From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection Chain

We had an opportunity to analyse a system with frequent detection-alerts over powershell execution. Our analysis revealed a multi-stage infection that relied heavily on obfuscation, Registry-based payload storage, covert data delivery, persistence mechanisms, security-control tampering, and in-memory execution.

Rather than deploying the final payload directly to disk, the threat actor used layered concealment and reconstructed payloads from Registry data, DNS TXT records, image files, and WAV files to operate Cryptomining

Figure 1 – Attack Chain

Phase 1: Registry-Based PowerShell Execution and PNG Payload Delivery

The relevant portion of the PowerShell code is shown below:

The following is the script that triggered the alert:

Powershell. exe -NoProfile -executionPolicy Bypass -File C:\Windows\System32\vstdfehze.