c30c4b943751e370c990ef5a11e496d54160b8deb604655172ead17f8825273e

Analysis

max time kernel
4s
max time network
12s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-05-19_6cc55517804ece9fd9bc33c0d1b9a2a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 8.6MB
Sample260519-eamylabv9r
SHA256 c30c4b943751e370c990ef5a11e496d54160b8deb604655172ead17f8825273e
MD5 6cc55517804ece9fd9bc33c0d1b9a2a4
SHA1 b36bc7f291a1c806e454849ad44598018a73cc8d
SHA512 1b8db3c1baf5b81af902381ed904e304d0f8e4ada4f135e099cd59325917fbab8f080610d4a22b29de13a1435ee5f73cfcb17b5b9f0ae391a7ca294a2846f969
SSDEEP 49152:lGkbowrAwQK5TEq2i8YfPHd8zY3OmaxHvbR2vpICUfnsZEIrdj9FiRcoW2VVrt0n:lGkfcFtbUcknXDPf8qqaEm
TLSH
T19B961817FDA564E9C0ADC6318A729213BB717C491B3127D72B50B7242F36BE0AEB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution persistence

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b575-23.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4400	powershell.exe
2576	powershell.exe
1784	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-dd943880 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_b9ddd5568941.exe\""	2026-05-19_6cc55517804ece9fd9bc33c0d1b9a2a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4400	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4400	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4400	4964	2026-05-19_6cc55517804ece9fd9bc33c0d1b9a2a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-19_6cc55517804ece9fd9bc33c0d1b9a2a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-19_6cc55517804ece9fd9bc33c0d1b9a2a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_b9ddd5568941.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_f11ae349' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4400

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_b9ddd5568941.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_b9ddd5568941.exe"
1⤵
PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_b9ddd5568941.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_f11ae349' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'ovd_ff11ae349'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'ovd_cf11ae349'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_b9ddd5568941.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='ovd_ff11ae349'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='ovd_cf11ae349'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3fc98f1a0dd73c0067a28034a6d84e86b27418d68cc2fdf26345be6f4217dcf1
MD5 9f3107a91c0a75eb75418f89fe7dcbcd
SHA1 4538595145969d10d68c8d5fd73d51a58cde93d4
SHA512 12506d31fba03a505c3921876135d8b9cd5fd3659c5c97b2158001ab788f0f9dcff055e95be1bd33583098848efd1036d05c0b6e23d7191b02b444a37d0dbf2c
TLSH
T1F381CD323375A0D4C9563F07192C19C463AF4396EA58AF4CB658620EE92B54BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 931ebe105c3d0e5bd38925c2b2d0e67b5dce138ddb16cdb9bc1bb62bf3bf06b5
MD5 cab626bc6bf51892df5743b1f6abcf3e
SHA1 015cfd9fe61eeb3907999762bbd387a0afa36b46
SHA512 3c5ea8a753991e14614c2051710a331861a839e1fb842410610219235db942189473db5abc803b88ab73f3a5849491870ca994743b1e37fa67de271a7b517258
TLSH
T19C216533B3ECC125C8D9117A208CAD00B2B5C3C7449F8F8B7A84C619957FADADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4wops5g0.eb0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4wops5g0.eb0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent-2979330154.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\agent-2979330154.tmp
Size 2.0MB
SHA256 1af91b8c07acd1f164f960f687b3a2747329cabec4eafc7f06c86565a2da73d6
MD5 57ce0a756cc1175e5e2856ba31a19cd7
SHA1 b6bcf284acba31ccd9b83e07548fde74f943ade7
SHA512 3a1abc84d27e12012e26b10489f7e2f0ca439678d0a95d946301b31a680793b317ef792b4c34686d9c9e20c79c5dea498d90f57e1fb7724ad3ffa75291f3b91f
SSDEEP 24576:lGk+UoOrrAVSQK5TEM5pHP27JbANrOql8YfjLCWlocD4A8F8WY3OJcaD:lGkbowrAwQK5TEq2i8YfPHd8zY3OmaD
TLSH
T1E6A5D657ECB940E8C0FED575C626E617BEA23449033833E72FA19A601F5AFE065B9710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ovd_b9ddd5568941.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_b9ddd5568941.exe
Size 6.1MB
SHA256 4803ed13dc268a606e5dc8635f9692780736a154d5ed6ad2ac83728e7553f3b2
MD5 bd9da9eb63844481e925f4916bf15148
SHA1 df972ee49412ae22d74c062d972abfcddeacf14c
SHA512 b53a74b025782d630ce00cf038b3816d00b6a40cf3e593370151039009cc5c959daab9ee01ffaa0a3c989fffb20ccf887d527870a901f3cdd4ac797542460337
SSDEEP 49152:lGkbowrAwQK5TEq2i8YfPHd8zY3OmaxHvbR2vpICUfnsZEIrdj9FiRcoW2VVrt0I:lGkfcFtbUcknXDPU
TLSH
T1BA561957EDA950E8C0FEC535CA6296237E613C49073537D36FA0A7205F6ABE0ADB9310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2576-45-0x0000025C27CB0000-0x0000025C28772000-memory.dmp

Download

memory/4400-14-0x00000218ECE90000-0x00000218ED952000-memory.dmp

Download

memory/4400-21-0x00000218EFD00000-0x00000218EFD1C000-memory.dmp

Download

memory/4400-22-0x00000218EFD20000-0x00000218EFDD3000-memory.dmp

Download

memory/4400-4-0x00000218ED65A000-0x00000218ED65B000-memory.dmp

Download

memory/4400-24-0x00000218ECE90000-0x00000218ED952000-memory.dmp

Download

memory/4400-25-0x00000218EFCF0000-0x00000218EFCFA000-memory.dmp

Download

memory/4400-32-0x00000218EFE00000-0x00000218EFE1C000-memory.dmp

Download

memory/4400-13-0x00000218ECE90000-0x00000218ED952000-memory.dmp

Download

memory/4400-44-0x00000218ECE90000-0x00000218ED952000-memory.dmp

Download

memory/4400-12-0x00000218ECE90000-0x00000218ED952000-memory.dmp

Download

memory/4400-5-0x00000218EFC70000-0x00000218EFC92000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads