xmrig | 762d34adaef9bdd6a5a6e2d894bb4c5bda434e8740360adf82a399d7d1f7f46c

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe
Size 6.5MB
Sample260718-fm9hssct21
SHA256 762d34adaef9bdd6a5a6e2d894bb4c5bda434e8740360adf82a399d7d1f7f46c
MD5 0616f526dd47ddc0b69bc9e8ddc946a0
SHA1 555f645eba8002c57ff8dd8c4a92a1533f0d8882
SHA512 4ab0accb11827b70492a312073a97dd86d83aa65761a84ae31d6619d92a93aba5ebf29a2e1fd2fdcc795e3a48950521a0908126e2b23636c24e311b28e079cfb
SSDEEP 98304:WY5HAEC5ohAc6HyBzOV+8QeDVWWRgIlGWF22Jj6xN3AfuH+:ht6HywVRbV7j4+ANd
TLSH
T1EB668D15BA9A58ADC49AC474834A4B636E3170CA0B36B9FF05C482353F6ABF42F3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c53a-13.dat	family_xmrig
behavioral2/files/0x000d00000001c53a-13.dat	xmrig

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SvcLnkx6mk05.lnk	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe

Executes dropped EXE 2 IoCs

pid	Process
5436	bnjbaaiy.exe
360	lcntkrjs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\SvcRun0ydtc7 = "\"C:\\Users\\Admin\\AppData\\Local\\Cache\\z53h4zjy\\lcntkrjs.exe\""	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2516	cmd.exe
1800	cmd.exe
5572	cmd.exe
4996	cmd.exe
1680	cmd.exe
5452	cmd.exe
3524	cmd.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
2556	reg.exe
2860	reg.exe
1084	reg.exe
5832	reg.exe
1776	reg.exe
1912	reg.exe
1596	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4212	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4932	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe
4932	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe
4932	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe
4932	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe
4932	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe
4932	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5436	bnjbaaiy.exe
Token: SeLockMemoryPrivilege	5436	bnjbaaiy.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5436	bnjbaaiy.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 5116	4884	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	89
PID 4884 wrote to memory of 3588	4884	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	91
PID 4884 wrote to memory of 5452	4884	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	93
PID 5452 wrote to memory of 1596	5452	cmd.exe	95
PID 4884 wrote to memory of 3524	4884	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	96
PID 3524 wrote to memory of 2556	3524	cmd.exe	98
PID 4884 wrote to memory of 3232	4884	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	99
PID 4884 wrote to memory of 2208	4884	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	101
PID 4884 wrote to memory of 2516	4884	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	103
PID 2516 wrote to memory of 2860	2516	cmd.exe	105
PID 4884 wrote to memory of 1800	4884	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	106
PID 1800 wrote to memory of 1084	1800	cmd.exe	108
PID 4884 wrote to memory of 4932	4884	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	109
PID 4932 wrote to memory of 5216	4932	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	110
PID 4932 wrote to memory of 5044	4932	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	112
PID 4932 wrote to memory of 5572	4932	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	114
PID 5572 wrote to memory of 5832	5572	cmd.exe	116
PID 4932 wrote to memory of 4996	4932	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	117
PID 4996 wrote to memory of 1776	4996	cmd.exe	119
PID 4932 wrote to memory of 5436	4932	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	120
PID 4932 wrote to memory of 3956	4932	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	122
PID 4932 wrote to memory of 4212	4932	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	124
PID 4932 wrote to memory of 2004	4932	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	129
PID 4932 wrote to memory of 1680	4932	2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe	131
PID 1680 wrote to memory of 1912	1680	cmd.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\system32\schtasks.exe
  "schtasks" /Query /TN Svcbd9gjp /FO LIST /V
  2⤵
  PID:5116
- C:\Windows\system32\schtasks.exe
  "schtasks" /Query /FO LIST /V
  2⤵
  PID:3588
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcRun /d"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Windows\system32\reg.exe
    reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcRun /d
    3⤵
    - Modifies registry key
    PID:1596
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcOnce /d"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\system32\reg.exe
    reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcOnce /d
    3⤵
    - Modifies registry key
    PID:2556
- C:\Windows\system32\schtasks.exe
  "schtasks" /Query /TN Svcbd9gjp /FO LIST /V
  2⤵
  PID:3232
- C:\Windows\system32\schtasks.exe
  "schtasks" /Query /FO LIST /V
  2⤵
  PID:2208
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcRun /d"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\system32\reg.exe
    reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcRun /d
    3⤵
    - Modifies registry key
    PID:2860
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcOnce /d"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\system32\reg.exe
    reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcOnce /d
    3⤵
    - Modifies registry key
    PID:1084
- C:\Users\Admin\AppData\Local\Temp\2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-17_0616f526dd47ddc0b69bc9e8ddc946a0_akira_glassworm_icedid.exe" --worker
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN Svcbd9gjp /FO LIST /V
    3⤵
    PID:5216
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /FO LIST /V
    3⤵
    PID:5044
- - C:\Windows\system32\cmd.exe
    "cmd" /C "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcRun /d"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5572
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcRun /d
      4⤵
      Modifies registry key
      PID:5832
- - C:\Windows\system32\cmd.exe
    "cmd" /C "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcOnce /d"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f SvcOnce /d
      4⤵
      Modifies registry key
      PID:1776
- - C:\Users\Admin\AppData\Local\Cache\z53h4zjy\bnjbaaiy.exe
    "C:\Users\Admin\AppData\Local\Cache\z53h4zjy\bnjbaaiy.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5436
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /FO LIST
    3⤵
    PID:3956
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /TN Svcbd9gjp /TR \"C:\Users\Admin\AppData\Local\Cache\z53h4zjy\lcntkrjs.exe\" /SC ONLOGON /RL LIMITED /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4212
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN Svcbd9gjp /FO LIST /V
    3⤵
    PID:2004
- - C:\Windows\system32\cmd.exe
    "cmd" /C "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
      4⤵
      Modifies registry key
      PID:1912

C:\Users\Admin\AppData\Local\Cache\z53h4zjy\lcntkrjs.exe
"C:\Users\Admin\AppData\Local\Cache\z53h4zjy\lcntkrjs.exe"
1⤵
- Executes dropped EXE
PID:360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bnjbaaiy.exe

Path C:\Users\Admin\AppData\Local\Cache\z53h4zjy\bnjbaaiy.exe
Size 6.2MB
SHA256 6fa80698d7268f6e88aa88c06fb27ee99e1bcee747c2e76911e6206a5b1aeeb3
MD5 d55877f44cd3a93f7f31a5437a615f6e
SHA1 687076e47a39abd783ba575f5356baefd18ab970
SHA512 16bfdad2e8fbc0d45b28216e44b38ddea08dfd10f8cc839c92bb35cf1e051611dec9e62ddc1553cb4b0cbc43f5b5bc0f688ce850201a076b314a26e09150ebdb
SSDEEP 98304:GqFp6S568NMyOefiH7cXdHkByf1WCseto4tMQXfXDox+Sxw427x2vHkZvfl3TDQU:GRC/NM0rDoxrix2PkZvdAv5n1gpgQ
TLSH
T1B9569D26B7A401E8C87AC53CC6469A13E7F2B81A5370A7DB17B0567A1F336D45E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.bin

Path C:\Users\Admin\AppData\Local\Cache\z53h4zjy\config.bin
Size 556B
SHA256 bbe66d58bad10e9833c1ab9946c05d099806559b85caf22a22db31964fcf2d9c
MD5 607ff84e82b1f05b66ea2a8e1e4521e5
SHA1 11c4940c0bcceaf9c8287be3a3f336a2e25c2191
SHA512 d631ce4dbf44197f59303f46b32d2fa1ca668c590ddb976d04202580407f7c4ef58acbe85548233b673c5a15c39bfa9bbcc2803731997f768562aec98446547c
TLSH
T1DFF041EB5B3829283DD3F22030D11EA4038A838A05AC961BB1CD92A084022A8944A643
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Cache\z53h4zjy\config.json
Size 913B
SHA256 28f1a6db91ac525469357d537a05bbf4be59fae09fa9e3806d7b18e740b3c3ed
MD5 8122c946180dda4a70cd50e73930c392
SHA1 5894d87f7151275017ccd1e3669a412a4561b845
SHA512 90421b0c82533cdb1d6062bf76a0473eee3baff05796a8d3ccc8618ac85ac53517edddf3b4c25612bb62e2116c705815a6d86dda60ae46a6544c1f085d7ce8ab
TLSH
T1411129118F3E197B85D69068447A72030BBC993361157D393766A21C0B6EA7BA23B3CB
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Cache\z53h4zjy\config.json
Size 3KB
SHA256 603634611ff1386d11e75d4ed01d4bb64ea687301d044fa764e2d5ece67406cf
MD5 0d14209510fa24a15cb03ffb48d9854a
SHA1 f0cb9ce33613fd8d3b5fe390cb7695ea69271fb6
SHA512 23270eca109375fd0dfafe82fe6921c09c3290ca175c9a79a45a76e3d560ed368e5cf28f74d0fce636daefc6a00bdd609f9f73ae0e053adb4d6d11fe2e56597d
TLSH
T17E71C515CA380DB602A491BC8CEC62934668C5176E5D3C39751C995C1F0E73E72B7BEA
MD5 SHA1 SHA512 TLSH

Submit Download

lcntkrjs.exe

Path C:\Users\Admin\AppData\Local\Cache\z53h4zjy\lcntkrjs.exe
Size 6.5MB
SHA256 762d34adaef9bdd6a5a6e2d894bb4c5bda434e8740360adf82a399d7d1f7f46c
MD5 0616f526dd47ddc0b69bc9e8ddc946a0
SHA1 555f645eba8002c57ff8dd8c4a92a1533f0d8882
SHA512 4ab0accb11827b70492a312073a97dd86d83aa65761a84ae31d6619d92a93aba5ebf29a2e1fd2fdcc795e3a48950521a0908126e2b23636c24e311b28e079cfb
SSDEEP 98304:WY5HAEC5ohAc6HyBzOV+8QeDVWWRgIlGWF22Jj6xN3AfuH+:ht6HywVRbV7j4+ANd
TLSH
T1EB668D15BA9A58ADC49AC474834A4B636E3170CA0B36B9FF05C482353F6ABF42F3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5436-16-0x000001AC5DB00000-0x000001AC5DB20000-memory.dmp

Download