ThreatFox: Coinminer IOCs

Hunt Hypothesis

This hunt hypothesis detects adversaries deploying Coinminer malware to covertly hijack system resources for unauthorized cryptocurrency mining operations. A proactive search in Azure Sentinel is essential because these miners often evade standard detection by mimicking legitimate processes while causing significant performance degradation and potential financial loss through resource exhaustion.

IOC Summary

Malware Family: Coinminer Total IOCs: 12 IOC Types: md5_hash, sha256_hash, sha1_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["f3d99d574240983bcf016ef1c477d2d3c764966a", "57dacba3658cf6df28ae9d54c10c98c9", "958f41d1487994caa3cacb8e52176712efa9d13115ea95587c6dec3658bbcee3", "c714a73211957aa0c71defa91d4d6beca8e4abb8", "45899f8f753e57ded07eb20ca57be0f1", "d44ff00fe9552510aefbf13c4b986dc094b5aefcd099fd3d7ad6dc816968a50b", "340bf1e84e50f99eb1d13b03fe3419899e706fbd", "d3893030cd2183ef27ca1ac845a6c5c1", "acc1d1aab8acad7d56dd2a8dc98680e9c19b7c133d24f668a2e40e080badf30f", "79c3a51a94ba9e5013542d8169ffbe24781830d602d5eb18458ff4040dfcf56f", "fb882688bb7eb2054f08ec902dbee30556fb82ae", "2f1f51762d96b0474441dd5fd8d2edde"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Coinminer

False Positive Guidance

False Positive Scenarios for “ThreatFox: Coinminer IOCs” Rule

• Scenario 1: Legitimate Scheduled Cryptocurrency Asset Audits

  • Context: Finance or IT departments often run scheduled scripts using tools like Python (with pycoin libraries) or PowerShell to audit internal crypto wallets or verify blockchain transaction logs. These processes may spawn child processes that match Coinminer hash signatures or network patterns, triggering the rule during business hours.
  • Suggested Filter: Create an exclusion for specific scheduled tasks (e.g., Task Scheduler jobs named “Crypto_Audit_Daily”) and whitelist the associated executable paths (e.g., C:\Scripts\Finance\CryptoAudit.exe) along with their known SHA-256 hashes.

• Scenario 2: Enterprise Virtualization Host Monitoring

  • Context: In virtualized environments managed by VMware vSphere or Microsoft Hyper-V, the host agents often run background processes to monitor resource utilization (CPU/GPU metrics). These monitoring daemons can exhibit high CPU usage and network connectivity patterns that mimic active coin mining, especially when running on GPU-heavy hosts.
  • Suggested Filter: Exclude known virtualization agent executables such as vmware-statsd.exe, vmsvc.exe, or Hyper-V-Worker from the detection logic by adding their file paths and process names to a global allowlist.

• Scenario 3: Developer Workstations Running Local Blockchain Nodes

  • Context: Software development teams frequently run local blockchain nodes (e.g., Geth, Parity, or Bitcoin Core) for testing smart contracts or validating API integrations. These developers often launch these nodes via Docker containers or native binaries, which generate network traffic and process behaviors identical to the Coinminer family IOCs.
  • **Suggested