Overview

overview

10

Static

static

3

2026-07-06...id.exe

windows10-2004-x64

10

2026-07-06...id.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 18:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_732c45cf433c4a7036bcd4d61132a87b_akira_glassworm_icedid.exe
  • Size 6.5MB
  • Sample260706-wpx6jsaz2v
  • SHA256 1fa1e028b2cad5297edcae7d505456d187bdf1bc29acba1e90d17f355951bca7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
executionxmrigminerpersistence

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 2 IoCs
    miner
  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry key 1 TTPs 7 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_732c45cf433c4a7036bcd4d61132a87b_akira_glassworm_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_732c45cf433c4a7036bcd4d61132a87b_akira_glassworm_icedid.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Windows\system32\schtasks.exe
      "schtasks" /Query /TN Svcbeckz7 /FO LIST /V
      2⤵
        PID:3876
      • C:\Windows\system32\schtasks.exe
        "schtasks" /Query /FO LIST /V
        2⤵
          PID:5512
        • C:\Windows\system32\cmd.exe
          "cmd" /C "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcRun /d"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1316
          • C:\Windows\system32\reg.exe
            reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcRun /d
            3⤵
            • Modifies registry key
            PID:1836
        • C:\Windows\system32\cmd.exe
          "cmd" /C "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcOnce /d"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3024
          • C:\Windows\system32\reg.exe
            reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcOnce /d
            3⤵
            • Modifies registry key
            PID:2132
        • C:\Windows\system32\schtasks.exe
          "schtasks" /Query /TN Svcbeckz7 /FO LIST /V
          2⤵
            PID:5992
          • C:\Windows\system32\schtasks.exe
            "schtasks" /Query /FO LIST /V
            2⤵
              PID:5552
            • C:\Windows\system32\cmd.exe
              "cmd" /C "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcRun /d"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4520
              • C:\Windows\system32\reg.exe
                reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcRun /d
                3⤵
                • Modifies registry key
                PID:4820
            • C:\Windows\system32\cmd.exe
              "cmd" /C "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcOnce /d"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1876
              • C:\Windows\system32\reg.exe
                reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcOnce /d
                3⤵
                • Modifies registry key
                PID:4388
            • C:\Users\Admin\AppData\Local\Temp\2026-07-06_732c45cf433c4a7036bcd4d61132a87b_akira_glassworm_icedid.exe
              "C:\Users\Admin\AppData\Local\Temp\2026-07-06_732c45cf433c4a7036bcd4d61132a87b_akira_glassworm_icedid.exe" --worker
              2⤵
              • Drops startup file
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1228
              • C:\Windows\system32\schtasks.exe
                "schtasks" /Query /TN Svcbeckz7 /FO LIST /V
                3⤵
                  PID:5836
                • C:\Windows\system32\schtasks.exe
                  "schtasks" /Query /FO LIST /V
                  3⤵
                    PID:1676
                  • C:\Windows\system32\cmd.exe
                    "cmd" /C "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcRun /d"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5220
                    • C:\Windows\system32\reg.exe
                      reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcRun /d
                      4⤵
                      • Modifies registry key
                      PID:2864
                  • C:\Windows\system32\cmd.exe
                    "cmd" /C "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcOnce /d"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:780
                    • C:\Windows\system32\reg.exe
                      reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcOnce /d
                      4⤵
                      • Modifies registry key
                      PID:1288
                  • C:\Users\Admin\AppData\Local\Cache\jb91pfza\bnqftiht.exe
                    "C:\Users\Admin\AppData\Local\Cache\jb91pfza\bnqftiht.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    PID:2328
                  • C:\Windows\system32\schtasks.exe
                    "schtasks" /Query /FO LIST
                    3⤵
                      PID:5700
                    • C:\Windows\system32\schtasks.exe
                      "schtasks" /Create /TN Svcbeckz7 /TR \"C:\Users\Admin\AppData\Local\Cache\jb91pfza\lckykhcr.exe\" /SC ONLOGON /RL LIMITED /F
                      3⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:3124
                    • C:\Windows\system32\schtasks.exe
                      "schtasks" /Query /TN Svcbeckz7 /FO LIST /V
                      3⤵
                        PID:5568
                      • C:\Windows\system32\cmd.exe
                        "cmd" /C "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:5776
                        • C:\Windows\system32\reg.exe
                          reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
                          4⤵
                          • Modifies registry key
                          PID:4808
                  • C:\Users\Admin\AppData\Local\Cache\jb91pfza\lckykhcr.exe
                    "C:\Users\Admin\AppData\Local\Cache\jb91pfza\lckykhcr.exe"
                    1⤵
                    • Executes dropped EXE
                    PID:3040

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        bnqftiht.exe
                        • Path C:\Users\Admin\AppData\Local\Cache\jb91pfza\bnqftiht.exe
                        • Size 6.2MB
                        • SHA256 6fa80698d7268f6e88aa88c06fb27ee99e1bcee747c2e76911e6206a5b1aeeb3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        config.bin
                        • Path C:\Users\Admin\AppData\Local\Cache\jb91pfza\config.bin
                        • Size 556B
                        • SHA256 33d0bc4316f338ab57ec81ec5f2a45b0dc166b1fa3f6a8c761ee29c8fd0b29ba
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        config.json
                        • Path C:\Users\Admin\AppData\Local\Cache\jb91pfza\config.json
                        • Size 913B
                        • SHA256 5a64dd6bb6ac95b7a5ac5b6e1f984c2d097024df3cd908c1050226b4f58303fd
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        config.json
                        • Path C:\Users\Admin\AppData\Local\Cache\jb91pfza\config.json
                        • Size 3KB
                        • SHA256 53793c5aa837d4f8396be34d63f7c86dcbbdb83d4eef1320632953bef4cd3137
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        lckykhcr.exe
                        • Path C:\Users\Admin\AppData\Local\Cache\jb91pfza\lckykhcr.exe
                        • Size 6.5MB
                        • SHA256 1fa1e028b2cad5297edcae7d505456d187bdf1bc29acba1e90d17f355951bca7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        memory/2328-16-0x00000121894B0000-0x00000121894D0000-memory.dmp
                        Download