Overview

overview

10

Static

static

3

BUSINESS.exe

windows10-2004-x64

10

BUSINESS.exe

windows10-ltsc_2021-x64

10

BUSINESS.exe

windows11-21h2-x64

10

BUSINESS.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    899s
  • max time network
    901s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-de
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-delocale:de-deos:windows10-ltsc_2021-x64systemwindows
  • submitted
    28/08/2026, 18:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BUSINESS.exe
  • Size 3.1MB
  • Sample260828-xdeeqsdh39
  • SHA256 77732467adc21963457d9a933842cffae9a9c4c46e5abbb26be3b3ac94fa406b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionxmrigminerpersistence

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 2 IoCs
    miner
  • Executes dropped EXE 4 IoCs
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\BUSINESS.exe
    "C:\Users\Admin\AppData\Local\Temp\BUSINESS.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Windows\system32\schtasks.exe
      "schtasks.exe" /Create /TN Microsoft\RuntimeBroker /XML C:\ProgramData\MicrosoftRuntime\task.xml /F
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3172
    • C:\ProgramData\MicrosoftRuntime\spoolsvdh.exe
      "C:\ProgramData\MicrosoftRuntime\spoolsvdh.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:836
      • C:\Windows\system32\taskkill.exe
        "taskkill.exe" /F /IM xwin.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3540
      • C:\ProgramData\MicrosoftRuntime\xwin\xwin.exe
        "C:\ProgramData\MicrosoftRuntime\xwin\xwin.exe" --http-enable --http-port 37575 --algo rx/0 --url pool.hashvault.pro:443 --user 87uCyt4KBazQmM3nEyvH9LcexVdTb9yE4bQgD9uE8TmeLuMyEfbhWgBGmJB2MKhkdUZSvQ3QrVPUt8iFQts9ouh5NnxHZpJ --pass Ryzen --threads 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:3492
      • C:\Windows\system32\taskkill.exe
        "taskkill.exe" /F /IM xwin.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3828
      • C:\ProgramData\MicrosoftRuntime\xwin\xwin.exe
        "C:\ProgramData\MicrosoftRuntime\xwin\xwin.exe" --http-enable --http-port 37575 --algo rx/0 --url pool.hashvault.pro:443 --user 87uCyt4KBazQmM3nEyvH9LcexVdTb9yE4bQgD9uE8TmeLuMyEfbhWgBGmJB2MKhkdUZSvQ3QrVPUt8iFQts9ouh5NnxHZpJ --pass Ryzen --threads 8 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:4252
    • C:\ProgramData\MicrosoftRuntime\WmiPrvSErs.exe
      "C:\ProgramData\MicrosoftRuntime\WmiPrvSErs.exe" --watchdog
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:5124

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        spoolsvdh.exe
        • Path C:\ProgramData\MicrosoftRuntime\spoolsvdh.exe
        • Size 3.1MB
        • SHA256 77732467adc21963457d9a933842cffae9a9c4c46e5abbb26be3b3ac94fa406b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        task.xml
        • Path C:\ProgramData\MicrosoftRuntime\task.xml
        • Size 1KB
        • SHA256 a8b60d9f6f4ad2e3b6fea902bfd4a19dde1d495c26a657b8e6dc8a459feb0b01
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        xwin.exe
        • Path C:\ProgramData\MicrosoftRuntime\xwin\xwin.exe
        • Size 6.1MB
        • SHA256 c37bb7771f6eaec85825ca8303493c6948567d3b00b9be17a8763cf7b8c8ed90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3492-10-0x000001BB12670000-0x000001BB12690000-memory.dmp
        Download