Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/05/2026, 02:58
General
- Target 2026-05-22_7241b47bc9b77446c8a8714f564f9845_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 8.5MB
- Sample260522-dgdstsfz41
- SHA256 6fdc01c4ea563cc23e3f131661bc7aef08e7a113bf9dfd7da9e47e7ee1f4bb8e
Score
7/10
Malware Config
Signatures
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_7241b47bc9b77446c8a8714f564f9845_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_7241b47bc9b77446c8a8714f564f9845_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Checks processor information in registry
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_d8da74543325.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_d8da74543325.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ovd_d8da74543325.exe