xmrig | d597fe00aabc409769ca044bc1e407f3636b6f62d9a3463d79a214638ceee956

Analysis

max time kernel
140s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 23:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_8e35a03895a7c7ad19c32db5e63eba0a_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe
Size 8.9MB
Sample260731-3k229sshpa
SHA256 d597fe00aabc409769ca044bc1e407f3636b6f62d9a3463d79a214638ceee956
MD5 8e35a03895a7c7ad19c32db5e63eba0a
SHA1 402f4ca6c09d4baaed7b3d28d251b5876af200c7
SHA512 79ee99eb7f837f6f762079bb2b6d7f876861be5357d0f5d6b25849d35d32de6a36ba47b070903f112915f0d48459b9303bb76f2c4508f6a6c78032981fd626be
SSDEEP 98304:ZMEWCjCF/9tRK2Xvf49fuI0nBkLuFvJr4XGCkc/zF2fz5IZ4ePzpS+KdbjrD/6Kd:vW42Xv42VKzYz6Z4qSndf3D+TU3AmrJ
TLSH
T147969E26BB9501E8C4AAC438C3475613EBB1B48A1770ABEF16A452792F37BE10F3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution xmrig miner persistence trojan

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Windows security bypass 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	2026-07-31_8e35a03895a7c7ad19c32db5e63eba0a_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c4ad-47.dat	family_xmrig
behavioral2/files/0x000d00000001c4ad-47.dat	xmrig

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4ad-47.dat	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4ad-47.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

detects Windows exceutables potentially bypassing UAC using eventvwr.exe 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4ad-47.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1956	powershell.exe
856	powershell.exe
1956	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1512	netsh.exe

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	2026-07-31_8e35a03895a7c7ad19c32db5e63eba0a_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	2026-07-31_8e35a03895a7c7ad19c32db5e63eba0a_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
908	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4316	timeout.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1140	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1956	powershell.exe
1956	powershell.exe
856	powershell.exe
856	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeIncreaseQuotaPrivilege	1956	powershell.exe
Token: SeSecurityPrivilege	1956	powershell.exe
Token: SeTakeOwnershipPrivilege	1956	powershell.exe
Token: SeLoadDriverPrivilege	1956	powershell.exe
Token: SeSystemProfilePrivilege	1956	powershell.exe
Token: SeSystemtimePrivilege	1956	powershell.exe
Token: SeProfSingleProcessPrivilege	1956	powershell.exe
Token: SeIncBasePriorityPrivilege	1956	powershell.exe
Token: SeCreatePagefilePrivilege	1956	powershell.exe
Token: SeBackupPrivilege	1956	powershell.exe
Token: SeRestorePrivilege	1956	powershell.exe
Token: SeShutdownPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeSystemEnvironmentPrivilege	1956	powershell.exe
Token: SeRemoteShutdownPrivilege	1956	powershell.exe
Token: SeUndockPrivilege	1956	powershell.exe
Token: SeManageVolumePrivilege	1956	powershell.exe
Token: 33	1956	powershell.exe
Token: 34	1956	powershell.exe
Token: 35	1956	powershell.exe
Token: 36	1956	powershell.exe
Token: SeIncreaseQuotaPrivilege	1956	powershell.exe
Token: SeSecurityPrivilege	1956	powershell.exe
Token: SeTakeOwnershipPrivilege	1956	powershell.exe
Token: SeLoadDriverPrivilege	1956	powershell.exe
Token: SeSystemProfilePrivilege	1956	powershell.exe
Token: SeSystemtimePrivilege	1956	powershell.exe
Token: SeProfSingleProcessPrivilege	1956	powershell.exe
Token: SeIncBasePriorityPrivilege	1956	powershell.exe
Token: SeCreatePagefilePrivilege	1956	powershell.exe
Token: SeBackupPrivilege	1956	powershell.exe
Token: SeRestorePrivilege	1956	powershell.exe
Token: SeShutdownPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeSystemEnvironmentPrivilege	1956	powershell.exe
Token: SeRemoteShutdownPrivilege	1956	powershell.exe
Token: SeUndockPrivilege	1956	powershell.exe
Token: SeManageVolumePrivilege	1956	powershell.exe
Token: 33	1956	powershell.exe
Token: 34	1956	powershell.exe
Token: 35	1956	powershell.exe
Token: 36	1956	powershell.exe
Token: SeIncreaseQuotaPrivilege	1956	powershell.exe
Token: SeSecurityPrivilege	1956	powershell.exe
Token: SeTakeOwnershipPrivilege	1956	powershell.exe
Token: SeLoadDriverPrivilege	1956	powershell.exe
Token: SeSystemProfilePrivilege	1956	powershell.exe
Token: SeSystemtimePrivilege	1956	powershell.exe
Token: SeProfSingleProcessPrivilege	1956	powershell.exe
Token: SeIncBasePriorityPrivilege	1956	powershell.exe
Token: SeCreatePagefilePrivilege	1956	powershell.exe
Token: SeBackupPrivilege	1956	powershell.exe
Token: SeRestorePrivilege	1956	powershell.exe
Token: SeShutdownPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeSystemEnvironmentPrivilege	1956	powershell.exe
Token: SeRemoteShutdownPrivilege	1956	powershell.exe
Token: SeUndockPrivilege	1956	powershell.exe
Token: SeManageVolumePrivilege	1956	powershell.exe
Token: 33	1956	powershell.exe
Token: 34	1956	powershell.exe
Token: 35	1956	powershell.exe
Token: 36	1956	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 1956	4408	2026-07-31_8e35a03895a7c7ad19c32db5e63eba0a_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe	90
PID 4408 wrote to memory of 856	4408	2026-07-31_8e35a03895a7c7ad19c32db5e63eba0a_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-31_8e35a03895a7c7ad19c32db5e63eba0a_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_8e35a03895a7c7ad19c32db5e63eba0a_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe"
1⤵
- Windows security bypass
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -NonInteractive -ExecutionPolicy Bypass -Command "Restart-Service WinDefend -Force -EA SilentlyContinue; Start-Sleep 3; Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -EA SilentlyContinue; Add-MpPreference -ExclusionProcess 'dllhost.exe' -EA SilentlyContinue; Add-MpPreference -ExclusionProcess 'UpdateHealthTools.exe' -EA SilentlyContinue; Add-MpPreference -ExclusionProcess 'WaasMedicAgent.exe' -EA SilentlyContinue; Add-MpPreference -ExclusionProcess 'SgrmBroker.exe' -EA SilentlyContinue; Add-MpPreference -ExclusionProcess 'WinSqmApi.exe' -EA SilentlyContinue; Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -MAPSReporting 0 -SubmitSamplesConsent 2 -EA SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -DisableIntrusionPreventionSystem $true -MAPSReporting 0 -SubmitSamplesConsent 2 -EA SilentlyContinue; netsh advfirewall firewall set rule group='Windows Defender Firewall' new enable=no 2>$null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:856
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall set rule "group=Windows Defender Firewall" new enable=no
    3⤵
    - Modifies Windows Firewall
    PID:1512
- C:\Windows\system32\reg.exe
  "reg" add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsHostSvc /t REG_SZ /d \"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" /f
  2⤵
  - Modifies registry key
  PID:1140
- C:\Windows\system32\schtasks.exe
  "schtasks" /Create /SC ONLOGON /TN Microsoft\Windows\RuntimeBroker\WindowsHostSvc /TR \"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" /RL HIGHEST /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3712
- C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
  "C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe"
  2⤵
  PID:3968
- C:\Windows\system32\cmd.exe
  "cmd" /C C:\Users\Admin\AppData\Local\Temp\__rtsvc_cleanup.bat
  2⤵
  - Executes a command shell one-liner
  PID:908
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dllhost.exe

Path C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
Size 8.9MB
SHA256 d597fe00aabc409769ca044bc1e407f3636b6f62d9a3463d79a214638ceee956
MD5 8e35a03895a7c7ad19c32db5e63eba0a
SHA1 402f4ca6c09d4baaed7b3d28d251b5876af200c7
SHA512 79ee99eb7f837f6f762079bb2b6d7f876861be5357d0f5d6b25849d35d32de6a36ba47b070903f112915f0d48459b9303bb76f2c4508f6a6c78032981fd626be
SSDEEP 98304:ZMEWCjCF/9tRK2Xvf49fuI0nBkLuFvJr4XGCkc/zF2fz5IZ4ePzpS+KdbjrD/6Kd:vW42Xv42VKzYz6Z4qSndf3D+TU3AmrJ
TLSH
T147969E26BB9501E8C4AAC438C3475613EBB1B48A1770ABEF16A452792F37BE10F3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 882cbbd0f6e7314805e0cbcc18c92be40898aa6e1179a2a742abbeaf0a14d66f
MD5 4c1f456849218513e97b3842cdd627c0
SHA1 e3098d583347e92993642727772a746a07338281
SHA512 035eb7685c89c3beb1f05e9546b49f1b1c36f271f91a43db8aaca573ad802065aeae0691dbd0b918ba1439ea0673e041a7dd6780f74de99a9b098f0f4286eda3
TLSH
T181216737B3DC8624C899013610CEAC1036BA87DB80DEDFABAB84E155A56F698CF60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qvskhjzx.oww.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qvskhjzx.oww.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

__rtsvc_cleanup.bat

Path C:\Users\Admin\AppData\Local\Temp\__rtsvc_cleanup.bat
Size 204B
SHA256 dbefe9de1a628c75a93873c0ceab5cb975b7d7f41df1d7dfdd64f0be73a6c8fd
MD5 cd88c3564b353898e0b7a6bc8c87aa00
SHA1 003c472150831985d87d62846e82aa16154afb57
SHA512 cdb84fd2077fa10707459f65d8acbc71df5543dd681008d572b30fd90ee46b7829c60b09d376fe501ba2bef7b0eeb925ace02f4996da52ae4e25b1222d91a2c7
TLSH
T1BDD0220A010FCBA4001220B209AF2649C09EB0EA6B0051970FA1C47ECB8609F74D6AC5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/856-39-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/856-36-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/856-41-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/856-40-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/856-26-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/856-38-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/856-37-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/856-42-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/856-33-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/856-32-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/856-31-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/856-43-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/856-45-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/856-29-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/1956-11-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/1956-12-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/1956-25-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/1956-22-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/1956-21-0x0000025AFB200000-0x0000025AFB2B2000-memory.dmp

Download

memory/1956-20-0x0000025AFB1E0000-0x0000025AFB1FE000-memory.dmp

Download

memory/1956-17-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/1956-16-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/1956-15-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/1956-14-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/1956-13-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/1956-23-0x0000025AFAD70000-0x0000025AFAD7A000-memory.dmp

Download

memory/1956-0-0x00007FFE9EF2F000-0x00007FFE9EF30000-memory.dmp

Download

memory/1956-10-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/1956-9-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/1956-8-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/1956-7-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/1956-6-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/1956-5-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/1956-4-0x0000025AFACF0000-0x0000025AFAD12000-memory.dmp

Download

memory/1956-3-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download