Lion Cipher Lab
Characterize a cryptominer: CPU abuse, pool connections, and how it hides
- Digital Forensics & IR (DFIR)
- Intermediate
- ~50 min
- Free · no account required
Why it matters
A cryptominer is the quietest serious infection you will ever chase: it does not steal files or pop ransom notes, it just silently rents out your CPUs to mine coins into a stranger's wallet — so it can sit on a fleet for months, showing up only as slow machines, hot laptops and a puzzling power bill. The tell is a very specific behavioural fingerprint: one process pinning every core, a network connection to a mining pool, and a wallet string baked into the binary. Learning to read that fingerprint — and, crucially, to separate it from a legitimate render farm or build server that also runs…
What you'll learn
- reading a CPU/process snapshot to spot the process pegging the cores
- recognizing a stratum+tcp pool connection in a netstat table as the smoking gun
- understanding the Stratum mining protocol just enough to read a miner's traffic
- pulling attribution IOCs (wallet address, pool host, mining port) from extracted strings and a miner config
- reading a scheduled-task export to identify persistence
- spotting process-hiding: a miner renamed to look like a Windows process, and throttling when the user is active
- mapping observed behaviour to MITRE ATT&CK (T1496 Resource Hijacking, T1053.005 Scheduled Task)
- judgment: telling an unauthorized miner from a legitimate CPU-heavy job, and pivoting to find every other infected host
Steps in this lab
- The scene: a hot, slow machine and a bag of collected artifacts
- The two suspects: an unauthorized miner vs a legitimate CPU-heavy job
- Read the CPU signature: find the process pegging the cores
- The smoking gun: the stratum+tcp pool connection
- Attribution: the wallet and pool config inside the binary
- Persistence: read the scheduled-task export
- How it hides: a system-process name and throttling when you're active
- Map it to MITRE ATT&CK
- The third rule: miner vs false positive, why it throttles, and finding the rest