---
title: Acronis Discovers New AutoIt Cryptominer Campaign Injecting Windows Process
description: ABC
canonical_url: https://www.acronis.com/en/blog/posts/acronis-discovers-new-autoit-cryptominer-campaign-injecting-windows-process/
locale: en
last_updated: 2026-10-27
---

[Acronis Blog](https://www.acronis.com/en/blog/)
# Acronis Discovers New AutoIt Cryptominer Campaign Injecting Windows Process

The Acronis Security Team was one of the first to identify a new cryptomining campaign targeting the attrib.exe Windows process. Learn how our team detected the spike in crytomining attacks, how the AutoIt cryptomining malware works, and how Acronis Active Protection - built into Acronis cyber protection solutions - helps to keep your systems protected.

[Try Now](https://www.acronis.com/en/products/cloud/trial/)

[![Image 2: Syed Aizad](https://staticfiles.acronis.com/images/content/4ebd2c6ab90855a20d45286557169382.png)](https://www.acronis.com/en/blog/authors/syed-aizad/ "Syed Aizad")

[Syed Aizad](https://www.acronis.com/en/blog/authors/syed-aizad/)

8 min read

Last updated 20 October 2022

In a [blog](https://www.acronis.com/en-us/blog/posts/just-one-month-acronis-new-cryptojacking-blocker-delivers-great-results) post last year we talked about how Acronis’ cryptomining protection had delivered great results within just one month of its release. Since then, we’ve seen few injection cases involving legitimate Windows processes. Recently, however, we’ve seen many cases involving attrib.exe being abused by the AutoIt script-based cryptominer malware. Malicious actors have famously abused attrib.exe often. Additionally, some other security vendors and researchers have reported that attrib.exe has been abused by injection techniques from other cryptominer variants.

We have observed some spike in our cryptomining protection telemetry: Around 36k attacks detected by our product in just three weeks. More than 30 countries were affected during this short timeframe.

![Image 3: Total attack count by date statistics](https://staticfiles.acronis.com/images/content/2e350b3fef6473dce3f0645b589d9353.png)

Total attack count by date statistics

![Image 4: Total countries where AutoIt attacked](https://staticfiles.acronis.com/images/content/766325e30ca1d2de7ae5183fc681a41f.png)

Total countries where AutoIt attacked

We managed to capture an interesting sample of the cryptominer that’s actively attacking our customers. The observed variant mines for one of the most famous cryptocurrencies that attackers abuse in the cyber world: Monero (XMR).

![Image 5: Stages of AutoIt cryptomining infection](https://staticfiles.acronis.com/images/content/8ea541324dc12811efe0481fa9668cda.png)

Stages of AutoIt cryptomining infection

During the execution of the dropper, it will unzip the archive containing the mining module and copy it into “%Appdata%\\Microsoft\\Windows\\Helper.exe”. Then it will create a task scheduler to execute the mining sample with the parameter we’ll soon explain.

![Image 6: Dropped files path](https://staticfiles.acronis.com/images/content/097a58ca7ce03bd882452fb9bd16c7fb.png)

Dropped files path

The dropper use information from an XML file to create a task scheduler with the task name "SystemCheck". This will execute the cryptominer module with "-SystemCheck" parameter.

![Image 7: Cryptominer module executed with parameter by task scheduler](https://staticfiles.acronis.com/images/content/da527822fb38f16a6f32444d592f2013.png)

Cryptominer module executed with parameter by task scheduler

## Cryptomining module

The cryptomining binary named as Helper.exe is actually a 64bit AutoIt script that’s compiled to an executable (.exe). Once decompiled, we managed to see the main script, which performs:

1.   Evasion - Described in detail in the section “Evasion technique”
2.   Modules download - It downloads additional component using tor.exe upd.version: Contains version number mn.pid: Contains process ID for process performing mining operation SysBackup.txt: XMRig miner executable 
3.   Process injection - Injecting mining module into legitimate attrib.exe, this is also part of evasion
4.   Cryptomining logic

This cryptominer will first drop the tor.exe component, which will download additional mining components anonymously via base64 hardcoded .onion domains. The main component downloaded is the XMRig binary itself.

![Image 8: Additional component to be downloaded by tor](https://staticfiles.acronis.com/images/content/4c64e511fe0494e83c54f06b4df99623.png)

Additional component to be downloaded by tor

![Image 9: AutoIt script to download XMRig executable](https://staticfiles.acronis.com/images/content/6cb87a0a6bc9b94d937a4b5c4a85e047.png)

AutoIt script to download XMRig executable

![Image 10: .onion domains encoded in base64](https://staticfiles.acronis.com/images/content/99b18d1351601bb0eab0a5741aafe43d.png)

.onion domains encoded in base64

![Image 11: List of .onion domains after decode](https://staticfiles.acronis.com/images/content/3d4234d7c80e788e3fbb85b760c31cd9.png)

List of .onion domains after decode

![Image 12: Tor network communication](https://staticfiles.acronis.com/images/content/cb353cae4897c9975aa844c1f5539d95.png)

Tor network communication

![Image 13: XMRig binary downloaded by tor.exe](https://staticfiles.acronis.com/images/content/74e1328ed80bb87b071b46f8b9352811.png)

XMRig binary downloaded by tor.exe

![Image 14: AutoIt script containing stratum mining logic](https://staticfiles.acronis.com/images/content/e249d21091f9e05331d4c30a4347f625.png)

AutoIt script containing stratum mining logic

![Image 15: Helper.exe injection to attrib.exe](https://staticfiles.acronis.com/images/content/b887e964c40848393934771548f570ee.png)

Helper.exe injection to attrib.exe

![Image 16: Attrib.exe executing mining logic](https://staticfiles.acronis.com/images/content/d7b7e011f09ef87407d5f109ad37130e.png)

Attrib.exe executing mining logic

Below is the TCP request and response containing XMRig mining JSON-RPC.

![Image 17: XMRig JSON-RPC mining over TCP](https://staticfiles.acronis.com/images/content/8df575f93dfe24eef4cdaa41ee162f1a.png)

XMRig JSON-RPC mining over TCP

## Evasion technique

This cryptominer module also has the ability to check for forensic and monitoring processes, as well as AV related processes. It will terminate itself if it sees any monitoring process listed below running on the victim’s machine.

![Image 18: Auto-shut down forensic and monitoring processes](https://staticfiles.acronis.com/images/content/b985ed5c072e683ea3c423fb3cac503c.png)

Auto-shut down forensic and monitoring processes 

![Image 19: Auto-shut down AV executable names](https://staticfiles.acronis.com/images/content/67cfc40439e702d64e5a2ea1d5b2c961.png)

Auto-shut down AV executable names

## Infostealer module

There is a module to collect the victim’s machine information and send it to the attacker’s server via User-Agent over HTTP header. The collected information includes OS, CPU, GPU, and AV program information.

![Image 20: Infostealer module in AutoIt script](https://staticfiles.acronis.com/images/content/40db1fb3cede3bbfddf4a93186419fa5.png)

Infostealer module in AutoIt script

## Conclusion

To protect against cryptomining, we recommend using an advanced anti-cryptomining solution and maintaining an updated anti-virus solution. Acronis products are equipped with advanced anti-cryptomining technology that can protect you against these kinds of attacks.

Cyber protection products like the personal solution [Acronis True Image 2020](https://www.acronis.com/en-us/personal/computer-backup/), business solution[Acronis Cyber Backup](https://www.acronis.com/en-us/business/backup/), and our newly released [Acronis Cyber Cloud](https://www.acronis.com/en-sg/cloud/service-provider/platform/) 8.0 come with the AI-based, anti-malware defense [Acronis Active Protection](https://www.acronis.com/en-us/articles/how-to-block-cryptomining-scripts-in-your-browser/) built-in, enabling them to protect users from cryptomining malware.

![Image 21: Acronis Active Protection detects mining activity by injected code in attrib.exe](https://staticfiles.acronis.com/images/content/8c73da5bd7f188e4e89f7989283ef51f.png)

Acronis Active Protection detects mining activity by injected code in attrib.exe

The effectiveness of Acronis Active Protection against illicit cryptomining was recently proven in an independent evaluation performed by AMTSO member testing laboratory, NioGuard. The test was done according to strict AMTSO standards and confirmed very good results from Acronis technology with Acronis Cyber Backup finishing in second place with an overall protection rating of 94%. You can check the full test to see details on more than 20 cryptojackers used in the evaluation.

![Image 22: Cryptominer hashes](https://staticfiles.acronis.com/images/content/f2677fac3687f8a7c9baa5f00e0b1ff5.png)

Cryptominer hashes

![Image 23: Mining pool domain](https://staticfiles.acronis.com/images/content/49ae69d5747378f2fb2fe15b5ff455e9.png)

Mining pool domain

![Image 24: Additional component download domain](https://staticfiles.acronis.com/images/content/63e0159ceb7b0be75b6350084b2bcdbb.png)

Additional component download domain

[Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/)  
[Cyber protection](https://www.acronis.com/en/blog/tags/cyber-protection/)

## Written by

![Image 25: Syed Aizad](https://staticfiles.acronis.com/images/content/4ebd2c6ab90855a20d45286557169382.png)

Syed Aizad

[Previous post](https://www.acronis.com/en/blog/posts/acronis-acquires-5nine-msps-gain-unified-cloud-management-and-security-tools/)  
[Acronis Acquires 5nine: MSPs Gain Unified Cloud Management and Security Tools](https://www.acronis.com/en/blog/posts/acronis-acquires-5nine-msps-gain-unified-cloud-management-and-security-tools/)

[Next post](https://www.acronis.com/en/blog/posts/acronis-draas-earns-gartner-peer-insights-customers-choice-and-singled-out-voice-customer/)  
[Acronis DRaaS Earns Gartner Peer Insights Customers’ Choice and Singled Out in the “Voice of the Customer” Report](https://www.acronis.com/en/blog/posts/acronis-draas-earns-gartner-peer-insights-customers-choice-and-singled-out-voice-customer/)

About Acronis

Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland.

[Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com)

## Related stories

Want to learn more? Read the latest stories featuring this solution on our blog.

[Acronis Blog](https://www.acronis.com/en/blog/)

![Image 26: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png)

[stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/)

We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain.

**October 26, 2026**3 min read

![Image 27: Introducing New Acronis CEO: Prakash Panjwani](https://staticfiles.acronis.com/images/blog-card/30cb571f6f1aaa131733e5727a4a250c.png)

[Introducing New Acronis CEO: Prakash Panjwani](https://www.acronis.com/en/blog/posts/introducing-new-acronis-ceo-prakash-panjwani/)

We are pleased to announce the appointment of our new Chief Executive Officer, Prakash Panjwani. A veteran cybersecurity CEO, Panjwani previously served as CEO of WatchGuard Technologies and SafeNet.

**October 15, 2026**2 min read

![Image 28: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png)

[Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/)

Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity.

**October 13, 2026**6 min read