Hola Browser Supply Chain Compromise: Cryptominer Detection and Removal

---
title: Hola Browser Spawning Undeclared Suspicious Process
id: 8a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects Hola Browser or its updater spawning a process that is not the browser itself, a known dependency, or an installer, indicative of the supply chain cryptominer activity.
references:
  - https://www.bleepingcomputer.com/news/security/hola-browser-for-windows-compromised-to-deliver-cryptominer/
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.execution
  - attack.t1059
  - attack.supply_chain
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Hola Browser\'
      - '\hola_updater.exe'
      - 'hola.exe'
  selection_child:
    Image|endswith:
      - '.exe'
  filter_legit_browser:
    Image|contains:
      - '\Hola Browser\'
      - '\hola.exe'
  filter_legit_installer:
    Image|contains:
      - '\Temp\'
      - '\setup'
    CommandLine|contains:
      - '/update'
      - '/install'
condition: selection_parent and selection_child and not 1 of filter_legit*
falsepositives:
  - Legitimate user-installed extensions launching helpers (rare)
level: high
---
title: Cryptominer Network Activity from Browser Context
id: 9b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects outbound network connections on ports commonly associated with cryptocurrency mining (Stratum protocol) initiated by a browser process.
references:
  - https://www.bleepingcomputer.com/news/security/hola-browser-for-windows-compromised-to-deliver-cryptominer/
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_ports:
    DestinationPort:
      - 3333
      - 4444
      - 14444
      - 3335
  selection_source:
    Image|contains:
      - 'hola.exe'
  filter_localhost:
    DestinationIp:
      - '127.0.0.1'
      - '::1'
condition: selection_ports and selection_source and not filter_localhost
falsepositives:
  - Legitimate websocket traffic to gaming servers (unlikely on these specific ports)
level: high


**KQL (Microsoft Sentinel / Defender)**

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName has "hola" 
| where ProcessFileName !contains "hola" 
| where not(ProcessFileName in~ ("conhost.exe", "cmd.exe", "powershell.exe", "WerFault.exe"))
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessFileName, ProcessCommandLine, FolderPath, SHA256
| order by Timestamp desc


**Velociraptor VQL**

-- Identify suspicious child processes spawned by Hola Browser
SELECT Pid, Name, CommandLine, Exe, Username,ppid
FROM pslist()
WHERE ppid IN (
    SELECT Pid FROM pslist() WHERE Name =~ "hola.exe" OR Name =~ "hola_updater.exe"
)
AND NOT Name =~ "hola"


**Remediation Script (PowerShell)**

# Requires Administrator Privileges
Write-Host "[*] Initiating Hola Browser Incident Response Script..." -ForegroundColor Cyan

# 1. Terminate Hola Processes and potential child miners
Write-Host "[*] Terminating Hola Browser processes..." -ForegroundColor Yellow
Get-Process | Where-Object { $_.ProcessName -like "*hola*" } | Stop-Process -Force -ErrorAction SilentlyContinue

# 2. Uninstall Hola Browser via Registry/WMI
Write-Host "[*] Attempting automated uninstallation..." -ForegroundColor Yellow
$uninstallPaths = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
)

$holaApps = Get-ItemProperty $uninstallPaths -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -like "*Hola*" }

if ($holaApps) {
    foreach ($app in $holaApps) {
        Write-Host "[+] Found application: $($app.DisplayName)" -ForegroundColor Green
        if ($app.UninstallString) {
            $uninstallCmd = $app.UninstallString -replace '"', ''
            $args = ($app.UninstallString -replace $uninstallCmd, '').Trim()
            Start-Process -FilePath $uninstallCmd -ArgumentList $args -Wait -ErrorAction SilentlyContinue
        }
    }
} else {
    Write-Host "[-] Hola Browser not found in standard uninstall registry keys." -ForegroundColor Red
}

# 3. Clean up残留 Directories (User Profile and Program Files)
Write-Host "[*] Removing residual directories..." -ForegroundColor Yellow
$pathsToRemove = @(
    "$env:LOCALAPPDATA\Hola Browser",
    "$env:PROGRAMFILES\Hola Browser",
    "$env:PROGRAMFILES(X86)\Hola Browser"
)

foreach ($path in $pathsToRemove) {
    if (Test-Path $path) {
        Write-Host "[+] Removing directory: $path" -ForegroundColor Green
        Remove-Item -Path $path -Recurse -Force -ErrorAction SilentlyContinue
    }
}

Write-Host "[*] Remediation complete. Please reboot the system." -ForegroundColor Cyan