16879525863a6cb22b9c5c3e335bc58450ad8be2c4407e522005b0662ae3ed9d

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 10.6MB
Sample260424-fatltae16v
SHA256 16879525863a6cb22b9c5c3e335bc58450ad8be2c4407e522005b0662ae3ed9d
MD5 09abb472ca3367f0fbc4d6a059185599
SHA1 a230ad7504944ee683250cf303dc90711b919adf
SHA512 51b6e8f21793076aa7cd215e2520071ee56429fb04d68a3c0dd0df111470d0bd10ba597eb8ad2707a1bfa6b2ef4f84fc4fc8be438217b889a3273b9d0186378c
SSDEEP 98304:r3uJhFBywLMc9tjGQ73q6ldNWodVLuJVfgPh83KEQ:rupfG6nZYQ
TLSH
T1FBB63947E8B501E5C4AD9175CA369613BB713C885B3163C76BA0FA252F37BE0AE79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion execution spyware stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 2 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4640	msedge.exe
4780	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
6	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4060	powershell.exe
4884	powershell.exe
4276	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1896	powershell.exe
3408	powershell.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3372	wmic.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	3	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
1896	powershell.exe
1896	powershell.exe
3408	powershell.exe
3408	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4060	powershell.exe
Token: SeIncreaseQuotaPrivilege	3164	wmic.exe
Token: SeSecurityPrivilege	3164	wmic.exe
Token: SeTakeOwnershipPrivilege	3164	wmic.exe
Token: SeLoadDriverPrivilege	3164	wmic.exe
Token: SeSystemProfilePrivilege	3164	wmic.exe
Token: SeSystemtimePrivilege	3164	wmic.exe
Token: SeProfSingleProcessPrivilege	3164	wmic.exe
Token: SeIncBasePriorityPrivilege	3164	wmic.exe
Token: SeCreatePagefilePrivilege	3164	wmic.exe
Token: SeBackupPrivilege	3164	wmic.exe
Token: SeRestorePrivilege	3164	wmic.exe
Token: SeShutdownPrivilege	3164	wmic.exe
Token: SeDebugPrivilege	3164	wmic.exe
Token: SeSystemEnvironmentPrivilege	3164	wmic.exe
Token: SeRemoteShutdownPrivilege	3164	wmic.exe
Token: SeUndockPrivilege	3164	wmic.exe
Token: SeManageVolumePrivilege	3164	wmic.exe
Token: 33	3164	wmic.exe
Token: 34	3164	wmic.exe
Token: 35	3164	wmic.exe
Token: 36	3164	wmic.exe
Token: SeIncreaseQuotaPrivilege	3164	wmic.exe
Token: SeSecurityPrivilege	3164	wmic.exe
Token: SeTakeOwnershipPrivilege	3164	wmic.exe
Token: SeLoadDriverPrivilege	3164	wmic.exe
Token: SeSystemProfilePrivilege	3164	wmic.exe
Token: SeSystemtimePrivilege	3164	wmic.exe
Token: SeProfSingleProcessPrivilege	3164	wmic.exe
Token: SeIncBasePriorityPrivilege	3164	wmic.exe
Token: SeCreatePagefilePrivilege	3164	wmic.exe
Token: SeBackupPrivilege	3164	wmic.exe
Token: SeRestorePrivilege	3164	wmic.exe
Token: SeShutdownPrivilege	3164	wmic.exe
Token: SeDebugPrivilege	3164	wmic.exe
Token: SeSystemEnvironmentPrivilege	3164	wmic.exe
Token: SeRemoteShutdownPrivilege	3164	wmic.exe
Token: SeUndockPrivilege	3164	wmic.exe
Token: SeManageVolumePrivilege	3164	wmic.exe
Token: 33	3164	wmic.exe
Token: 34	3164	wmic.exe
Token: 35	3164	wmic.exe
Token: 36	3164	wmic.exe
Token: SeIncreaseQuotaPrivilege	5032	wmic.exe
Token: SeSecurityPrivilege	5032	wmic.exe
Token: SeTakeOwnershipPrivilege	5032	wmic.exe
Token: SeLoadDriverPrivilege	5032	wmic.exe
Token: SeSystemProfilePrivilege	5032	wmic.exe
Token: SeSystemtimePrivilege	5032	wmic.exe
Token: SeProfSingleProcessPrivilege	5032	wmic.exe
Token: SeIncBasePriorityPrivilege	5032	wmic.exe
Token: SeCreatePagefilePrivilege	5032	wmic.exe
Token: SeBackupPrivilege	5032	wmic.exe
Token: SeRestorePrivilege	5032	wmic.exe
Token: SeShutdownPrivilege	5032	wmic.exe
Token: SeDebugPrivilege	5032	wmic.exe
Token: SeSystemEnvironmentPrivilege	5032	wmic.exe
Token: SeRemoteShutdownPrivilege	5032	wmic.exe
Token: SeUndockPrivilege	5032	wmic.exe
Token: SeManageVolumePrivilege	5032	wmic.exe
Token: 33	5032	wmic.exe
Token: 34	5032	wmic.exe
Token: 35	5032	wmic.exe
Token: 36	5032	wmic.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 4060	768	2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	80
PID 768 wrote to memory of 3164	768	2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	82
PID 768 wrote to memory of 5032	768	2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	85
PID 768 wrote to memory of 3372	768	2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	87
PID 768 wrote to memory of 1896	768	2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 768 wrote to memory of 3408	768	2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 768 wrote to memory of 4884	768	2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 768 wrote to memory of 4640	768	2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	95
PID 768 wrote to memory of 4276	768	2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 768 wrote to memory of 4780	768	2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 4780 wrote to memory of 3480	4780	chrome.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_09abb472ca3367f0fbc4d6a059185599_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-Process | Where-Object { $_.ProcessName -match \"chrome|msedge|brave|firefox|googleupdate|msedgeupdate|elevation_service\" -or ($_.Path -and ($_.Path -match \"Chrome|Edge|Brave|Firefox\")) } | Stop-Process -Force -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4060
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get name
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3164
- C:\Windows\System32\Wbem\wmic.exe
  wmic computersystem get totalphysicalmemory
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5032
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:3372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Get-WmiObject -Class Win32_VideoController | Select-Object -ExpandProperty VideoModeDescription"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Cryptography').MachineGuid"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-Process | Where-Object { $_.ProcessName -match \"chrome|msedge|brave|firefox|googleupdate|msedgeupdate|elevation_service\" -or ($_.Path -and ($_.Path -match \"Chrome|Edge|Brave|Firefox\")) } | Stop-Process -Force -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=old --remote-debugging-port=9622 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\VoltGhost_63fa --profile-directory=Default --no-sandbox --disable-gpu --window-position=-32000,-32000 --disable-features=LockProfile --disable-blink-features=AutomationControlled --no-first-run --no-default-browser-check --remote-allow-origins=* --disable-extensions
  2⤵
  - Uses browser remote debugging
  PID:4640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-Process | Where-Object { $_.ProcessName -match \"chrome|msedge|brave|firefox|googleupdate|msedgeupdate|elevation_service\" -or ($_.Path -and ($_.Path -match \"Chrome|Edge|Brave|Firefox\")) } | Stop-Process -Force -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=old --remote-debugging-port=9322 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\VoltGhost_5199 --profile-directory=Default --no-sandbox --disable-gpu --window-position=-32000,-32000 --disable-features=LockProfile --disable-blink-features=AutomationControlled --no-first-run --no-default-browser-check --remote-allow-origins=* --disable-extensions
  2⤵
  - Uses browser remote debugging
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\VoltGhost_5199 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\VoltGhost_5199\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\VoltGhost_5199 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffc1cffc728,0x7ffc1cffc734,0x7ffc1cffc740
    3⤵
    PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b7a310f65a970fe4c65c8f9a83f7d402f8527b216a38b17336add7218c5613a5
MD5 7e7db55033ab03221df11bd564f5356f
SHA1 e09bc775bc2948517750504d5bc71b9cbaa0412a
SHA512 c4d5bbfb9f050d6d4b56ace906213952bcc069e132b81bddf22944827a5cd5abc707164b21a42e65ab14ce6bcf2ab5cf51b048f2daa23fe0d8744016acdac476
TLSH
T11D115333B79CC235C8E915BA1088AD11B1B1C3C7049EDE8F7A84C119E67F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4c6de1b0d420c6f20e8cfb389f692e1615aea6e4cf09c20472dd0f0b9a73eafa
MD5 0459dd327efe9b6b264891ff3d15333d
SHA1 fc69b0ff3b98efdd739bf26c1583a91eaca891a4
SHA512 70b5a0a887212e92ddf9aa44055deefbbe58a2d1ed62f7ba9ca7b558a5204e550a231c4ed261fa80d746a64a474de7cc2c153f4f807224bb43478107ff592de1
TLSH
T148217833B3ACC135C8D9117A108CAD01B2B5C3CB449ECEDB7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3a3dd2d4bdfc17d64262f4dc86ceb242ecf743f2da0412eb60074557a741a5eb
MD5 d6b84d4be64de661c778642e3a7f6ff7
SHA1 714900a833208d39d6a4d0a96c671372dc5a12dd
SHA512 7fb33a924af54810bb8c69a0c4a126b1ba6ade4944f098ab8334c0a6c8fee91c7d8e25465c79deed6f6f7fe2000366831f801691dd950051a37c850722907c77
TLSH
T108115333B79CC235C8E915BA1088AE11B1B5C3C7049EDE8F7A84C109E67F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8ca943c02c163cdf5099c1a6f7795399ec72d9d3520f97e01b2cc3fa5a381d5d
MD5 80814906f25b1fe1f0e57faff079ac06
SHA1 2d345eb65650071b9d08c4f23605d016155eb41a
SHA512 60b87cbff23bbca996c907b472e16d64e4d9d9d805fbd97a7f0a36d7f136be242f5e8d9b7a9caf16f7d44fafd2be2a8b69116c9b00e1546727f1a9c6aca6a3de
TLSH
T163115333B79CC234C8E915BA1088AE11B1B1C3C7049EDE8F7A84C109E67F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

VOLT_LOG.txt

Path C:\Users\Admin\AppData\Local\Temp\VOLT_LOG.txt
Size 2KB
SHA256 5b260af6fc7fb451eb00cb39d69f6a715dfbeb99f3e3cc858755f0df88e8ca3b
MD5 02b92a4d14b65d729438e3227094fc38
SHA1 32bf4ab4465011d5a5f8c7a81213741585a1b891
SHA512 91650d433c3c1a03421c9d326a9343eee36d5f7aca6f9109232895a889acdb872fdbd3ac9a6709b027da64d1c2049696f43a4d43d4f8c436fbc65ffdadb0ee64
TLSH
T1BB512F9938CBB42D4A5355C22341E2052FA61283DF6E2417CF5B120C3EE69CBF45DA53
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kcvsl4hj.dks.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kcvsl4hj.dks.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/768-158-0x0000014F7D570000-0x0000014F7D579000-memory.dmp

Download

memory/768-17-0x0000014F7D570000-0x0000014F7D579000-memory.dmp

Download

memory/1896-27-0x000001886F4B0000-0x000001886F4C2000-memory.dmp

Download

memory/1896-28-0x000001886F770000-0x000001886F7DF000-memory.dmp

Download

memory/3408-37-0x000001A7AB610000-0x000001A7AB622000-memory.dmp

Download

memory/3408-38-0x000001A7C3D80000-0x000001A7C3DEF000-memory.dmp

Download

memory/4060-4-0x00000237B8760000-0x00000237B8770000-memory.dmp

Download

memory/4060-16-0x00000237D0EB0000-0x00000237D0F1F000-memory.dmp

Download

memory/4060-15-0x00000237B8800000-0x00000237B8812000-memory.dmp

Download

memory/4060-3-0x00000237B8760000-0x00000237B8770000-memory.dmp

Download

memory/4060-11-0x00000237D0E80000-0x00000237D0EA2000-memory.dmp

Download

memory/4060-12-0x00000237B8760000-0x00000237B8770000-memory.dmp

Download

memory/4276-97-0x000001E8243C0000-0x000001E8243D2000-memory.dmp

Download

memory/4276-98-0x000001E83E2A0000-0x000001E83E30F000-memory.dmp

Download

memory/4884-53-0x000001FFF28D0000-0x000001FFF293F000-memory.dmp

Download

memory/4884-52-0x000001FFF2580000-0x000001FFF2592000-memory.dmp

Download