• Case Overview
• How It Was Discovered
  • Investigation Tools Used
  • Investigation Timeline
• Threat Summary
• File-by-File Analysis
• Indicators of Compromise (IOCs)
  • File System IOCs
  • Network IOCs
  • Attacker Wallet
  • Persistence IOCs
• MITRE ATT&CK Mapping
• Why the Host AV Failed
• Impact Assessment
• Remediation Steps
• Sample Preservation
• Key Learning Points
• Conclusion

The malware was not detected by the antivirus running on the host. It was discovered through manual investigation after observing suspicious system behavior:

Upon laptop startup, CPU/memory usage immediately spiked to ~80% before any user applications were opened. This abnormal resource consumption at boot time raised suspicion and triggered a manual investigation.

Step 1 — Symptom Observed Laptop boots with ~80% CPU usage, no user apps open.

Step 2 — Task Manager Suspicious svchost32.exe visible in the Details tab.

Behaviour: Shows the renamed miner running alongside legitimate svchost.exe instances.
Use case: First visual confirmation that an unknown process is masquerading as a system process.

Step 3 — Process Explorer Inspected the process to see private bytes, working set, and threads.

Behaviour: svchost32.exe (PID 35592) holds ~2.45 GB working set with heavy CPU cycles.
Use case: Quantifies the resource theft caused by the miner.

Step 4 — Located the Malware Folder Drilled into AppData\Roaming\windowshost\.

Behaviour: 7 files staged in user AppData — exe, vbs, config, lock, certs, hash list.
Use case: Enumerates every artifact dropped by the attacker.

Step 5 — Inspected runhidden.vbs The hidden launcher used at logon.

Behaviour: Launches svchost32.exe with window style 0 (hidden) using WScript.Shell.Run.
Use case: Explains how the miner runs with no visible window or console.

Step 6 — Inspected config.json XMRig configuration with mining pool and wallet.

Behaviour: Pool URL pool.supportxmr.com:3333, attacker wallet, tls:false, nicehash:false.
Use case: Extracts the mining pool, wallet address, and protocol IOCs.

Step 7 — Inspected SHA256SUMS Confirms the binary origin.

Behaviour: Lists hashes for xmrig.exe, WinRing0x64.sys, config.json, and helper scripts.
Use case: Proves the dropped binary is an official XMRig 6.24.0 build, only renamed.

Step 8 — Process Monitor Built a filter for svchost32.exe / xmrig.exe to capture mining activity.

Behaviour: Includes svchost32.exe and xmrig.exe; excludes windowshost, Procmon, Procexp, Autoruns.
Use case: Documents the exact investigation methodology used to isolate miner events.

Step 9 — Captured Stratum Traffic Live TCP send/receive events to the pool.

Behaviour: Continuous TCP Send/Receive frames between svchost32.exe and ns31430818.ip-141-94-96.eu:3333.
Use case: Live evidence of active Stratum mining communication.

Step 10 — TCPView Confirmed the established outbound connection.

Behaviour: svchost32.exe PID 35592 — 192.168.1.64:52338 → 141.94.96.144:3333, state ESTABLISHED.
Use case: Pins down the live remote IP, port, and source PID for IOC and firewall blocking.

Step 11 — RamMap Confirmed memory consumption.

Behaviour: svchost32.exe shows a multi-MB total/working set among normal services.
Use case: Corroborates the memory impact reported by Process Explorer.

Step 12 — Autoruns Discovered the persistence entry.

Behaviour: Search for "windowshost" reveals a scheduled task named WindowsHostService.
Use case: Identifies the autostart mechanism keeping the miner alive across reboots.

Step 13 — Task Scheduler Verified the persistence trigger and command.

Behaviour: Task WindowsHostService runs wscript.exe "C:\Users\niraj\AppData\Roaming\windowshost\runhidden.vbs" at logon.
Use case: Confirms exactly how, when, and with what command the miner is auto-launched.

This is a trojanized XMRig cryptocurrency miner disguised as a legitimate Windows system process. The attacker renamed the XMRig mining executable to svchost32.exe to mimic the legitimate Windows service host process (svchost.exe). The malware completely evaded the host antivirus and was only found through manual forensic investigation.

The sample has been independently confirmed as a Monero miner on VirusTotal — most major engines flag it as XMRig, CoinMiner, or BitMiner (categories: miner / trojan / pua).

🔗 Reference: VirusTotal Report — 5379df3d...

Why it evades the host antivirus:

• XMRig is technically "legitimate" mining software — many AV vendors classify it as PUA (Potentially Unwanted Application).
• Placed in a user directory where AV real-time scanning may have exclusions.
• The renamed filename avoids signature rules targeting xmrig.exe.
• VBScript indirection adds another layer of evasion.

Critical observations:

• Uses all 16 CPU threads at maximum intensity — explains the 80% resource usage at startup.
• pause-on-active: false means it never stops, even when the user is working.
• pause-on-battery: false drains laptop battery aggressively.
• background: true ensures no visible console window appears.

Set objShell = CreateObject("WScript.Shell") 
objShell.CurrentDirectory = "C:\Users\niraj\AppData\Roaming\windowshost" 
objShell.Run "svchost32.exe", 0, False 

The VBScript itself contains no overtly malicious code — it simply runs an executable — which is why it is not flagged by signature-based AV.

The HTTP API is disabled in config.json, but these certificates are bundled for the optional XMRig HTTPS API endpoint.

This file lists hashes for the original XMRig distribution, confirming the malware's source:

42eXxkZXEKLD38gM4XpNxUitLdkt5f7yZFJXRswCjvqPX9BjRmSUCL5Nxw7AKAY5hbaWpfbxWyors87ZZfvvWXhd6uTvXcN

Note: While the host AV missed it, VirusTotal cross-checks (sample report) show that the majority of engines do recognize this binary as XMRig / CoinMiner — the failure was specific to the host's installed product.

1. Kill the process — Open Task Manager → find svchost32.exe → End Task.
2. Disconnect from network — Prevent further communication with the mining pool.
3. Verify process is dead — Use Process Explorer to confirm no child processes remain.

4. Open Task Scheduler (taskschd.msc) → delete the WindowsHostService task.
5. Open Autoruns (run as Administrator) → remove any entry referencing runhidden.vbs, svchost32.exe, or windowshost.
6. Check the registry for any backup persistence:

   HKCU\Software\Microsoft\Windows\CurrentVersion\Run
   HKLM\Software\Microsoft\Windows\CurrentVersion\Run
   HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
   

7. Check Startup folders: shell:startup and shell:common startup.

8. Delete the entire malware directory:

   rmdir /s /q "C:\Users\niraj\AppData\Roaming\windowshost"

9. Search for related files — Check for copies in:
   • C:\Users\niraj\AppData\Local\Temp\
   • C:\ProgramData\
   • Other user profiles

10. Block the mining pool / observed IP at the firewall:

    netsh advfirewall firewall add rule name="Block Mining Pool" dir=out action=block remoteip=141.94.96.144
    netsh advfirewall firewall add rule name="Block SupportXMR" dir=out action=block remoteip=pool.supportxmr.com

11. Monitor CPU usage for 48 hours to confirm mining has stopped.
12. Run full antivirus scan with updated definitions (consider Malwarebytes or HitmanPro as a secondary scanner).

13. Change all passwords — Assume credentials may be compromised.
14. Investigate infection vector — phishing, cracked software, drive-by download, or USB?
15. Check for additional payloads — the dropper may have installed other malware.
16. Audit AV exclusions — ensure AppData\Roaming is not excluded from scanning.

The complete malware folder has been compressed into windowshost.zip and kept alongside this report for educational and incident-response purposes.

⚠️ WARNING: windowshost.zip contains a live, working XMRig miner. Do not unzip or execute it on any production or personal system.

1. Disable internet access (or route through INetSim/FakeNet) before unzipping.
2. Calculate hashes of every file and compare with the SHA256SUMS shipped in the archive.
3. Open config.json, runhidden.vbs, and SHA256SUMS in a text viewer — they are plain text.
4. Run static analysis on svchost32.exe (PE-bear, CFF Explorer, DIE) without executing.
5. Only execute under controlled conditions (Process Monitor + Wireshark running) if dynamic behavior is needed.
6. Revert the snapshot when done.

1. Antivirus alone is not enough — the host AV missed this entirely while VirusTotal engines did not.
2. Behavioral analysis matters — the 80% CPU usage was the only visible symptom.
3. Sysinternals tools are essential — Process Explorer, Autoruns, Process Monitor, TCPView, and RamMap revealed what AV could not.
4. Know your baseline — recognizing normal system behavior is what made the anomaly stand out.
5. Check process paths — the real svchost.exe only runs from C:\Windows\System32\, never from AppData.
6. Living-off-the-land techniques are common — attackers chain trusted Windows tools (VBScript, wscript, scheduled tasks) to avoid detection.

├── High CPU at startup with no user applications open
├── Process named similar to a system process (svchost32 vs svchost)
├── Executable running from AppData\Roaming (not System32)
├── Persistent outbound connections to known mining pools / Stratum ports
├── VBScript or PowerShell entries in Task Scheduler / startup
└── Lock files indicating background process management

This is a confirmed XMRig cryptocurrency miner operating covertly on the system. The attacker deployed a well-crafted evasion strategy that bypassed the host antivirus by:

1. Renaming the miner to mimic a Windows system process.
2. Using a VBScript launcher with a hidden window to execute it.
3. Persisting via a scheduled task disguised as WindowsHostService.
4. Staging files in a legitimate-looking AppData\Roaming directory.
5. Leveraging the fact that XMRig is technically "legitimate" software.

The malware was only discovered through manual forensic investigation using Sysinternals tools after the analyst noticed abnormal 80% CPU usage at startup. The sample is independently confirmed as a Monero miner by the majority of engines on VirusTotal:

🔗 https://www.virustotal.com/gui/file/5379df3d28d83164b24cfa02833233514958652eca489b968ff6e36b1bc49bc3

This case demonstrates that antivirus alone is insufficient against well-disguised threats. Manual investigation skills and knowledge of system internals remain critical for identifying stealthy malware.