How WannaMine Works: A Fileless Cryptominer Malware

WannaMine is a sophisticated, file-less cryptojacking worm that primarily utilizes "living-off-the-land" techniques to infect systems and mine Monero cryptocurrency. Unlike traditional malware that relies heavily on writing files to disk, WannaMine operates almost entirely within system memory, leveraging legitimate administrative tools such as PowerShell and Windows Management Instrumentation (WMI) to maintain persistence and execute malicious code.

The infection cycle typically begins via a phishing email containing a malicious batch file or through the exploitation of the EternalBlue vulnerability (MS17-010) on unpatched Server Message Block (SMB) services. Once a system is compromised, the malware establishes persistence by creating malicious WMI event subscriptions, ensuring it automatically re-executes even after a reboot [1].

To propagate across the network, WannaMine employs a multi-staged lateral movement strategy. It first attempts to harvest user credentials (specifically NTLM hashes) from memory using a PowerShell implementation of the Mimikatz tool. If credential theft is successful, it uses WMIExec to remotely execute commands on other networked devices. If credential harvesting fails, the malware falls back to the EternalBlue exploit to compromise vulnerable machines [2]. The ultimate goal is to hijack the CPU resources of infected servers and workstations to mine cryptocurrency, often rendering the devices unusable due to high processor usage.

How Does WannaMine Malware Work?

WannaMine is characterized by its modular architecture and heavy reliance on WMI for both storage and execution. The attack chain involves initial access, persistence, credential harvesting, network scanning, and payload execution.

Initial Infection and Payload Retrieval

The attack often initiates through a malicious email attachment or an unpatched SMB vulnerability. Upon execution, the malware spawns a PowerShell process that determines the operating system's architecture (32-bit vs. 64-bit) to download the appropriate payload [1].

Persistence via WMI

To ensure the infection survives system reboots without leaving traditional file artifacts, WannaMine stores its malicious scripts directly within the WMI database properties. It creates specific WMI classes (e.g., systemcore_Updater, Office_Updater, Win32_Services) and populates their properties with encoded payloads.

The following properties contain the core modules of the malware [2]:

• mimi: Stores the Mimikatz credential harvesting script.
• mon: Contains the Monero CPU mining module.
• funs: Holds the scripts for "Pass the Hash," WMIExec, and EternalBlue exploitation.
• sc: Contains MS17-010 shellcode and persistence mechanisms.
• ipsu: Maintains a list of devices successfully infected via WMI/Invoke-WMIExec.

Persistence is triggered using WMI Event Consumers (e.g., SCM Event Log Consumer), which automatically run the stored PowerShell scripts when specific system events occur. Below is an example of a script that executes the cryptominer [1]:

Lateral Movement Mechanisms

To identify viable targets, the malware utilizes code derived from the PingCastle scanner. This component maps the network and identifies the shortest path to exploitable machines via SMB.

WannaMine employs a dual-strategy for spreading to other hosts on the network:

Credential Theft and WMIExec

The malware loads the mimi module (Mimikatz) into memory to extract NTLM hashes or clear-text passwords. If a Domain Administrator's hash is recovered, the malware utilizes Invoke-WMIExec to launch attacks against other IP addresses found on the network.

Examples of lateral movement commands using harvested credentials [2]:

EternalBlue Exploitation

If credential-based movement fails, the malware utilizes the funs module to deploy the EternalBlue exploit against unpatched machines [2].

Mining Operations and Resource Control

Once established, the malware configures the system for maximum mining efficiency. It alters power management settings to prevent the computer from entering sleep mode [1]:

The malware also actively eliminates competition. It scans for and terminates processes connected to standard mining ports (3333, 5555, 7777), while its own miner operates on port 14444 [1].

How Picus Simulates WannaMine Malware Attacks?

We also strongly suggest simulating WannaMine Malware Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Security Validation Platform. You can also test your defenses against hundreds of other malware variants, such as BRICKSTORM, VenomRAT, Chinotto, and Rustonotto, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for the WannaMine Malware Attacks:

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Security Validation Platform.

Key Takeaways

• WannaMine is a sophisticated, file-less cryptojacking worm that operates almost entirely within system memory using living-off-the-land techniques like PowerShell and Windows Management Instrumentation (WMI).
• The infection typically initiates through phishing emails with malicious batch files or by exploiting the EternalBlue vulnerability (MS17-010) on unpatched SMB services.
• Persistence is maintained without writing files to disk by storing malicious modules directly in WMI database properties and using WMI event subscriptions to trigger execution upon system events.
• The malware utilizes a multi-staged lateral movement strategy that first attempts to harvest user credentials using Mimikatz to run remote commands via WMIExec.
• If credential harvesting is unsuccessful, the malware falls back to the EternalBlue exploit to compromise other vulnerable machines on the network.
• To ensure maximum mining efficiency for Monero, WannaMine alters power management settings to prevent sleep mode and actively terminates processes associated with competing miners on ports like 3333 and 7777.

References

[1] C. Nocturnus, “WannaMine Cryptominer that uses EternalBlue still active.” Accessed: Jan. 11, 2026. [Online]. Available: https://www.cybereason.com/blog/research/wannamine-cryptominer-eternalblue-wannacry

[2] “Service and Support.” Accessed: Jan. 11, 2026. [Online]. Available: https://support.sophos.com/support/s/article/KBA-000005976?language=en_US