0f920fa388c3771ce475aee4dfc828cbbbbe7379c5b1eec53f195d735213a7d5

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 16:49

Target
2026-05-17_f0c5f1178604792fa4cc6464145ff0f4_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe
Size 62.4MB
Sample260517-vbss8se16m
SHA256 0f920fa388c3771ce475aee4dfc828cbbbbe7379c5b1eec53f195d735213a7d5
MD5 f0c5f1178604792fa4cc6464145ff0f4
SHA1 6a05fcc5c3c9d19a2e69fc4f794be8bf52a98763
SHA512 dbb7c08285ee24d73c3040349d74bd9e261a1e908067ee09f00f5b1018eefb659ce88e2490485716171a5aa4b2a0199b09ffbf3ce762329e5101615487adccd3
SSDEEP 393216:0ko6fAWVJ4IuCQtBc4AvSGgyfQbj9U+Fpl/9+NdpD:0ko6oWVJ4CQrGg9U+Fpl/9+NPD
TLSH
T125E76C03F94449EECA55C57AC5AA468177B0FC145F26A7C7AB10F23CAEB67D46EB8300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3248	2026-05-17_f0c5f1178604792fa4cc6464145ff0f4_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-17_f0c5f1178604792fa4cc6464145ff0f4_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_f0c5f1178604792fa4cc6464145ff0f4_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3248