Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/04/2026, 04:40
Static task
static1
5 signatures
Behavioral task
behavioral1
Sample
2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 10.6MB
- Sample260424-fatltae16v
- SHA256 16879525863a6cb22b9c5c3e335bc58450ad8be2c4407e522005b0662ae3ed9d
- MD5 09abb472ca3367f0fbc4d6a059185599
- SHA1 a230ad7504944ee683250cf303dc90711b919adf
- SHA512 51b6e8f21793076aa7cd215e2520071ee56429fb04d68a3c0dd0df111470d0bd10ba597eb8ad2707a1bfa6b2ef4f84fc4fc8be438217b889a3273b9d0186378c
- SSDEEP 98304:r3uJhFBywLMc9tjGQ73q6ldNWodVLuJVfgPh83KEQ:rupfG6nZYQ
- TLSH T1FBB63947E8B501E5C4AD9175CA369613BB713C885B3163C76BA0FA252F37BE0AE79700
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Uses browser remote debugging 2 TTPs 2 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 2944 chrome.exe 564 msedge.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 33 discord.com 34 discord.com - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 ip-api.com - Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
pid Process 2408 powershell.exe 1352 powershell.exe 1844 powershell.exe -
pid Process 3540 powershell.exe 3312 powershell.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1488 wmic.exe - GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 10 Go-http-client/1.1 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 2408 powershell.exe 3540 powershell.exe 3540 powershell.exe 3312 powershell.exe 3312 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1352 powershell.exe 1844 powershell.exe 1844 powershell.exe 1844 powershell.exe 1844 powershell.exe 1844 powershell.exe 1844 powershell.exe 1844 powershell.exe 1844 powershell.exe 1844 powershell.exe 1844 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2408 powershell.exe Token: SeIncreaseQuotaPrivilege 4300 wmic.exe Token: SeSecurityPrivilege 4300 wmic.exe Token: SeTakeOwnershipPrivilege 4300 wmic.exe Token: SeLoadDriverPrivilege 4300 wmic.exe Token: SeSystemProfilePrivilege 4300 wmic.exe Token: SeSystemtimePrivilege 4300 wmic.exe Token: SeProfSingleProcessPrivilege 4300 wmic.exe Token: SeIncBasePriorityPrivilege 4300 wmic.exe Token: SeCreatePagefilePrivilege 4300 wmic.exe Token: SeBackupPrivilege 4300 wmic.exe Token: SeRestorePrivilege 4300 wmic.exe Token: SeShutdownPrivilege 4300 wmic.exe Token: SeDebugPrivilege 4300 wmic.exe Token: SeSystemEnvironmentPrivilege 4300 wmic.exe Token: SeRemoteShutdownPrivilege 4300 wmic.exe Token: SeUndockPrivilege 4300 wmic.exe Token: SeManageVolumePrivilege 4300 wmic.exe Token: 33 4300 wmic.exe Token: 34 4300 wmic.exe Token: 35 4300 wmic.exe Token: 36 4300 wmic.exe Token: SeIncreaseQuotaPrivilege 4300 wmic.exe Token: SeSecurityPrivilege 4300 wmic.exe Token: SeTakeOwnershipPrivilege 4300 wmic.exe Token: SeLoadDriverPrivilege 4300 wmic.exe Token: SeSystemProfilePrivilege 4300 wmic.exe Token: SeSystemtimePrivilege 4300 wmic.exe Token: SeProfSingleProcessPrivilege 4300 wmic.exe Token: SeIncBasePriorityPrivilege 4300 wmic.exe Token: SeCreatePagefilePrivilege 4300 wmic.exe Token: SeBackupPrivilege 4300 wmic.exe Token: SeRestorePrivilege 4300 wmic.exe Token: SeShutdownPrivilege 4300 wmic.exe Token: SeDebugPrivilege 4300 wmic.exe Token: SeSystemEnvironmentPrivilege 4300 wmic.exe Token: SeRemoteShutdownPrivilege 4300 wmic.exe Token: SeUndockPrivilege 4300 wmic.exe Token: SeManageVolumePrivilege 4300 wmic.exe Token: 33 4300 wmic.exe Token: 34 4300 wmic.exe Token: 35 4300 wmic.exe Token: 36 4300 wmic.exe Token: SeIncreaseQuotaPrivilege 3900 wmic.exe Token: SeSecurityPrivilege 3900 wmic.exe Token: SeTakeOwnershipPrivilege 3900 wmic.exe Token: SeLoadDriverPrivilege 3900 wmic.exe Token: SeSystemProfilePrivilege 3900 wmic.exe Token: SeSystemtimePrivilege 3900 wmic.exe Token: SeProfSingleProcessPrivilege 3900 wmic.exe Token: SeIncBasePriorityPrivilege 3900 wmic.exe Token: SeCreatePagefilePrivilege 3900 wmic.exe Token: SeBackupPrivilege 3900 wmic.exe Token: SeRestorePrivilege 3900 wmic.exe Token: SeShutdownPrivilege 3900 wmic.exe Token: SeDebugPrivilege 3900 wmic.exe Token: SeSystemEnvironmentPrivilege 3900 wmic.exe Token: SeRemoteShutdownPrivilege 3900 wmic.exe Token: SeUndockPrivilege 3900 wmic.exe Token: SeManageVolumePrivilege 3900 wmic.exe Token: 33 3900 wmic.exe Token: 34 3900 wmic.exe Token: 35 3900 wmic.exe Token: 36 3900 wmic.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5028 wrote to memory of 2408 5028 2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 84 PID 5028 wrote to memory of 4300 5028 2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 86 PID 5028 wrote to memory of 3900 5028 2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 89 PID 5028 wrote to memory of 1488 5028 2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 91 PID 5028 wrote to memory of 3540 5028 2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 93 PID 5028 wrote to memory of 3312 5028 2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 95 PID 5028 wrote to memory of 1352 5028 2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 97 PID 5028 wrote to memory of 2944 5028 2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 99 PID 2944 wrote to memory of 5052 2944 chrome.exe 100 PID 5028 wrote to memory of 1844 5028 2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 106 PID 5028 wrote to memory of 564 5028 2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-Process | Where-Object { $_.ProcessName -match \"chrome|msedge|brave|firefox|googleupdate|msedgeupdate|elevation_service\" -or ($_.Path -and ($_.Path -match \"Chrome|Edge|Brave|Firefox\")) } | Stop-Process -Force -ErrorAction SilentlyContinue"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get name2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3900
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
PID:1488
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Get-WmiObject -Class Win32_VideoController | Select-Object -ExpandProperty VideoModeDescription"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3540
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Cryptography').MachineGuid"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3312
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-Process | Where-Object { $_.ProcessName -match \"chrome|msedge|brave|firefox|googleupdate|msedgeupdate|elevation_service\" -or ($_.Path -and ($_.Path -match \"Chrome|Edge|Brave|Firefox\")) } | Stop-Process -Force -ErrorAction SilentlyContinue"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
PID:1352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=old --remote-debugging-port=9522 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\VoltGhost_cb03 --profile-directory=Default --no-sandbox --disable-gpu --window-position=-32000,-32000 --disable-features=LockProfile --disable-blink-features=AutomationControlled --no-first-run --no-default-browser-check --remote-allow-origins=* --disable-extensions2⤵
- Uses browser remote debugging
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\VoltGhost_cb03 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\VoltGhost_cb03\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\VoltGhost_cb03 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ff983c7c728,0x7ff983c7c734,0x7ff983c7c7403⤵PID:5052
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-Process | Where-Object { $_.ProcessName -match \"chrome|msedge|brave|firefox|googleupdate|msedgeupdate|elevation_service\" -or ($_.Path -and ($_.Path -match \"Chrome|Edge|Brave|Firefox\")) } | Stop-Process -Force -ErrorAction SilentlyContinue"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
PID:1844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=old --remote-debugging-port=9222 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\VoltGhost_e65a --profile-directory=Default --no-sandbox --disable-gpu --window-position=-32000,-32000 --disable-features=LockProfile --disable-blink-features=AutomationControlled --no-first-run --no-default-browser-check --remote-allow-origins=* --disable-extensions2⤵
- Uses browser remote debugging
PID:564
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Modify Authentication Process
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
- MD5 6cf293cb4d80be23433eecf74ddb5503
- SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
- SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
- TLSH T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 23dbe2cabf8e49894cd35c30b12f8e95d4f292698979f4f3f6546877b6a43eb3
- MD5 a7957b7776dde24b5c616a5ef0b20973
- SHA1 ae8d046d1596e0c657d777bf5b418dd911a753fb
- SHA512 06e12bd8fd45de39d3fdf90b069443ea21aea029b47101132e7afd92e79593e4290f0dfc44939223cdeca3af20f5615566e701b01efd9ab68dceddc22e2f0f4d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 eff52a77e2fd653199c31162fbd5557a83995ef0e6e0570bf6495d1b5386b3b8
- MD5 5b5352c55a8e79ac8de4be3202d496a1
- SHA1 4a263d9e36e5ef972e4b19035cae169e1df6459c
- SHA512 c4e5e245c427bc6f9cc95ae80efbd46fd432bea5a4f9366332b1850d833316e6f4eab0e25259b2ea39c40724dcae91ba748234cb1a3cf95b38d8fed162741d63
- TLSH T16C215227B39C89A1CC86163A109D9C1176A783C780AEDFDF6BC0D614A1BF998CB61294
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 907d59c4a1decc4fcdd1a2614e3884392d7c275f82cc900fe742151b9c9be22c
- MD5 caf7c8d742be571cc9df52e5fed42eac
- SHA1 6022d6909c68bccce19eeedd6b95b4c74a4eaffb
- SHA512 9e8f1a4c2b44b8222f5a31e750ca8fa7f0a4fa6a961c03c0ba8746bc3a8b5cdf08ee91fbc607876b7b2e9ea52562dd55a92d488e4b352f930a4214d5fec8be4b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
- MD5 446dd1cf97eaba21cf14d03aebc79f27
- SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
- SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\VOLT_LOG.txt
- Size 2KB
- SHA256 13db3a0e438caa0dd6eea2bfd8f93458fa26ae4276b15cce02c4b6b01f00e029
- MD5 25b5b298fabc5a95d814cc2a80c08782
- SHA1 a87f44f587ee470560a41cfd38fc7f13583528bd
- SHA512 0f006acefbf09a0f5e1920aacfc38116ca743061c1cfd7f5e8b2eccf6e998022c8e75910a1e2fa2ce4a7bb85f3f56fe103562570937c4ac0e0f40f506ea040a4
- TLSH T15D41208938C7B03E0A5356C31345E2052FA616838F6E64168F5B120C7EE68CEF96DB93
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zc5i1xf5.bkl.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH