Overview

overview

8

Static

static

3

2026-05-10...at.exe

windows10-2004-x64

8

2026-05-10...at.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/05/2026, 15:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-10_5d5cc6ecb4a43a4ccd6a3dc51abbb12b_coinminer_dosia_ekans_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe
  • Size 68.1MB
  • Sample260510-sw4ecset4r
  • SHA256 1526e1adb2e95de234d14794f94f02ba07a2048f21f1c4c1dbdecc46d844b130
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-10_5d5cc6ecb4a43a4ccd6a3dc51abbb12b_coinminer_dosia_ekans_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-10_5d5cc6ecb4a43a4ccd6a3dc51abbb12b_coinminer_dosia_ekans_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Command $PSVersionTable.PSVersion
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:644
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Command $PSVersionTable.PSVersion
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2220
    • C:\Windows\system32\netsh.exe
      C:\Windows\system32\netsh.exe advfirewall show allprofiles
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:4528
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe --version
      2⤵
        PID:4588
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Command "$v = [System.Environment]::OSVersion.Version; \"$($v.Major).$($v.Minor).$($v.Build)\""
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1660

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 64B
          • SHA256 ce2fd4529dc0edd2e230a10b973623819351c3b89ddc4d56d5e1b8564e8280a7
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 64B
          • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
          • MD5 SHA1 SHA512
          Submit Download

          __PSScriptPolicyTest_iysdtdya.10g.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iysdtdya.10g.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/644-13-0x000002EE958D0000-0x000002EE958DC000-memory.dmp
          Download

          memory/644-1-0x000002EE95910000-0x000002EE95920000-memory.dmp
          Download

          memory/644-2-0x000002EE95910000-0x000002EE95920000-memory.dmp
          Download

          memory/644-10-0x000002EEAF910000-0x000002EEAF932000-memory.dmp
          Download

          memory/1660-34-0x00000211B7F10000-0x00000211B7F1C000-memory.dmp
          Download

          memory/2220-24-0x0000024DA3D40000-0x0000024DA3D4C000-memory.dmp
          Download

          memory/4480-36-0x0000024249350000-0x000002424935C000-memory.dmp
          Download

          memory/4480-35-0x00007FF721560000-0x00007FF725638000-memory.dmp
          Download

          memory/4480-38-0x0000024249350000-0x000002424935C000-memory.dmp
          Download

          memory/4480-37-0x00007FF721560000-0x00007FF725638000-memory.dmp
          Download