Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
22/05/2026, 04:49
General
- Target 2026-05-22_426df5ca6203e734ad67ecb7d9334230_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz.exe
- Size 20.5MB
- Sample260522-ff7qmaev9l
- SHA256 305c70a99cd5e040be0c9b6b287a33698b0f999f74b2641c9f1d60096a6064a1
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 34 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_426df5ca6203e734ad67ecb7d9334230_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_426df5ca6203e734ad67ecb7d9334230_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\2dwRU\jetbrainsh-static.exeC:\ProgramData\2dwRU\jetbrainsh-static.exe uCpjQ2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\2dwRU\jetbrainsh-static.exeC:\ProgramData\2dwRU\jetbrainsh-static.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\2dwRU\jetbrainsh-static.exeC:\ProgramData\2dwRU\jetbrainsh-static.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
.resource
JrONH9Smyi.dll
jetbrainsh-static.exe
5f0fd2db-3a82-6d5d-232a-0d302632da00.tmp
82d209c8-ed52-6de0-021b-4088b14a732c.tmp
memory/3480-76-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/3480-102-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/3480-65-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/3480-77-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/3480-78-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/3480-64-0x00000165679F0000-0x0000016568DCD000-memory.dmp
memory/3480-79-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/3480-83-0x00007FFADD2E0000-0x00007FFADFBB4000-memory.dmp
memory/3480-130-0x00007FFADD2E0000-0x00007FFADFBB4000-memory.dmp
memory/3480-118-0x00007FFADD2E0000-0x00007FFADFBB4000-memory.dmp
memory/3480-104-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/3480-75-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/4132-99-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/4132-100-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/4132-97-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/4132-98-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/4132-107-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/4132-109-0x00007FFADD2E0000-0x00007FFADFBB4000-memory.dmp
memory/4132-110-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/4132-96-0x00000002CAEB0000-0x00000002CE2F6000-memory.dmp
memory/4132-121-0x00007FFADD2E0000-0x00007FFADFBB4000-memory.dmp
memory/4132-85-0x00007FFADD2E0000-0x00007FFADFBB4000-memory.dmp
memory/4132-133-0x00007FFADD2E0000-0x00007FFADFBB4000-memory.dmp
memory/5336-59-0x00007FFADD2E0000-0x00007FFADFBB4000-memory.dmp