unwanted Application (PUA) or 'CoinMiner' by enterprise antivirus engines because threat actors frequently bundle it silently with malware or deploy it en masse across compromised corporate networks (Cryptojacking) to illegally hijack CPU/GPU resources (`T1496`).<br><br><b>Understanding Nicehashminer (Cryptojacking Vector)</b><br>To an end-user intentionally running it, it's a way to earn crypto. To a corporate IT department, its unauthorized presence represents a massive theft of electricity, severe degradation of workstation performance, and a clear indication that perimeter defenses or endpoint controls have failed, allowing an attacker to execute arbitrary binaries.<br><br><b>Execution and Resource Hijacking Mechanics</b><br>When deployed maliciously, attackers use droppers or exploit tools (like PsExec) to silently install the Nicehashminer client on victim machines. They configure the application (`.json` or `.ini` files) to mine cryptocurrency to the attacker's wallet address rather than the victim's. They often use scheduled tasks or registry run keys to ensure the miner starts automatically (`T1547.001`), and may use simple scripts to hide the mining window from the user's desktop.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme resource exhaustion and increased operational costs. Host-based IoCs are highly visible: CPU or GPU utilization will pin at 90-100%, causing the system fans to run loudly and the machine to become sluggish. You will find the `nicehashminer.exe` process (or renamed variants) running, often from unusual directories like `%Temp%` or `C:\\Windows\\Temp`. Network IoCs include continuous outbound traffic over specific mining stratum protocols (e.g., port 3333, 4444) to known mining pools like `stratum.nicehash.com`.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1204.002",
    "T1547.001",
    "T1496"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1496",
      "name": "Resource Hijacking (The core activity of utilizing CPU/GPU power for cryptomining)",
      "tactic": "Impact"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (Often bundled with 'free' software the user downloads)",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys (Ensuring the miner runs constantly)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Terminate the rogue mining processes to immediately restore system performance.",
    "Identify how the miner was installed; if a user intentionally installed it, enforce corporate acceptable use policies. If it was dropped by malware, initiate a full incident response.",
    "Block known mining pool domains (e.g., *.nicehash.com) and stratum protocol ports at the corporate firewall.",
    "Enforce strict Application Control (AppLocker) to prevent the execution of known mining binaries."
  ],
  "what_to_avoid": [
    "Do not dismiss cryptomining as a 'low severity' threat; if an attacker can deploy a miner, they can just as easily deploy ransomware.",
    "Avoid relying solely on CPU monitoring, as advanced malicious deployments can throttle the miner when user activity is detected."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}