Overview

overview

8

Static

static

3

2026-05-10...at.exe

windows10-2004-x64

8

2026-05-10...at.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    10/05/2026, 15:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-10_5d5cc6ecb4a43a4ccd6a3dc51abbb12b_coinminer_dosia_ekans_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe
  • Size 68.1MB
  • Sample260510-sw4ecset4r
  • SHA256 1526e1adb2e95de234d14794f94f02ba07a2048f21f1c4c1dbdecc46d844b130
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-10_5d5cc6ecb4a43a4ccd6a3dc51abbb12b_coinminer_dosia_ekans_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-10_5d5cc6ecb4a43a4ccd6a3dc51abbb12b_coinminer_dosia_ekans_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Command $PSVersionTable.PSVersion
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3140
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Command $PSVersionTable.PSVersion
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3580
    • C:\Windows\system32\netsh.exe
      C:\Windows\system32\netsh.exe advfirewall show allprofiles
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:3284
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe --version
      2⤵
        PID:2940
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Command "$v = [System.Environment]::OSVersion.Version; \"$($v.Major).$($v.Minor).$($v.Build)\""
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1816

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 3f63c900813de99733f162952bb27d374ba2e07d7751965b4de4a557cb4478ce
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 64B
          • SHA256 63157cf1d6056d84a9c37010f9f6b55b9fcfdd60fe008e46b8618c0946f5394f
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 64B
          • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
          • MD5 SHA1 SHA512
          Submit Download

          __PSScriptPolicyTest_nkp2tmyk.ua0.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nkp2tmyk.ua0.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1816-34-0x000002ACD39F0000-0x000002ACD3A02000-memory.dmp
          Download

          memory/1816-33-0x000002ACB9AF0000-0x000002ACB9B4D000-memory.dmp
          Download

          memory/3140-13-0x000001FB74BE0000-0x000001FB74BF2000-memory.dmp
          Download

          memory/3140-12-0x000001FB5AD10000-0x000001FB5AD6D000-memory.dmp
          Download

          memory/3140-2-0x000001FB74CB0000-0x000001FB74CC0000-memory.dmp
          Download

          memory/3140-9-0x000001FB74D30000-0x000001FB74D52000-memory.dmp
          Download

          memory/3140-1-0x000001FB74CB0000-0x000001FB74CC0000-memory.dmp
          Download

          memory/3580-24-0x00000216FF7D0000-0x00000216FF7E2000-memory.dmp
          Download

          memory/3580-23-0x00000216E5860000-0x00000216E58BD000-memory.dmp
          Download

          memory/4712-36-0x00000279EB3F0000-0x00000279EB44D000-memory.dmp
          Download

          memory/4712-35-0x00007FF73A9C0000-0x00007FF73EA98000-memory.dmp
          Download

          memory/4712-38-0x00000279EB3F0000-0x00000279EB44D000-memory.dmp
          Download

          memory/4712-37-0x00007FF73A9C0000-0x00007FF73EA98000-memory.dmp
          Download