SimpleRunPE

SimpleRunPE is a Windows loader used in a Microsoft-reported 2026 cryptojacking campaign that targeted users seeking popular PC utilities and hardware-monitoring tools, including CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, and PDFgear. Victims were directed to attacker-controlled download sites via SEO poisoning and, in some observed cases, AI assistant software recommendations. The infection chain used malicious ZIP archives containing a legitimate executable and a malicious autorun.dll for DLL sideloading, which installed ScreenConnect (ConnectWise Control) for persistent remote access; after the ScreenConnect session was established, attackers transferred SimpleRunPE.exe, or in some cases downloaded the same component via PowerShell under the name vlc.exe.

Once executed, SimpleRunPE copies itself to a hidden installation path as RuntimeHost.exe, hides the file via attribute changes, and establishes persistence through multiple mechanisms including registry Run keys, scheduled tasks, and a Startup folder shortcut. Reported scheduled task names include Windows System Health, Windows System Health Monitor, and Windows System Health Check. The malware recreates persistence artifacts if removed and re-adds Microsoft Defender exclusions if those exclusions are deleted. It invokes PowerShell Add-MpPreference commands to create path-based and process-based Defender exclusions covering its hollowing targets and miner-related binaries.

The malware performs anti-analysis and environment checks for virtualization platforms such as VMware, VirtualBox, and QEMU, and for analyst or monitoring tools including Task Manager, Process Explorer, Process Hacker, System Informer, dnSpy, x64dbg, IDA, Ghidra, ProcMon, Wireshark, and Fiddler. It uses process hollowing to execute payloads inside trusted Microsoft-signed .NET binaries, including InstallUtil.exe, RegAsm.exe, RegSvcs.exe, MSBuild.exe, AppLaunch.exe, AddInProcess.exe, and aspnet_compiler.exe.

After hollowing, SimpleRunPE profiles the host and communicates with attacker-controlled infrastructure. Reported reconnaissance includes CPU and GPU details, RAM, Windows version, local IP address, country code, installed antivirus, idle time, GPU activity, and mining state. Microsoft reported that the malware stores its C2 in an AES-128-CBC encrypted blob, pins the TLS certificate by hardcoded SHA-256 fingerprint, and decrypts to the WebSocket URL wss://minemine.gleeze[.]com:8443/ws. The malware then downloads and runs GPU-focused cryptocurrency miners at runtime, specifically gminer, lolMiner, and SRBMiner-MULTI, rather than embedding a miner directly.

Microsoft assessed that the broader operation selectively targeted systems with high-performance GPUs to maximize mining profitability and that the persistent ScreenConnect access could also enable follow-on activity such as data theft, lateral movement, or ransomware. Additional high-confidence identifiers mentioned in reporting include the campaign identifier D3F4E2A1 used in the install path, mutex Global\D3F4E2A1_Svc, and Defender exclusion entries; ScreenConnect infrastructure at 193.42.11[.]108 with host parameter directdownload[.]icu; and related infrastructure including 93.115[.]10.35, 198.23[.]185.238, 2.59.132[.]106, and domains such as direct-download[.]giize[.]com and free-download[.]giize[.]com. Microsoft also noted an embedded PDB path in SimpleRunPE.exe matching the public GitHub proof-of-concept Watermwo/Simple-RunPE-Process-Hollowing and assessed with moderate confidence that the malware may be a fork of that codebase.