Cryptojacking via ScreenConnect - Process Hollowing RegAsm

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•3

Correlates RuntimeHost.exe spawning suspended RegAsm.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities for process hollowing.