[🧑‍💻] The Cause of a Company PC’s Memory Shortage: Crypto-Mining Malware and a Zombie PC

✨ GPT-5.6 Sol’s Summary 　

A two-day investigation of a company PC whose commit charge kept reaching the limit despite available RAM, ending with mining commands and a disguised loader found in a WPR ETL trace.

Yesterday morning, I heard that one company PC kept showing out-of-memory errors.

Task Manager looked strange. Only about half of the 16GB of physical RAM was actually in use. Nearly 9GB remained available, yet Excel and the browser closed with Out of Memory errors. The commit charge, meanwhile, had reached 18.1 / 18.8GB.

At first, the C drive had less than 10GB free and the page file was only around 3GB, so I suspected SSD free space and virtual-memory settings. ChatGPT also said there was more than a 90% chance that insufficient SSD space was the cause.

But one question kept bothering me.

Why was the commit charge this high when nothing was open?

Increasing the Page File Let the Culprit Grow Too

I switched the page file to automatic management and rebooted. This kept the system from dying immediately, but it did not solve the problem.

When the commit limit was 16GB, usage rose to 15.5 / 16GB. After virtual memory increased the limit to nearly 32GB, it climbed to 31.9 / 32GB.

That finally made one thing certain.

The small page file did make the error appear sooner, but the page file was not what consumed the memory. Something kept reserving nearly the entire limit. Raising the limit only gave it more to consume.

I sorted processes by commit size in Task Manager and Process Explorer. I stopped resident programs one by one, disabled antivirus software, and reduced startup programs. Even the combined commit charge of all visible processes could not explain the total.

Malware Zero found and quarantined a potentially unwanted program named SmartBridge. I wondered whether this was the cause, but the commit charge began rising again after reboot.

I kept asking:

Honestly, at this point isn’t it reasonable to suspect a virus?

Even then, ChatGPT said malware had to be considered seriously but was not yet confirmed. A PUP, malfunctioning security module, or hidden service could still explain it.

A One-Hour WPR Trace Went Wrong Before I Got a Usable Recording

I installed Windows Performance Recorder and Windows Performance Analyzer to identify the commit charge that Task Manager could not attribute.

The first attempt was a mess. I left VirtualAlloc tracing in file mode for more than an hour until the commit limit filled. Stopping the trace also failed, and the ETL was not saved.

After another reboot, I specified the exact path of the installed WPR. I started a memory-mode trace and stopped it the moment the commit charge surged, producing memory.etl.

The file was 318MB.

The Mining Command Was Preserved in the ETL

This afternoon, analysis of that ETL ended the long chain of guesses at once.

The log repeatedly contained this command:

C:\Windows\System32\cmd.exe
  --algo progpowz
  --url stratum+tcp://pool.zh.woolypooly.com:3146
  --user [wallet address]
  --pass x

progpowz, stratum+tcp, a mining-pool address, and a wallet address appeared in a single command. This was a cryptocurrency-mining command, not an ordinary software failure.

The same ETL contained even more explicit traces:

• C:\ProgramData\KB5019959.exe, disguised as a Windows update file, ran repeatedly.
• Encoded PowerShell commands were executed.
• A command attempted to disguise PowerShell as a normal system file.
• Microsoft Defender behavior and path/process exclusions were added.
• Files were downloaded from an external repository and extracted with 7-Zip under C:\ProgramData\Google.
• DNS settings were changed, and sleep and hibernation were disabled.

The ETL also mentioned FindWorker.exe, which appeared to be normal work software, many times. But appearing frequently in the same log was not enough to call it the infection source. The decisive evidence was the separate mining-pool command and the behavior of the disguised loader. The initial infection vector was still unknown.

When I saw the result, I said:

Wow… is this the zombie PC I’d only heard about????

More precisely, it was a mining zombie PC whose resources were being secretly used by an attacker. The low SSD space and page-file size only made the symptom surface sooner; they were not the root cause.

I Alerted the Company Immediately

Someone said the symptoms began after a USB drive was connected, but that alone could not prove the USB was the infection vector. Still, the same USB might be connected to other PCs, and the infected PC had access to the company NAS. I could not keep the result to myself.

I sent this emergency notice internally:

[Urgent Security Notice]

A company PC has been confirmed as a “zombie PC” infected with cryptocurrency-mining malware.

The exact infection vector has not yet been identified, but we currently suspect a USB device containing malware as the first possibility.

We are also investigating whether the company NAS and shared files were infected or altered, and will provide another notice when the results are available.

If your PC has become unusually slow or Excel, documents, or browsers close without reason, check the following:

Ctrl + Shift + Esc → Task Manager → Performance → Memory → Committed

On the infected PC, nearly 9GB of physical RAM remained “available,” yet we observed abnormal behavior in which

• the commit charge nearly reached its limit, such as 15.5GB / 16GB, or
• after virtual memory was enabled, it continued rising to the limit, such as 31.9GB / 32GB.

If any of the following apply, capture the Task Manager memory screen and notify us immediately:

• Commit charge above 12GB while no significant programs are running
• Commit usage above 80% of the maximum limit
• A commit value that continues rising while the PC is idle
• Excel, documents, or browsers repeatedly closing without reason
• “Out of Memory” or other memory-shortage errors
• A slowdown or unusual symptoms after a recent USB connection

If you notice unusual behavior, do not delete files or programs yourself, and do not connect the USB device you used to another PC. I will inspect affected PCs in person.

I Sent a Follow-Up Notice After Checking the NAS

I exported the NAS logs and ran a full investigation for altered files. Fortunately, I found no sign that malware had spread to the NAS. After checking that, I sent this follow-up:

The company NAS inspection has not found evidence sufficient to confirm infection of the NAS itself. However, infection cannot yet be completely ruled out, so we will perform sequential folder backups to protect the data.

Work files can currently be opened and used normally.

Backups will run every day from 23:00 to 07:00 the following morning. The NAS will remain available, but access and file processing may temporarily slow during this period.

Please report immediately if a file will not open or if its name, extension, or content has changed abnormally. (Emergency contact: 010-0000-0000)

To Be Continued

Tomorrow looks like it will be extremely busy.

Three people on the same second floor are now reporting almost identical symptoms, and, coincidentally, all three belong to the company’s only finance and accounting team. I will therefore have to reformat those three PCs as quickly as possible tomorrow.

This has overtime written all over it…