Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/05/2026, 04:49
General
- Target 2026-05-22_426df5ca6203e734ad67ecb7d9334230_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz.exe
- Size 20.5MB
- Sample260522-ff7qmaev9l
- SHA256 305c70a99cd5e040be0c9b6b287a33698b0f999f74b2641c9f1d60096a6064a1
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_426df5ca6203e734ad67ecb7d9334230_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_426df5ca6203e734ad67ecb7d9334230_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\RL6U9\jetbrainsh-static.exeC:\ProgramData\RL6U9\jetbrainsh-static.exe zjB6j2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\RL6U9\jetbrainsh-static.exeC:\ProgramData\RL6U9\jetbrainsh-static.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\RL6U9\jetbrainsh-static.exeC:\ProgramData\RL6U9\jetbrainsh-static.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
.resource
JrONH9Smyi.dll
jetbrainsh-static.exe
d808c382-c82b-9e43-3b86-ee8086b365b0.tmp
7d2e9be1-dc8d-c060-9b0b-0fc813dac673.tmp
memory/516-59-0x00007FFDF52B0000-0x00007FFDF7B84000-memory.dmp
memory/1664-77-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/1664-76-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/1664-101-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/1664-78-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/1664-75-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/1664-79-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/1664-83-0x00007FFDF52B0000-0x00007FFDF7B84000-memory.dmp
memory/1664-129-0x00007FFDF52B0000-0x00007FFDF7B84000-memory.dmp
memory/1664-65-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/1664-117-0x00007FFDF52B0000-0x00007FFDF7B84000-memory.dmp
memory/1664-64-0x0000014DCCFF0000-0x0000014DCE3CD000-memory.dmp
memory/1972-96-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/1972-100-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/1972-97-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/1972-98-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/1972-105-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/1972-107-0x00007FFDF52B0000-0x00007FFDF7B84000-memory.dmp
memory/1972-108-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/1972-99-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/1972-120-0x00007FFDF52B0000-0x00007FFDF7B84000-memory.dmp
memory/1972-85-0x00007FFDF52B0000-0x00007FFDF7B84000-memory.dmp
memory/1972-132-0x00007FFDF52B0000-0x00007FFDF7B84000-memory.dmp