cryptojacking — quick-start

checklist

1. isolate the suspect host or scale down the cloud workload — stop pool traffic and bill bleed; do not reboot if you need memory artifacts.
2. snapshot sustained CPU/GPU utilization for the last 7 days — baseline drift is the signal, not a one-minute spike.
3. export the live process list and parent-child tree now — before EDR cleanup or auto-remediation kills the miner parent.
4. pull netflow, firewall, and proxy logs for stratum, pool, and mining-related domains — export before retention rolls.
5. export DNS query logs for the host and segment — miners beacon to pool hosts, failovers, and wallet payout domains.
6. check scheduled tasks, cron, systemd units, and registry autoruns — persistence survives reboot and image refresh.
7. if cloud: pull instance launch, user-data, container image digest, and IAM audit for the workload — miners often arrive as a bad image or leaked key.
8. capture a memory dump or approved live triage export before kill — pe and entropy analysis need the binary in RAM.
9. hash any miner binary, script, or container layer sha-256 before quarantine deletes it — custody row goes in now.
10. begin the primary tool path below — process tree rebuilder, memory analyzers, and beaconing detectors.

primary tools

1. 01process tree rebuilderdrop Sysmon Event 1 or Security 4688 EVTX CSV · ProcessGuid parent chain · Image · CommandLine · orphan and LOLBAS triage · export CSV · runs locally
2. 02memory pe extractordrop a memory dump · scan for PE headers · carve embedded executables · rebuild PE structure · download extracted files · runs locally
3. 03memory entropy analyzermemory dump · shannon entropy per block · heatmap · high-entropy regions · hex dump · csv + png export · runs locally
4. 04in-memory malware configuration extractordrop process memory dump · xor decode json xml config blocks · c2 ip port campaign mutex extraction · multi-technique local scan · runs locally
5. 05network beaconing detectordrop connection logs or PCAP · statistical analysis of connection intervals per host · jitter detection · C2 beaconing patterns · periodic callback identification · export CSV · runs locally
6. 06beaconing pattern detectordrop pcap or zeek conn log · periodic c2 beacon intervals · regularity and jitter scores · export csv · runs locally
7. 07dns query analyzerdrop a PCAP or paste DNS log · extract queries · detect DGA patterns · DNS tunneling · high-frequency domains · suspicious TLDs · export CSV · runs locally
8. 08c2 callback interval analyzerdrop pcap or zeek conn log · deep interval stats · c2 framework timing profiles · jitter estimation · export csv · runs locally

go deeper