From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection Chain

We had an opportunity to analyse a system with frequent detection-alerts over powershell execution. Our analysis revealed a multi-stage infection that relied heavily on obfuscation, Registry-based payload storage, covert data delivery, persistence mechanisms, security-control tampering, and in-memory execution. Rather than deploying the final payload directly to disk, the threat actor used layered concealment and reconstructed payloads from Registry data, DNS TXT records, image files, and WAV f…