6826e0df86d9c2b142801c691e8e8ad0e3fe4a83d7a379432e899af2f57c822b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_4b19874c5ee1d9bd6ea789ba6009e05c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 8.9MB
Sample260522-wfb7qaet9s
SHA256 6826e0df86d9c2b142801c691e8e8ad0e3fe4a83d7a379432e899af2f57c822b
MD5 4b19874c5ee1d9bd6ea789ba6009e05c
SHA1 81c4dd4dec41a3f553de4ec5582a7badf387a520
SHA512 2fb79da801befef6e06045a899be171b59849bd52202654a689deb4cc091673e5b4033c53774503e0db960e4c785d29f8268def24c33483b04748bbe99ac0393
SSDEEP 49152:yVENV/BxDMSjGqTPzkF+yWU2tIwubt3YRWxCRGvomjH5lmQ9cpriWYFENgt0sfwM:yVEXJ9XPbHTmWLG9DQYr5A7E
TLSH
T1B9963867FD6968E9C0AEC17189729112BB71BC490B2133D32B50F7286F76BD06EB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution persistence

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002467f-4.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3812	powershell.exe
3960	powershell.exe
4392	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-3570032545.tmp	2026-05-22_4b19874c5ee1d9bd6ea789ba6009e05c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-2917573089.tmp	ovd_bf4c3f7eadd0.exe

Executes dropped EXE 1 IoCs

pid	Process
3204	ovd_bf4c3f7eadd0.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-315c56f3 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_bf4c3f7eadd0.exe\""	ovd_bf4c3f7eadd0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-315c56f3 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_bf4c3f7eadd0.exe\""	2026-05-22_4b19874c5ee1d9bd6ea789ba6009e05c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3812	powershell.exe
3812	powershell.exe
3960	powershell.exe
3960	powershell.exe
4392	powershell.exe
4392	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3812	powershell.exe
Token: SeIncreaseQuotaPrivilege	3812	powershell.exe
Token: SeSecurityPrivilege	3812	powershell.exe
Token: SeTakeOwnershipPrivilege	3812	powershell.exe
Token: SeLoadDriverPrivilege	3812	powershell.exe
Token: SeSystemProfilePrivilege	3812	powershell.exe
Token: SeSystemtimePrivilege	3812	powershell.exe
Token: SeProfSingleProcessPrivilege	3812	powershell.exe
Token: SeIncBasePriorityPrivilege	3812	powershell.exe
Token: SeCreatePagefilePrivilege	3812	powershell.exe
Token: SeBackupPrivilege	3812	powershell.exe
Token: SeRestorePrivilege	3812	powershell.exe
Token: SeShutdownPrivilege	3812	powershell.exe
Token: SeDebugPrivilege	3812	powershell.exe
Token: SeSystemEnvironmentPrivilege	3812	powershell.exe
Token: SeRemoteShutdownPrivilege	3812	powershell.exe
Token: SeUndockPrivilege	3812	powershell.exe
Token: SeManageVolumePrivilege	3812	powershell.exe
Token: 33	3812	powershell.exe
Token: 34	3812	powershell.exe
Token: 35	3812	powershell.exe
Token: 36	3812	powershell.exe
Token: SeIncreaseQuotaPrivilege	3812	powershell.exe
Token: SeSecurityPrivilege	3812	powershell.exe
Token: SeTakeOwnershipPrivilege	3812	powershell.exe
Token: SeLoadDriverPrivilege	3812	powershell.exe
Token: SeSystemProfilePrivilege	3812	powershell.exe
Token: SeSystemtimePrivilege	3812	powershell.exe
Token: SeProfSingleProcessPrivilege	3812	powershell.exe
Token: SeIncBasePriorityPrivilege	3812	powershell.exe
Token: SeCreatePagefilePrivilege	3812	powershell.exe
Token: SeBackupPrivilege	3812	powershell.exe
Token: SeRestorePrivilege	3812	powershell.exe
Token: SeShutdownPrivilege	3812	powershell.exe
Token: SeDebugPrivilege	3812	powershell.exe
Token: SeSystemEnvironmentPrivilege	3812	powershell.exe
Token: SeRemoteShutdownPrivilege	3812	powershell.exe
Token: SeUndockPrivilege	3812	powershell.exe
Token: SeManageVolumePrivilege	3812	powershell.exe
Token: 33	3812	powershell.exe
Token: 34	3812	powershell.exe
Token: 35	3812	powershell.exe
Token: 36	3812	powershell.exe
Token: SeIncreaseQuotaPrivilege	3812	powershell.exe
Token: SeSecurityPrivilege	3812	powershell.exe
Token: SeTakeOwnershipPrivilege	3812	powershell.exe
Token: SeLoadDriverPrivilege	3812	powershell.exe
Token: SeSystemProfilePrivilege	3812	powershell.exe
Token: SeSystemtimePrivilege	3812	powershell.exe
Token: SeProfSingleProcessPrivilege	3812	powershell.exe
Token: SeIncBasePriorityPrivilege	3812	powershell.exe
Token: SeCreatePagefilePrivilege	3812	powershell.exe
Token: SeBackupPrivilege	3812	powershell.exe
Token: SeRestorePrivilege	3812	powershell.exe
Token: SeShutdownPrivilege	3812	powershell.exe
Token: SeDebugPrivilege	3812	powershell.exe
Token: SeSystemEnvironmentPrivilege	3812	powershell.exe
Token: SeRemoteShutdownPrivilege	3812	powershell.exe
Token: SeUndockPrivilege	3812	powershell.exe
Token: SeManageVolumePrivilege	3812	powershell.exe
Token: 33	3812	powershell.exe
Token: 34	3812	powershell.exe
Token: 35	3812	powershell.exe
Token: 36	3812	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 3812	4888	2026-05-22_4b19874c5ee1d9bd6ea789ba6009e05c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	87
PID 3204 wrote to memory of 3960	3204	ovd_bf4c3f7eadd0.exe	94
PID 3204 wrote to memory of 4392	3204	ovd_bf4c3f7eadd0.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-05-22_4b19874c5ee1d9bd6ea789ba6009e05c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_4b19874c5ee1d9bd6ea789ba6009e05c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_bf4c3f7eadd0.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_6fd41d8d' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3812

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_bf4c3f7eadd0.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_bf4c3f7eadd0.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_bf4c3f7eadd0.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_6fd41d8d' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'ovd_f6fd41d8d'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'ovd_c6fd41d8d'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_bf4c3f7eadd0.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='ovd_f6fd41d8d'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='ovd_c6fd41d8d'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
TLSH
T1DC51FE323375F0D4C8567F07293819D463BF4386EA94AF58B258621ED93641B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 05446ecfa346be261ec85b9d2a4175ac667b0933084f032e8426d8bf780106b3
MD5 e6490f46bcdb227a810710728a93f557
SHA1 b48172d063c916e7a2571c5a9b0b35728335ef8b
SHA512 b7af815266352cfc53b0c44687815e5da7f5b5a182279e88c395daaa6bd1ae714a22afb0a178f592cf3f86d399310e068d9fb45d9495df6813ff9481cbff6725
TLSH
T163217823B39D8820CCD5153A109D9C5172A682C781DFCF9F6EC0D21191BFAC8CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2b7db7451da9af148e35877d16964eef716aaa7dc6d1b9b53be88af84fefc5c0
MD5 fdace1a4961c17316b6cc1713325d90f
SHA1 64ae5ffb6e74f560ea3424cd3bfdbed741ac8ba3
SHA512 64c105dcc60d920b44ddb4e57c7ce22e414c263862844eee5331d47b634fa4d17f6a3b2555373e63e65507da1f4c0729ebeaf3c2dea173e24ca9ed659547d36b
TLSH
T13C217823B39D8560CCD6163A109D9C5072A782C781DEDFDB2AC0C21191BFAC8CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cngehzfy.pxc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cngehzfy.pxc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent-2425640429.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\agent-2425640429.tmp
Size 8.9MB
SHA256 6826e0df86d9c2b142801c691e8e8ad0e3fe4a83d7a379432e899af2f57c822b
MD5 4b19874c5ee1d9bd6ea789ba6009e05c
SHA1 81c4dd4dec41a3f553de4ec5582a7badf387a520
SHA512 2fb79da801befef6e06045a899be171b59849bd52202654a689deb4cc091673e5b4033c53774503e0db960e4c785d29f8268def24c33483b04748bbe99ac0393
SSDEEP 49152:yVENV/BxDMSjGqTPzkF+yWU2tIwubt3YRWxCRGvomjH5lmQ9cpriWYFENgt0sfwM:yVEXJ9XPbHTmWLG9DQYr5A7E
TLSH
T1B9963867FD6968E9C0AEC17189729112BB71BC490B2133D32B50F7286F76BD06EB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3812-7-0x0000025BCC7D0000-0x0000025BCC7E0000-memory.dmp

Download

memory/3812-6-0x0000025BCC7D0000-0x0000025BCC7E0000-memory.dmp

Download

memory/3812-15-0x0000025BCE850000-0x0000025BCE872000-memory.dmp

Download

memory/3812-16-0x0000025BCC7D0000-0x0000025BCC7E0000-memory.dmp

Download

memory/3812-19-0x0000025BCC7D0000-0x0000025BCC7E0000-memory.dmp

Download