Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/04/2026, 03:57
Behavioral task
behavioral1
Sample
2026-04-16_66fec606f9574fee66a7ec2c4be2ad95_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260130-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-16_66fec606f9574fee66a7ec2c4be2ad95_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch.exe
Resource
win11-20260130-en
2 signatures
150 seconds
General
- Target 2026-04-16_66fec606f9574fee66a7ec2c4be2ad95_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch.exe
- Size 12.3MB
- Sample260416-ejc5rafs3r
- SHA256 c45658142566ff37e0f746e8a624e03eb144f11ac3ac8302396745d11c7151db
- MD5 66fec606f9574fee66a7ec2c4be2ad95
- SHA1 3bd70522f6a0e0b956c684672e758753f6282989
- SHA512 9ec6c3ee38014d2a7cb602b13e77db5edc72f5168ed818bbb900e0e0db698881a785a62ee6645cf50f7619eae7a7c28bca9859295c93a11c4621560424244104
- SSDEEP 49152:w7aYvvYGE5W108AkBX3RBWxaAg96MhpLn3deehHgW3Od2w5O4Rd+DwzqZFobGxxw:zY3YrkBHvIapJBXYOrxwfl24VjE
- TLSH T17CD65B01F99B54F6E903583141ABB23F23319C048B29DB9BEB587B6BFC77A911876305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_66fec606f9574fee66a7ec2c4be2ad95_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_66fec606f9574fee66a7ec2c4be2ad95_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_66fec606f9574fee66a7ec2c4be2ad95_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3812