2dee5dcf033c81fa82cf742fe16ba412945068953382a8769b0b76acd80dce00

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_bbea01a958bdb320a04c6182c768f037_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch.exe
Size 6.3MB
Sample260523-2vhwpse18w
SHA256 2dee5dcf033c81fa82cf742fe16ba412945068953382a8769b0b76acd80dce00
MD5 bbea01a958bdb320a04c6182c768f037
SHA1 5d85345ec513f5aff0089641755c6c47ff17e4eb
SHA512 2983130fd79c0aa235f3f2dbbcc4fb6c3784ad9989b4d5c241a9a8fa77a93226b88304076fccc82aca89ced139b4e96de3d5532c76c3b07d527b9e17732bd010
SSDEEP 49152:4FLTR98X1iAsLSWljmdAyFGEH7XFED1YNSXf1KjW+shpCZGo4c5NONPk+B5Ed0s:CTRmFpWzlSdAyFH7VEDYSRpnLCgEd0s
TLSH
T118666B12FDCB91F6EA03087155A7727F6B304D054B24CBD7EB407BAAF8BB2915836285
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2132	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_bbea01a958bdb320a04c6182c768f037_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
800	schtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4364	4392	2026-05-23_bbea01a958bdb320a04c6182c768f037_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch.exe	80
PID 4364 wrote to memory of 2132	4364	cmd.exe	82
PID 4392 wrote to memory of 800	4392	2026-05-23_bbea01a958bdb320a04c6182c768f037_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch.exe	83
PID 4392 wrote to memory of 1804	4392	2026-05-23_bbea01a958bdb320a04c6182c768f037_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-05-23_bbea01a958bdb320a04c6182c768f037_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_bbea01a958bdb320a04c6182c768f037_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "netsh advfirewall firewall add rule name=\"WindowsHealth\" dir=out program=\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsHealth.exe\" action=allow"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name=\"WindowsHealth\" dir=out program=\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsHealth.exe\" action=allow
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2132
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn WindowsHealth /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsHealth.exe /sc onlogon /ru ZHNNKJRL\Admin /rl HIGHEST /it /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:800
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /tn WindowsHealth
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1804