Hackers Abuse Legitimate HWMonitor Binary to Load Malicious DLL Payload

Attackers distributed a trojanized HWMonitor installer that includes a malicious CRYPTBASE.dll which sideloads into the legitimate HWMonitor_x64.exe to execute a multi-stage, reflective in-memory loader delivering STX RAT. The RAT enables remote access, screenshot capture, system and security-product enumeration, and persistence; the report includes IoCs (distribution URL, C2 endpoint, filenames, and hashes) and defensive recommendations such as monitoring DLL loads, blocking unexpected DLLs, and enabling memory-based detections.