ThreatFox: Coinminer IOCs

Hunt Hypothesis

This hunt identifies hosts exhibiting indicators of compromise linked to active cryptocurrency mining operations, which often signal unauthorized resource consumption or initial access footholds. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect stealthy mining activities that may be leveraging compromised identities or misconfigured permissions before they lead to significant infrastructure costs or lateral movement.

IOC Summary

Malware Family: Coinminer Total IOCs: 8 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Coinminer
let malicious_urls = dynamic(["http://178.198.246.24/info.zip", "http://178.61.160.6:5001/info.zip", "http://178.61.160.6:5001/video.scr", "http://180.148.33.24/AV.scr", "http://180.148.33.24/info.zip", "http://177.70.102.232:8070/TmpFTP/01/Cancelamento/2022-09-06/info.zip", "http://177.70.102.232:8070/TmpFTP/01/Consulta/2019-08-02/info.zip", "http://177.70.102.232:8070/TmpFTP/01/Inutiliza%C3%A7%C3%A3o/2019-12-19/info.zip"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Coinminer

False Positive Guidance

• Legitimate Cryptocurrency Mining for R&D or Testing: Developers or data scientists may run open-source mining software (e.g., ethminer, xmrig, or cgminer) in isolated development VMs or containerized environments to test performance, benchmark GPU/CPU efficiency, or validate new blockchain protocols.

  • Filter/Exclusion: Exclude processes originating from known development paths (e.g., C:\dev\mining\, /home/user/crypto-test/) or restrict the rule to non-development user groups (e.g., exclude Dev-Team, QA-Team, or Research-Group AD groups).

• Scheduled Backup or Archive Compression Jobs: Some enterprise backup or archival tools (e.g., Veeam, Commvault, or custom PowerShell scripts using 7z or tar) may exhibit high CPU usage or specific process names that overlap with Coinminer IOCs if they are heavily parallelized or if the IOC list includes generic high-CPU process names. Additionally, some legacy backup agents may spawn helper processes with names similar to mining daemons.

  • Filter/Exclusion: Correlate with scheduled task names (e.g., Backup-Job, Nightly-Archive) or exclude processes parented by known backup executables (e.g., veeam.exe, commvault.exe, python.exe running specific backup scripts).

• GPU-Intensive AI/ML Training or Inference Workloads: Machine learning training jobs (e.g., PyTorch, TensorFlow) or real-time inference services on GPU servers can consume significant CPU/GPU resources and may spawn worker processes that match generic Coinminer IOCs (especially if the IOC list includes generic high-CPU or GPU-utilization patterns). Tools like nvidia-smi or dcgm (Data Center GPU Manager) may also be flagged if their process names or behaviors