Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 23:10
General
- Target 2026-04-24_e1b572c26e25a66df1d5c388ad4bbfd9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 9.8MB
- Sample260424-25vm9afs5l
- SHA256 c9c9b505043b997826d501aee7c5d4531c6e2ee68ac92d54858424832dc06d3f
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_e1b572c26e25a66df1d5c388ad4bbfd9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_e1b572c26e25a66df1d5c388ad4bbfd9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\2026-04-24_e1b572c26e25a66df1d5c388ad4bbfd9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_videocontroller get name2⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing).Content"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exewmic /namespace:\\root\securitycenter2 path antivirusproduct get displayname2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exewmic product get name2⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_sxo2tx42.rus.ps1
memory/2204-23-0x0000022CEFA90000-0x0000022CEFA98000-memory.dmp
memory/2204-25-0x0000022CEFAD0000-0x0000022CEFADA000-memory.dmp
memory/2204-10-0x00007FF43F5E0000-0x00007FF43F5F0000-memory.dmp
memory/2204-17-0x0000022CEF990000-0x0000022CEF9AC000-memory.dmp
memory/2204-18-0x0000022CEF9B0000-0x0000022CEFA63000-memory.dmp
memory/2204-19-0x0000022CEFA70000-0x0000022CEFA7A000-memory.dmp
memory/2204-20-0x0000022CEFAA0000-0x0000022CEFABC000-memory.dmp
memory/2204-21-0x0000022CEFA80000-0x0000022CEFA8A000-memory.dmp
memory/2204-22-0x0000022CEFD50000-0x0000022CEFD6A000-memory.dmp
memory/2204-1-0x0000022CEEFD0000-0x0000022CEEFE0000-memory.dmp
memory/2204-24-0x0000022CEFAC0000-0x0000022CEFAC6000-memory.dmp
memory/2204-9-0x0000022CEEFD0000-0x0000022CEEFE0000-memory.dmp
memory/2204-26-0x0000022CEEFD0000-0x0000022CEEFE0000-memory.dmp
memory/2204-29-0x0000022CED6D0000-0x0000022CED6DC000-memory.dmp
memory/2204-30-0x0000022CED720000-0x0000022CED732000-memory.dmp
memory/2204-31-0x0000022CEF620000-0x0000022CEF70A000-memory.dmp
memory/2204-8-0x0000022CEF710000-0x0000022CEF732000-memory.dmp
memory/2204-0-0x0000022CEEFD0000-0x0000022CEEFE0000-memory.dmp
memory/3200-41-0x000001C653380000-0x000001C65338C000-memory.dmp
memory/3200-42-0x000001C66BB10000-0x000001C66BBFA000-memory.dmp
memory/3200-43-0x000001C653430000-0x000001C653442000-memory.dmp
memory/4376-44-0x000001F3A45B0000-0x000001F3A469A000-memory.dmp