Cryptojacking - Process Hollowing InstallUtil.exe (T1055.012)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•6

Identifies RuntimeHost.exe spawning legitimate Microsoft .NET binaries (InstallUtil.exe) in a suspended state (no arguments) to hollow and inject miner shellcode.